feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
This commit is contained in:
yangwx committed
1 parent
1d49e6f5ee
commit
18101cf11a
636 files changed
+58517
-9519
No files matched your search
@@ -0,0 +1,166 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace addon\paycenter\library;
|
||||
|
||||
use addon\paycenter\library\contract\Channel;
|
||||
use Psr\Http\Message\MessageInterface;
|
||||
use think\Response;
|
||||
use Yansongda\Artful\Rocket;
|
||||
use Yansongda\Supports\Collection;
|
||||
|
||||
/**
|
||||
* 支付宝渠道（证书模式，yansongda/pay v3）。
|
||||
*
|
||||
* 场景映射：
|
||||
* web → 电脑网站支付（返回自动提交表单 HTML）
|
||||
* wap → 手机网站支付（返回自动提交表单 HTML）
|
||||
* qr → 当面付扫码（返回二维码地址）
|
||||
* app → App 支付（返回前端唤起参数）
|
||||
*/
|
||||
class AlipayChannel implements Channel
|
||||
{
|
||||
/** 已付款状态（与 MarketService 旧逻辑一致） */
|
||||
private const PAID_STATUS = ['TRADE_SUCCESS', 'TRADE_FINISHED'];
|
||||
|
||||
public function code(): string
|
||||
{
|
||||
return 'alipay';
|
||||
}
|
||||
|
||||
public function name(): string
|
||||
{
|
||||
return '支付宝';
|
||||
}
|
||||
|
||||
public function configured(): bool
|
||||
{
|
||||
$cfg = PayConfig::get('alipay');
|
||||
|
||||
return !empty($cfg['app_id']) && !empty($cfg['app_secret_cert']);
|
||||
}
|
||||
|
||||
public function scenes(): array
|
||||
{
|
||||
return ['web', 'wap', 'qr', 'app'];
|
||||
}
|
||||
|
||||
public function create(array $order, string $scene, array $urls): array
|
||||
{
|
||||
$params = [
|
||||
'out_trade_no' => (string) $order['trade_no'],
|
||||
'total_amount' => (string) $order['amount'],
|
||||
'subject' => (string) $order['subject'],
|
||||
];
|
||||
// 每单回调地址只能走 params（下划线前缀），写在配置里会被容器忽略，见 PayFactory 注释
|
||||
if (!empty($urls['notify'])) {
|
||||
$params['_notify_url'] = (string) $urls['notify'];
|
||||
}
|
||||
if (!empty($urls['return'])) {
|
||||
$params['_return_url'] = (string) $urls['return'];
|
||||
}
|
||||
|
||||
$pay = PayFactory::alipay();
|
||||
switch ($scene) {
|
||||
case 'wap':
|
||||
$result = $pay->wap($params);
|
||||
break;
|
||||
case 'qr':
|
||||
$result = $pay->scan($params);
|
||||
break;
|
||||
case 'app':
|
||||
$result = $pay->app($params);
|
||||
break;
|
||||
default:
|
||||
$result = $pay->web($params);
|
||||
}
|
||||
|
||||
return ['trade_no' => (string) $order['trade_no']] + self::normalize($result);
|
||||
}
|
||||
|
||||
public function query(string $tradeNo): array
|
||||
{
|
||||
$result = PayFactory::alipay()->query(['out_trade_no' => $tradeNo]);
|
||||
|
||||
return [
|
||||
'paid' => in_array((string) $result->get('trade_status', ''), self::PAID_STATUS, true),
|
||||
'amount' => (float) $result->get('total_amount', 0),
|
||||
'gateway_no' => (string) $result->get('trade_no', ''),
|
||||
];
|
||||
}
|
||||
|
||||
public function notify(): array
|
||||
{
|
||||
// v3.7 无 verify()，callback() 内部完成验签
|
||||
$data = PayFactory::alipay()->callback();
|
||||
|
||||
return [
|
||||
'paid' => in_array((string) $data->get('trade_status', ''), self::PAID_STATUS, true),
|
||||
'trade_no' => (string) $data->get('out_trade_no', ''),
|
||||
'amount' => (float) $data->get('total_amount', 0),
|
||||
'gateway_no' => (string) $data->get('trade_no', ''),
|
||||
];
|
||||
}
|
||||
|
||||
public function ack(bool $ok = true): Response
|
||||
{
|
||||
if (!$ok) {
|
||||
return response('fail', 200, ['Content-Type' => 'text/plain; charset=utf-8']);
|
||||
}
|
||||
$psr = PayFactory::alipay()->success();
|
||||
|
||||
return response((string) $psr->getBody(), $psr->getStatusCode(), ['Content-Type' => 'text/plain; charset=utf-8']);
|
||||
}
|
||||
|
||||
public function refund(string $tradeNo, float $amount, float $total): array
|
||||
{
|
||||
try {
|
||||
PayFactory::alipay()->refund([
|
||||
'out_trade_no' => $tradeNo,
|
||||
'trade_no' => '',
|
||||
'refund_amount' => $amount,
|
||||
'out_request_no' => 'R' . $tradeNo . date('His'),
|
||||
'refund_reason' => '买家申请退款',
|
||||
]);
|
||||
|
||||
return ['ok' => true, 'message' => '退款申请已提交'];
|
||||
} catch (\Throwable $e) {
|
||||
return ['ok' => false, 'message' => $e->getMessage()];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 网关返回值归一化。
|
||||
*
|
||||
* shortcut 的返回类型声明为 ResponseInterface|Rocket，实际由 ResponsePlugin 决定；
|
||||
* 直接调 getBody() 在拿到 Rocket 时会致命错误，这里按类型分流。
|
||||
*
|
||||
* @return array{type: string, content: mixed}
|
||||
*/
|
||||
private static function normalize($result): array
|
||||
{
|
||||
if ($result instanceof Rocket) {
|
||||
$result = $result->getDestination() ?? $result->getPayload();
|
||||
}
|
||||
if ($result instanceof MessageInterface) {
|
||||
return ['type' => 'form', 'content' => $result->getBody()->getContents()];
|
||||
}
|
||||
if ($result instanceof Collection) {
|
||||
$qr = (string) ($result->get('qr_code') ?: $result->get('code_url') ?: '');
|
||||
if ($qr !== '') {
|
||||
return ['type' => 'qrcode', 'content' => $qr];
|
||||
}
|
||||
$url = (string) ($result->get('h5_url') ?: $result->get('mweb_url') ?: '');
|
||||
if ($url !== '') {
|
||||
return ['type' => 'url', 'content' => $url];
|
||||
}
|
||||
|
||||
return ['type' => 'params', 'content' => $result->toArray()];
|
||||
}
|
||||
if (is_string($result)) {
|
||||
return ['type' => 'form', 'content' => $result];
|
||||
}
|
||||
|
||||
throw new PayException('支付发起失败：网关返回了无法识别的响应', 500);
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user