213 行
7.7 KiB
TypeScript
213 行
7.7 KiB
TypeScript
import crypto from 'crypto';
|
|
import {
|
|
buildAuthorization,
|
|
buildJsapiPayParams,
|
|
verifyNotifySignature,
|
|
decryptNotifyResource,
|
|
resolvePlatformKey,
|
|
WechatPayConfig,
|
|
} from '../src/core/pay/wechat-pay-v3';
|
|
|
|
/**
|
|
* 微信支付 V3 加密管道行为测试
|
|
* 通过内存生成 RSA 密钥对，离线验证：请求签名 / 回调验签 / APIv3 解密 / 小程序支付参数签名。
|
|
* 这些是「真实收款对账」的安全基石，必须可被公钥验证且篡改必然失败。
|
|
*/
|
|
describe('WechatPayV3 (支付加密管道)', () => {
|
|
let merchantPriv: string;
|
|
let merchantPub: string;
|
|
let platformPriv: string;
|
|
let platformPub: string;
|
|
let cfg: WechatPayConfig;
|
|
|
|
beforeAll(() => {
|
|
const merchant = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 });
|
|
merchantPriv = merchant.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
|
|
merchantPub = merchant.publicKey.export({ type: 'spki', format: 'pem' }).toString();
|
|
|
|
const platform = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 });
|
|
platformPriv = platform.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
|
|
platformPub = platform.publicKey.export({ type: 'spki', format: 'pem' }).toString();
|
|
|
|
cfg = {
|
|
appId: 'wx_test_app',
|
|
mchId: '1600000000',
|
|
apiV3Key: 'A'.repeat(32),
|
|
serialNo: 'MERCHANTSERIAL001',
|
|
privateKey: merchantPriv,
|
|
};
|
|
});
|
|
|
|
describe('1. 商户请求签名 (buildAuthorization)', () => {
|
|
it('生成的 Authorization 头包含 mchid/序列号 且签名可被商户公钥验证', () => {
|
|
const body = JSON.stringify({ appid: cfg.appId, out_trade_no: 'TEST_1' });
|
|
const auth = buildAuthorization({
|
|
method: 'POST',
|
|
urlPath: '/v3/pay/transactions/jsapi',
|
|
body,
|
|
cfg,
|
|
});
|
|
const m = auth.match(
|
|
/mchid="([^"]+)",nonce_str="([^"]+)",signature="([^"]+)",timestamp="([^"]+)",serial_no="([^"]+)"/
|
|
);
|
|
expect(m).not.toBeNull();
|
|
expect(m![1]).toBe(cfg.mchId);
|
|
expect(m![5]).toBe(cfg.serialNo);
|
|
|
|
const message = `POST\n/v3/pay/transactions/jsapi\n${m![4]}\n${m![2]}\n${body}\n`;
|
|
const ok = crypto
|
|
.createVerify('RSA-SHA256')
|
|
.update(message)
|
|
.verify(merchantPub, m![3], 'base64');
|
|
expect(ok).toBe(true);
|
|
});
|
|
|
|
it('报文体被篡改后验签必然失败', () => {
|
|
const body = JSON.stringify({ out_trade_no: 'TEST_1' });
|
|
const auth = buildAuthorization({
|
|
method: 'POST',
|
|
urlPath: '/v3/pay/transactions/jsapi',
|
|
body,
|
|
cfg,
|
|
});
|
|
const m = auth.match(/nonce_str="([^"]+)",signature="([^"]+)",timestamp="([^"]+)"/)!;
|
|
const tamperedMsg = `POST\n/v3/pay/transactions/jsapi\n${m[3]}\n${m[1]}\n${JSON.stringify({ out_trade_no: 'TEST_2' })}\n`;
|
|
const ok = crypto
|
|
.createVerify('RSA-SHA256')
|
|
.update(tamperedMsg)
|
|
.verify(merchantPub, m[2], 'base64');
|
|
expect(ok).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('2. 回调验签 (verifyNotifySignature)', () => {
|
|
it('平台私钥签名 + 平台公钥验签 通过', () => {
|
|
const pcfg: WechatPayConfig = { ...cfg, platformPublicKey: platformPub };
|
|
const timestamp = String(Math.floor(Date.now() / 1000));
|
|
const nonce = 'nonce123456';
|
|
const body = JSON.stringify({ id: 'evt_1', event_type: 'TRANSACTION.SUCCESS' });
|
|
const signature = crypto
|
|
.createSign('RSA-SHA256')
|
|
.update(`${timestamp}\n${nonce}\n${body}\n`)
|
|
.sign(platformPriv, 'base64');
|
|
|
|
expect(
|
|
verifyNotifySignature({ cfg: pcfg, timestamp, nonce, body, signature, serial: 'P' })
|
|
).toBe(true);
|
|
});
|
|
|
|
it('报文被篡改后验签失败', () => {
|
|
const pcfg: WechatPayConfig = { ...cfg, platformPublicKey: platformPub };
|
|
const timestamp = String(Math.floor(Date.now() / 1000));
|
|
const nonce = 'nonce123456';
|
|
const body = JSON.stringify({ id: 'evt_1' });
|
|
const signature = crypto
|
|
.createSign('RSA-SHA256')
|
|
.update(`${timestamp}\n${nonce}\n${body}\n`)
|
|
.sign(platformPriv, 'base64');
|
|
|
|
expect(
|
|
verifyNotifySignature({ cfg: pcfg, timestamp, nonce, body: body + 'x', signature, serial: 'P' })
|
|
).toBe(false);
|
|
});
|
|
|
|
it('时间戳超出 5 分钟容差时验签失败 (防重放)', () => {
|
|
const pcfg: WechatPayConfig = { ...cfg, platformPublicKey: platformPub };
|
|
const timestamp = String(Math.floor(Date.now() / 1000) - 1000);
|
|
const nonce = 'nonce123456';
|
|
const body = JSON.stringify({ id: 'evt_1' });
|
|
const signature = crypto
|
|
.createSign('RSA-SHA256')
|
|
.update(`${timestamp}\n${nonce}\n${body}\n`)
|
|
.sign(platformPriv, 'base64');
|
|
|
|
expect(
|
|
verifyNotifySignature({ cfg: pcfg, timestamp, nonce, body, signature, serial: 'P' })
|
|
).toBe(false);
|
|
});
|
|
|
|
it('未配置平台公钥时失败关闭 (fail-closed)', () => {
|
|
const timestamp = String(Math.floor(Date.now() / 1000));
|
|
const nonce = 'nonce123456';
|
|
const body = '{}';
|
|
const signature = 'anything';
|
|
expect(
|
|
verifyNotifySignature({ cfg, timestamp, nonce, body, signature, serial: 'P' })
|
|
).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('3. APIv3 回调报文解密 (decryptNotifyResource)', () => {
|
|
const apiV3Key = 'abcdefghijklmnopqrstuvwxyz123456';
|
|
const nonce = 'randnonce12';
|
|
const aad = 'transaction';
|
|
|
|
const encrypt = (plain: string) => {
|
|
const cipher = crypto.createCipheriv(
|
|
'aes-256-gcm',
|
|
Buffer.from(apiV3Key),
|
|
Buffer.from(nonce)
|
|
);
|
|
cipher.setAAD(Buffer.from(aad));
|
|
const enc = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
|
|
return Buffer.concat([enc, cipher.getAuthTag()]).toString('base64');
|
|
};
|
|
|
|
it('AES-256-GCM 解密还原原始业务报文', () => {
|
|
const plain = JSON.stringify({
|
|
out_trade_no: 'WX_RECHARGE_1',
|
|
trade_state: 'SUCCESS',
|
|
transaction_id: '42000',
|
|
amount: { total: 1000 },
|
|
});
|
|
const decrypted = decryptNotifyResource(apiV3Key, {
|
|
ciphertext: encrypt(plain),
|
|
nonce,
|
|
associated_data: aad,
|
|
});
|
|
expect(decrypted.out_trade_no).toBe('WX_RECHARGE_1');
|
|
expect(decrypted.trade_state).toBe('SUCCESS');
|
|
expect(decrypted.amount.total).toBe(1000);
|
|
});
|
|
|
|
it('密钥错误时解密抛错，绝不返回伪造数据', () => {
|
|
const plain = JSON.stringify({ out_trade_no: 'X' });
|
|
const ciphertext = encrypt(plain);
|
|
expect(() =>
|
|
decryptNotifyResource('z'.repeat(32), { ciphertext, nonce, associated_data: aad })
|
|
).toThrow();
|
|
});
|
|
|
|
it('APIv3 密钥长度非 32 位时拒绝解密', () => {
|
|
expect(() =>
|
|
decryptNotifyResource('short', { ciphertext: 'AAAA', nonce, associated_data: aad })
|
|
).toThrow();
|
|
});
|
|
});
|
|
|
|
describe('4. 小程序支付参数签名 (buildJsapiPayParams)', () => {
|
|
it('paySign 可被商户公钥验证', () => {
|
|
const params = buildJsapiPayParams(cfg, 'wx_test_123');
|
|
expect(params.signType).toBe('RSA');
|
|
expect(params.package).toBe('prepay_id=wx_test_123');
|
|
const message = `${cfg.appId}\n${params.timeStamp}\n${params.nonceStr}\n${params.package}\n`;
|
|
const ok = crypto
|
|
.createVerify('RSA-SHA256')
|
|
.update(message)
|
|
.verify(merchantPub, params.paySign, 'base64');
|
|
expect(ok).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe('5. 平台公钥解析 (resolvePlatformKey)', () => {
|
|
it('合法的公钥 PEM 可解析', () => {
|
|
expect(resolvePlatformKey(platformPub)).not.toBeNull();
|
|
});
|
|
|
|
it('空值与非法内容返回 null', () => {
|
|
expect(resolvePlatformKey('')).toBeNull();
|
|
expect(resolvePlatformKey('not-a-pem')).toBeNull();
|
|
});
|
|
});
|
|
});
|