257 lines
6.5 KiB
Go
257 lines
6.5 KiB
Go
|
package providers
|
|||
|
|
|
|||
|
|
import (
|
|||
|
|
"context"
|
|||
|
|
"crypto"
|
|||
|
|
"crypto/rand"
|
|||
|
|
"crypto/rsa"
|
|||
|
|
"crypto/sha256"
|
|||
|
|
"crypto/x509"
|
|||
|
|
"encoding/base64"
|
|||
|
|
"encoding/json"
|
|||
|
|
"encoding/pem"
|
|||
|
|
"fmt"
|
|||
|
|
"net/http"
|
|||
|
|
"net/url"
|
|||
|
|
"sort"
|
|||
|
|
"strings"
|
|||
|
|
"time"
|
|||
|
|
)
|
|||
|
|
|
|||
|
|
// AlipayProvider 支付宝 OAuth提供者
|
|||
|
|
// 支付宝使用 RSA2 签名（SHA256withRSA）
|
|||
|
|
type AlipayProvider struct {
|
|||
|
|
AppID string
|
|||
|
|
PrivateKey string // RSA2 私钥（PKCS#8 PEM格式）
|
|||
|
|
RedirectURI string
|
|||
|
|
IsSandbox bool
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// AlipayTokenResponse 支付宝 Token响应
|
|||
|
|
type AlipayTokenResponse struct {
|
|||
|
|
UserID string `json:"user_id"`
|
|||
|
|
AccessToken string `json:"access_token"`
|
|||
|
|
ExpiresIn int `json:"expires_in"`
|
|||
|
|
RefreshToken string `json:"refresh_token"`
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// AlipayUserInfo 支付宝用户信息
|
|||
|
|
type AlipayUserInfo struct {
|
|||
|
|
UserID string `json:"user_id"`
|
|||
|
|
Nickname string `json:"nick_name"`
|
|||
|
|
Avatar string `json:"avatar"`
|
|||
|
|
Gender string `json:"gender"`
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// NewAlipayProvider 创建支付宝 OAuth提供者
|
|||
|
|
func NewAlipayProvider(appID, privateKey, redirectURI string, isSandbox bool) *AlipayProvider {
|
|||
|
|
return &AlipayProvider{
|
|||
|
|
AppID: appID,
|
|||
|
|
PrivateKey: privateKey,
|
|||
|
|
RedirectURI: redirectURI,
|
|||
|
|
IsSandbox: isSandbox,
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
func (a *AlipayProvider) getGateway() string {
|
|||
|
|
if a.IsSandbox {
|
|||
|
|
return "https://openapi-sandbox.dl.alipaydev.com/gateway.do"
|
|||
|
|
}
|
|||
|
|
return "https://openapi.alipay.com/gateway.do"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// GetAuthURL 获取支付宝授权URL
|
|||
|
|
func (a *AlipayProvider) GetAuthURL(state string) (string, error) {
|
|||
|
|
authURL := fmt.Sprintf(
|
|||
|
|
"https://openauth.alipay.com/oauth2/publicAppAuthorize.htm?app_id=%s&scope=auth_user&redirect_uri=%s&state=%s",
|
|||
|
|
a.AppID,
|
|||
|
|
url.QueryEscape(a.RedirectURI),
|
|||
|
|
url.QueryEscape(state),
|
|||
|
|
)
|
|||
|
|
return authURL, nil
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ExchangeCode 用授权码换取 access_token
|
|||
|
|
func (a *AlipayProvider) ExchangeCode(ctx context.Context, code string) (*AlipayTokenResponse, error) {
|
|||
|
|
params := map[string]string{
|
|||
|
|
"app_id": a.AppID,
|
|||
|
|
"method": "alipay.system.oauth.token",
|
|||
|
|
"charset": "UTF-8",
|
|||
|
|
"sign_type": "RSA2",
|
|||
|
|
"timestamp": time.Now().Format("2006-01-02 15:04:05"),
|
|||
|
|
"version": "1.0",
|
|||
|
|
"grant_type": "authorization_code",
|
|||
|
|
"code": code,
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if a.PrivateKey != "" {
|
|||
|
|
sign, err := a.signParams(params)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, fmt.Errorf("sign failed: %w", err)
|
|||
|
|
}
|
|||
|
|
params["sign"] = sign
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
form := url.Values{}
|
|||
|
|
for k, v := range params {
|
|||
|
|
form.Set(k, v)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
req, err := http.NewRequestWithContext(ctx, "POST", a.getGateway(),
|
|||
|
|
strings.NewReader(form.Encode()))
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, fmt.Errorf("create request failed: %w", err)
|
|||
|
|
}
|
|||
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|||
|
|
|
|||
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|||
|
|
resp, err := client.Do(req)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, fmt.Errorf("request failed: %w", err)
|
|||
|
|
}
|
|||
|
|
defer resp.Body.Close()
|
|||
|
|
|
|||
|
|
body, err := readOAuthResponseBody(resp)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, fmt.Errorf("read response failed: %w", err)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
var rawResp map[string]json.RawMessage
|
|||
|
|
if err := json.Unmarshal(body, &rawResp); err != nil {
|
|||
|
|
return nil, fmt.Errorf("parse response failed: %w", err)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
tokenData, ok := rawResp["alipay_system_oauth_token_response"]
|
|||
|
|
if !ok {
|
|||
|
|
return nil, fmt.Errorf("invalid alipay response structure")
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
var tokenResp AlipayTokenResponse
|
|||
|
|
if err := json.Unmarshal(tokenData, &tokenResp); err != nil {
|
|||
|
|
return nil, fmt.Errorf("parse token response failed: %w", err)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
return &tokenResp, nil
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// GetUserInfo 获取支付宝用户信息
|
|||
|
|
func (a *AlipayProvider) GetUserInfo(ctx context.Context, accessToken string) (*AlipayUserInfo, error) {
|
|||
|
|
params := map[string]string{
|
|||
|
|
"app_id": a.AppID,
|
|||
|
|
"method": "alipay.user.info.share",
|
|||
|
|
"charset": "UTF-8",
|
|||
|
|
"sign_type": "RSA2",
|
|||
|
|
"timestamp": time.Now().Format("2006-01-02 15:04:05"),
|
|||
|
|
"version": "1.0",
|
|||
|
|
"auth_token": accessToken,
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if a.PrivateKey != "" {
|
|||
|
|
sign, err := a.signParams(params)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, fmt.Errorf("sign failed: %w", err)
|
|||
|
|
}
|
|||
|
|
params["sign"] = sign
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
form := url.Values{}
|
|||
|
|
for k, v := range params {
|
|||
|
|
form.Set(k, v)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
req, err := http.NewRequestWithContext(ctx, "POST", a.getGateway(),
|
|||
|
|
strings.NewReader(form.Encode()))
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, fmt.Errorf("create request failed: %w", err)
|
|||
|
|
}
|
|||
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|||
|
|
|
|||
|
|
client := &http.Client{Timeout: 10 * time.Second}
|
|||
|
|
resp, err := client.Do(req)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, fmt.Errorf("request failed: %w", err)
|
|||
|
|
}
|
|||
|
|
defer resp.Body.Close()
|
|||
|
|
|
|||
|
|
body, err := readOAuthResponseBody(resp)
|
|||
|
|
if err != nil {
|
|||
|
|
return nil, fmt.Errorf("read response failed: %w", err)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
var rawResp map[string]json.RawMessage
|
|||
|
|
if err := json.Unmarshal(body, &rawResp); err != nil {
|
|||
|
|
return nil, fmt.Errorf("parse response failed: %w", err)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
userData, ok := rawResp["alipay_user_info_share_response"]
|
|||
|
|
if !ok {
|
|||
|
|
return nil, fmt.Errorf("invalid alipay user info response")
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
var userInfo AlipayUserInfo
|
|||
|
|
if err := json.Unmarshal(userData, &userInfo); err != nil {
|
|||
|
|
return nil, fmt.Errorf("parse user info failed: %w", err)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
return &userInfo, nil
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// signParams 使用 RSA2（SHA256withRSA）对参数签名
|
|||
|
|
func (a *AlipayProvider) signParams(params map[string]string) (string, error) {
|
|||
|
|
// 按字典序排列参数
|
|||
|
|
keys := make([]string, 0, len(params))
|
|||
|
|
for k := range params {
|
|||
|
|
if k != "sign" {
|
|||
|
|
keys = append(keys, k)
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
sort.Strings(keys)
|
|||
|
|
|
|||
|
|
var parts []string
|
|||
|
|
for _, k := range keys {
|
|||
|
|
parts = append(parts, k+"="+params[k])
|
|||
|
|
}
|
|||
|
|
signContent := strings.Join(parts, "&")
|
|||
|
|
|
|||
|
|
// 解析私钥
|
|||
|
|
privKey, err := parseAlipayPrivateKey(a.PrivateKey)
|
|||
|
|
if err != nil {
|
|||
|
|
return "", fmt.Errorf("parse private key: %w", err)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// SHA256withRSA 签名
|
|||
|
|
hash := sha256.Sum256([]byte(signContent))
|
|||
|
|
signature, err := rsa.SignPKCS1v15(rand.Reader, privKey, crypto.SHA256, hash[:])
|
|||
|
|
if err != nil {
|
|||
|
|
return "", fmt.Errorf("rsa sign: %w", err)
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
return base64.StdEncoding.EncodeToString(signature), nil
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// parseAlipayPrivateKey 解析支付宝私钥（支持 PKCS#8 和 PKCS#1）
|
|||
|
|
func parseAlipayPrivateKey(pemStr string) (*rsa.PrivateKey, error) {
|
|||
|
|
// 如果没有 PEM 头，添加 PKCS#8 头
|
|||
|
|
if !strings.Contains(pemStr, "-----BEGIN") {
|
|||
|
|
pemStr = "-----BEGIN PRIVATE KEY-----\n" + pemStr + "\n-----END PRIVATE KEY-----"
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
block, _ := pem.Decode([]byte(pemStr))
|
|||
|
|
if block == nil {
|
|||
|
|
return nil, fmt.Errorf("failed to decode PEM block")
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 尝试 PKCS#8
|
|||
|
|
key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
|
|||
|
|
if err == nil {
|
|||
|
|
rsaKey, ok := key.(*rsa.PrivateKey)
|
|||
|
|
if !ok {
|
|||
|
|
return nil, fmt.Errorf("not an RSA private key")
|
|||
|
|
}
|
|||
|
|
return rsaKey, nil
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 尝试 PKCS#1
|
|||
|
|
return x509.ParsePKCS1PrivateKey(block.Bytes)
|
|||
|
|
}
|