外部支付对接手册

const crypto = require('crypto');

const APP_ID = 'your_app_id';
const APP_SECRET = 'your_app_secret';
const BASE_URL = 'https://your-domain.com';

function generateSign(params, secret) {
  const sorted = Object.keys(params).sort()
    .map(k => `${k}=${params[k]}`).join('&');
  return crypto.createHmac('sha256', secret)
    .update(sorted).digest('hex');
}

// 创建订单
async function createOrder(outTradeNo, subject, amount, payMethod) {
  const timestamp = Math.floor(Date.now() / 1000);
  const params = {
    app_id: APP_ID, out_trade_no: outTradeNo,
    subject, amount, pay_method: payMethod, timestamp,
  };
  params.sign = generateSign(params, APP_SECRET);

  const res = await fetch(`${BASE_URL}/api/service/external/orders`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(params),
  });
  return res.json();
}

// 验证回调签名
function verifyNotify(body) {
  const { sign, ...rest } = body;
  return sign === generateSign(rest, APP_SECRET);
}

import hmac, hashlib, time, requests

APP_ID = 'your_app_id'
APP_SECRET = 'your_app_secret'
BASE_URL = 'https://your-domain.com'

def generate_sign(params: dict, secret: str) -> str:
    sorted_str = '&'.join(f'{k}={params[k]}' for k in sorted(params))
    return hmac.new(
        secret.encode(), sorted_str.encode(), hashlib.sha256
    ).hexdigest()

def create_order(out_trade_no, subject, amount, pay_method):
    params = {
        'app_id': APP_ID, 'out_trade_no': out_trade_no,
        'subject': subject, 'amount': amount,
        'pay_method': pay_method, 'timestamp': int(time.time()),
    }
    params['sign'] = generate_sign(params, APP_SECRET)
    return requests.post(f'{BASE_URL}/api/service/external/orders', json=params).json()

# Flask 回调处理
from flask import Flask, request
app = Flask(__name__)

@app.route('/notify', methods=['POST'])
def notify():
    body = request.json
    sign = body.pop('sign', '')
    if generate_sign(body, APP_SECRET) != sign:
        return 'fail', 400
    # 处理业务逻辑...
    return 'success'

<?php
$APP_SECRET = 'your_app_secret';

function generateSign(array $params, string $secret): string {
    ksort($params);
    $pairs = [];
    foreach ($params as $k => $v) { $pairs[] = "$k=$v"; }
    return hash_hmac('sha256', implode('&', $pairs), $secret);
}

// 回调处理
$body = json_decode(file_get_contents('php://input'), true);
$sign = $body['sign'];
unset($body['sign']);
if (generateSign($body, $APP_SECRET) === $sign) {
    // 处理业务逻辑...
    echo 'success';
} else {
    http_response_code(400);
    echo 'fail';
}