-
Notifications
You must be signed in to change notification settings - Fork 144
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* feat: 支持使用微信支付公钥验签 * feat: 回调验签同时支持公钥和证书 * Update README.md
- Loading branch information
Showing
17 changed files
with
445 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| package verifiers | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto/rsa" | ||
| "github.com/wechatpay-apiv3/wechatpay-go/core" | ||
| ) | ||
|
|
||
| // SHA256WithRSACombinedVerifier 数字签名验证器，组合了公钥和平台证书 | ||
| type SHA256WithRSACombinedVerifier struct { | ||
| publicKeyVerifier SHA256WithRSAPubkeyVerifier | ||
| certVerifier SHA256WithRSAVerifier | ||
| } | ||
|
|
||
| // Verify 验证签名，如果序列号和公钥一致则使用公钥验签，否则使用平台证书验签 | ||
| func (v *SHA256WithRSACombinedVerifier) Verify(ctx context.Context, serialNumber, message, signature string) error { | ||
| if serialNumber == v.publicKeyVerifier.keyID { | ||
| return v.publicKeyVerifier.Verify(ctx, serialNumber, message, signature) | ||
| } | ||
| return v.certVerifier.Verify(ctx, serialNumber, message, signature) | ||
| } | ||
|
|
||
| // GetSerial 获取可验签的公钥序列号。该验签器只用在回调，所以获取序列号时返回错误 | ||
| func (v *SHA256WithRSACombinedVerifier) GetSerial(ctx context.Context) (string, error) { | ||
| return v.publicKeyVerifier.keyID, nil | ||
| } | ||
|
|
||
| // NewSHA256WithRSACombinedVerifier 用公钥和平台证书初始化验证器 | ||
| func NewSHA256WithRSACombinedVerifier( | ||
| getter core.CertificateGetter, | ||
| keyID string, | ||
| publicKey rsa.PublicKey) *SHA256WithRSACombinedVerifier { | ||
| return &SHA256WithRSACombinedVerifier{ | ||
| *NewSHA256WithRSAPubkeyVerifier(keyID, publicKey), | ||
| *NewSHA256WithRSAVerifier(getter), | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| // Copyright 2024 Tencent Inc. All rights reserved. | ||
|
|
||
| // Package verifiers 微信支付 API v3 Go SDK 数字签名验证器 | ||
| package verifiers | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto" | ||
| "crypto/rsa" | ||
| "crypto/sha256" | ||
| "encoding/base64" | ||
| "fmt" | ||
| ) | ||
|
|
||
| // SHA256WithRSAPubkeyVerifier 数字签名验证器,使用微信支付提供的公钥验证签名 | ||
| type SHA256WithRSAPubkeyVerifier struct { | ||
| keyID string | ||
| publicKey rsa.PublicKey | ||
| } | ||
|
|
||
| // Verify 使用微信支付提供的公钥验证签名 | ||
| func (v *SHA256WithRSAPubkeyVerifier) Verify(ctx context.Context, serialNumber, message, signature string) error { | ||
| if ctx == nil { | ||
| return fmt.Errorf("verify failed: context is nil") | ||
| } | ||
| if v.keyID != serialNumber { | ||
| return fmt.Errorf("verify failed: key-id[%s] does not match serial number[%s]", v.keyID, serialNumber) | ||
| } | ||
|
|
||
| sigBytes, err := base64.StdEncoding.DecodeString(signature) | ||
| if err != nil { | ||
| return fmt.Errorf("verify failed: signature is not base64 encoded") | ||
| } | ||
| hashed := sha256.Sum256([]byte(message)) | ||
| err = rsa.VerifyPKCS1v15(&v.publicKey, crypto.SHA256, hashed[:], sigBytes) | ||
| if err != nil { | ||
| return fmt.Errorf("verify signature with public key error:%s", err.Error()) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // GetSerial 获取可验签的公钥序列号 | ||
| func (v *SHA256WithRSAPubkeyVerifier) GetSerial(ctx context.Context) (string, error) { | ||
| return v.keyID, nil | ||
| } | ||
|
|
||
| // NewSHA256WithRSAPubkeyVerifier 使用 rsa.PublicKey 初始化验签器 | ||
| func NewSHA256WithRSAPubkeyVerifier(keyID string, publicKey rsa.PublicKey) *SHA256WithRSAPubkeyVerifier { | ||
| return &SHA256WithRSAPubkeyVerifier{keyID: keyID, publicKey: publicKey} | ||
| } |
Oops, something went wrong.