BinancePayTool v0.1.0：币安支付个人收款网关（Go 核心 + 四语言 SDK）
- Go 服务端：唯一金额/备注码/回填订单编号三路匹配、托管收银页、HMAC 回调七级重试、SQLite 单二进制 - SDK：Go / Java / PHP / Python，共享签名测试向量（docs/test_vectors.json） - 跨语言 e2e（真实二进制 × Python SDK × mock 币安）、GitHub Actions CI、Dockerfile - 协议文档 docs/protocol.md、调研与实测结论 docs/research.md Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
qianyubtcandClaude Fable 5 committed
1 parent
e4275368ea
commit
f87ec65541
46 files changed
+4378
No files matched your search
@@ -0,0 +1,57 @@
|
|||||||
|
name: CI
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches: ["**"]
|
||||||
|
pull_request:
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
core-and-sdks:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
- uses: actions/setup-go@v5
|
||||||
|
with:
|
||||||
|
go-version: "1.24.x"
|
||||||
|
cache-dependency-path: server/go.sum
|
||||||
|
- name: 服务端 vet + 测试
|
||||||
|
run: cd server && go vet ./... && go test ./... -count=1
|
||||||
|
- name: 编译服务端二进制
|
||||||
|
run: cd server && go build -o bpaygate .
|
||||||
|
- name: Go SDK 测试
|
||||||
|
run: cd sdk/go && go vet ./... && go test ./... -count=1
|
||||||
|
- name: Go 示例编译
|
||||||
|
run: cd examples/go && go build ./... && rm -f bpaygate-example
|
||||||
|
- uses: actions/setup-python@v5
|
||||||
|
with:
|
||||||
|
python-version: "3.11"
|
||||||
|
- name: Python SDK 向量测试
|
||||||
|
run: python3 sdk/python/test_bpaygate.py
|
||||||
|
- name: 跨语言端到端（真实二进制 × Python SDK × mock 币安）
|
||||||
|
run: python3 e2e/cross_e2e.py server/bpaygate
|
||||||
|
|
||||||
|
php-sdk:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
- uses: shivammathur/setup-php@v2
|
||||||
|
with:
|
||||||
|
php-version: "8.2"
|
||||||
|
- name: 语法检查
|
||||||
|
run: php -l sdk/php/BPayGate.php && php -l sdk/php/test_vectors.php && php -l examples/php/index.php && php -l examples/php/notify.php
|
||||||
|
- name: 向量测试
|
||||||
|
run: php sdk/php/test_vectors.php
|
||||||
|
|
||||||
|
java-sdk:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
- uses: actions/setup-java@v4
|
||||||
|
with:
|
||||||
|
distribution: temurin
|
||||||
|
java-version: "17"
|
||||||
|
- name: 下载 Gson
|
||||||
|
run: curl -sSLo gson.jar https://repo1.maven.org/maven2/com/google/code/gson/gson/2.10.1/gson-2.10.1.jar
|
||||||
|
- name: 编译 SDK 与示例（-source 8 兼容校验交给 pom；此处用当前 JDK）
|
||||||
|
run: mkdir -p out && javac -encoding UTF-8 -cp gson.jar -d out sdk/java/BPayGateClient.java sdk/java/VectorTest.java examples/java/ExampleServer.java
|
||||||
|
- name: 向量测试
|
||||||
|
run: cd out && java -cp .:../gson.jar VectorTest ../docs/test_vectors.json
|
||||||
+21
@@ -0,0 +1,21 @@
|
|||||||
|
# 本地私有内容（不进开源仓库）
|
||||||
|
CLAUDE.md
|
||||||
|
docs_币安支付个人收款网关_可行性调研.md
|
||||||
|
config.env
|
||||||
|
*.db
|
||||||
|
*.db-journal
|
||||||
|
*.db-wal
|
||||||
|
*.db-shm
|
||||||
|
qr.png
|
||||||
|
qr.jpg
|
||||||
|
|
||||||
|
# 临时工具链与构建产物
|
||||||
|
.toolchain/
|
||||||
|
bpaygate
|
||||||
|
bpaygate-*
|
||||||
|
server/bpaygate
|
||||||
|
*.class
|
||||||
|
sdk/java/*.jar
|
||||||
|
__pycache__/
|
||||||
|
*.pyc
|
||||||
|
.DS_Store
|
||||||
+16
@@ -0,0 +1,16 @@
|
|||||||
|
# BinancePayTool 服务端镜像（二进制名沿用 bpaygate）
|
||||||
|
# docker build -t bpaygate .
|
||||||
|
# docker run -d -v $(pwd)/data:/data -p 8080:8080 bpaygate
|
||||||
|
# /data 内放 config.env（参考 config.example.env），数据库默认也写在 /data。
|
||||||
|
FROM golang:1.24-alpine AS build
|
||||||
|
WORKDIR /src
|
||||||
|
COPY server/ ./server/
|
||||||
|
RUN cd server && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /bpaygate .
|
||||||
|
|
||||||
|
FROM alpine:3.20
|
||||||
|
RUN apk add --no-cache ca-certificates tzdata && adduser -D bpg
|
||||||
|
USER bpg
|
||||||
|
WORKDIR /data
|
||||||
|
COPY --from=build /bpaygate /usr/local/bin/bpaygate
|
||||||
|
EXPOSE 8080
|
||||||
|
ENTRYPOINT ["bpaygate", "-config", "/data/config.env"]
|
||||||
@@ -0,0 +1,138 @@
|
|||||||
|
# BinancePayTool · 币安支付个人收款网关
|
||||||
|
|
||||||
|
> 用一个**普通币安个人账户**收 Binance Pay 转账，自动确认到账、回调你的业务系统。
|
||||||
|
> 单二进制部署，官方只读 API，零手续费、即时到账。
|
||||||
|
> 附 **Go / Java / PHP / Python** 四语言接入 SDK。
|
||||||
|
|
||||||
|
**本项目为社区项目，与 Binance 无任何关联。** 仓库名中的 “Binance” 仅为描述所对接的支付渠道，不代表官方授权或合作。
|
||||||
|
|
||||||
|
## 它解决什么问题
|
||||||
|
|
||||||
|
币安官方的 Binance Pay 商户 API 只对**企业实体账户**开放（个人商户账户已于 2025-02-28 终止）。
|
||||||
|
个人开发者想用币安支付收款，只剩两条野路子：逆向私有接口（违反条款、随时失效），或人工对账。
|
||||||
|
|
||||||
|
BinancePayTool 走第三条路：**只用官方公开的只读接口** `GET /sapi/v1/pay/transactions`
|
||||||
|
轮询自己账号的收款流水，用三把钥匙自动核销订单：
|
||||||
|
|
||||||
|
| 优先级 | 匹配方式 | 说明 |
|
||||||
|
|---|---|---|
|
||||||
|
| ① | **唯一金额** | 每笔订单分配唯一尾数（如 10 → 10.0037），付款金额即订单指纹，付完全自动确认 |
|
||||||
|
| ② | **备注码** | 付款方转账备注带上 6 位码，金额不准也能对上 |
|
||||||
|
| ③ | **回填编号** | 收银页里粘贴币安订单编号（18 位数字），兜底一切例外 |
|
||||||
|
|
||||||
|
关键行为均经真实账号实测（2026-09）：币安 Pay 金额支持至少 4 位小数、
|
||||||
|
付款备注原样回传、付款方 App 显示的订单编号 = 接口的 `orderId`、到账后数秒内接口可见。
|
||||||
|
|
||||||
|
## 原理
|
||||||
|
|
||||||
|
```mermaid
|
||||||
|
sequenceDiagram
|
||||||
|
participant U as 付款方(币安App)
|
||||||
|
participant S as 商户系统
|
||||||
|
participant G as BinancePayTool
|
||||||
|
participant B as 币安官方API(只读)
|
||||||
|
S->>G: 创建订单(10 USDT)
|
||||||
|
G-->>S: pay_amount=10.0037, pay_url
|
||||||
|
S->>U: 跳转收银页
|
||||||
|
U->>U: 币安App按金额转账(0手续费,即时)
|
||||||
|
loop 每 POLL_INTERVAL 秒
|
||||||
|
G->>B: GET /sapi/v1/pay/transactions
|
||||||
|
B-->>G: 收款流水(金额/备注/orderId/付款方)
|
||||||
|
end
|
||||||
|
G->>G: 三规则匹配 → 订单已支付
|
||||||
|
G->>S: 回调(HMAC签名, 失败按梯度重试)
|
||||||
|
G-->>U: 收银页变绿 → 跳转 return_url
|
||||||
|
```
|
||||||
|
|
||||||
|
## 特性
|
||||||
|
|
||||||
|
- **单二进制 + SQLite**，无外部依赖；Docker 一行起
|
||||||
|
- 托管收银页：大字金额一键复制、二维码展示、倒计时、状态轮询、回填入口，适配移动端与深色模式
|
||||||
|
- 唯一金额**递进式尾数**：优先 0.0001–0.0099 档（付款方最多多付一分钱级别），档位用满自动升位，同价并发容量最高 9999
|
||||||
|
- 金额冷却：订单结束后该金额 24h 不复用，杜绝迟付错配
|
||||||
|
- 回调 HMAC-SHA256 签名 + 时间戳 + nonce 防重放，`0s/15s/1m/5m/15m/1h/3h` 七次重试
|
||||||
|
- 幂等：一笔币安流水只核销一单；重复回调由商户侧按 `merchant_order_id` 幂等
|
||||||
|
- 少付/多付/过期后迟付都有明确定义（见 [docs/protocol.md](docs/protocol.md)）
|
||||||
|
- 币安 API Key **只需读取权限**，建议绑 IP 白名单；网关永不发起转账
|
||||||
|
|
||||||
|
## 快速开始
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 1. 编译（或用 Docker，见 Dockerfile 注释）
|
||||||
|
cd server && go build -o bpaygate . && cd ..
|
||||||
|
|
||||||
|
# 2. 配置
|
||||||
|
cp config.example.env config.env
|
||||||
|
./server/bpaygate -gen-key # 生成 API_AUTH_KEY 填入 config.env
|
||||||
|
# 再填 BINANCE_API_KEY / BINANCE_API_SECRET（只勾"允许读取"）和 BINANCE_UID
|
||||||
|
|
||||||
|
# 3. 运行
|
||||||
|
./server/bpaygate -config config.env
|
||||||
|
```
|
||||||
|
|
||||||
|
创建一笔测试订单（也可直接用四语言 SDK，见下）：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# 签名规则见 docs/protocol.md §1.1，SDK 已封装，无需手写
|
||||||
|
```
|
||||||
|
|
||||||
|
```python
|
||||||
|
import sys; sys.path.insert(0, "sdk/python")
|
||||||
|
from bpaygate import BinancePayTool
|
||||||
|
gw = BinancePayTool("http://127.0.0.1:8080", "你的API_AUTH_KEY")
|
||||||
|
print(gw.create_order("TEST-1", "1", currency="USDT")["pay_url"])
|
||||||
|
```
|
||||||
|
|
||||||
|
打开返回的 `pay_url`，用另一个币安账号按页面金额转账，几秒后页面自动变为已支付。
|
||||||
|
|
||||||
|
## 商户接入
|
||||||
|
|
||||||
|
| 语言 | SDK | 示例 |
|
||||||
|
|---|---|---|
|
||||||
|
| Python | [sdk/python](sdk/python)（仅标准库） | [examples/python](examples/python) |
|
||||||
|
| PHP | [sdk/php](sdk/php)（单文件） | [examples/php](examples/php) |
|
||||||
|
| Go | [sdk/go](sdk/go)（仅标准库） | [examples/go](examples/go) |
|
||||||
|
| Java | [sdk/java](sdk/java)（Java 8+，Gson） | [examples/java](examples/java) |
|
||||||
|
|
||||||
|
接入只有三步：**创建订单 → 跳转 pay_url → 处理回调（验签 + 幂等发货）**。
|
||||||
|
协议细节（签名、字段、状态机、错误码）：[docs/protocol.md](docs/protocol.md)。
|
||||||
|
调研背景与官方接口实测结论：[docs/research.md](docs/research.md)。
|
||||||
|
|
||||||
|
## 配置
|
||||||
|
|
||||||
|
所有配置项见 [config.example.env](config.example.env)，每项都有注释。最常调的：
|
||||||
|
|
||||||
|
| 配置 | 默认 | 说明 |
|
||||||
|
|---|---|---|
|
||||||
|
| `POLL_INTERVAL` | 4 | 轮询秒数。接口权重 3000/次、限额 180000/分钟，最低可到 1 |
|
||||||
|
| `ORDER_TTL` | 900 | 订单有效期（秒） |
|
||||||
|
| `AMOUNT_DECIMALS` | 4 | 唯一金额小数位（实测币安支持至少 4） |
|
||||||
|
| `SUFFIX_MODE` | add | add=多收尾数 / sub=少收尾数 |
|
||||||
|
| `EXPIRED_GRACE` | 1800 | 过期后宽限期，期内精确到账仍自动确认 |
|
||||||
|
|
||||||
|
## 必读：风险与边界
|
||||||
|
|
||||||
|
- **条款风险**：币安条款不允许未经书面同意将服务用于商业目的（Terms §28(c)）。
|
||||||
|
个人账户跑收款网关属于灰色地带，**账号被风控的后果自担**。建议：专号收款、
|
||||||
|
控制频率、余额及时转走；量大后注册企业实体走官方商户 API。
|
||||||
|
- **本网关只读**：不代付、不退款。退款需在币安 App 里手动转回（流水里有付款方信息）。
|
||||||
|
- **备注不可靠**：部分付款路径（如扫码）可能填不了备注，所以备注只是第二钥匙。
|
||||||
|
- **underpaid 需人工**：实付少于应付只报状态不自动补齐，商户自行决定放行或退回。
|
||||||
|
- 收款账户的 API Key 只给读取权限；`API_AUTH_KEY` 泄漏 = 任何人都能创建订单和伪造回调，妥善保管。
|
||||||
|
|
||||||
|
## Roadmap
|
||||||
|
|
||||||
|
- [ ] 易支付（epay）兼容层：独角数卡等现有系统零代码接入
|
||||||
|
- [ ] MySQL 支持与多收款账号轮换
|
||||||
|
- [ ] 简易管理面板（订单查询、手动补单、Telegram 通知）
|
||||||
|
- [ ] 多商户 key
|
||||||
|
|
||||||
|
## 相关项目
|
||||||
|
|
||||||
|
链上收款方案（不依赖币安账号）：[BEpusdt](https://github.com/v03413/BEpusdt) ·
|
||||||
|
[epusdt](https://github.com/GMWalletApp/epusdt) · [TokenPay](https://github.com/LightCountry/TokenPay)。
|
||||||
|
本项目与它们互补：Pay 内部转账零手续费、即时、无链上确认等待，但绑定币安生态。
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
[MIT](LICENSE)
|
||||||
@@ -0,0 +1,46 @@
|
|||||||
|
# ========= BinancePayTool 配置示例 =========
|
||||||
|
# 复制为 config.env 后填写。config.env 已被 .gitignore 排除，勿提交。
|
||||||
|
# 同名环境变量优先于本文件。
|
||||||
|
|
||||||
|
# 监听地址与对外基础 URL（收银页链接用它拼接）
|
||||||
|
LISTEN=0.0.0.0:8080
|
||||||
|
BASE_URL=http://127.0.0.1:8080
|
||||||
|
|
||||||
|
# 商户接入密钥：商户调用 API 与校验回调签名共用。
|
||||||
|
# 生成方法: ./bpaygate -gen-key
|
||||||
|
API_AUTH_KEY=
|
||||||
|
|
||||||
|
# ---- 币安（收款账号）----
|
||||||
|
# 现货 API Key，只勾选「允许读取」，强烈建议绑定服务器 IP 白名单
|
||||||
|
BINANCE_API_KEY=
|
||||||
|
BINANCE_API_SECRET=
|
||||||
|
# 你的币安 UID（App 头像页可见），用于收银页展示与方向判断
|
||||||
|
BINANCE_UID=
|
||||||
|
# 测试时可指向 mock 服务，生产留默认
|
||||||
|
BINANCE_API_BASE=https://api.binance.com
|
||||||
|
|
||||||
|
# ---- 收银页展示 ----
|
||||||
|
# 可选：静态收款二维码图片路径（币安 App「收款」保存的那张）；配置后收银页显示扫码
|
||||||
|
QR_IMAGE=
|
||||||
|
# 可选：额外展示的收款邮箱（不填则只展示 UID）
|
||||||
|
RECEIVE_EMAIL=
|
||||||
|
|
||||||
|
# ---- 订单与匹配 ----
|
||||||
|
# 允许的收款币种（逗号分隔）
|
||||||
|
CURRENCIES=USDT,USDC
|
||||||
|
# 订单有效期（秒），可被下单请求覆盖
|
||||||
|
ORDER_TTL=900
|
||||||
|
# 过期宽限（秒）：过期后这段时间内到账的精确金额仍自动确认
|
||||||
|
EXPIRED_GRACE=1800
|
||||||
|
# 唯一金额小数位（实测币安 Pay 支持至少 4 位）
|
||||||
|
AMOUNT_DECIMALS=4
|
||||||
|
# 尾数方向：add=在基础金额上加尾数（默认，商户实收略多）；sub=减尾数
|
||||||
|
SUFFIX_MODE=add
|
||||||
|
# 尾数冷却（秒）：订单结束后该金额多久内不复用
|
||||||
|
SUFFIX_COOLDOWN=86400
|
||||||
|
# 币安流水轮询间隔（秒）。接口权重 3000/次、UID 限额 180000/分钟，最低可到 1
|
||||||
|
POLL_INTERVAL=4
|
||||||
|
|
||||||
|
# ---- 存储与日志 ----
|
||||||
|
DB_PATH=./bpaygate.db
|
||||||
|
LOG_LEVEL=info
|
||||||
@@ -0,0 +1,136 @@
|
|||||||
|
# BinancePayTool 接入协议 v1
|
||||||
|
|
||||||
|
> 签名头与错误码沿用 `X-BPG-` / `BPG` 前缀，它们是协议稳定标识，与仓库名无关。
|
||||||
|
|
||||||
|
所有接口均为 HTTP + JSON（UTF-8）。金额一律为**字符串**十进制（如 `"10.0037"`），最多 8 位小数。
|
||||||
|
时间戳一律为**毫秒** Unix 时间。
|
||||||
|
|
||||||
|
## 1. 签名
|
||||||
|
|
||||||
|
商户与网关共享一个密钥 `API_AUTH_KEY`（下称 `secret`），同时用于「商户调用网关」与「网关回调商户」。
|
||||||
|
|
||||||
|
### 1.1 商户 → 网关（API 请求签名）
|
||||||
|
|
||||||
|
请求头：
|
||||||
|
|
||||||
|
| Header | 说明 |
|
||||||
|
|---|---|
|
||||||
|
| `X-BPG-Timestamp` | 当前毫秒时间戳；与服务器偏差超过 300 秒拒绝 |
|
||||||
|
| `X-BPG-Nonce` | 随机串（≥16 字符）；5 分钟内不得重复 |
|
||||||
|
| `X-BPG-Signature` | 小写十六进制签名 |
|
||||||
|
|
||||||
|
签名串（`\n` 为换行符；`path` 只含路径不含查询串与域名；GET/无 body 时 body 视为空串）：
|
||||||
|
|
||||||
|
```
|
||||||
|
string_to_sign = timestamp + "\n" + nonce + "\n" + METHOD + "\n" + path + "\n" + SHA256_HEX(body)
|
||||||
|
signature = HMAC_SHA256_HEX(secret, string_to_sign)
|
||||||
|
```
|
||||||
|
|
||||||
|
### 1.2 网关 → 商户（回调签名）
|
||||||
|
|
||||||
|
回调为 `POST callback_url`，`Content-Type: application/json`，请求头同上三个，签名串少 METHOD 与 path：
|
||||||
|
|
||||||
|
```
|
||||||
|
string_to_sign = timestamp + "\n" + nonce + "\n" + SHA256_HEX(body)
|
||||||
|
```
|
||||||
|
|
||||||
|
商户校验：时间戳偏差 ≤300 秒、签名一致（常数时间比较）。校验通过返回 HTTP 2xx 即视为成功；
|
||||||
|
否则网关按 `0s, 15s, 60s, 5m, 15m, 1h, 3h` 重试 7 次后放弃。**回调可能重复投递，商户须按
|
||||||
|
`order_id` 幂等处理。**
|
||||||
|
|
||||||
|
## 2. 接口
|
||||||
|
|
||||||
|
### 2.1 创建订单 `POST /api/v1/orders`
|
||||||
|
|
||||||
|
请求体：
|
||||||
|
|
||||||
|
| 字段 | 类型 | 必填 | 说明 |
|
||||||
|
|---|---|---|---|
|
||||||
|
| `merchant_order_id` | string | 是 | 商户侧唯一订单号（≤64 字符）；重复返回 `ERR_DUPLICATE` |
|
||||||
|
| `currency` | string | 是 | 币种，须在网关 `CURRENCIES` 白名单内（如 `USDT`）|
|
||||||
|
| `amount` | string | 是 | 基础金额，>0，小数位 ≤ 网关 `AMOUNT_DECIMALS` |
|
||||||
|
| `callback_url` | string | 否 | 支付结果回调地址 |
|
||||||
|
| `return_url` | string | 否 | 支付成功后收银页跳转地址（自动附加 `?order_id=&status=`）|
|
||||||
|
| `timeout` | int | 否 | 有效期秒数，120–86400，缺省用网关 `ORDER_TTL` |
|
||||||
|
|
||||||
|
响应 `data`：
|
||||||
|
|
||||||
|
| 字段 | 说明 |
|
||||||
|
|---|---|
|
||||||
|
| `order_id` | 网关订单号 |
|
||||||
|
| `merchant_order_id` | 原样返回 |
|
||||||
|
| `status` | `pending` |
|
||||||
|
| `currency` / `base_amount` / `pay_amount` | `pay_amount` 为**实际应付的唯一金额**，付款方必须严格按它支付 |
|
||||||
|
| `note_code` | 6 位备注码；付款方转账备注里带上它可加速/兜底确认（可选）|
|
||||||
|
| `pay_url` | 网关托管收银页地址，直接跳转即可 |
|
||||||
|
| `receive_uid` | 收款方币安 UID |
|
||||||
|
| `created_at` / `expires_at` | 毫秒时间戳 |
|
||||||
|
|
||||||
|
### 2.2 查询订单 `GET /api/v1/orders/{order_id}`
|
||||||
|
|
||||||
|
响应 `data` 在 2.1 基础上增加：`actual_amount`、`paid_at`、`matched_by`（`amount`/`note`/`claim`）、
|
||||||
|
`binance_order_id`（币安 18 位订单编号）、`payer_id`（付款方 Pay 账户 ID）、`overpaid`（bool）。
|
||||||
|
也可用 `GET /api/v1/orders/by-merchant/{merchant_order_id}` 按商户单号查询。
|
||||||
|
|
||||||
|
### 2.3 关闭订单 `POST /api/v1/orders/{order_id}/close`
|
||||||
|
|
||||||
|
仅 `pending` 可关闭；成功后状态为 `closed`，唯一金额进入冷却。
|
||||||
|
|
||||||
|
### 2.4 收银页（免签名，公开）
|
||||||
|
|
||||||
|
- `GET /pay/{token}`：托管收银页（token 含在 `pay_url` 中）
|
||||||
|
- `GET /pay/{token}/status`：`{status, paid_at, return_url}`，页面轮询用
|
||||||
|
- `POST /pay/{token}/claim`：`{"binance_order_id":"18位数字"}`——「我已付款」回填入口，限流 5 次/分钟
|
||||||
|
|
||||||
|
### 2.5 响应外层
|
||||||
|
|
||||||
|
```json
|
||||||
|
{"code":"OK","data":{...}}
|
||||||
|
{"code":"ERR_AUTH","message":"..."}
|
||||||
|
```
|
||||||
|
|
||||||
|
`code` 取值：`OK`、`ERR_AUTH`、`ERR_PARAM`、`ERR_DUPLICATE`、`ERR_NOT_FOUND`、`ERR_STATE`、
|
||||||
|
`ERR_RATE_LIMIT`、`ERR_ALLOC`（唯一金额耗尽）、`ERR_INTERNAL`。
|
||||||
|
|
||||||
|
## 3. 回调体
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"event": "paid", // paid | underpaid | expired
|
||||||
|
"order_id": "…",
|
||||||
|
"merchant_order_id": "…",
|
||||||
|
"status": "paid",
|
||||||
|
"currency": "USDT",
|
||||||
|
"base_amount": "10",
|
||||||
|
"pay_amount": "10.0037",
|
||||||
|
"actual_amount": "10.0037",
|
||||||
|
"overpaid": false,
|
||||||
|
"matched_by": "amount",
|
||||||
|
"binance_order_id": "452021922068888888",
|
||||||
|
"binance_txn_id": "P_EXAMPLE1234567890",
|
||||||
|
"payer_id": "1160000000",
|
||||||
|
"paid_at": 1788325910559,
|
||||||
|
"timestamp": 1788325912000
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
`underpaid`：备注/回填命中但实付低于基础金额，需人工处理；`expired`：超时未支付。
|
||||||
|
|
||||||
|
## 4. 订单状态机
|
||||||
|
|
||||||
|
```
|
||||||
|
pending ──精确金额/备注码/回填命中──▶ paid
|
||||||
|
pending ──实付不足(备注/回填)──▶ underpaid
|
||||||
|
pending ──到期──▶ expired ──宽限期内精确金额到账/回填──▶ paid
|
||||||
|
pending ──商户关闭──▶ closed
|
||||||
|
```
|
||||||
|
|
||||||
|
## 5. 匹配规则（网关内部，供理解）
|
||||||
|
|
||||||
|
对每条**入账**流水（金额>0、币种在白名单、币安 `orderId` 未被消费过）：
|
||||||
|
|
||||||
|
1. 金额与某待支付订单的 `pay_amount` 完全相等，且到账时间在订单窗口内 → 自动确认；
|
||||||
|
2. 否则备注含某订单 `note_code`（不区分大小写）→ 实付 ≥ 基础金额则确认，否则 `underpaid`；
|
||||||
|
3. 否则保留，等付款方在收银页回填币安订单编号（7 天内有效）。
|
||||||
|
|
||||||
|
同一笔币安流水只能核销一个订单（以币安 `orderId` 幂等）。
|
||||||
@@ -0,0 +1,49 @@
|
|||||||
|
# 调研与实测结论（为什么这样设计）
|
||||||
|
|
||||||
|
时间：2026-09。以下结论来自币安官方文档、官方开发者论坛与真实个人账号实测。
|
||||||
|
|
||||||
|
## 官方能力边界
|
||||||
|
|
||||||
|
| 事实 | 来源 |
|
||||||
|
|---|---|
|
||||||
|
| Binance Pay Merchant API 功能完整（下单/退款/webhook/收银台），但入驻需**企业实体账户**+ 公司注册文件 | [商户申请 FAQ](https://www.binance.com/en/support/faq/detail/7a49148912214defa816f14ee51b9f9f) |
|
||||||
|
| 个人商户账户 2024-11-05 停止新申请、2025-02-28 终止 | 多家集成商公告转述 |
|
||||||
|
| 商户后台的「收款链接」只能后台手工创建，无 API | [merchant.binance.com 文档](https://merchant.binance.com/en/docs/functionalities/payment-links) |
|
||||||
|
| 个人版收款链接（可设币种金额、30 天过期）与定额收款码存在，但无创建 API | 官方 FAQ |
|
||||||
|
| 网页/App 的私有 bapi 接口被官方明确表态「非公开、不建议使用」；条款禁止脚本化访问非公开功能 | [官方论坛](https://dev.binance.vision/t/is-there-a-way-to-use-bapi/19804)、Terms §28(i) |
|
||||||
|
| 个人账户可用现货 API Key（只读）调 `GET /sapi/v1/pay/transactions` 读取 Pay 流水 | [官方文档](https://developers.binance.com/docs/pay/rest-api) |
|
||||||
|
| Pay ID 已于 2025-01-01 停用；收款标识为 UID / 邮箱 / 手机号 / 二维码 | 官方公告 |
|
||||||
|
| Pay 内部转账 0 手续费、即时到账、不可撤销；接收无限额 | 官方 FAQ |
|
||||||
|
|
||||||
|
→ 结论：个人账户唯一合规的程序化通道是**只读流水接口**，所以本网关是「被动对账」模型，
|
||||||
|
不创建支付单、不发起任何资金操作。
|
||||||
|
|
||||||
|
## 关键实测（真实个人账号 + 真实转账）
|
||||||
|
|
||||||
|
文档没写或写错、但被实测确认的行为：
|
||||||
|
|
||||||
|
| 实测项 | 结果 |
|
||||||
|
|---|---|
|
||||||
|
| 返回字段比文档多 | 实测有 `orderId`（18 位数字）、`note`（付款备注原文）、`counterpartyId`（对方 Pay 账户 ID，每条都有） |
|
||||||
|
| 付款方 App 显示的「订单编号」 | = 接口返回的 `orderId`（现场对照确认）→ 回填核验直接比对该字段 |
|
||||||
|
| 金额精度 | 0.1234 USDT 原样到账 → 至少 4 位小数，唯一尾数容量充足 |
|
||||||
|
| 备注 | 付款方填的备注通过 `note` 原样回传 → 备注码匹配成立 |
|
||||||
|
| 到账延迟 | 到账即出现在接口，检测延迟 ≈ 轮询间隔 |
|
||||||
|
| 方向 | `amount` 收款为正、付款为负 |
|
||||||
|
| `payerInfo.binanceId` | 不一定返回（部分记录缺失）→ 网关用 `counterpartyId` 兜底标识付款方 |
|
||||||
|
| 文档示例的 `M_P_` 前缀 transactionId、"无备注字段" | 与实测不符，实测为 `P_` 前缀且有 note 字段 |
|
||||||
|
|
||||||
|
## 接口约束（设计输入）
|
||||||
|
|
||||||
|
- 签名接口，权重 3000（按 UID 计，限额 180000/分钟 → 理论最高约 1 次/秒）
|
||||||
|
- 不传时间返回最近 90 天；时间跨度最长 90 天；最多查 18 个月；`limit` 最大 100、**无游标分页**
|
||||||
|
→ 网关用时间窗口滑动 + 满页向前翻页
|
||||||
|
- 有地区差异风险：论坛有账号反馈该接口恒返回空 → 部署前先跑 `tools/pay_history_probe.py` 自测
|
||||||
|
|
||||||
|
## 被否决的方案
|
||||||
|
|
||||||
|
| 方案 | 否决原因 |
|
||||||
|
|---|---|
|
||||||
|
| cookie / JWT 监听网页流水 | 有官方只读 API 平替；登录态会过期；违反条款；风控风险 |
|
||||||
|
| 程序化创建个人收款链接 | 无公开 API，只能逆向私有 bapi，官方明确不建议 |
|
||||||
|
| 让付款方必须回填订单号 | 体验差、漏填率高 → 降级为兜底入口，主链路零动作 |
|
||||||
@@ -0,0 +1,52 @@
|
|||||||
|
{
|
||||||
|
"secret": "test-secret-0123456789abcdef",
|
||||||
|
"note": "所有 SDK 与服务端的签名实现必须通过本文件全部用例",
|
||||||
|
"cases": [
|
||||||
|
{
|
||||||
|
"type": "request",
|
||||||
|
"timestamp": "1788326000000",
|
||||||
|
"nonce": "nonce-0123456789abcdef",
|
||||||
|
"method": "POST",
|
||||||
|
"path": "/api/v1/orders",
|
||||||
|
"body": "{\"merchant_order_id\":\"M1001\",\"currency\":\"USDT\",\"amount\":\"10\",\"callback_url\":\"https://shop.example.com/notify\"}",
|
||||||
|
"body_sha256": "22b3f243103ddcb2ad8d915ff9ef2a963f8975a753f62baa97c3ddee62b2ab10",
|
||||||
|
"signature": "9f1f26f95c7996cd3a225cc40ad79b29ec863de58e282ea7f77c6a4509d31925"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"type": "request",
|
||||||
|
"timestamp": "1788326001234",
|
||||||
|
"nonce": "9f8e7d6c5b4a39281706fedcba",
|
||||||
|
"method": "GET",
|
||||||
|
"path": "/api/v1/orders/01hxyzabcdefghjkmnpqrs",
|
||||||
|
"body": "",
|
||||||
|
"body_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
|
||||||
|
"signature": "433d6094d014157c9883e99781c93afab4d3c10a0ef605fe1840552038538ee4"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"type": "request",
|
||||||
|
"timestamp": "1788326002000",
|
||||||
|
"nonce": "unicode-测试-nonce-000001",
|
||||||
|
"method": "POST",
|
||||||
|
"path": "/api/v1/orders/01hxyzabcdefghjkmnpqrs/close",
|
||||||
|
"body": "{}",
|
||||||
|
"body_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
|
||||||
|
"signature": "5db7765bc4562c3ab279f23b8688557158cdf4d73941657c63b1666ba3aa16d2"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"type": "callback",
|
||||||
|
"timestamp": "1788326100000",
|
||||||
|
"nonce": "cbnonce-abcdef0123456789",
|
||||||
|
"body": "{\"event\":\"paid\",\"order_id\":\"01hxyzabcdefghjkmnpqrs\",\"merchant_order_id\":\"M1001\",\"status\":\"paid\",\"currency\":\"USDT\",\"base_amount\":\"10\",\"pay_amount\":\"10.0037\",\"actual_amount\":\"10.0037\",\"overpaid\":false,\"matched_by\":\"amount\",\"binance_order_id\":\"452021922068888888\",\"binance_txn_id\":\"P_EXAMPLE1234567890\",\"payer_id\":\"1160000000\",\"paid_at\":1788325910559,\"timestamp\":1788326100000}",
|
||||||
|
"body_sha256": "aa8e1b00794fb83de98fefa39d37d070930db888602a7de5e50d71804beed493",
|
||||||
|
"signature": "88d62e1ff11da171fc185f8f04ef9ec74df7251fc96c833fb786d82b024ff383"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"type": "callback",
|
||||||
|
"timestamp": "1788326200000",
|
||||||
|
"nonce": "cbnonce-fedcba9876543210",
|
||||||
|
"body": "{\"event\":\"expired\",\"order_id\":\"01habcdefghjkmnpqrstuv\",\"merchant_order_id\":\"M1002\",\"status\":\"expired\",\"currency\":\"USDC\",\"base_amount\":\"5.5\",\"pay_amount\":\"5.5123\",\"actual_amount\":\"\",\"overpaid\":false,\"matched_by\":\"\",\"binance_order_id\":\"\",\"binance_txn_id\":\"\",\"payer_id\":\"\",\"paid_at\":0,\"timestamp\":1788326200000}",
|
||||||
|
"body_sha256": "205e708b5c9939e16bed46acedd2d0ba0a668a3b30979cce51f274a17a732074",
|
||||||
|
"signature": "726ac40414e5c461f06211148db7166e32703c22d1b0ad3dad29b1e1c87a61d4"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@@ -0,0 +1,154 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
"""跨语言端到端测试：真实网关二进制 × Python SDK × mock 币安。
|
||||||
|
|
||||||
|
用法: python3 e2e/cross_e2e.py [网关二进制路径，默认 server/bpaygate]
|
||||||
|
流程: 起 mock 币安与回调接收器 → 起网关子进程 → SDK 下单 → 注入到账流水
|
||||||
|
→ 等回调并验签 → 查单断言 paid → 再测回填(claim)路径。
|
||||||
|
"""
|
||||||
|
import json
|
||||||
|
import os
|
||||||
|
import queue
|
||||||
|
import socket
|
||||||
|
import subprocess
|
||||||
|
import sys
|
||||||
|
import tempfile
|
||||||
|
import threading
|
||||||
|
import time
|
||||||
|
import urllib.request
|
||||||
|
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
|
||||||
|
|
||||||
|
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "sdk", "python"))
|
||||||
|
from bpaygate import BPayGate
|
||||||
|
|
||||||
|
SECRET = "e2e-secret-0123456789abcdef"
|
||||||
|
TXNS = []
|
||||||
|
CB_QUEUE = queue.Queue()
|
||||||
|
|
||||||
|
|
||||||
|
class MockBinance(BaseHTTPRequestHandler):
|
||||||
|
def do_GET(self):
|
||||||
|
if self.path.startswith("/sapi/v1/pay/transactions"):
|
||||||
|
body = json.dumps({"code": "000000", "message": "success", "data": TXNS, "success": True}).encode()
|
||||||
|
self.send_response(200)
|
||||||
|
self.send_header("Content-Type", "application/json")
|
||||||
|
self.end_headers()
|
||||||
|
self.wfile.write(body)
|
||||||
|
else:
|
||||||
|
self.send_response(404)
|
||||||
|
self.end_headers()
|
||||||
|
|
||||||
|
def log_message(self, *a):
|
||||||
|
pass
|
||||||
|
|
||||||
|
|
||||||
|
class CallbackReceiver(BaseHTTPRequestHandler):
|
||||||
|
def do_POST(self):
|
||||||
|
body = self.rfile.read(int(self.headers.get("Content-Length", 0)))
|
||||||
|
CB_QUEUE.put((dict(self.headers), body))
|
||||||
|
self.send_response(200)
|
||||||
|
self.end_headers()
|
||||||
|
|
||||||
|
def log_message(self, *a):
|
||||||
|
pass
|
||||||
|
|
||||||
|
|
||||||
|
def free_port():
|
||||||
|
s = socket.socket()
|
||||||
|
s.bind(("127.0.0.1", 0))
|
||||||
|
p = s.getsockname()[1]
|
||||||
|
s.close()
|
||||||
|
return p
|
||||||
|
|
||||||
|
|
||||||
|
def wait_http(url, seconds=15):
|
||||||
|
for _ in range(seconds * 10):
|
||||||
|
try:
|
||||||
|
urllib.request.urlopen(url, timeout=1)
|
||||||
|
return True
|
||||||
|
except Exception:
|
||||||
|
time.sleep(0.1)
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
binary = sys.argv[1] if len(sys.argv) > 1 else os.path.join(os.path.dirname(__file__), "..", "server", "bpaygate")
|
||||||
|
binary = os.path.abspath(binary)
|
||||||
|
if not os.path.isfile(binary):
|
||||||
|
sys.exit(f"找不到网关二进制: {binary}（先在 server/ 下 go build -o bpaygate .）")
|
||||||
|
|
||||||
|
mock = ThreadingHTTPServer(("127.0.0.1", 0), MockBinance)
|
||||||
|
threading.Thread(target=mock.serve_forever, daemon=True).start()
|
||||||
|
cbs = ThreadingHTTPServer(("127.0.0.1", 0), CallbackReceiver)
|
||||||
|
threading.Thread(target=cbs.serve_forever, daemon=True).start()
|
||||||
|
|
||||||
|
gw_port = free_port()
|
||||||
|
base = f"http://127.0.0.1:{gw_port}"
|
||||||
|
cfg = tempfile.NamedTemporaryFile("w", suffix=".env", delete=False)
|
||||||
|
cfg.write(f"""LISTEN=127.0.0.1:{gw_port}
|
||||||
|
BASE_URL={base}
|
||||||
|
API_AUTH_KEY={SECRET}
|
||||||
|
BINANCE_API_KEY=k
|
||||||
|
BINANCE_API_SECRET=s
|
||||||
|
BINANCE_UID=90000001
|
||||||
|
BINANCE_API_BASE=http://127.0.0.1:{mock.server_address[1]}
|
||||||
|
CURRENCIES=USDT,USDC
|
||||||
|
POLL_INTERVAL=1
|
||||||
|
DB_PATH={tempfile.mkdtemp()}/e2e.db
|
||||||
|
""")
|
||||||
|
cfg.close()
|
||||||
|
proc = subprocess.Popen([binary, "-config", cfg.name], stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
|
||||||
|
try:
|
||||||
|
assert wait_http(base + "/healthz"), "网关未就绪"
|
||||||
|
gw = BPayGate(base, SECRET)
|
||||||
|
cb_url = f"http://127.0.0.1:{cbs.server_address[1]}/notify"
|
||||||
|
|
||||||
|
# ① 唯一金额自动匹配
|
||||||
|
order = gw.create_order("E2E-1", "12", currency="USDT", callback_url=cb_url, return_url="https://shop.test/done")
|
||||||
|
assert order["status"] == "pending" and order["pay_amount"] != "12", order
|
||||||
|
assert order["pay_amount"].startswith("12.00"), order # 首单应落在最小尾数档 0.0001–0.0099
|
||||||
|
TXNS.append({"orderId": "452100000000000001", "note": "", "orderType": "C2C",
|
||||||
|
"transactionId": "P_E2E000001", "transactionTime": int(time.time() * 1000),
|
||||||
|
"amount": order["pay_amount"], "currency": "USDT",
|
||||||
|
"counterpartyId": 1163000000, "payerInfo": {"name": "e2e-payer"}})
|
||||||
|
headers, body = CB_QUEUE.get(timeout=15)
|
||||||
|
payload = BPayGate.verify_callback(headers, body, SECRET)
|
||||||
|
assert payload["event"] == "paid" and payload["merchant_order_id"] == "E2E-1", payload
|
||||||
|
got = gw.get_order(order["order_id"])
|
||||||
|
assert got["status"] == "paid" and got["matched_by"] == "amount", got
|
||||||
|
got2 = gw.get_order_by_merchant_id("E2E-1")
|
||||||
|
assert got2["order_id"] == order["order_id"]
|
||||||
|
print("① 金额匹配 + 回调验签 ... PASS")
|
||||||
|
|
||||||
|
# ② 回填 claim
|
||||||
|
order2 = gw.create_order("E2E-2", "33", currency="USDT", callback_url=cb_url)
|
||||||
|
TXNS.append({"orderId": "452100000000000002", "note": "", "orderType": "C2C",
|
||||||
|
"transactionId": "P_E2E000002", "transactionTime": int(time.time() * 1000),
|
||||||
|
"amount": "33", "currency": "USDT",
|
||||||
|
"counterpartyId": 1163000000, "payerInfo": {"name": "e2e-payer"}})
|
||||||
|
token = order2["pay_url"].rsplit("/", 1)[1]
|
||||||
|
req = urllib.request.Request(base + f"/pay/{token}/claim",
|
||||||
|
data=json.dumps({"binance_order_id": "452100000000000002"}).encode(),
|
||||||
|
headers={"Content-Type": "application/json"}, method="POST")
|
||||||
|
out = json.loads(urllib.request.urlopen(req, timeout=10).read())
|
||||||
|
assert out["data"]["code"] == "OK" and out["data"]["status"] == "paid", out
|
||||||
|
headers, body = CB_QUEUE.get(timeout=15)
|
||||||
|
payload = BPayGate.verify_callback(headers, body, SECRET)
|
||||||
|
assert payload["event"] == "paid" and payload["matched_by"] == "claim", payload
|
||||||
|
print("② 回填核验 + 回调验签 ... PASS")
|
||||||
|
|
||||||
|
# ③ 收银页可渲染
|
||||||
|
html = urllib.request.urlopen(base + "/pay/" + token, timeout=5).read().decode()
|
||||||
|
assert "币安" in html and order2["note_code"] in html
|
||||||
|
print("③ 收银页渲染 ... PASS")
|
||||||
|
print("CROSS-E2E ALL PASS")
|
||||||
|
finally:
|
||||||
|
proc.terminate()
|
||||||
|
try:
|
||||||
|
proc.wait(timeout=5)
|
||||||
|
except subprocess.TimeoutExpired:
|
||||||
|
proc.kill()
|
||||||
|
os.unlink(cfg.name)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
module bpaygate-example
|
||||||
|
|
||||||
|
go 1.21
|
||||||
|
|
||||||
|
require github.com/qianyubtc/BinancePayTool/sdk/go v0.0.0
|
||||||
|
|
||||||
|
replace github.com/qianyubtc/BinancePayTool/sdk/go => ../../sdk/go
|
||||||
@@ -0,0 +1,58 @@
|
|||||||
|
// 最小商户示例：go run . 后访问 http://127.0.0.1:9000/buy
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"log"
|
||||||
|
"net/http"
|
||||||
|
"os"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
bpaygate "github.com/qianyubtc/BinancePayTool/sdk/go"
|
||||||
|
)
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
base := envOr("BPG_BASE", "http://127.0.0.1:8080")
|
||||||
|
secret := os.Getenv("BPG_SECRET")
|
||||||
|
gw := bpaygate.New(base, secret)
|
||||||
|
|
||||||
|
http.HandleFunc("/buy", func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
order, err := gw.CreateOrder(bpaygate.CreateOrderReq{
|
||||||
|
MerchantOrderID: fmt.Sprintf("DEMO-%d", time.Now().Unix()),
|
||||||
|
Currency: "USDT",
|
||||||
|
Amount: "1",
|
||||||
|
CallbackURL: "http://127.0.0.1:9000/notify",
|
||||||
|
ReturnURL: "http://127.0.0.1:9000/done",
|
||||||
|
})
|
||||||
|
if err != nil {
|
||||||
|
http.Error(w, err.Error(), 500)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
http.Redirect(w, r, order.PayURL, http.StatusFound)
|
||||||
|
})
|
||||||
|
http.HandleFunc("/notify", func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
body, _ := io.ReadAll(http.MaxBytesReader(w, r.Body, 1<<20))
|
||||||
|
cb, err := bpaygate.VerifyCallback(r.Header, body, secret, 5*time.Minute)
|
||||||
|
if err != nil {
|
||||||
|
http.Error(w, "bad signature", 401)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
// TODO: 按 cb.MerchantOrderID 幂等发货
|
||||||
|
log.Printf("回调: %s %s %s%s", cb.Event, cb.MerchantOrderID, cb.ActualAmount, cb.Currency)
|
||||||
|
w.WriteHeader(200)
|
||||||
|
})
|
||||||
|
http.HandleFunc("/done", func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||||
|
fmt.Fprint(w, "<h1>支付完成，感谢购买！</h1>")
|
||||||
|
})
|
||||||
|
log.Println("商户示例: http://127.0.0.1:9000/buy")
|
||||||
|
log.Fatal(http.ListenAndServe("127.0.0.1:9000", nil))
|
||||||
|
}
|
||||||
|
|
||||||
|
func envOr(k, def string) string {
|
||||||
|
if v := os.Getenv(k); v != "" {
|
||||||
|
return v
|
||||||
|
}
|
||||||
|
return def
|
||||||
|
}
|
||||||
@@ -0,0 +1,62 @@
|
|||||||
|
import com.bpaygate.sdk.BPayGateClient;
|
||||||
|
import com.google.gson.JsonObject;
|
||||||
|
import com.sun.net.httpserver.HttpServer;
|
||||||
|
|
||||||
|
import java.io.ByteArrayOutputStream;
|
||||||
|
import java.io.InputStream;
|
||||||
|
import java.io.OutputStream;
|
||||||
|
import java.net.InetSocketAddress;
|
||||||
|
import java.nio.charset.StandardCharsets;
|
||||||
|
import java.util.HashMap;
|
||||||
|
import java.util.Map;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* 最小商户示例（Java 8+，无 Web 框架）。
|
||||||
|
* 编译运行后访问 http://127.0.0.1:9000/buy
|
||||||
|
*/
|
||||||
|
public class ExampleServer {
|
||||||
|
public static void main(String[] args) throws Exception {
|
||||||
|
String base = System.getenv().getOrDefault("BPG_BASE", "http://127.0.0.1:8080");
|
||||||
|
String secret = System.getenv().getOrDefault("BPG_SECRET", "");
|
||||||
|
BPayGateClient gw = new BPayGateClient(base, secret);
|
||||||
|
|
||||||
|
HttpServer srv = HttpServer.create(new InetSocketAddress("127.0.0.1", 9000), 0);
|
||||||
|
srv.createContext("/buy", ex -> {
|
||||||
|
JsonObject order = gw.createOrder("DEMO-" + System.currentTimeMillis(), "USDT", "1",
|
||||||
|
"http://127.0.0.1:9000/notify", "http://127.0.0.1:9000/done", 0);
|
||||||
|
ex.getResponseHeaders().add("Location", order.get("pay_url").getAsString());
|
||||||
|
ex.sendResponseHeaders(302, -1);
|
||||||
|
ex.close();
|
||||||
|
});
|
||||||
|
srv.createContext("/notify", ex -> {
|
||||||
|
String body = readAll(ex.getRequestBody());
|
||||||
|
Map<String, String> headers = new HashMap<>();
|
||||||
|
ex.getRequestHeaders().forEach((k, v) -> headers.put(k, v.isEmpty() ? "" : v.get(0)));
|
||||||
|
try {
|
||||||
|
JsonObject payload = BPayGateClient.verifyCallback(headers, body, secret, 300000);
|
||||||
|
// TODO: 按 merchant_order_id 幂等发货
|
||||||
|
System.out.println("回调: " + payload.get("event") + " " + payload.get("merchant_order_id"));
|
||||||
|
ex.sendResponseHeaders(200, -1);
|
||||||
|
} catch (BPayGateClient.BPayGateException e) {
|
||||||
|
ex.sendResponseHeaders(401, -1);
|
||||||
|
}
|
||||||
|
ex.close();
|
||||||
|
});
|
||||||
|
srv.createContext("/done", ex -> {
|
||||||
|
byte[] b = "<h1>支付完成，感谢购买！</h1>".getBytes(StandardCharsets.UTF_8);
|
||||||
|
ex.getResponseHeaders().add("Content-Type", "text/html; charset=utf-8");
|
||||||
|
ex.sendResponseHeaders(200, b.length);
|
||||||
|
try (OutputStream os = ex.getResponseBody()) { os.write(b); }
|
||||||
|
});
|
||||||
|
System.out.println("商户示例: http://127.0.0.1:9000/buy");
|
||||||
|
srv.start();
|
||||||
|
}
|
||||||
|
|
||||||
|
private static String readAll(InputStream is) throws java.io.IOException {
|
||||||
|
ByteArrayOutputStream bos = new ByteArrayOutputStream();
|
||||||
|
byte[] buf = new byte[4096];
|
||||||
|
int n;
|
||||||
|
while ((n = is.read(buf)) > 0) bos.write(buf, 0, n);
|
||||||
|
return new String(bos.toByteArray(), StandardCharsets.UTF_8);
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,14 @@
|
|||||||
|
<?php
|
||||||
|
/* 最小商户示例：创建订单并跳转收银页。
|
||||||
|
php -S 127.0.0.1:9000 后访问 http://127.0.0.1:9000/index.php */
|
||||||
|
require __DIR__ . '/../../sdk/php/BPayGate.php';
|
||||||
|
|
||||||
|
$gw = new BPayGate(getenv('BPG_BASE') ?: 'http://127.0.0.1:8080', getenv('BPG_SECRET') ?: '');
|
||||||
|
$order = $gw->createOrder([
|
||||||
|
'merchant_order_id' => 'DEMO-' . time(),
|
||||||
|
'currency' => 'USDT',
|
||||||
|
'amount' => '1',
|
||||||
|
'callback_url' => 'https://你的域名/notify.php',
|
||||||
|
'return_url' => 'https://你的域名/done.php',
|
||||||
|
]);
|
||||||
|
header('Location: ' . $order['pay_url']);
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
<?php
|
||||||
|
/* 回调处理示例 */
|
||||||
|
require __DIR__ . '/../../sdk/php/BPayGate.php';
|
||||||
|
|
||||||
|
try {
|
||||||
|
$payload = BPayGate::verifyCallback(getallheaders(), file_get_contents('php://input'), getenv('BPG_SECRET') ?: '');
|
||||||
|
} catch (BPayGateException $e) {
|
||||||
|
http_response_code(401);
|
||||||
|
exit;
|
||||||
|
}
|
||||||
|
if ($payload['event'] === 'paid') {
|
||||||
|
// TODO: 按 merchant_order_id 幂等发货
|
||||||
|
error_log('已支付: ' . $payload['merchant_order_id'] . ' ' . $payload['actual_amount'] . $payload['currency']);
|
||||||
|
}
|
||||||
|
http_response_code(200);
|
||||||
@@ -0,0 +1,73 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
"""最小商户示例（仅标准库）。
|
||||||
|
|
||||||
|
export BPG_BASE=http://127.0.0.1:8080 BPG_SECRET=你的API_AUTH_KEY
|
||||||
|
python3 app.py # 然后浏览器打开 http://127.0.0.1:9000/buy
|
||||||
|
"""
|
||||||
|
import json
|
||||||
|
import os
|
||||||
|
import sys
|
||||||
|
import time
|
||||||
|
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
|
||||||
|
|
||||||
|
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "sdk", "python"))
|
||||||
|
from bpaygate import BPayGate, BPayGateError
|
||||||
|
|
||||||
|
BASE = os.environ.get("BPG_BASE", "http://127.0.0.1:8080")
|
||||||
|
SECRET = os.environ.get("BPG_SECRET", "")
|
||||||
|
PORT = int(os.environ.get("PORT", "9000"))
|
||||||
|
gw = BPayGate(BASE, SECRET)
|
||||||
|
|
||||||
|
|
||||||
|
class Shop(BaseHTTPRequestHandler):
|
||||||
|
def do_GET(self):
|
||||||
|
if self.path.startswith("/buy"):
|
||||||
|
mid = f"DEMO-{int(time.time())}"
|
||||||
|
try:
|
||||||
|
order = gw.create_order(
|
||||||
|
mid, "1", currency="USDT",
|
||||||
|
callback_url=f"http://127.0.0.1:{PORT}/notify",
|
||||||
|
return_url=f"http://127.0.0.1:{PORT}/done",
|
||||||
|
)
|
||||||
|
except BPayGateError as e:
|
||||||
|
self.send_response(500)
|
||||||
|
self.end_headers()
|
||||||
|
self.wfile.write(str(e).encode())
|
||||||
|
return
|
||||||
|
self.send_response(302)
|
||||||
|
self.send_header("Location", order["pay_url"])
|
||||||
|
self.end_headers()
|
||||||
|
elif self.path.startswith("/done"):
|
||||||
|
self.send_response(200)
|
||||||
|
self.send_header("Content-Type", "text/html; charset=utf-8")
|
||||||
|
self.end_headers()
|
||||||
|
self.wfile.write("<h1>支付完成，感谢购买！</h1>".encode())
|
||||||
|
else:
|
||||||
|
self.send_response(404)
|
||||||
|
self.end_headers()
|
||||||
|
|
||||||
|
def do_POST(self):
|
||||||
|
if self.path != "/notify":
|
||||||
|
self.send_response(404)
|
||||||
|
self.end_headers()
|
||||||
|
return
|
||||||
|
body = self.rfile.read(int(self.headers.get("Content-Length", 0)))
|
||||||
|
try:
|
||||||
|
payload = BPayGate.verify_callback(self.headers, body, SECRET)
|
||||||
|
except BPayGateError as e:
|
||||||
|
print("回调验签失败:", e)
|
||||||
|
self.send_response(401)
|
||||||
|
self.end_headers()
|
||||||
|
return
|
||||||
|
# TODO: 按 merchant_order_id 幂等发货
|
||||||
|
print("收到回调:", payload["event"], payload["merchant_order_id"], payload.get("actual_amount"))
|
||||||
|
self.send_response(200)
|
||||||
|
self.end_headers()
|
||||||
|
|
||||||
|
def log_message(self, *a):
|
||||||
|
pass
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
print(f"商户示例: http://127.0.0.1:{PORT}/buy")
|
||||||
|
ThreadingHTTPServer(("127.0.0.1", PORT), Shop).serve_forever()
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
# BinancePayTool Go SDK
|
||||||
|
|
||||||
|
仅标准库。模块路径 `github.com/qianyubtc/BinancePayTool/sdk/go`；仓库发布前本地可用 `replace` 指到目录（见 examples/go/go.mod）。
|
||||||
|
|
||||||
|
```go
|
||||||
|
gw := bpaygate.New("https://pay.example.com", "你的API_AUTH_KEY")
|
||||||
|
order, err := gw.CreateOrder(bpaygate.CreateOrderReq{
|
||||||
|
MerchantOrderID: "SHOP-1001", Currency: "USDT", Amount: "10",
|
||||||
|
CallbackURL: "https://shop.example.com/bpg/notify",
|
||||||
|
})
|
||||||
|
// 跳转用户到 order.PayURL
|
||||||
|
|
||||||
|
// 回调:
|
||||||
|
cb, err := bpaygate.VerifyCallback(r.Header, body, secret, 5*time.Minute)
|
||||||
|
```
|
||||||
|
|
||||||
|
完整字段见 [docs/protocol.md](../../docs/protocol.md)。示例：[examples/go](../../examples/go)。
|
||||||
@@ -0,0 +1,214 @@
|
|||||||
|
// Package bpaygate 是 BinancePayTool 网关的 Go 接入 SDK（仅标准库）。
|
||||||
|
//
|
||||||
|
// gw := bpaygate.New("https://pay.example.com", "你的API_AUTH_KEY")
|
||||||
|
// order, err := gw.CreateOrder(bpaygate.CreateOrderReq{
|
||||||
|
// MerchantOrderID: "SHOP-1001", Currency: "USDT", Amount: "10",
|
||||||
|
// CallbackURL: "https://shop.example.com/bpg/notify",
|
||||||
|
// })
|
||||||
|
// // 跳转用户到 order.PayURL；回调用 VerifyCallback 验签后按 MerchantOrderID 幂等发货。
|
||||||
|
package bpaygate
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"crypto/hmac"
|
||||||
|
"crypto/rand"
|
||||||
|
"crypto/sha256"
|
||||||
|
"encoding/hex"
|
||||||
|
"encoding/json"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
type Client struct {
|
||||||
|
BaseURL string
|
||||||
|
Secret string
|
||||||
|
HC *http.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
func New(baseURL, secret string) *Client {
|
||||||
|
for len(baseURL) > 0 && baseURL[len(baseURL)-1] == '/' {
|
||||||
|
baseURL = baseURL[:len(baseURL)-1]
|
||||||
|
}
|
||||||
|
return &Client{BaseURL: baseURL, Secret: secret, HC: &http.Client{Timeout: 10 * time.Second}}
|
||||||
|
}
|
||||||
|
|
||||||
|
type Order struct {
|
||||||
|
OrderID string `json:"order_id"`
|
||||||
|
MerchantOrderID string `json:"merchant_order_id"`
|
||||||
|
Status string `json:"status"`
|
||||||
|
Currency string `json:"currency"`
|
||||||
|
BaseAmount string `json:"base_amount"`
|
||||||
|
PayAmount string `json:"pay_amount"`
|
||||||
|
ActualAmount string `json:"actual_amount"`
|
||||||
|
NoteCode string `json:"note_code"`
|
||||||
|
PayURL string `json:"pay_url"`
|
||||||
|
ReceiveUID string `json:"receive_uid"`
|
||||||
|
MatchedBy string `json:"matched_by"`
|
||||||
|
BinanceOrderID string `json:"binance_order_id"`
|
||||||
|
BinanceTxnID string `json:"binance_txn_id"`
|
||||||
|
PayerID string `json:"payer_id"`
|
||||||
|
Overpaid bool `json:"overpaid"`
|
||||||
|
CreatedAt int64 `json:"created_at"`
|
||||||
|
ExpiresAt int64 `json:"expires_at"`
|
||||||
|
PaidAt int64 `json:"paid_at"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type Callback struct {
|
||||||
|
Event string `json:"event"` // paid | underpaid | expired
|
||||||
|
OrderID string `json:"order_id"`
|
||||||
|
MerchantOrderID string `json:"merchant_order_id"`
|
||||||
|
Status string `json:"status"`
|
||||||
|
Currency string `json:"currency"`
|
||||||
|
BaseAmount string `json:"base_amount"`
|
||||||
|
PayAmount string `json:"pay_amount"`
|
||||||
|
ActualAmount string `json:"actual_amount"`
|
||||||
|
Overpaid bool `json:"overpaid"`
|
||||||
|
MatchedBy string `json:"matched_by"`
|
||||||
|
BinanceOrderID string `json:"binance_order_id"`
|
||||||
|
BinanceTxnID string `json:"binance_txn_id"`
|
||||||
|
PayerID string `json:"payer_id"`
|
||||||
|
PaidAt int64 `json:"paid_at"`
|
||||||
|
Timestamp int64 `json:"timestamp"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type APIError struct {
|
||||||
|
Code string
|
||||||
|
Message string
|
||||||
|
HTTPStatus int
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e *APIError) Error() string { return e.Code + ": " + e.Message }
|
||||||
|
|
||||||
|
type CreateOrderReq struct {
|
||||||
|
MerchantOrderID string `json:"merchant_order_id"`
|
||||||
|
Currency string `json:"currency"`
|
||||||
|
Amount string `json:"amount"`
|
||||||
|
CallbackURL string `json:"callback_url,omitempty"`
|
||||||
|
ReturnURL string `json:"return_url,omitempty"`
|
||||||
|
Timeout int64 `json:"timeout,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *Client) CreateOrder(req CreateOrderReq) (*Order, error) {
|
||||||
|
return c.do("POST", "/api/v1/orders", req)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *Client) GetOrder(orderID string) (*Order, error) {
|
||||||
|
return c.do("GET", "/api/v1/orders/"+orderID, nil)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *Client) GetOrderByMerchantID(mid string) (*Order, error) {
|
||||||
|
return c.do("GET", "/api/v1/orders/by-merchant/"+mid, nil)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *Client) CloseOrder(orderID string) (*Order, error) {
|
||||||
|
return c.do("POST", "/api/v1/orders/"+orderID+"/close", struct{}{})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (c *Client) do(method, path string, payload any) (*Order, error) {
|
||||||
|
var body []byte
|
||||||
|
if payload != nil {
|
||||||
|
b, err := json.Marshal(payload)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
body = b
|
||||||
|
}
|
||||||
|
ts := strconv.FormatInt(time.Now().UnixMilli(), 10)
|
||||||
|
nonce := randNonce()
|
||||||
|
req, err := http.NewRequest(method, c.BaseURL+path, bytes.NewReader(body))
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
req.Header.Set("Content-Type", "application/json")
|
||||||
|
req.Header.Set("X-BPG-Timestamp", ts)
|
||||||
|
req.Header.Set("X-BPG-Nonce", nonce)
|
||||||
|
req.Header.Set("X-BPG-Signature", SignRequest(c.Secret, ts, nonce, method, path, body))
|
||||||
|
resp, err := c.HC.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
raw, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
var env struct {
|
||||||
|
Code string `json:"code"`
|
||||||
|
Message string `json:"message"`
|
||||||
|
Data json.RawMessage `json:"data"`
|
||||||
|
}
|
||||||
|
if err := json.Unmarshal(raw, &env); err != nil {
|
||||||
|
return nil, fmt.Errorf("响应解析失败 (HTTP %d): %w", resp.StatusCode, err)
|
||||||
|
}
|
||||||
|
if env.Code != "OK" {
|
||||||
|
return nil, &APIError{Code: env.Code, Message: env.Message, HTTPStatus: resp.StatusCode}
|
||||||
|
}
|
||||||
|
var o Order
|
||||||
|
if err := json.Unmarshal(env.Data, &o); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &o, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// VerifyCallback 校验网关回调签名并解析。商户须按 MerchantOrderID 幂等处理。
|
||||||
|
func VerifyCallback(header http.Header, body []byte, secret string, maxSkew time.Duration) (*Callback, error) {
|
||||||
|
ts := header.Get("X-BPG-Timestamp")
|
||||||
|
nonce := header.Get("X-BPG-Nonce")
|
||||||
|
sig := header.Get("X-BPG-Signature")
|
||||||
|
if ts == "" || nonce == "" || sig == "" {
|
||||||
|
return nil, errors.New("缺少签名头")
|
||||||
|
}
|
||||||
|
tsv, err := strconv.ParseInt(ts, 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
return nil, errors.New("时间戳非法")
|
||||||
|
}
|
||||||
|
skew := time.Now().UnixMilli() - tsv
|
||||||
|
if skew < 0 {
|
||||||
|
skew = -skew
|
||||||
|
}
|
||||||
|
if maxSkew <= 0 {
|
||||||
|
maxSkew = 5 * time.Minute
|
||||||
|
}
|
||||||
|
if skew > maxSkew.Milliseconds() {
|
||||||
|
return nil, errors.New("时间戳偏差过大")
|
||||||
|
}
|
||||||
|
if !hmac.Equal([]byte(SignCallback(secret, ts, nonce, body)), []byte(sig)) {
|
||||||
|
return nil, errors.New("签名错误")
|
||||||
|
}
|
||||||
|
var cb Callback
|
||||||
|
if err := json.Unmarshal(body, &cb); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &cb, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func sha256Hex(b []byte) string {
|
||||||
|
h := sha256.Sum256(b)
|
||||||
|
return hex.EncodeToString(h[:])
|
||||||
|
}
|
||||||
|
|
||||||
|
func hmacHex(secret, msg string) string {
|
||||||
|
m := hmac.New(sha256.New, []byte(secret))
|
||||||
|
m.Write([]byte(msg))
|
||||||
|
return hex.EncodeToString(m.Sum(nil))
|
||||||
|
}
|
||||||
|
|
||||||
|
// SignRequest 商户→网关请求签名（docs/protocol.md §1.1）。
|
||||||
|
func SignRequest(secret, ts, nonce, method, path string, body []byte) string {
|
||||||
|
return hmacHex(secret, ts+"\n"+nonce+"\n"+method+"\n"+path+"\n"+sha256Hex(body))
|
||||||
|
}
|
||||||
|
|
||||||
|
// SignCallback 网关→商户回调签名（docs/protocol.md §1.2）。
|
||||||
|
func SignCallback(secret, ts, nonce string, body []byte) string {
|
||||||
|
return hmacHex(secret, ts+"\n"+nonce+"\n"+sha256Hex(body))
|
||||||
|
}
|
||||||
|
|
||||||
|
func randNonce() string {
|
||||||
|
b := make([]byte, 16)
|
||||||
|
rand.Read(b)
|
||||||
|
return hex.EncodeToString(b)
|
||||||
|
}
|
||||||
@@ -0,0 +1,34 @@
|
|||||||
|
package bpaygate
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"os"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestVectors(t *testing.T) {
|
||||||
|
data, err := os.ReadFile("../../docs/test_vectors.json")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
var vf struct {
|
||||||
|
Secret string `json:"secret"`
|
||||||
|
Cases []struct {
|
||||||
|
Type, Timestamp, Nonce, Method, Path, Body, Signature string
|
||||||
|
} `json:"cases"`
|
||||||
|
}
|
||||||
|
if err := json.Unmarshal(data, &vf); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
for i, c := range vf.Cases {
|
||||||
|
var got string
|
||||||
|
if c.Type == "request" {
|
||||||
|
got = SignRequest(vf.Secret, c.Timestamp, c.Nonce, c.Method, c.Path, []byte(c.Body))
|
||||||
|
} else {
|
||||||
|
got = SignCallback(vf.Secret, c.Timestamp, c.Nonce, []byte(c.Body))
|
||||||
|
}
|
||||||
|
if got != c.Signature {
|
||||||
|
t.Errorf("case %d: got %s want %s", i, got, c.Signature)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
module github.com/qianyubtc/BinancePayTool/sdk/go
|
||||||
|
|
||||||
|
go 1.21
|
||||||
@@ -0,0 +1,228 @@
|
|||||||
|
package com.bpaygate.sdk;
|
||||||
|
|
||||||
|
import com.google.gson.Gson;
|
||||||
|
import com.google.gson.JsonObject;
|
||||||
|
|
||||||
|
import javax.crypto.Mac;
|
||||||
|
import javax.crypto.spec.SecretKeySpec;
|
||||||
|
import java.io.ByteArrayOutputStream;
|
||||||
|
import java.io.InputStream;
|
||||||
|
import java.io.OutputStream;
|
||||||
|
import java.net.HttpURLConnection;
|
||||||
|
import java.net.URL;
|
||||||
|
import java.nio.charset.StandardCharsets;
|
||||||
|
import java.security.MessageDigest;
|
||||||
|
import java.security.SecureRandom;
|
||||||
|
import java.util.Map;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* BPayGate Java SDK（Java 8+，依赖 Gson）。
|
||||||
|
*
|
||||||
|
* <pre>
|
||||||
|
* BPayGateClient gw = new BPayGateClient("https://pay.example.com", "你的API_AUTH_KEY");
|
||||||
|
* JsonObject order = gw.createOrder("SHOP-1001", "USDT", "10",
|
||||||
|
* "https://shop.example.com/bpg/notify", "https://shop.example.com/orders/1001", 0);
|
||||||
|
* String payUrl = order.get("pay_url").getAsString(); // 跳转用户
|
||||||
|
*
|
||||||
|
* // 回调处理：
|
||||||
|
* JsonObject payload = BPayGateClient.verifyCallback(tsHeader, nonceHeader, sigHeader, rawBody, SECRET, 300000);
|
||||||
|
* if ("paid".equals(payload.get("event").getAsString())) { ... } // 按 merchant_order_id 幂等发货
|
||||||
|
* </pre>
|
||||||
|
*/
|
||||||
|
public class BPayGateClient {
|
||||||
|
|
||||||
|
public static class BPayGateException extends RuntimeException {
|
||||||
|
public final String code;
|
||||||
|
public final int httpStatus;
|
||||||
|
|
||||||
|
public BPayGateException(String code, String message, int httpStatus) {
|
||||||
|
super(code + ": " + message);
|
||||||
|
this.code = code;
|
||||||
|
this.httpStatus = httpStatus;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private static final Gson GSON = new Gson();
|
||||||
|
private static final SecureRandom RND = new SecureRandom();
|
||||||
|
|
||||||
|
private final String baseUrl;
|
||||||
|
private final String secret;
|
||||||
|
private final int timeoutMs;
|
||||||
|
|
||||||
|
public BPayGateClient(String baseUrl, String secret) {
|
||||||
|
this(baseUrl, secret, 10000);
|
||||||
|
}
|
||||||
|
|
||||||
|
public BPayGateClient(String baseUrl, String secret, int timeoutMs) {
|
||||||
|
String b = baseUrl;
|
||||||
|
while (b.endsWith("/")) b = b.substring(0, b.length() - 1);
|
||||||
|
this.baseUrl = b;
|
||||||
|
this.secret = secret;
|
||||||
|
this.timeoutMs = timeoutMs;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* ---------- API ---------- */
|
||||||
|
|
||||||
|
public JsonObject createOrder(String merchantOrderId, String currency, String amount,
|
||||||
|
String callbackUrl, String returnUrl, long timeoutSec) {
|
||||||
|
JsonObject p = new JsonObject();
|
||||||
|
p.addProperty("merchant_order_id", merchantOrderId);
|
||||||
|
p.addProperty("currency", currency);
|
||||||
|
p.addProperty("amount", amount);
|
||||||
|
if (callbackUrl != null && !callbackUrl.isEmpty()) p.addProperty("callback_url", callbackUrl);
|
||||||
|
if (returnUrl != null && !returnUrl.isEmpty()) p.addProperty("return_url", returnUrl);
|
||||||
|
if (timeoutSec > 0) p.addProperty("timeout", timeoutSec);
|
||||||
|
return request("POST", "/api/v1/orders", GSON.toJson(p));
|
||||||
|
}
|
||||||
|
|
||||||
|
public JsonObject getOrder(String orderId) {
|
||||||
|
return request("GET", "/api/v1/orders/" + orderId, "");
|
||||||
|
}
|
||||||
|
|
||||||
|
public JsonObject getOrderByMerchantId(String merchantOrderId) {
|
||||||
|
return request("GET", "/api/v1/orders/by-merchant/" + merchantOrderId, "");
|
||||||
|
}
|
||||||
|
|
||||||
|
public JsonObject closeOrder(String orderId) {
|
||||||
|
return request("POST", "/api/v1/orders/" + orderId + "/close", "{}");
|
||||||
|
}
|
||||||
|
|
||||||
|
/* ---------- 签名 ---------- */
|
||||||
|
|
||||||
|
public static String signRequest(String secret, String ts, String nonce, String method, String path, String body) {
|
||||||
|
String sts = ts + "\n" + nonce + "\n" + method + "\n" + path + "\n" + sha256Hex(body.getBytes(StandardCharsets.UTF_8));
|
||||||
|
return hmacHex(secret, sts);
|
||||||
|
}
|
||||||
|
|
||||||
|
public static String signCallback(String secret, String ts, String nonce, String body) {
|
||||||
|
String sts = ts + "\n" + nonce + "\n" + sha256Hex(body.getBytes(StandardCharsets.UTF_8));
|
||||||
|
return hmacHex(secret, sts);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* 校验网关回调，通过返回回调 JSON，失败抛 BPayGateException。
|
||||||
|
* 注意：回调可能重复投递，商户须按 merchant_order_id 幂等处理。
|
||||||
|
*/
|
||||||
|
public static JsonObject verifyCallback(String ts, String nonce, String sig, String body,
|
||||||
|
String secret, long maxSkewMs) {
|
||||||
|
if (ts == null || nonce == null || sig == null || ts.isEmpty() || nonce.isEmpty() || sig.isEmpty()) {
|
||||||
|
throw new BPayGateException("ERR_AUTH", "缺少签名头", 0);
|
||||||
|
}
|
||||||
|
long tsv;
|
||||||
|
try {
|
||||||
|
tsv = Long.parseLong(ts);
|
||||||
|
} catch (NumberFormatException e) {
|
||||||
|
throw new BPayGateException("ERR_AUTH", "时间戳非法", 0);
|
||||||
|
}
|
||||||
|
if (Math.abs(System.currentTimeMillis() - tsv) > maxSkewMs) {
|
||||||
|
throw new BPayGateException("ERR_AUTH", "时间戳偏差过大", 0);
|
||||||
|
}
|
||||||
|
if (!constantTimeEquals(signCallback(secret, ts, nonce, body), sig)) {
|
||||||
|
throw new BPayGateException("ERR_AUTH", "签名错误", 0);
|
||||||
|
}
|
||||||
|
return GSON.fromJson(body, JsonObject.class);
|
||||||
|
}
|
||||||
|
|
||||||
|
/** 便捷重载：直接传 header map（键不区分大小写）。 */
|
||||||
|
public static JsonObject verifyCallback(Map<String, String> headers, String body, String secret, long maxSkewMs) {
|
||||||
|
String ts = null, nonce = null, sig = null;
|
||||||
|
for (Map.Entry<String, String> e : headers.entrySet()) {
|
||||||
|
String k = e.getKey() == null ? "" : e.getKey().toLowerCase();
|
||||||
|
if (k.equals("x-bpg-timestamp")) ts = e.getValue();
|
||||||
|
else if (k.equals("x-bpg-nonce")) nonce = e.getValue();
|
||||||
|
else if (k.equals("x-bpg-signature")) sig = e.getValue();
|
||||||
|
}
|
||||||
|
return verifyCallback(ts, nonce, sig, body, secret, maxSkewMs);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* ---------- 内部 ---------- */
|
||||||
|
|
||||||
|
private JsonObject request(String method, String path, String body) {
|
||||||
|
try {
|
||||||
|
String ts = String.valueOf(System.currentTimeMillis());
|
||||||
|
byte[] nb = new byte[16];
|
||||||
|
RND.nextBytes(nb);
|
||||||
|
String nonce = hex(nb);
|
||||||
|
String sig = signRequest(secret, ts, nonce, method, path, body);
|
||||||
|
|
||||||
|
HttpURLConnection conn = (HttpURLConnection) new URL(baseUrl + path).openConnection();
|
||||||
|
conn.setRequestMethod(method);
|
||||||
|
conn.setConnectTimeout(timeoutMs);
|
||||||
|
conn.setReadTimeout(timeoutMs);
|
||||||
|
conn.setRequestProperty("Content-Type", "application/json");
|
||||||
|
conn.setRequestProperty("X-BPG-Timestamp", ts);
|
||||||
|
conn.setRequestProperty("X-BPG-Nonce", nonce);
|
||||||
|
conn.setRequestProperty("X-BPG-Signature", sig);
|
||||||
|
if (!body.isEmpty()) {
|
||||||
|
conn.setDoOutput(true);
|
||||||
|
try (OutputStream os = conn.getOutputStream()) {
|
||||||
|
os.write(body.getBytes(StandardCharsets.UTF_8));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
int status = conn.getResponseCode();
|
||||||
|
InputStream is = status >= 400 ? conn.getErrorStream() : conn.getInputStream();
|
||||||
|
String raw = readAll(is);
|
||||||
|
JsonObject out;
|
||||||
|
try {
|
||||||
|
out = GSON.fromJson(raw, JsonObject.class);
|
||||||
|
} catch (Exception e) {
|
||||||
|
throw new BPayGateException("ERR_HTTP", "HTTP " + status, status);
|
||||||
|
}
|
||||||
|
if (out == null || out.get("code") == null) {
|
||||||
|
throw new BPayGateException("ERR_HTTP", "HTTP " + status, status);
|
||||||
|
}
|
||||||
|
String code = out.get("code").getAsString();
|
||||||
|
if (!"OK".equals(code)) {
|
||||||
|
String msg = out.get("message") == null ? "" : out.get("message").getAsString();
|
||||||
|
throw new BPayGateException(code, msg, status);
|
||||||
|
}
|
||||||
|
return out.getAsJsonObject("data");
|
||||||
|
} catch (BPayGateException e) {
|
||||||
|
throw e;
|
||||||
|
} catch (Exception e) {
|
||||||
|
throw new BPayGateException("ERR_NETWORK", e.getMessage() == null ? e.toString() : e.getMessage(), 0);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private static String readAll(InputStream is) throws Exception {
|
||||||
|
if (is == null) return "";
|
||||||
|
ByteArrayOutputStream bos = new ByteArrayOutputStream();
|
||||||
|
byte[] buf = new byte[4096];
|
||||||
|
int n;
|
||||||
|
while ((n = is.read(buf)) > 0) bos.write(buf, 0, n);
|
||||||
|
return new String(bos.toByteArray(), StandardCharsets.UTF_8);
|
||||||
|
}
|
||||||
|
|
||||||
|
private static String sha256Hex(byte[] b) {
|
||||||
|
try {
|
||||||
|
return hex(MessageDigest.getInstance("SHA-256").digest(b));
|
||||||
|
} catch (Exception e) {
|
||||||
|
throw new RuntimeException(e);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private static String hmacHex(String secret, String msg) {
|
||||||
|
try {
|
||||||
|
Mac mac = Mac.getInstance("HmacSHA256");
|
||||||
|
mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
|
||||||
|
return hex(mac.doFinal(msg.getBytes(StandardCharsets.UTF_8)));
|
||||||
|
} catch (Exception e) {
|
||||||
|
throw new RuntimeException(e);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private static String hex(byte[] b) {
|
||||||
|
StringBuilder sb = new StringBuilder(b.length * 2);
|
||||||
|
for (byte x : b) sb.append(String.format("%02x", x));
|
||||||
|
return sb.toString();
|
||||||
|
}
|
||||||
|
|
||||||
|
private static boolean constantTimeEquals(String a, String b) {
|
||||||
|
byte[] x = a.getBytes(StandardCharsets.UTF_8);
|
||||||
|
byte[] y = b.getBytes(StandardCharsets.UTF_8);
|
||||||
|
if (x.length != y.length) return false;
|
||||||
|
int r = 0;
|
||||||
|
for (int i = 0; i < x.length; i++) r |= x[i] ^ y[i];
|
||||||
|
return r == 0;
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
# BinancePayTool Java SDK
|
||||||
|
|
||||||
|
Java 8+，依赖 Gson（见 pom.xml）。也可直接把 `BPayGateClient.java` 拷进项目。
|
||||||
|
|
||||||
|
```java
|
||||||
|
BPayGateClient gw = new BPayGateClient("https://pay.example.com", "你的API_AUTH_KEY");
|
||||||
|
JsonObject order = gw.createOrder("SHOP-1001", "USDT", "10",
|
||||||
|
"https://shop.example.com/bpg/notify", null, 0);
|
||||||
|
String payUrl = order.get("pay_url").getAsString();
|
||||||
|
|
||||||
|
// 回调:
|
||||||
|
JsonObject payload = BPayGateClient.verifyCallback(headersMap, rawBody, SECRET, 300000);
|
||||||
|
```
|
||||||
|
|
||||||
|
完整字段见 [docs/protocol.md](../../docs/protocol.md)。示例：[examples/java](../../examples/java)。
|
||||||
@@ -0,0 +1,54 @@
|
|||||||
|
import com.bpaygate.sdk.BPayGateClient;
|
||||||
|
import com.google.gson.Gson;
|
||||||
|
import com.google.gson.JsonArray;
|
||||||
|
import com.google.gson.JsonObject;
|
||||||
|
|
||||||
|
import java.nio.charset.StandardCharsets;
|
||||||
|
import java.nio.file.Files;
|
||||||
|
import java.nio.file.Paths;
|
||||||
|
|
||||||
|
/** 签名向量测试（无 JUnit 依赖，CI 中直接 java 运行；非零退出即失败）。 */
|
||||||
|
public class VectorTest {
|
||||||
|
public static void main(String[] args) throws Exception {
|
||||||
|
String path = args.length > 0 ? args[0] : "../../docs/test_vectors.json";
|
||||||
|
String raw = new String(Files.readAllBytes(Paths.get(path)), StandardCharsets.UTF_8);
|
||||||
|
JsonObject vf = new Gson().fromJson(raw, JsonObject.class);
|
||||||
|
String secret = vf.get("secret").getAsString();
|
||||||
|
JsonArray cases = vf.getAsJsonArray("cases");
|
||||||
|
int fails = 0;
|
||||||
|
for (int i = 0; i < cases.size(); i++) {
|
||||||
|
JsonObject c = cases.get(i).getAsJsonObject();
|
||||||
|
String got;
|
||||||
|
if ("request".equals(c.get("type").getAsString())) {
|
||||||
|
got = BPayGateClient.signRequest(secret, c.get("timestamp").getAsString(),
|
||||||
|
c.get("nonce").getAsString(), c.get("method").getAsString(),
|
||||||
|
c.get("path").getAsString(), c.get("body").getAsString());
|
||||||
|
} else {
|
||||||
|
got = BPayGateClient.signCallback(secret, c.get("timestamp").getAsString(),
|
||||||
|
c.get("nonce").getAsString(), c.get("body").getAsString());
|
||||||
|
}
|
||||||
|
if (!got.equals(c.get("signature").getAsString())) {
|
||||||
|
System.err.println("case " + i + ": got " + got + " want " + c.get("signature").getAsString());
|
||||||
|
fails++;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// verifyCallback 正反例
|
||||||
|
String body = "{\"event\":\"paid\",\"merchant_order_id\":\"M1\"}";
|
||||||
|
String ts = String.valueOf(System.currentTimeMillis());
|
||||||
|
String sig = BPayGateClient.signCallback(secret, ts, "nnnnnnnnnnnnnnnnnnnn", body);
|
||||||
|
JsonObject payload = BPayGateClient.verifyCallback(ts, "nnnnnnnnnnnnnnnnnnnn", sig, body, secret, 300000);
|
||||||
|
if (!"paid".equals(payload.get("event").getAsString())) {
|
||||||
|
System.err.println("verifyCallback 解析失败");
|
||||||
|
fails++;
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
BPayGateClient.verifyCallback(ts, "nnnnnnnnnnnnnnnnnnnn", "bad", body, secret, 300000);
|
||||||
|
System.err.println("坏签名未被拒绝");
|
||||||
|
fails++;
|
||||||
|
} catch (BPayGateClient.BPayGateException e) {
|
||||||
|
// 预期
|
||||||
|
}
|
||||||
|
if (fails > 0) System.exit(1);
|
||||||
|
System.out.println("Java SDK vectors: ALL PASS");
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,33 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
||||||
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||||
|
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||||||
|
<modelVersion>4.0.0</modelVersion>
|
||||||
|
<groupId>com.bpaygate</groupId>
|
||||||
|
<artifactId>bpaygate-sdk</artifactId>
|
||||||
|
<version>0.1.0</version>
|
||||||
|
<packaging>jar</packaging>
|
||||||
|
<properties>
|
||||||
|
<maven.compiler.source>8</maven.compiler.source>
|
||||||
|
<maven.compiler.target>8</maven.compiler.target>
|
||||||
|
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
|
||||||
|
</properties>
|
||||||
|
<dependencies>
|
||||||
|
<dependency>
|
||||||
|
<groupId>com.google.code.gson</groupId>
|
||||||
|
<artifactId>gson</artifactId>
|
||||||
|
<version>2.10.1</version>
|
||||||
|
</dependency>
|
||||||
|
</dependencies>
|
||||||
|
<build>
|
||||||
|
<sourceDirectory>.</sourceDirectory>
|
||||||
|
<plugins>
|
||||||
|
<plugin>
|
||||||
|
<groupId>org.apache.maven.plugins</groupId>
|
||||||
|
<artifactId>maven-jar-plugin</artifactId>
|
||||||
|
<version>3.4.1</version>
|
||||||
|
<configuration><excludes><exclude>VectorTest*</exclude></excludes></configuration>
|
||||||
|
</plugin>
|
||||||
|
</plugins>
|
||||||
|
</build>
|
||||||
|
</project>
|
||||||
@@ -0,0 +1,157 @@
|
|||||||
|
<?php
|
||||||
|
/**
|
||||||
|
* BPayGate PHP SDK（单文件，PHP 7.4+，需 curl 与 json 扩展）
|
||||||
|
*
|
||||||
|
* 用法：
|
||||||
|
* require 'BPayGate.php';
|
||||||
|
* $gw = new BPayGate('https://pay.example.com', '你的API_AUTH_KEY');
|
||||||
|
* $order = $gw->createOrder([
|
||||||
|
* 'merchant_order_id' => 'SHOP-1001',
|
||||||
|
* 'currency' => 'USDT',
|
||||||
|
* 'amount' => '10',
|
||||||
|
* 'callback_url' => 'https://shop.example.com/bpg_notify.php',
|
||||||
|
* 'return_url' => 'https://shop.example.com/orders/1001',
|
||||||
|
* ]);
|
||||||
|
* header('Location: ' . $order['pay_url']);
|
||||||
|
*
|
||||||
|
* 回调处理（bpg_notify.php）：
|
||||||
|
* $payload = BPayGate::verifyCallback(getallheaders(), file_get_contents('php://input'), $secret);
|
||||||
|
* if ($payload['event'] === 'paid') { ... } // 按 merchant_order_id 幂等发货
|
||||||
|
* http_response_code(200);
|
||||||
|
*/
|
||||||
|
|
||||||
|
class BPayGateException extends \Exception
|
||||||
|
{
|
||||||
|
public $errCode;
|
||||||
|
public $httpStatus;
|
||||||
|
|
||||||
|
public function __construct(string $errCode, string $message = '', int $httpStatus = 0)
|
||||||
|
{
|
||||||
|
parent::__construct($errCode . ': ' . $message);
|
||||||
|
$this->errCode = $errCode;
|
||||||
|
$this->httpStatus = $httpStatus;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
class BPayGate
|
||||||
|
{
|
||||||
|
private $baseUrl;
|
||||||
|
private $secret;
|
||||||
|
private $timeout;
|
||||||
|
|
||||||
|
public function __construct(string $baseUrl, string $secret, int $timeout = 10)
|
||||||
|
{
|
||||||
|
$this->baseUrl = rtrim($baseUrl, '/');
|
||||||
|
$this->secret = $secret;
|
||||||
|
$this->timeout = $timeout;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* ---------- API ---------- */
|
||||||
|
|
||||||
|
public function createOrder(array $params): array
|
||||||
|
{
|
||||||
|
return $this->request('POST', '/api/v1/orders', $params);
|
||||||
|
}
|
||||||
|
|
||||||
|
public function getOrder(string $orderId): array
|
||||||
|
{
|
||||||
|
return $this->request('GET', '/api/v1/orders/' . $orderId);
|
||||||
|
}
|
||||||
|
|
||||||
|
public function getOrderByMerchantId(string $merchantOrderId): array
|
||||||
|
{
|
||||||
|
return $this->request('GET', '/api/v1/orders/by-merchant/' . $merchantOrderId);
|
||||||
|
}
|
||||||
|
|
||||||
|
public function closeOrder(string $orderId): array
|
||||||
|
{
|
||||||
|
return $this->request('POST', '/api/v1/orders/' . $orderId . '/close', []);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* ---------- 签名 ---------- */
|
||||||
|
|
||||||
|
public static function signRequest(string $secret, string $ts, string $nonce, string $method, string $path, string $body): string
|
||||||
|
{
|
||||||
|
$sts = $ts . "\n" . $nonce . "\n" . $method . "\n" . $path . "\n" . hash('sha256', $body);
|
||||||
|
return hash_hmac('sha256', $sts, $secret);
|
||||||
|
}
|
||||||
|
|
||||||
|
public static function signCallback(string $secret, string $ts, string $nonce, string $body): string
|
||||||
|
{
|
||||||
|
$sts = $ts . "\n" . $nonce . "\n" . hash('sha256', $body);
|
||||||
|
return hash_hmac('sha256', $sts, $secret);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* 校验网关回调，成功返回回调数组，失败抛 BPayGateException。
|
||||||
|
* $headers 传 getallheaders() 即可（键大小写不敏感）。
|
||||||
|
* 注意：回调可能重复投递，商户须按 merchant_order_id 幂等处理。
|
||||||
|
*/
|
||||||
|
public static function verifyCallback(array $headers, string $body, string $secret, int $maxSkewMs = 300000): array
|
||||||
|
{
|
||||||
|
$h = [];
|
||||||
|
foreach ($headers as $k => $v) {
|
||||||
|
$h[strtolower($k)] = $v;
|
||||||
|
}
|
||||||
|
$ts = $h['x-bpg-timestamp'] ?? '';
|
||||||
|
$nonce = $h['x-bpg-nonce'] ?? '';
|
||||||
|
$sig = $h['x-bpg-signature'] ?? '';
|
||||||
|
if ($ts === '' || $nonce === '' || $sig === '') {
|
||||||
|
throw new BPayGateException('ERR_AUTH', '缺少签名头');
|
||||||
|
}
|
||||||
|
if (!ctype_digit($ts) || abs((int)(microtime(true) * 1000) - (int)$ts) > $maxSkewMs) {
|
||||||
|
throw new BPayGateException('ERR_AUTH', '时间戳非法或偏差过大');
|
||||||
|
}
|
||||||
|
if (!hash_equals(self::signCallback($secret, $ts, $nonce, $body), $sig)) {
|
||||||
|
throw new BPayGateException('ERR_AUTH', '签名错误');
|
||||||
|
}
|
||||||
|
$payload = json_decode($body, true);
|
||||||
|
if (!is_array($payload)) {
|
||||||
|
throw new BPayGateException('ERR_PARAM', '回调体解析失败');
|
||||||
|
}
|
||||||
|
return $payload;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* ---------- 内部 ---------- */
|
||||||
|
|
||||||
|
private function request(string $method, string $path, ?array $payload = null): array
|
||||||
|
{
|
||||||
|
$body = $payload === null ? '' : json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
|
||||||
|
$ts = (string)(int)(microtime(true) * 1000);
|
||||||
|
$nonce = bin2hex(random_bytes(12));
|
||||||
|
$sig = self::signRequest($this->secret, $ts, $nonce, $method, $path, $body);
|
||||||
|
|
||||||
|
$ch = curl_init($this->baseUrl . $path);
|
||||||
|
curl_setopt_array($ch, [
|
||||||
|
CURLOPT_CUSTOMREQUEST => $method,
|
||||||
|
CURLOPT_RETURNTRANSFER => true,
|
||||||
|
CURLOPT_TIMEOUT => $this->timeout,
|
||||||
|
CURLOPT_HTTPHEADER => [
|
||||||
|
'Content-Type: application/json',
|
||||||
|
'X-BPG-Timestamp: ' . $ts,
|
||||||
|
'X-BPG-Nonce: ' . $nonce,
|
||||||
|
'X-BPG-Signature: ' . $sig,
|
||||||
|
],
|
||||||
|
]);
|
||||||
|
if ($body !== '') {
|
||||||
|
curl_setopt($ch, CURLOPT_POSTFIELDS, $body);
|
||||||
|
}
|
||||||
|
$raw = curl_exec($ch);
|
||||||
|
if ($raw === false) {
|
||||||
|
$err = curl_error($ch);
|
||||||
|
curl_close($ch);
|
||||||
|
throw new BPayGateException('ERR_NETWORK', $err);
|
||||||
|
}
|
||||||
|
$status = (int)curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
|
||||||
|
curl_close($ch);
|
||||||
|
|
||||||
|
$out = json_decode($raw, true);
|
||||||
|
if (!is_array($out)) {
|
||||||
|
throw new BPayGateException('ERR_HTTP', 'HTTP ' . $status, $status);
|
||||||
|
}
|
||||||
|
if (($out['code'] ?? '') !== 'OK') {
|
||||||
|
throw new BPayGateException($out['code'] ?? 'ERR_UNKNOWN', $out['message'] ?? '', $status);
|
||||||
|
}
|
||||||
|
return $out['data'];
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
# BinancePayTool PHP SDK
|
||||||
|
|
||||||
|
单文件 `BPayGate.php`，PHP 7.4+，需 curl 扩展。
|
||||||
|
|
||||||
|
```php
|
||||||
|
require 'BPayGate.php';
|
||||||
|
$gw = new BPayGate('https://pay.example.com', '你的API_AUTH_KEY');
|
||||||
|
$order = $gw->createOrder([
|
||||||
|
'merchant_order_id' => 'SHOP-1001',
|
||||||
|
'currency' => 'USDT',
|
||||||
|
'amount' => '10',
|
||||||
|
'callback_url' => 'https://shop.example.com/bpg_notify.php',
|
||||||
|
]);
|
||||||
|
header('Location: ' . $order['pay_url']);
|
||||||
|
```
|
||||||
|
|
||||||
|
回调：`BPayGate::verifyCallback(getallheaders(), file_get_contents('php://input'), $secret)`，
|
||||||
|
通过返回数组、失败抛异常；按 `merchant_order_id` 幂等发货后回 200。
|
||||||
|
完整字段见 [docs/protocol.md](../../docs/protocol.md)。示例：[examples/php](../../examples/php)。
|
||||||
@@ -0,0 +1,48 @@
|
|||||||
|
<?php
|
||||||
|
/* 签名向量测试：php sdk/php/test_vectors.php （CI 中运行） */
|
||||||
|
require __DIR__ . '/BPayGate.php';
|
||||||
|
|
||||||
|
$vf = json_decode(file_get_contents(__DIR__ . '/../../docs/test_vectors.json'), true);
|
||||||
|
if (!$vf) {
|
||||||
|
fwrite(STDERR, "无法读取向量文件\n");
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
$fails = 0;
|
||||||
|
foreach ($vf['cases'] as $i => $c) {
|
||||||
|
if ($c['type'] === 'request') {
|
||||||
|
$got = BPayGate::signRequest($vf['secret'], $c['timestamp'], $c['nonce'], $c['method'], $c['path'], $c['body']);
|
||||||
|
} else {
|
||||||
|
$got = BPayGate::signCallback($vf['secret'], $c['timestamp'], $c['nonce'], $c['body']);
|
||||||
|
}
|
||||||
|
if ($got !== $c['signature']) {
|
||||||
|
fwrite(STDERR, "case $i ({$c['type']}): got $got want {$c['signature']}\n");
|
||||||
|
$fails++;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// verifyCallback 正反例
|
||||||
|
$body = '{"event":"paid","merchant_order_id":"M1"}';
|
||||||
|
$ts = (string)(int)(microtime(true) * 1000);
|
||||||
|
$nonce = str_repeat('n', 20);
|
||||||
|
$sig = BPayGate::signCallback($vf['secret'], $ts, $nonce, $body);
|
||||||
|
$payload = BPayGate::verifyCallback(
|
||||||
|
['X-Bpg-Timestamp' => $ts, 'X-Bpg-Nonce' => $nonce, 'X-Bpg-Signature' => $sig],
|
||||||
|
$body, $vf['secret']
|
||||||
|
);
|
||||||
|
if (($payload['event'] ?? '') !== 'paid') {
|
||||||
|
fwrite(STDERR, "verifyCallback 解析失败\n");
|
||||||
|
$fails++;
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
BPayGate::verifyCallback(
|
||||||
|
['X-Bpg-Timestamp' => $ts, 'X-Bpg-Nonce' => $nonce, 'X-Bpg-Signature' => 'bad'],
|
||||||
|
$body, $vf['secret']
|
||||||
|
);
|
||||||
|
fwrite(STDERR, "坏签名未被拒绝\n");
|
||||||
|
$fails++;
|
||||||
|
} catch (BPayGateException $e) {
|
||||||
|
// 预期
|
||||||
|
}
|
||||||
|
if ($fails > 0) {
|
||||||
|
exit(1);
|
||||||
|
}
|
||||||
|
echo "PHP SDK vectors: ALL PASS\n";
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
# BinancePayTool Python SDK
|
||||||
|
|
||||||
|
仅标准库，Python 3.7+。把 `bpaygate.py` 拷进项目或按路径引入即可。
|
||||||
|
|
||||||
|
```python
|
||||||
|
from bpaygate import BPayGate, BPayGateError
|
||||||
|
|
||||||
|
gw = BPayGate("https://pay.example.com", "你的API_AUTH_KEY")
|
||||||
|
order = gw.create_order("SHOP-1001", "10", currency="USDT",
|
||||||
|
callback_url="https://shop.example.com/bpg/notify")
|
||||||
|
# 跳转用户到 order["pay_url"]
|
||||||
|
|
||||||
|
# 回调（Flask 写法）:
|
||||||
|
payload = BPayGate.verify_callback(request.headers, request.get_data(), SECRET)
|
||||||
|
if payload["event"] == "paid":
|
||||||
|
... # 按 merchant_order_id 幂等发货
|
||||||
|
```
|
||||||
|
|
||||||
|
方法：`create_order` / `get_order` / `get_order_by_merchant_id` / `close_order` / `verify_callback`。
|
||||||
|
完整字段见 [docs/protocol.md](../../docs/protocol.md)。示例：[examples/python](../../examples/python)。
|
||||||
@@ -0,0 +1,133 @@
|
|||||||
|
"""BPayGate Python SDK（仅标准库，Python 3.7+）
|
||||||
|
|
||||||
|
用法:
|
||||||
|
from bpaygate import BPayGate
|
||||||
|
|
||||||
|
gw = BPayGate("https://pay.example.com", "你的API_AUTH_KEY")
|
||||||
|
order = gw.create_order("SHOP-1001", "10", currency="USDT",
|
||||||
|
callback_url="https://shop.example.com/bpg/notify",
|
||||||
|
return_url="https://shop.example.com/orders/1001")
|
||||||
|
# 跳转用户到 order["pay_url"]
|
||||||
|
|
||||||
|
# 回调处理（Flask 示例见 examples/python/app.py）:
|
||||||
|
payload = BPayGate.verify_callback(request.headers, request.get_data(), SECRET)
|
||||||
|
if payload["event"] == "paid": ... # 按 merchant_order_id 幂等发货
|
||||||
|
"""
|
||||||
|
import hashlib
|
||||||
|
import hmac
|
||||||
|
import json
|
||||||
|
import secrets
|
||||||
|
import time
|
||||||
|
import urllib.error
|
||||||
|
import urllib.request
|
||||||
|
|
||||||
|
__all__ = ["BPayGate", "BPayGateError"]
|
||||||
|
|
||||||
|
|
||||||
|
class BPayGateError(Exception):
|
||||||
|
def __init__(self, code, message="", http_status=0):
|
||||||
|
super().__init__(f"{code}: {message}")
|
||||||
|
self.code = code
|
||||||
|
self.message = message
|
||||||
|
self.http_status = http_status
|
||||||
|
|
||||||
|
|
||||||
|
def _sha256_hex(b: bytes) -> str:
|
||||||
|
return hashlib.sha256(b).hexdigest()
|
||||||
|
|
||||||
|
|
||||||
|
def _hmac_hex(secret: str, msg: str) -> str:
|
||||||
|
return hmac.new(secret.encode(), msg.encode(), hashlib.sha256).hexdigest()
|
||||||
|
|
||||||
|
|
||||||
|
def sign_request(secret, timestamp, nonce, method, path, body: bytes) -> str:
|
||||||
|
sts = "\n".join([timestamp, nonce, method, path, _sha256_hex(body)])
|
||||||
|
return _hmac_hex(secret, sts)
|
||||||
|
|
||||||
|
|
||||||
|
def sign_callback(secret, timestamp, nonce, body: bytes) -> str:
|
||||||
|
sts = "\n".join([timestamp, nonce, _sha256_hex(body)])
|
||||||
|
return _hmac_hex(secret, sts)
|
||||||
|
|
||||||
|
|
||||||
|
class BPayGate:
|
||||||
|
def __init__(self, base_url: str, secret: str, timeout: int = 10):
|
||||||
|
self.base_url = base_url.rstrip("/")
|
||||||
|
self.secret = secret
|
||||||
|
self.timeout = timeout
|
||||||
|
|
||||||
|
# ---- API ----
|
||||||
|
|
||||||
|
def create_order(self, merchant_order_id: str, amount: str, currency: str = "USDT",
|
||||||
|
callback_url: str = None, return_url: str = None, timeout: int = None) -> dict:
|
||||||
|
payload = {"merchant_order_id": merchant_order_id, "amount": str(amount), "currency": currency}
|
||||||
|
if callback_url:
|
||||||
|
payload["callback_url"] = callback_url
|
||||||
|
if return_url:
|
||||||
|
payload["return_url"] = return_url
|
||||||
|
if timeout:
|
||||||
|
payload["timeout"] = int(timeout)
|
||||||
|
return self._request("POST", "/api/v1/orders", payload)
|
||||||
|
|
||||||
|
def get_order(self, order_id: str) -> dict:
|
||||||
|
return self._request("GET", "/api/v1/orders/" + order_id)
|
||||||
|
|
||||||
|
def get_order_by_merchant_id(self, merchant_order_id: str) -> dict:
|
||||||
|
return self._request("GET", "/api/v1/orders/by-merchant/" + merchant_order_id)
|
||||||
|
|
||||||
|
def close_order(self, order_id: str) -> dict:
|
||||||
|
return self._request("POST", "/api/v1/orders/" + order_id + "/close", {})
|
||||||
|
|
||||||
|
# ---- 回调验签 ----
|
||||||
|
|
||||||
|
@staticmethod
|
||||||
|
def verify_callback(headers, body: bytes, secret: str, max_skew_ms: int = 300000) -> dict:
|
||||||
|
"""校验网关回调。headers 可传 dict 或任意支持 get 的对象（大小写不敏感）。
|
||||||
|
校验通过返回回调 JSON；失败抛 BPayGateError。商户须按 merchant_order_id 幂等处理。"""
|
||||||
|
def h(name):
|
||||||
|
for k in (name, name.lower(), name.upper()):
|
||||||
|
v = headers.get(k) if hasattr(headers, "get") else None
|
||||||
|
if v:
|
||||||
|
return v
|
||||||
|
return ""
|
||||||
|
ts, nonce, sig = h("X-Bpg-Timestamp") or h("X-BPG-Timestamp"), h("X-Bpg-Nonce") or h("X-BPG-Nonce"), \
|
||||||
|
h("X-Bpg-Signature") or h("X-BPG-Signature")
|
||||||
|
if not ts or not nonce or not sig:
|
||||||
|
raise BPayGateError("ERR_AUTH", "缺少签名头")
|
||||||
|
try:
|
||||||
|
skew = abs(int(time.time() * 1000) - int(ts))
|
||||||
|
except ValueError:
|
||||||
|
raise BPayGateError("ERR_AUTH", "时间戳非法")
|
||||||
|
if skew > max_skew_ms:
|
||||||
|
raise BPayGateError("ERR_AUTH", "时间戳偏差过大")
|
||||||
|
if not isinstance(body, bytes):
|
||||||
|
body = body.encode()
|
||||||
|
if not hmac.compare_digest(sign_callback(secret, ts, nonce, body), sig):
|
||||||
|
raise BPayGateError("ERR_AUTH", "签名错误")
|
||||||
|
return json.loads(body.decode())
|
||||||
|
|
||||||
|
# ---- 内部 ----
|
||||||
|
|
||||||
|
def _request(self, method: str, path: str, payload: dict = None) -> dict:
|
||||||
|
body = json.dumps(payload, separators=(",", ":")).encode() if payload is not None else b""
|
||||||
|
ts = str(int(time.time() * 1000))
|
||||||
|
nonce = secrets.token_hex(12)
|
||||||
|
req = urllib.request.Request(self.base_url + path, data=body if body else None, method=method)
|
||||||
|
req.add_header("Content-Type", "application/json")
|
||||||
|
req.add_header("X-BPG-Timestamp", ts)
|
||||||
|
req.add_header("X-BPG-Nonce", nonce)
|
||||||
|
req.add_header("X-BPG-Signature", sign_request(self.secret, ts, nonce, method, path, body))
|
||||||
|
try:
|
||||||
|
with urllib.request.urlopen(req, timeout=self.timeout) as resp:
|
||||||
|
out = json.loads(resp.read().decode())
|
||||||
|
except urllib.error.HTTPError as e:
|
||||||
|
try:
|
||||||
|
out = json.loads(e.read().decode())
|
||||||
|
except Exception:
|
||||||
|
raise BPayGateError("ERR_HTTP", f"HTTP {e.code}", e.code)
|
||||||
|
raise BPayGateError(out.get("code", "ERR_HTTP"), out.get("message", ""), e.code)
|
||||||
|
except urllib.error.URLError as e:
|
||||||
|
raise BPayGateError("ERR_NETWORK", str(e))
|
||||||
|
if out.get("code") != "OK":
|
||||||
|
raise BPayGateError(out.get("code", "ERR_UNKNOWN"), out.get("message", ""))
|
||||||
|
return out["data"]
|
||||||
@@ -0,0 +1,50 @@
|
|||||||
|
"""签名向量测试：python3 sdk/python/test_bpaygate.py"""
|
||||||
|
import json
|
||||||
|
import os
|
||||||
|
import sys
|
||||||
|
import time
|
||||||
|
import unittest
|
||||||
|
|
||||||
|
sys.path.insert(0, os.path.dirname(__file__))
|
||||||
|
from bpaygate import BPayGate, BPayGateError, sign_callback, sign_request
|
||||||
|
|
||||||
|
VEC = os.path.join(os.path.dirname(__file__), "..", "..", "docs", "test_vectors.json")
|
||||||
|
|
||||||
|
|
||||||
|
class TestVectors(unittest.TestCase):
|
||||||
|
def setUp(self):
|
||||||
|
with open(VEC, encoding="utf-8") as f:
|
||||||
|
self.vf = json.load(f)
|
||||||
|
|
||||||
|
def test_vectors(self):
|
||||||
|
for i, c in enumerate(self.vf["cases"]):
|
||||||
|
if c["type"] == "request":
|
||||||
|
got = sign_request(self.vf["secret"], c["timestamp"], c["nonce"], c["method"], c["path"], c["body"].encode())
|
||||||
|
else:
|
||||||
|
got = sign_callback(self.vf["secret"], c["timestamp"], c["nonce"], c["body"].encode())
|
||||||
|
self.assertEqual(got, c["signature"], f"case {i} ({c['type']})")
|
||||||
|
|
||||||
|
def test_verify_callback(self):
|
||||||
|
secret = self.vf["secret"]
|
||||||
|
body = b'{"event":"paid","merchant_order_id":"M1"}'
|
||||||
|
ts = str(int(time.time() * 1000))
|
||||||
|
nonce = "n" * 20
|
||||||
|
headers = {
|
||||||
|
"X-Bpg-Timestamp": ts,
|
||||||
|
"X-Bpg-Nonce": nonce,
|
||||||
|
"X-Bpg-Signature": sign_callback(secret, ts, nonce, body),
|
||||||
|
}
|
||||||
|
payload = BPayGate.verify_callback(headers, body, secret)
|
||||||
|
self.assertEqual(payload["event"], "paid")
|
||||||
|
headers["X-Bpg-Signature"] = "bad"
|
||||||
|
with self.assertRaises(BPayGateError):
|
||||||
|
BPayGate.verify_callback(headers, body, secret)
|
||||||
|
# 过期时间戳
|
||||||
|
old = {"X-Bpg-Timestamp": "1000000", "X-Bpg-Nonce": nonce,
|
||||||
|
"X-Bpg-Signature": sign_callback(secret, "1000000", nonce, body)}
|
||||||
|
with self.assertRaises(BPayGateError):
|
||||||
|
BPayGate.verify_callback(old, body, secret)
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
unittest.main(verbosity=2)
|
||||||
+280
@@ -0,0 +1,280 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"errors"
|
||||||
|
"io"
|
||||||
|
"log"
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
"sync"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
type App struct {
|
||||||
|
cfg *Config
|
||||||
|
st *Store
|
||||||
|
bc *binanceClient
|
||||||
|
matcher *Matcher
|
||||||
|
notifier *Notifier
|
||||||
|
mux *http.ServeMux
|
||||||
|
|
||||||
|
nonceMu sync.Mutex
|
||||||
|
nonces map[string]int64 // nonce → 过期时间 ms
|
||||||
|
|
||||||
|
rlMu sync.Mutex
|
||||||
|
rl map[string][]int64 // 限流：key → 时间戳窗口
|
||||||
|
}
|
||||||
|
|
||||||
|
func newApp(cfg *Config) (*App, error) {
|
||||||
|
st, err := openStore(cfg.DBPath)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
bc := newBinanceClient(cfg)
|
||||||
|
a := &App{
|
||||||
|
cfg: cfg, st: st, bc: bc,
|
||||||
|
matcher: newMatcher(cfg, st, bc),
|
||||||
|
notifier: newNotifier(cfg, st),
|
||||||
|
nonces: map[string]int64{},
|
||||||
|
rl: map[string][]int64{},
|
||||||
|
}
|
||||||
|
mux := http.NewServeMux()
|
||||||
|
mux.HandleFunc("POST /api/v1/orders", a.auth(a.handleCreate))
|
||||||
|
mux.HandleFunc("GET /api/v1/orders/{id}", a.auth(a.handleGet))
|
||||||
|
mux.HandleFunc("GET /api/v1/orders/by-merchant/{mid}", a.auth(a.handleGetByMerchant))
|
||||||
|
mux.HandleFunc("POST /api/v1/orders/{id}/close", a.auth(a.handleClose))
|
||||||
|
mux.HandleFunc("GET /pay/{token}", a.handleCashier)
|
||||||
|
mux.HandleFunc("GET /pay/{token}/status", a.handleStatus)
|
||||||
|
mux.HandleFunc("POST /pay/{token}/claim", a.handleClaim)
|
||||||
|
mux.HandleFunc("GET /pay/{token}/qr", a.handleQR)
|
||||||
|
mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
writeJSON(w, 200, map[string]any{"ok": true, "version": version})
|
||||||
|
})
|
||||||
|
mux.HandleFunc("GET /{$}", func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
w.Header().Set("Content-Type", "text/plain; charset=utf-8")
|
||||||
|
w.Write([]byte("BinancePayTool " + version + " running\n"))
|
||||||
|
})
|
||||||
|
a.mux = mux
|
||||||
|
return a, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func writeJSON(w http.ResponseWriter, status int, v any) {
|
||||||
|
w.Header().Set("Content-Type", "application/json; charset=utf-8")
|
||||||
|
w.WriteHeader(status)
|
||||||
|
json.NewEncoder(w).Encode(v)
|
||||||
|
}
|
||||||
|
|
||||||
|
func ok(w http.ResponseWriter, data any) {
|
||||||
|
writeJSON(w, 200, map[string]any{"code": "OK", "data": data})
|
||||||
|
}
|
||||||
|
|
||||||
|
func fail(w http.ResponseWriter, status int, code, msg string) {
|
||||||
|
writeJSON(w, status, map[string]any{"code": code, "message": msg})
|
||||||
|
}
|
||||||
|
|
||||||
|
// auth 校验商户请求签名（docs/protocol.md §1.1）。
|
||||||
|
func (a *App) auth(next func(http.ResponseWriter, *http.Request, []byte)) http.HandlerFunc {
|
||||||
|
return func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
|
||||||
|
if err != nil {
|
||||||
|
fail(w, 400, "ERR_PARAM", "读取请求体失败")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
ts := r.Header.Get("X-BPG-Timestamp")
|
||||||
|
nonce := r.Header.Get("X-BPG-Nonce")
|
||||||
|
sig := r.Header.Get("X-BPG-Signature")
|
||||||
|
if ts == "" || len(nonce) < 16 || sig == "" {
|
||||||
|
fail(w, 401, "ERR_AUTH", "缺少签名头")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
tsv, err := strconv.ParseInt(ts, 10, 64)
|
||||||
|
if err != nil || tsv < nowMs()-300000 || tsv > nowMs()+300000 {
|
||||||
|
fail(w, 401, "ERR_AUTH", "时间戳无效或偏差过大")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
expect := signRequest(a.cfg.APIAuthKey, ts, nonce, r.Method, r.URL.Path, body)
|
||||||
|
if !sigEqual(expect, sig) {
|
||||||
|
fail(w, 401, "ERR_AUTH", "签名错误")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
a.nonceMu.Lock()
|
||||||
|
now := nowMs()
|
||||||
|
if len(a.nonces) > 10000 {
|
||||||
|
for k, exp := range a.nonces {
|
||||||
|
if exp < now {
|
||||||
|
delete(a.nonces, k)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if exp, seen := a.nonces[nonce]; seen && exp > now {
|
||||||
|
a.nonceMu.Unlock()
|
||||||
|
fail(w, 401, "ERR_AUTH", "nonce 重复")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
a.nonces[nonce] = now + 300000
|
||||||
|
a.nonceMu.Unlock()
|
||||||
|
next(w, r, body)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// allow 简单滑动窗口限流。
|
||||||
|
func (a *App) allow(key string, max int, windowSec int64) bool {
|
||||||
|
a.rlMu.Lock()
|
||||||
|
defer a.rlMu.Unlock()
|
||||||
|
now := nowMs()
|
||||||
|
lo := now - windowSec*1000
|
||||||
|
win := a.rl[key]
|
||||||
|
var kept []int64
|
||||||
|
for _, t := range win {
|
||||||
|
if t >= lo {
|
||||||
|
kept = append(kept, t)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if len(kept) >= max {
|
||||||
|
a.rl[key] = kept
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
a.rl[key] = append(kept, now)
|
||||||
|
return true
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *App) orderJSON(o *Order) map[string]any {
|
||||||
|
actual := ""
|
||||||
|
if o.ActualAmount > 0 {
|
||||||
|
actual = fmtAmount(o.ActualAmount)
|
||||||
|
}
|
||||||
|
return map[string]any{
|
||||||
|
"order_id": o.ID,
|
||||||
|
"merchant_order_id": o.MerchantOrderID,
|
||||||
|
"status": o.Status,
|
||||||
|
"currency": o.Currency,
|
||||||
|
"base_amount": fmtAmount(o.BaseAmount),
|
||||||
|
"pay_amount": fmtAmount(o.PayAmount),
|
||||||
|
"actual_amount": actual,
|
||||||
|
"note_code": o.NoteCode,
|
||||||
|
"pay_url": a.cfg.BaseURL + "/pay/" + o.Token,
|
||||||
|
"receive_uid": a.cfg.BinanceUID,
|
||||||
|
"matched_by": o.MatchedBy,
|
||||||
|
"binance_order_id": o.BinanceOrderID,
|
||||||
|
"binance_txn_id": o.BinanceTxnID,
|
||||||
|
"payer_id": o.PayerID,
|
||||||
|
"overpaid": o.Overpaid,
|
||||||
|
"created_at": o.CreatedAt,
|
||||||
|
"expires_at": o.ExpiresAt,
|
||||||
|
"paid_at": o.PaidAt,
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
type createReq struct {
|
||||||
|
MerchantOrderID string `json:"merchant_order_id"`
|
||||||
|
Currency string `json:"currency"`
|
||||||
|
Amount string `json:"amount"`
|
||||||
|
CallbackURL string `json:"callback_url"`
|
||||||
|
ReturnURL string `json:"return_url"`
|
||||||
|
Timeout int64 `json:"timeout"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *App) handleCreate(w http.ResponseWriter, r *http.Request, body []byte) {
|
||||||
|
var req createReq
|
||||||
|
if err := json.Unmarshal(body, &req); err != nil {
|
||||||
|
fail(w, 400, "ERR_PARAM", "JSON 解析失败")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
req.MerchantOrderID = strings.TrimSpace(req.MerchantOrderID)
|
||||||
|
if req.MerchantOrderID == "" || len(req.MerchantOrderID) > 64 {
|
||||||
|
fail(w, 400, "ERR_PARAM", "merchant_order_id 必填且 ≤64 字符")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
cur := strings.ToUpper(strings.TrimSpace(req.Currency))
|
||||||
|
if !a.cfg.Currencies[cur] {
|
||||||
|
fail(w, 400, "ERR_PARAM", "currency 不在允许列表内")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
base, err := parseAmount(req.Amount)
|
||||||
|
if err != nil || base <= 0 {
|
||||||
|
fail(w, 400, "ERR_PARAM", "amount 非法")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if decimalsOf(base) > a.cfg.AmountDecimals {
|
||||||
|
fail(w, 400, "ERR_PARAM", "amount 小数位超过网关 AMOUNT_DECIMALS")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
ttl := req.Timeout
|
||||||
|
if ttl == 0 {
|
||||||
|
ttl = a.cfg.OrderTTL
|
||||||
|
}
|
||||||
|
if ttl < 120 || ttl > 86400 {
|
||||||
|
fail(w, 400, "ERR_PARAM", "timeout 须在 120~86400 秒之间")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
o, err := a.st.CreateOrder(a.cfg, req.MerchantOrderID, cur, base, ttl, req.CallbackURL, req.ReturnURL)
|
||||||
|
if errors.Is(err, ErrDuplicate) {
|
||||||
|
fail(w, 409, "ERR_DUPLICATE", "merchant_order_id 已存在")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if errors.Is(err, ErrAlloc) {
|
||||||
|
fail(w, 503, "ERR_ALLOC", "该金额档位唯一尾数已耗尽，请稍后或换金额")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("[error] 创建订单失败: %v", err)
|
||||||
|
fail(w, 500, "ERR_INTERNAL", "内部错误")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
log.Printf("[info] 新订单 %s %s %s 应付 %s", o.ID, o.Currency, fmtAmount(o.BaseAmount), fmtAmount(o.PayAmount))
|
||||||
|
ok(w, a.orderJSON(o))
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *App) handleGet(w http.ResponseWriter, r *http.Request, _ []byte) {
|
||||||
|
o, err := a.st.OrderByID(r.PathValue("id"))
|
||||||
|
if errors.Is(err, ErrNotFound) {
|
||||||
|
fail(w, 404, "ERR_NOT_FOUND", "订单不存在")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
fail(w, 500, "ERR_INTERNAL", "内部错误")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
ok(w, a.orderJSON(o))
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *App) handleGetByMerchant(w http.ResponseWriter, r *http.Request, _ []byte) {
|
||||||
|
o, err := a.st.OrderByMerchantID(r.PathValue("mid"))
|
||||||
|
if errors.Is(err, ErrNotFound) {
|
||||||
|
fail(w, 404, "ERR_NOT_FOUND", "订单不存在")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
fail(w, 500, "ERR_INTERNAL", "内部错误")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
ok(w, a.orderJSON(o))
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *App) handleClose(w http.ResponseWriter, r *http.Request, _ []byte) {
|
||||||
|
o, err := a.st.CloseOrder(r.PathValue("id"), a.cfg.SuffixCooldown)
|
||||||
|
if errors.Is(err, ErrNotFound) {
|
||||||
|
fail(w, 404, "ERR_NOT_FOUND", "订单不存在")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if errors.Is(err, ErrState) {
|
||||||
|
fail(w, 409, "ERR_STATE", "仅待支付订单可关闭")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
fail(w, 500, "ERR_INTERNAL", "内部错误")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
ok(w, a.orderJSON(o))
|
||||||
|
}
|
||||||
|
|
||||||
|
func clientIP(r *http.Request) string {
|
||||||
|
if i := strings.LastIndex(r.RemoteAddr, ":"); i > 0 {
|
||||||
|
return r.RemoteAddr[:i]
|
||||||
|
}
|
||||||
|
return r.RemoteAddr
|
||||||
|
}
|
||||||
|
|
||||||
|
var _ = time.Now
|
||||||
@@ -0,0 +1,96 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"strconv"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// payTxn 对应 GET /sapi/v1/pay/transactions 返回的一条流水。
|
||||||
|
// 字段以 2026-09-02 真实账号实测为准（文档缺 orderId/note/counterpartyId，实测存在）。
|
||||||
|
type payTxn struct {
|
||||||
|
OrderID string `json:"orderId"` // 18 位数字，付款方 App 显示的「订单编号」
|
||||||
|
Note string `json:"note"` // 付款方备注，可能缺省
|
||||||
|
OrderType string `json:"orderType"` // C2C / PAYOUT / ...
|
||||||
|
TransactionID string `json:"transactionId"` // P_xxxxxxxxxxxxxxxx
|
||||||
|
Time int64 `json:"transactionTime"`
|
||||||
|
Amount string `json:"amount"` // 收款为正、付款为负
|
||||||
|
Currency string `json:"currency"`
|
||||||
|
CounterpartyID int64 `json:"counterpartyId"`
|
||||||
|
PayerInfo struct {
|
||||||
|
Name string `json:"name"`
|
||||||
|
BinanceID int64 `json:"binanceId"`
|
||||||
|
} `json:"payerInfo"`
|
||||||
|
}
|
||||||
|
|
||||||
|
type binanceClient struct {
|
||||||
|
base string
|
||||||
|
key string
|
||||||
|
secret string
|
||||||
|
hc *http.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
func newBinanceClient(cfg *Config) *binanceClient {
|
||||||
|
return &binanceClient{
|
||||||
|
base: cfg.BinanceAPIBase,
|
||||||
|
key: cfg.BinanceKey,
|
||||||
|
secret: cfg.BinanceSecret,
|
||||||
|
hc: &http.Client{Timeout: 15 * time.Second},
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// PayTransactions 拉取 Pay 流水（签名 GET）。limit 上限 100，接口权重 3000/UID。
|
||||||
|
func (b *binanceClient) PayTransactions(startMs, endMs int64, limit int) ([]payTxn, error) {
|
||||||
|
q := url.Values{}
|
||||||
|
q.Set("timestamp", strconv.FormatInt(nowMs(), 10))
|
||||||
|
q.Set("recvWindow", "10000")
|
||||||
|
q.Set("limit", strconv.Itoa(limit))
|
||||||
|
if startMs > 0 {
|
||||||
|
q.Set("startTime", strconv.FormatInt(startMs, 10))
|
||||||
|
}
|
||||||
|
if endMs > 0 {
|
||||||
|
q.Set("endTime", strconv.FormatInt(endMs, 10))
|
||||||
|
}
|
||||||
|
enc := q.Encode()
|
||||||
|
sig := hmacHex(b.secret, enc)
|
||||||
|
req, err := http.NewRequest("GET", b.base+"/sapi/v1/pay/transactions?"+enc+"&signature="+sig, nil)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
req.Header.Set("X-MBX-APIKEY", b.key)
|
||||||
|
resp, err := b.hc.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if resp.StatusCode != 200 {
|
||||||
|
return nil, fmt.Errorf("binance HTTP %d: %s", resp.StatusCode, truncate(string(body), 300))
|
||||||
|
}
|
||||||
|
var env struct {
|
||||||
|
Data []payTxn `json:"data"`
|
||||||
|
Success bool `json:"success"`
|
||||||
|
Message string `json:"message"`
|
||||||
|
}
|
||||||
|
if err := json.Unmarshal(body, &env); err != nil {
|
||||||
|
return nil, fmt.Errorf("binance 响应解析失败: %w", err)
|
||||||
|
}
|
||||||
|
if !env.Success {
|
||||||
|
return nil, fmt.Errorf("binance 返回失败: %s", truncate(string(body), 300))
|
||||||
|
}
|
||||||
|
return env.Data, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func truncate(s string, n int) string {
|
||||||
|
if len(s) <= n {
|
||||||
|
return s
|
||||||
|
}
|
||||||
|
return s[:n] + "..."
|
||||||
|
}
|
||||||
@@ -0,0 +1,123 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"context"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"log"
|
||||||
|
"net/http"
|
||||||
|
"strconv"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
var cbSchedule = []int64{0, 15, 60, 300, 900, 3600, 10800} // 秒
|
||||||
|
|
||||||
|
type Notifier struct {
|
||||||
|
cfg *Config
|
||||||
|
st *Store
|
||||||
|
hc *http.Client
|
||||||
|
}
|
||||||
|
|
||||||
|
func newNotifier(cfg *Config, st *Store) *Notifier {
|
||||||
|
return &Notifier{cfg: cfg, st: st, hc: &http.Client{Timeout: 10 * time.Second}}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *Notifier) run(ctx context.Context) {
|
||||||
|
t := time.NewTicker(500 * time.Millisecond)
|
||||||
|
defer t.Stop()
|
||||||
|
for {
|
||||||
|
select {
|
||||||
|
case <-ctx.Done():
|
||||||
|
return
|
||||||
|
case <-t.C:
|
||||||
|
jobs, err := n.st.DueCallbacks(10)
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("[error] 读取回调队列失败: %v", err)
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
for _, j := range jobs {
|
||||||
|
n.deliver(j)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func callbackPayload(o *Order, event string) ([]byte, error) {
|
||||||
|
actual := ""
|
||||||
|
if o.ActualAmount > 0 {
|
||||||
|
actual = fmtAmount(o.ActualAmount)
|
||||||
|
}
|
||||||
|
p := map[string]any{
|
||||||
|
"event": event,
|
||||||
|
"order_id": o.ID,
|
||||||
|
"merchant_order_id": o.MerchantOrderID,
|
||||||
|
"status": o.Status,
|
||||||
|
"currency": o.Currency,
|
||||||
|
"base_amount": fmtAmount(o.BaseAmount),
|
||||||
|
"pay_amount": fmtAmount(o.PayAmount),
|
||||||
|
"actual_amount": actual,
|
||||||
|
"overpaid": o.Overpaid,
|
||||||
|
"matched_by": o.MatchedBy,
|
||||||
|
"binance_order_id": o.BinanceOrderID,
|
||||||
|
"binance_txn_id": o.BinanceTxnID,
|
||||||
|
"payer_id": o.PayerID,
|
||||||
|
"paid_at": o.PaidAt,
|
||||||
|
"timestamp": nowMs(),
|
||||||
|
}
|
||||||
|
return json.Marshal(p)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *Notifier) deliver(j cbJob) {
|
||||||
|
o, err := n.st.OrderByID(j.OrderID)
|
||||||
|
if err != nil {
|
||||||
|
log.Printf("[error] 回调找不到订单 %s: %v", j.OrderID, err)
|
||||||
|
n.st.CallbackDone(j.ID)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if o.CallbackURL == "" {
|
||||||
|
n.st.CallbackDone(j.ID)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
body, err := callbackPayload(o, j.Event)
|
||||||
|
if err != nil {
|
||||||
|
n.st.CallbackDone(j.ID)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
ts := strconv.FormatInt(nowMs(), 10)
|
||||||
|
nonce := newNonce()
|
||||||
|
req, err := http.NewRequest("POST", o.CallbackURL, bytes.NewReader(body))
|
||||||
|
if err != nil {
|
||||||
|
n.retry(j, fmt.Sprintf("bad url: %v", err))
|
||||||
|
return
|
||||||
|
}
|
||||||
|
req.Header.Set("Content-Type", "application/json")
|
||||||
|
req.Header.Set("X-BPG-Timestamp", ts)
|
||||||
|
req.Header.Set("X-BPG-Nonce", nonce)
|
||||||
|
req.Header.Set("X-BPG-Signature", signCallback(n.cfg.APIAuthKey, ts, nonce, body))
|
||||||
|
resp, err := n.hc.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
n.retry(j, err.Error())
|
||||||
|
return
|
||||||
|
}
|
||||||
|
io.Copy(io.Discard, io.LimitReader(resp.Body, 4096))
|
||||||
|
resp.Body.Close()
|
||||||
|
if resp.StatusCode >= 200 && resp.StatusCode < 300 {
|
||||||
|
n.st.CallbackDone(j.ID)
|
||||||
|
log.Printf("[info] 回调成功 order=%s event=%s → %s", o.ID, j.Event, o.CallbackURL)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
n.retry(j, fmt.Sprintf("HTTP %d", resp.StatusCode))
|
||||||
|
}
|
||||||
|
|
||||||
|
func (n *Notifier) retry(j cbJob, errStr string) {
|
||||||
|
next := j.Attempt + 1
|
||||||
|
if next >= len(cbSchedule) {
|
||||||
|
n.st.CallbackRetry(j.ID, next, 0, errStr, true)
|
||||||
|
log.Printf("[warn] 回调放弃 order=%s attempts=%d lastErr=%s", j.OrderID, next, errStr)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
n.st.CallbackRetry(j.ID, next, nowMs()+cbSchedule[next]*1000, errStr, false)
|
||||||
|
log.Printf("[warn] 回调失败将重试 order=%s attempt=%d err=%s", j.OrderID, next, errStr)
|
||||||
|
}
|
||||||
@@ -0,0 +1,118 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
_ "embed"
|
||||||
|
"encoding/json"
|
||||||
|
"errors"
|
||||||
|
"html/template"
|
||||||
|
"net/http"
|
||||||
|
"net/url"
|
||||||
|
"regexp"
|
||||||
|
"strings"
|
||||||
|
)
|
||||||
|
|
||||||
|
//go:embed templates/cashier.html
|
||||||
|
var cashierHTML string
|
||||||
|
|
||||||
|
var cashierTpl = template.Must(template.New("cashier").Parse(cashierHTML))
|
||||||
|
|
||||||
|
var reBinanceOrderID = regexp.MustCompile(`^[0-9]{6,20}$`)
|
||||||
|
|
||||||
|
func (a *App) handleCashier(w http.ResponseWriter, r *http.Request) {
|
||||||
|
o, err := a.st.OrderByToken(r.PathValue("token"))
|
||||||
|
if errors.Is(err, ErrNotFound) {
|
||||||
|
http.NotFound(w, r)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
http.Error(w, "internal error", 500)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
||||||
|
cashierTpl.Execute(w, map[string]any{
|
||||||
|
"PayAmount": fmtAmount(o.PayAmount),
|
||||||
|
"Currency": o.Currency,
|
||||||
|
"UID": a.cfg.BinanceUID,
|
||||||
|
"Email": a.cfg.ReceiveEmail,
|
||||||
|
"HasQR": a.cfg.QRImage != "",
|
||||||
|
"NoteCode": o.NoteCode,
|
||||||
|
"ExpiresAt": o.ExpiresAt,
|
||||||
|
"Token": o.Token,
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *App) redirectURL(o *Order) string {
|
||||||
|
if o.ReturnURL == "" || o.Status != "paid" {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
sep := "?"
|
||||||
|
if strings.Contains(o.ReturnURL, "?") {
|
||||||
|
sep = "&"
|
||||||
|
}
|
||||||
|
return o.ReturnURL + sep + "order_id=" + url.QueryEscape(o.ID) +
|
||||||
|
"&merchant_order_id=" + url.QueryEscape(o.MerchantOrderID) + "&status=paid"
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *App) handleStatus(w http.ResponseWriter, r *http.Request) {
|
||||||
|
o, err := a.st.OrderByToken(r.PathValue("token"))
|
||||||
|
if errors.Is(err, ErrNotFound) {
|
||||||
|
http.NotFound(w, r)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
http.Error(w, "internal error", 500)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
writeJSON(w, 200, map[string]any{
|
||||||
|
"status": o.Status,
|
||||||
|
"paid_at": o.PaidAt,
|
||||||
|
"redirect": a.redirectURL(o),
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *App) handleClaim(w http.ResponseWriter, r *http.Request) {
|
||||||
|
tok := r.PathValue("token")
|
||||||
|
o, err := a.st.OrderByToken(tok)
|
||||||
|
if errors.Is(err, ErrNotFound) {
|
||||||
|
http.NotFound(w, r)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
fail(w, 500, "ERR_INTERNAL", "内部错误")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if !a.allow("claim:"+tok, 5, 60) || !a.allow("claimip:"+clientIP(r), 20, 60) {
|
||||||
|
fail(w, 429, "ERR_RATE_LIMIT", "操作过于频繁")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
var req struct {
|
||||||
|
BinanceOrderID string `json:"binance_order_id"`
|
||||||
|
}
|
||||||
|
if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4096)).Decode(&req); err != nil {
|
||||||
|
fail(w, 400, "ERR_PARAM", "JSON 解析失败")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
req.BinanceOrderID = strings.TrimSpace(req.BinanceOrderID)
|
||||||
|
if !reBinanceOrderID.MatchString(req.BinanceOrderID) {
|
||||||
|
fail(w, 400, "ERR_PARAM", "订单编号格式错误")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
res, err := a.matcher.Claim(o, req.BinanceOrderID)
|
||||||
|
if err != nil {
|
||||||
|
fail(w, 502, "ERR_INTERNAL", "查询币安流水失败，请稍后再试")
|
||||||
|
return
|
||||||
|
}
|
||||||
|
ok(w, map[string]any{"code": res.Code, "status": res.Status})
|
||||||
|
}
|
||||||
|
|
||||||
|
func (a *App) handleQR(w http.ResponseWriter, r *http.Request) {
|
||||||
|
if a.cfg.QRImage == "" {
|
||||||
|
http.NotFound(w, r)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if _, err := a.st.OrderByToken(r.PathValue("token")); err != nil {
|
||||||
|
http.NotFound(w, r)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
http.ServeFile(w, r, a.cfg.QRImage)
|
||||||
|
}
|
||||||
@@ -0,0 +1,121 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
)
|
||||||
|
|
||||||
|
type Config struct {
|
||||||
|
Listen string
|
||||||
|
BaseURL string
|
||||||
|
APIAuthKey string
|
||||||
|
BinanceKey string
|
||||||
|
BinanceSecret string
|
||||||
|
BinanceUID string
|
||||||
|
BinanceAPIBase string
|
||||||
|
QRImage string
|
||||||
|
ReceiveEmail string
|
||||||
|
Currencies map[string]bool
|
||||||
|
OrderTTL int64 // 秒
|
||||||
|
ExpiredGrace int64 // 秒
|
||||||
|
SuffixCooldown int64 // 秒
|
||||||
|
PollInterval int64 // 秒
|
||||||
|
AmountDecimals int
|
||||||
|
SuffixMode string
|
||||||
|
DBPath string
|
||||||
|
LogLevel string
|
||||||
|
}
|
||||||
|
|
||||||
|
func loadConfig(path string) (*Config, error) {
|
||||||
|
vals := map[string]string{}
|
||||||
|
if path != "" {
|
||||||
|
data, err := os.ReadFile(path)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("读取配置 %s: %w", path, err)
|
||||||
|
}
|
||||||
|
for _, line := range strings.Split(string(data), "\n") {
|
||||||
|
line = strings.TrimSpace(line)
|
||||||
|
if line == "" || strings.HasPrefix(line, "#") {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
kv := strings.SplitN(line, "=", 2)
|
||||||
|
if len(kv) != 2 {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
vals[strings.TrimSpace(kv[0])] = strings.TrimSpace(kv[1])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
get := func(k, def string) string {
|
||||||
|
if v, ok := os.LookupEnv(k); ok && v != "" {
|
||||||
|
return v
|
||||||
|
}
|
||||||
|
if v, ok := vals[k]; ok && v != "" {
|
||||||
|
return v
|
||||||
|
}
|
||||||
|
return def
|
||||||
|
}
|
||||||
|
getInt := func(k string, def int64) int64 {
|
||||||
|
s := get(k, "")
|
||||||
|
if s == "" {
|
||||||
|
return def
|
||||||
|
}
|
||||||
|
n, err := strconv.ParseInt(s, 10, 64)
|
||||||
|
if err != nil {
|
||||||
|
return def
|
||||||
|
}
|
||||||
|
return n
|
||||||
|
}
|
||||||
|
c := &Config{
|
||||||
|
Listen: get("LISTEN", "0.0.0.0:8080"),
|
||||||
|
BaseURL: strings.TrimRight(get("BASE_URL", "http://127.0.0.1:8080"), "/"),
|
||||||
|
APIAuthKey: get("API_AUTH_KEY", ""),
|
||||||
|
BinanceKey: get("BINANCE_API_KEY", ""),
|
||||||
|
BinanceSecret: get("BINANCE_API_SECRET", ""),
|
||||||
|
BinanceUID: get("BINANCE_UID", ""),
|
||||||
|
BinanceAPIBase: strings.TrimRight(get("BINANCE_API_BASE", "https://api.binance.com"), "/"),
|
||||||
|
QRImage: get("QR_IMAGE", ""),
|
||||||
|
ReceiveEmail: get("RECEIVE_EMAIL", ""),
|
||||||
|
Currencies: map[string]bool{},
|
||||||
|
OrderTTL: getInt("ORDER_TTL", 900),
|
||||||
|
ExpiredGrace: getInt("EXPIRED_GRACE", 1800),
|
||||||
|
SuffixCooldown: getInt("SUFFIX_COOLDOWN", 86400),
|
||||||
|
PollInterval: getInt("POLL_INTERVAL", 4),
|
||||||
|
AmountDecimals: int(getInt("AMOUNT_DECIMALS", 4)),
|
||||||
|
SuffixMode: get("SUFFIX_MODE", "add"),
|
||||||
|
DBPath: get("DB_PATH", "./bpaygate.db"),
|
||||||
|
LogLevel: strings.ToLower(get("LOG_LEVEL", "info")),
|
||||||
|
}
|
||||||
|
for _, cur := range strings.Split(get("CURRENCIES", "USDT,USDC"), ",") {
|
||||||
|
cur = strings.ToUpper(strings.TrimSpace(cur))
|
||||||
|
if cur != "" {
|
||||||
|
c.Currencies[cur] = true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if len(c.APIAuthKey) < 16 {
|
||||||
|
return nil, errors.New("API_AUTH_KEY 未设置或过短（≥16 字符，可用 ./bpaygate -gen-key 生成）")
|
||||||
|
}
|
||||||
|
if c.BinanceKey == "" || c.BinanceSecret == "" {
|
||||||
|
return nil, errors.New("BINANCE_API_KEY / BINANCE_API_SECRET 未设置（只读权限即可）")
|
||||||
|
}
|
||||||
|
if c.BinanceUID == "" {
|
||||||
|
return nil, errors.New("BINANCE_UID 未设置")
|
||||||
|
}
|
||||||
|
if c.AmountDecimals < 2 || c.AmountDecimals > 8 {
|
||||||
|
return nil, errors.New("AMOUNT_DECIMALS 须在 2~8 之间")
|
||||||
|
}
|
||||||
|
if c.SuffixMode != "add" && c.SuffixMode != "sub" {
|
||||||
|
return nil, errors.New("SUFFIX_MODE 只能是 add 或 sub")
|
||||||
|
}
|
||||||
|
if c.PollInterval < 1 {
|
||||||
|
c.PollInterval = 1
|
||||||
|
}
|
||||||
|
if c.QRImage != "" {
|
||||||
|
if _, err := os.Stat(c.QRImage); err != nil {
|
||||||
|
return nil, fmt.Errorf("QR_IMAGE 文件不存在: %s", c.QRImage)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return c, nil
|
||||||
|
}
|
||||||
@@ -0,0 +1,339 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"context"
|
||||||
|
"encoding/json"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"net/http"
|
||||||
|
"net/http/httptest"
|
||||||
|
"strconv"
|
||||||
|
"sync"
|
||||||
|
"testing"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
const testSecret = "test-secret-0123456789abcdef"
|
||||||
|
|
||||||
|
// ---- mock 币安 ----
|
||||||
|
|
||||||
|
type mockBinance struct {
|
||||||
|
mu sync.Mutex
|
||||||
|
txns []payTxn
|
||||||
|
srv *httptest.Server
|
||||||
|
}
|
||||||
|
|
||||||
|
func newMockBinance() *mockBinance {
|
||||||
|
m := &mockBinance{}
|
||||||
|
mux := http.NewServeMux()
|
||||||
|
mux.HandleFunc("/sapi/v1/pay/transactions", func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
m.mu.Lock()
|
||||||
|
defer m.mu.Unlock()
|
||||||
|
writeJSON(w, 200, map[string]any{"code": "000000", "message": "success", "data": m.txns, "success": true})
|
||||||
|
})
|
||||||
|
m.srv = httptest.NewServer(mux)
|
||||||
|
return m
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *mockBinance) inject(t payTxn) {
|
||||||
|
m.mu.Lock()
|
||||||
|
defer m.mu.Unlock()
|
||||||
|
m.txns = append(m.txns, t)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---- 商户回调接收器 ----
|
||||||
|
|
||||||
|
type cbRecv struct {
|
||||||
|
body []byte
|
||||||
|
headers http.Header
|
||||||
|
}
|
||||||
|
|
||||||
|
func newCallbackServer(ch chan cbRecv) *httptest.Server {
|
||||||
|
return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||||
|
body, _ := io.ReadAll(r.Body)
|
||||||
|
ch <- cbRecv{body: body, headers: r.Header.Clone()}
|
||||||
|
w.WriteHeader(200)
|
||||||
|
}))
|
||||||
|
}
|
||||||
|
|
||||||
|
// ---- 测试环境 ----
|
||||||
|
|
||||||
|
type env struct {
|
||||||
|
t *testing.T
|
||||||
|
app *App
|
||||||
|
srv *httptest.Server
|
||||||
|
mock *mockBinance
|
||||||
|
cbCh chan cbRecv
|
||||||
|
cbS *httptest.Server
|
||||||
|
}
|
||||||
|
|
||||||
|
func newEnv(t *testing.T) *env {
|
||||||
|
mock := newMockBinance()
|
||||||
|
cfg := &Config{
|
||||||
|
Listen: "127.0.0.1:0", BaseURL: "http://gw.test", APIAuthKey: testSecret,
|
||||||
|
BinanceKey: "k", BinanceSecret: "s", BinanceUID: "90000001",
|
||||||
|
BinanceAPIBase: mock.srv.URL,
|
||||||
|
Currencies: map[string]bool{"USDT": true, "USDC": true},
|
||||||
|
OrderTTL: 900, ExpiredGrace: 1800, SuffixCooldown: 86400, PollInterval: 1,
|
||||||
|
AmountDecimals: 4, SuffixMode: "add",
|
||||||
|
DBPath: t.TempDir() + "/test.db", LogLevel: "info",
|
||||||
|
}
|
||||||
|
app, err := newApp(cfg)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("newApp: %v", err)
|
||||||
|
}
|
||||||
|
srv := httptest.NewServer(app.mux)
|
||||||
|
ctx, cancel := context.WithCancel(context.Background())
|
||||||
|
go app.matcher.run(ctx)
|
||||||
|
go app.notifier.run(ctx)
|
||||||
|
ch := make(chan cbRecv, 16)
|
||||||
|
cbS := newCallbackServer(ch)
|
||||||
|
e := &env{t: t, app: app, srv: srv, mock: mock, cbCh: ch, cbS: cbS}
|
||||||
|
t.Cleanup(func() {
|
||||||
|
cancel()
|
||||||
|
srv.Close()
|
||||||
|
cbS.Close()
|
||||||
|
mock.srv.Close()
|
||||||
|
app.st.Close()
|
||||||
|
})
|
||||||
|
return e
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e *env) doSigned(method, path string, body []byte) (int, map[string]any) {
|
||||||
|
ts := strconv.FormatInt(nowMs(), 10)
|
||||||
|
nonce := newNonce()
|
||||||
|
req, _ := http.NewRequest(method, e.srv.URL+path, bytes.NewReader(body))
|
||||||
|
req.Header.Set("Content-Type", "application/json")
|
||||||
|
req.Header.Set("X-BPG-Timestamp", ts)
|
||||||
|
req.Header.Set("X-BPG-Nonce", nonce)
|
||||||
|
req.Header.Set("X-BPG-Signature", signRequest(testSecret, ts, nonce, method, path, body))
|
||||||
|
resp, err := http.DefaultClient.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
e.t.Fatalf("%s %s: %v", method, path, err)
|
||||||
|
}
|
||||||
|
defer resp.Body.Close()
|
||||||
|
var out map[string]any
|
||||||
|
json.NewDecoder(resp.Body).Decode(&out)
|
||||||
|
return resp.StatusCode, out
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e *env) create(mid, currency, amount, cb string) map[string]any {
|
||||||
|
body, _ := json.Marshal(map[string]any{
|
||||||
|
"merchant_order_id": mid, "currency": currency, "amount": amount, "callback_url": cb,
|
||||||
|
})
|
||||||
|
code, out := e.doSigned("POST", "/api/v1/orders", body)
|
||||||
|
if code != 200 {
|
||||||
|
e.t.Fatalf("创建订单失败 %d: %v", code, out)
|
||||||
|
}
|
||||||
|
return out["data"].(map[string]any)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e *env) waitStatus(orderID, want string, timeout time.Duration) map[string]any {
|
||||||
|
deadline := time.Now().Add(timeout)
|
||||||
|
for time.Now().Before(deadline) {
|
||||||
|
code, out := e.doSigned("GET", "/api/v1/orders/"+orderID, nil)
|
||||||
|
if code == 200 {
|
||||||
|
d := out["data"].(map[string]any)
|
||||||
|
if d["status"] == want {
|
||||||
|
return d
|
||||||
|
}
|
||||||
|
}
|
||||||
|
time.Sleep(200 * time.Millisecond)
|
||||||
|
}
|
||||||
|
e.t.Fatalf("订单 %s 未在 %v 内达到状态 %s", orderID, timeout, want)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (e *env) waitCallback(timeout time.Duration) cbRecv {
|
||||||
|
select {
|
||||||
|
case r := <-e.cbCh:
|
||||||
|
return r
|
||||||
|
case <-time.After(timeout):
|
||||||
|
e.t.Fatal("等待回调超时")
|
||||||
|
return cbRecv{}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
var txnSeq int64 = 452000000000000000
|
||||||
|
var txnSeqMu sync.Mutex
|
||||||
|
|
||||||
|
func nextBinanceOrderID() string {
|
||||||
|
txnSeqMu.Lock()
|
||||||
|
defer txnSeqMu.Unlock()
|
||||||
|
txnSeq++
|
||||||
|
return strconv.FormatInt(txnSeq, 10)
|
||||||
|
}
|
||||||
|
|
||||||
|
func mkTxn(binanceOrderID, amount, currency, note string) payTxn {
|
||||||
|
var t payTxn
|
||||||
|
t.OrderID = binanceOrderID
|
||||||
|
t.Amount = amount
|
||||||
|
t.Currency = currency
|
||||||
|
t.Note = note
|
||||||
|
t.OrderType = "C2C"
|
||||||
|
t.TransactionID = "P_TEST" + binanceOrderID[len(binanceOrderID)-6:]
|
||||||
|
t.Time = nowMs()
|
||||||
|
t.CounterpartyID = 1163000000
|
||||||
|
t.PayerInfo.Name = "tester"
|
||||||
|
return t
|
||||||
|
}
|
||||||
|
|
||||||
|
// ① 唯一金额自动匹配 + 回调验签
|
||||||
|
func TestAmountMatchFlow(t *testing.T) {
|
||||||
|
e := newEnv(t)
|
||||||
|
d := e.create("M-amount-1", "USDT", "10", e.cbS.URL)
|
||||||
|
payAmount := d["pay_amount"].(string)
|
||||||
|
if payAmount == "10" {
|
||||||
|
t.Fatalf("pay_amount 应带唯一尾数，得到 %s", payAmount)
|
||||||
|
}
|
||||||
|
bid := nextBinanceOrderID()
|
||||||
|
e.mock.inject(mkTxn(bid, payAmount, "USDT", ""))
|
||||||
|
|
||||||
|
got := e.waitStatus(d["order_id"].(string), "paid", 10*time.Second)
|
||||||
|
if got["matched_by"] != "amount" || got["binance_order_id"] != bid {
|
||||||
|
t.Fatalf("匹配信息错误: %v", got)
|
||||||
|
}
|
||||||
|
cb := e.waitCallback(10 * time.Second)
|
||||||
|
var payload map[string]any
|
||||||
|
if err := json.Unmarshal(cb.body, &payload); err != nil {
|
||||||
|
t.Fatalf("回调体解析: %v", err)
|
||||||
|
}
|
||||||
|
if payload["event"] != "paid" || payload["merchant_order_id"] != "M-amount-1" {
|
||||||
|
t.Fatalf("回调内容错误: %v", payload)
|
||||||
|
}
|
||||||
|
ts := cb.headers.Get("X-BPG-Timestamp")
|
||||||
|
nonce := cb.headers.Get("X-BPG-Nonce")
|
||||||
|
sig := cb.headers.Get("X-BPG-Signature")
|
||||||
|
if signCallback(testSecret, ts, nonce, cb.body) != sig {
|
||||||
|
t.Fatal("回调签名校验失败")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ② 备注码匹配（金额不唯一也能确认）
|
||||||
|
func TestNoteMatchFlow(t *testing.T) {
|
||||||
|
e := newEnv(t)
|
||||||
|
d := e.create("M-note-1", "USDT", "25.5", e.cbS.URL)
|
||||||
|
code := d["note_code"].(string)
|
||||||
|
bid := nextBinanceOrderID()
|
||||||
|
e.mock.inject(mkTxn(bid, "25.5", "USDT", "订单 "+code+" 谢谢"))
|
||||||
|
got := e.waitStatus(d["order_id"].(string), "paid", 10*time.Second)
|
||||||
|
if got["matched_by"] != "note" || got["actual_amount"] != "25.5" {
|
||||||
|
t.Fatalf("备注匹配信息错误: %v", got)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ②b 备注命中但实付不足 → underpaid
|
||||||
|
func TestUnderpaidViaNote(t *testing.T) {
|
||||||
|
e := newEnv(t)
|
||||||
|
d := e.create("M-under-1", "USDT", "30", e.cbS.URL)
|
||||||
|
code := d["note_code"].(string)
|
||||||
|
e.mock.inject(mkTxn(nextBinanceOrderID(), "29", "USDT", code))
|
||||||
|
got := e.waitStatus(d["order_id"].(string), "underpaid", 10*time.Second)
|
||||||
|
if got["actual_amount"] != "29" {
|
||||||
|
t.Fatalf("underpaid 信息错误: %v", got)
|
||||||
|
}
|
||||||
|
cb := e.waitCallback(10 * time.Second)
|
||||||
|
var payload map[string]any
|
||||||
|
json.Unmarshal(cb.body, &payload)
|
||||||
|
if payload["event"] != "underpaid" {
|
||||||
|
t.Fatalf("回调事件应为 underpaid: %v", payload)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// ③ 收银页回填币安订单编号
|
||||||
|
func TestClaimFlow(t *testing.T) {
|
||||||
|
e := newEnv(t)
|
||||||
|
d := e.create("M-claim-1", "USDT", "40", e.cbS.URL)
|
||||||
|
bid := nextBinanceOrderID()
|
||||||
|
e.mock.inject(mkTxn(bid, "40", "USDT", "")) // 金额=基础值且无备注 → 自动路径不命中
|
||||||
|
payURL := d["pay_url"].(string)
|
||||||
|
token := payURL[len("http://gw.test/pay/"):]
|
||||||
|
body, _ := json.Marshal(map[string]string{"binance_order_id": bid})
|
||||||
|
resp, err := http.Post(e.srv.URL+"/pay/"+token+"/claim", "application/json", bytes.NewReader(body))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
var out map[string]any
|
||||||
|
json.NewDecoder(resp.Body).Decode(&out)
|
||||||
|
resp.Body.Close()
|
||||||
|
data, okCast := out["data"].(map[string]any)
|
||||||
|
if !okCast {
|
||||||
|
t.Fatalf("claim 响应异常: %v", out)
|
||||||
|
}
|
||||||
|
if data["code"] != "OK" || data["status"] != "paid" {
|
||||||
|
t.Fatalf("claim 结果错误: %v", out)
|
||||||
|
}
|
||||||
|
got := e.waitStatus(d["order_id"].(string), "paid", 5*time.Second)
|
||||||
|
if got["matched_by"] != "claim" {
|
||||||
|
t.Fatalf("matched_by 应为 claim: %v", got)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// 过期 → 宽限期内精确金额到账 → 复活为已支付
|
||||||
|
func TestExpiredThenLatePayment(t *testing.T) {
|
||||||
|
e := newEnv(t)
|
||||||
|
d := e.create("M-exp-1", "USDT", "50", e.cbS.URL)
|
||||||
|
oid := d["order_id"].(string)
|
||||||
|
if _, err := e.app.st.db.Exec(`UPDATE orders SET expires_at=? WHERE id=?`, nowMs()-1000, oid); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
e.waitStatus(oid, "expired", 10*time.Second)
|
||||||
|
cb := e.waitCallback(10 * time.Second)
|
||||||
|
var payload map[string]any
|
||||||
|
json.Unmarshal(cb.body, &payload)
|
||||||
|
if payload["event"] != "expired" {
|
||||||
|
t.Fatalf("应先收到 expired 回调: %v", payload)
|
||||||
|
}
|
||||||
|
e.mock.inject(mkTxn(nextBinanceOrderID(), d["pay_amount"].(string), "USDT", ""))
|
||||||
|
e.waitStatus(oid, "paid", 10*time.Second)
|
||||||
|
}
|
||||||
|
|
||||||
|
// 鉴权与幂等
|
||||||
|
func TestAuthAndDuplicate(t *testing.T) {
|
||||||
|
e := newEnv(t)
|
||||||
|
body := []byte(`{"merchant_order_id":"M-auth-1","currency":"USDT","amount":"1"}`)
|
||||||
|
req, _ := http.NewRequest("POST", e.srv.URL+"/api/v1/orders", bytes.NewReader(body))
|
||||||
|
req.Header.Set("X-BPG-Timestamp", strconv.FormatInt(nowMs(), 10))
|
||||||
|
req.Header.Set("X-BPG-Nonce", newNonce())
|
||||||
|
req.Header.Set("X-BPG-Signature", "bad")
|
||||||
|
resp, err := http.DefaultClient.Do(req)
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
if resp.StatusCode != 401 {
|
||||||
|
t.Fatalf("坏签名应 401，得到 %d", resp.StatusCode)
|
||||||
|
}
|
||||||
|
resp.Body.Close()
|
||||||
|
e.create("M-dup-1", "USDT", "2", "")
|
||||||
|
b2, _ := json.Marshal(map[string]any{"merchant_order_id": "M-dup-1", "currency": "USDT", "amount": "2"})
|
||||||
|
code, out := e.doSigned("POST", "/api/v1/orders", b2)
|
||||||
|
if code != 409 || out["code"] != "ERR_DUPLICATE" {
|
||||||
|
t.Fatalf("重复单号应 409/ERR_DUPLICATE，得到 %d %v", code, out)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// 唯一金额分配：不撞、关单冷却不复用
|
||||||
|
func TestAllocatorUniqueness(t *testing.T) {
|
||||||
|
e := newEnv(t)
|
||||||
|
seen := map[string]bool{}
|
||||||
|
for i := 0; i < 30; i++ {
|
||||||
|
d := e.create(fmt.Sprintf("M-alloc-%d", i), "USDT", "88", "")
|
||||||
|
pa := d["pay_amount"].(string)
|
||||||
|
if seen[pa] {
|
||||||
|
t.Fatalf("pay_amount 重复: %s", pa)
|
||||||
|
}
|
||||||
|
seen[pa] = true
|
||||||
|
}
|
||||||
|
d := e.create("M-alloc-close", "USDT", "77", "")
|
||||||
|
closedAmt := d["pay_amount"].(string)
|
||||||
|
if code, out := e.doSigned("POST", "/api/v1/orders/"+d["order_id"].(string)+"/close", nil); code != 200 {
|
||||||
|
t.Fatalf("关单失败: %v", out)
|
||||||
|
}
|
||||||
|
for i := 0; i < 20; i++ {
|
||||||
|
d2 := e.create(fmt.Sprintf("M-alloc2-%d", i), "USDT", "77", "")
|
||||||
|
if d2["pay_amount"].(string) == closedAmt {
|
||||||
|
t.Fatalf("冷却期内金额被复用: %s", closedAmt)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
module bpaygate
|
||||||
|
|
||||||
|
go 1.25.0
|
||||||
|
|
||||||
|
require modernc.org/sqlite v1.57.0
|
||||||
|
|
||||||
|
require (
|
||||||
|
github.com/dustin/go-humanize v1.0.1 // indirect
|
||||||
|
github.com/google/uuid v1.6.0 // indirect
|
||||||
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
||||||
|
github.com/ncruces/go-strftime v1.0.0 // indirect
|
||||||
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
|
||||||
|
golang.org/x/sys v0.47.0 // indirect
|
||||||
|
modernc.org/libc v1.74.4 // indirect
|
||||||
|
modernc.org/mathutil v1.7.1 // indirect
|
||||||
|
modernc.org/memory v1.11.0 // indirect
|
||||||
|
)
|
||||||
@@ -0,0 +1,50 @@
|
|||||||
|
github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
|
||||||
|
github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
|
||||||
|
github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo=
|
||||||
|
github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk=
|
||||||
|
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
|
||||||
|
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
|
||||||
|
github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
|
||||||
|
github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
|
||||||
|
github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
|
||||||
|
github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
|
||||||
|
github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
|
||||||
|
github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
|
||||||
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
|
||||||
|
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
|
||||||
|
golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
|
||||||
|
golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
|
||||||
|
golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
|
||||||
|
golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
|
||||||
|
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
|
||||||
|
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||||
|
golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
|
||||||
|
golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
|
||||||
|
modernc.org/cc/v4 v4.29.1 h1:MKgdCV3WykTSPqpVrnxdEDS0HEd2FHpKZDzxzU5LyeI=
|
||||||
|
modernc.org/cc/v4 v4.29.1/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
|
||||||
|
modernc.org/ccgo/v4 v4.34.6 h1:sBgfIwyN0TQ9C5hwIeuqyeAKyMWnbvj2fvpF4L11uzU=
|
||||||
|
modernc.org/ccgo/v4 v4.34.6/go.mod h1:SZ8YcN9NG7XVsQYdm6jYBvi8PQP1qi+kqB6OhjqI3Fk=
|
||||||
|
modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
|
||||||
|
modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
|
||||||
|
modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
|
||||||
|
modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
|
||||||
|
modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
|
||||||
|
modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
|
||||||
|
modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
|
||||||
|
modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
|
||||||
|
modernc.org/libc v1.74.4 h1:fX1Omw4o2/1C2iRkkIsrQTasJQldLhRmuPreXLoWs9k=
|
||||||
|
modernc.org/libc v1.74.4/go.mod h1:eeQAS9W3sZeKYMFubydxJpII9ybHWshk+7or7bLG9co=
|
||||||
|
modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
|
||||||
|
modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
|
||||||
|
modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
|
||||||
|
modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
|
||||||
|
modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
|
||||||
|
modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
|
||||||
|
modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
|
||||||
|
modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
|
||||||
|
modernc.org/sqlite v1.57.0 h1:qNQP6xnx5M0ISNtlnxoOX0+cD5bJ0/gr9aMmndFczzg=
|
||||||
|
modernc.org/sqlite v1.57.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ=
|
||||||
|
modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
|
||||||
|
modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
|
||||||
|
modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
|
||||||
|
modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
|
||||||
@@ -0,0 +1,65 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/base64"
|
||||||
|
"flag"
|
||||||
|
"fmt"
|
||||||
|
"log"
|
||||||
|
"net/http"
|
||||||
|
"os"
|
||||||
|
"os/signal"
|
||||||
|
"syscall"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
const version = "0.1.0"
|
||||||
|
|
||||||
|
func main() {
|
||||||
|
cfgPath := flag.String("config", "./config.env", "配置文件路径（KEY=VALUE 格式，环境变量优先）")
|
||||||
|
showVer := flag.Bool("version", false, "打印版本")
|
||||||
|
genKey := flag.Bool("gen-key", false, "生成一个随机 API_AUTH_KEY")
|
||||||
|
flag.Parse()
|
||||||
|
|
||||||
|
if *showVer {
|
||||||
|
fmt.Println("BinancePayTool", version)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if *genKey {
|
||||||
|
b := make([]byte, 32)
|
||||||
|
if _, err := rand.Read(b); err != nil {
|
||||||
|
log.Fatal(err)
|
||||||
|
}
|
||||||
|
fmt.Println(base64.RawURLEncoding.EncodeToString(b))
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
cfg, err := loadConfig(*cfgPath)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("[fatal] %v", err)
|
||||||
|
}
|
||||||
|
app, err := newApp(cfg)
|
||||||
|
if err != nil {
|
||||||
|
log.Fatalf("[fatal] 初始化失败: %v", err)
|
||||||
|
}
|
||||||
|
defer app.st.Close()
|
||||||
|
|
||||||
|
ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
|
||||||
|
defer stop()
|
||||||
|
go app.matcher.run(ctx)
|
||||||
|
go app.notifier.run(ctx)
|
||||||
|
|
||||||
|
srv := &http.Server{Addr: cfg.Listen, Handler: app.mux}
|
||||||
|
go func() {
|
||||||
|
<-ctx.Done()
|
||||||
|
shutCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
||||||
|
defer cancel()
|
||||||
|
srv.Shutdown(shutCtx)
|
||||||
|
}()
|
||||||
|
log.Printf("[info] BinancePayTool %s 监听 %s，收款 UID %s，轮询间隔 %ds", version, cfg.Listen, cfg.BinanceUID, cfg.PollInterval)
|
||||||
|
if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
|
||||||
|
log.Fatalf("[fatal] %v", err)
|
||||||
|
}
|
||||||
|
log.Printf("[info] 已退出")
|
||||||
|
}
|
||||||
@@ -0,0 +1,248 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"log"
|
||||||
|
"sort"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
"sync"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Matcher 负责轮询币安流水并按三条规则核销订单：
|
||||||
|
// ① 唯一金额精确匹配 ② 备注含 note_code ③ 收银页回填币安订单编号（claim）。
|
||||||
|
type Matcher struct {
|
||||||
|
cfg *Config
|
||||||
|
st *Store
|
||||||
|
bc *binanceClient
|
||||||
|
|
||||||
|
mu sync.Mutex
|
||||||
|
cache []payTxn
|
||||||
|
cacheAt int64
|
||||||
|
}
|
||||||
|
|
||||||
|
func newMatcher(cfg *Config, st *Store, bc *binanceClient) *Matcher {
|
||||||
|
return &Matcher{cfg: cfg, st: st, bc: bc}
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *Matcher) run(ctx context.Context) {
|
||||||
|
t := time.NewTicker(time.Duration(m.cfg.PollInterval) * time.Second)
|
||||||
|
defer t.Stop()
|
||||||
|
for {
|
||||||
|
select {
|
||||||
|
case <-ctx.Done():
|
||||||
|
return
|
||||||
|
case <-t.C:
|
||||||
|
if n, err := m.st.ExpireDue(m.cfg.SuffixCooldown); err != nil {
|
||||||
|
log.Printf("[error] 过期处理失败: %v", err)
|
||||||
|
} else if n > 0 {
|
||||||
|
log.Printf("[info] %d 个订单已过期", n)
|
||||||
|
}
|
||||||
|
if err := m.scan(); err != nil {
|
||||||
|
log.Printf("[error] 流水扫描失败: %v", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// fetchWindow 拉取自 startMs 以来的流水，满 100 条时向前翻页（最多 5 页），按时间升序返回。
|
||||||
|
func (m *Matcher) fetchWindow(startMs int64) ([]payTxn, error) {
|
||||||
|
seen := map[string]bool{}
|
||||||
|
var all []payTxn
|
||||||
|
endMs := int64(0)
|
||||||
|
for page := 0; page < 5; page++ {
|
||||||
|
txns, err := m.bc.PayTransactions(startMs, endMs, 100)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
minT := int64(0)
|
||||||
|
for _, t := range txns {
|
||||||
|
key := t.OrderID
|
||||||
|
if key == "" {
|
||||||
|
key = t.TransactionID
|
||||||
|
}
|
||||||
|
if key == "" || seen[key] {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
seen[key] = true
|
||||||
|
all = append(all, t)
|
||||||
|
if minT == 0 || t.Time < minT {
|
||||||
|
minT = t.Time
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if len(txns) < 100 || minT == 0 {
|
||||||
|
break
|
||||||
|
}
|
||||||
|
endMs = minT - 1
|
||||||
|
}
|
||||||
|
sort.Slice(all, func(i, j int) bool { return all[i].Time < all[j].Time })
|
||||||
|
return all, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (m *Matcher) scan() error {
|
||||||
|
now := nowMs()
|
||||||
|
graceMs := m.cfg.ExpiredGrace * 1000
|
||||||
|
cands, err := m.st.CandidateOrders(now, graceMs)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if len(cands) == 0 {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
minCreated := cands[0].CreatedAt
|
||||||
|
for _, o := range cands {
|
||||||
|
if o.CreatedAt < minCreated {
|
||||||
|
minCreated = o.CreatedAt
|
||||||
|
}
|
||||||
|
}
|
||||||
|
txns, err := m.fetchWindow(minCreated - 10*60*1000)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
m.mu.Lock()
|
||||||
|
m.cache, m.cacheAt = txns, now
|
||||||
|
m.mu.Unlock()
|
||||||
|
for _, t := range txns {
|
||||||
|
if err := m.applyTxn(t); err != nil {
|
||||||
|
log.Printf("[error] 核销流水 %s 失败: %v", t.OrderID, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// applyTxn 尝试用一笔流水核销订单（规则 ①②）。
|
||||||
|
func (m *Matcher) applyTxn(t payTxn) error {
|
||||||
|
amt, err := parseAmount(t.Amount)
|
||||||
|
if err != nil || amt <= 0 {
|
||||||
|
return nil // 非入账
|
||||||
|
}
|
||||||
|
cur := strings.ToUpper(t.Currency)
|
||||||
|
if !m.cfg.Currencies[cur] {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
if t.OrderID == "" {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
if done, err := m.st.Consumed(t.OrderID); err != nil || done {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
now := nowMs()
|
||||||
|
cands, err := m.st.CandidateOrders(now, m.cfg.ExpiredGrace*1000)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
payerID := strconv64(t.CounterpartyID)
|
||||||
|
if t.PayerInfo.BinanceID > 0 {
|
||||||
|
payerID = strconv64(t.PayerInfo.BinanceID)
|
||||||
|
}
|
||||||
|
// ① 唯一金额精确匹配
|
||||||
|
for _, o := range cands {
|
||||||
|
if o.Currency == cur && o.PayAmount == amt && t.Time >= o.CreatedAt-120*1000 {
|
||||||
|
ok, err := m.st.Finish(o, "paid", "amount", t.OrderID, t.TransactionID, payerID, t.PayerInfo.Name, amt, m.cfg.SuffixCooldown)
|
||||||
|
if ok {
|
||||||
|
log.Printf("[info] 订单 %s 已支付（金额匹配）binanceOrderId=%s amount=%s %s", o.ID, t.OrderID, fmtAmount(amt), cur)
|
||||||
|
}
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// ② 备注含 note_code
|
||||||
|
note := strings.ToUpper(t.Note)
|
||||||
|
if note == "" {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
for _, o := range cands {
|
||||||
|
if o.Currency != cur || !strings.Contains(note, o.NoteCode) {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
status := "paid"
|
||||||
|
if amt < o.BaseAmount {
|
||||||
|
status = "underpaid"
|
||||||
|
}
|
||||||
|
ok, err := m.st.Finish(o, status, "note", t.OrderID, t.TransactionID, payerID, t.PayerInfo.Name, amt, m.cfg.SuffixCooldown)
|
||||||
|
if ok {
|
||||||
|
log.Printf("[info] 订单 %s → %s（备注匹配）binanceOrderId=%s amount=%s %s", o.ID, status, t.OrderID, fmtAmount(amt), cur)
|
||||||
|
}
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
type claimResult struct {
|
||||||
|
Code string // OK / NOT_FOUND / CONSUMED / CURRENCY / UNDERPAID / STATE
|
||||||
|
Status string // 处理后订单状态
|
||||||
|
}
|
||||||
|
|
||||||
|
// Claim 处理收银页回填的币安订单编号（规则 ③）。
|
||||||
|
func (m *Matcher) Claim(o *Order, binanceOrderID string) (claimResult, error) {
|
||||||
|
if o.Status == "paid" {
|
||||||
|
return claimResult{Code: "OK", Status: "paid"}, nil
|
||||||
|
}
|
||||||
|
if o.Status != "pending" && o.Status != "expired" {
|
||||||
|
return claimResult{Code: "STATE", Status: o.Status}, nil
|
||||||
|
}
|
||||||
|
if done, err := m.st.Consumed(binanceOrderID); err != nil {
|
||||||
|
return claimResult{}, err
|
||||||
|
} else if done {
|
||||||
|
return claimResult{Code: "CONSUMED", Status: o.Status}, nil
|
||||||
|
}
|
||||||
|
// 先查缓存；未命中则强制现拉一次（付款可能刚到账，缓存虽新但没有它）
|
||||||
|
find := func(txns []payTxn) *payTxn {
|
||||||
|
for i := range txns {
|
||||||
|
if txns[i].OrderID == binanceOrderID {
|
||||||
|
return &txns[i]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
m.mu.Lock()
|
||||||
|
hit := find(m.cache)
|
||||||
|
m.mu.Unlock()
|
||||||
|
if hit == nil {
|
||||||
|
fresh, err := m.fetchWindow(o.CreatedAt - 10*60*1000)
|
||||||
|
if err != nil {
|
||||||
|
return claimResult{}, err
|
||||||
|
}
|
||||||
|
m.mu.Lock()
|
||||||
|
m.cache, m.cacheAt = fresh, nowMs()
|
||||||
|
m.mu.Unlock()
|
||||||
|
hit = find(fresh)
|
||||||
|
}
|
||||||
|
if hit != nil {
|
||||||
|
t := *hit
|
||||||
|
amt, err := parseAmount(t.Amount)
|
||||||
|
if err != nil || amt <= 0 {
|
||||||
|
return claimResult{Code: "NOT_FOUND", Status: o.Status}, nil
|
||||||
|
}
|
||||||
|
if strings.ToUpper(t.Currency) != o.Currency {
|
||||||
|
return claimResult{Code: "CURRENCY", Status: o.Status}, nil
|
||||||
|
}
|
||||||
|
payerID := strconv64(t.CounterpartyID)
|
||||||
|
if t.PayerInfo.BinanceID > 0 {
|
||||||
|
payerID = strconv64(t.PayerInfo.BinanceID)
|
||||||
|
}
|
||||||
|
status := "paid"
|
||||||
|
code := "OK"
|
||||||
|
if amt < o.BaseAmount {
|
||||||
|
status = "underpaid"
|
||||||
|
code = "UNDERPAID"
|
||||||
|
}
|
||||||
|
ok, err := m.st.Finish(o, status, "claim", t.OrderID, t.TransactionID, payerID, t.PayerInfo.Name, amt, m.cfg.SuffixCooldown)
|
||||||
|
if err != nil {
|
||||||
|
return claimResult{}, err
|
||||||
|
}
|
||||||
|
if !ok {
|
||||||
|
return claimResult{Code: "CONSUMED", Status: o.Status}, nil
|
||||||
|
}
|
||||||
|
log.Printf("[info] 订单 %s → %s（回填匹配）binanceOrderId=%s", o.ID, status, t.OrderID)
|
||||||
|
return claimResult{Code: code, Status: status}, nil
|
||||||
|
}
|
||||||
|
return claimResult{Code: "NOT_FOUND", Status: o.Status}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func strconv64(v int64) string {
|
||||||
|
if v == 0 {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
return strconv.FormatInt(v, 10)
|
||||||
|
}
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/hmac"
|
||||||
|
"crypto/sha256"
|
||||||
|
"encoding/hex"
|
||||||
|
)
|
||||||
|
|
||||||
|
func sha256Hex(b []byte) string {
|
||||||
|
h := sha256.Sum256(b)
|
||||||
|
return hex.EncodeToString(h[:])
|
||||||
|
}
|
||||||
|
|
||||||
|
func hmacHex(secret, msg string) string {
|
||||||
|
m := hmac.New(sha256.New, []byte(secret))
|
||||||
|
m.Write([]byte(msg))
|
||||||
|
return hex.EncodeToString(m.Sum(nil))
|
||||||
|
}
|
||||||
|
|
||||||
|
// signRequest 商户→网关请求签名（见 docs/protocol.md §1.1）
|
||||||
|
func signRequest(secret, ts, nonce, method, path string, body []byte) string {
|
||||||
|
return hmacHex(secret, ts+"\n"+nonce+"\n"+method+"\n"+path+"\n"+sha256Hex(body))
|
||||||
|
}
|
||||||
|
|
||||||
|
// signCallback 网关→商户回调签名（见 docs/protocol.md §1.2）
|
||||||
|
func signCallback(secret, ts, nonce string, body []byte) string {
|
||||||
|
return hmacHex(secret, ts+"\n"+nonce+"\n"+sha256Hex(body))
|
||||||
|
}
|
||||||
|
|
||||||
|
func sigEqual(a, b string) bool { return hmac.Equal([]byte(a), []byte(b)) }
|
||||||
@@ -0,0 +1,48 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"encoding/json"
|
||||||
|
"os"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
type vectorFile struct {
|
||||||
|
Secret string `json:"secret"`
|
||||||
|
Cases []struct {
|
||||||
|
Type string `json:"type"`
|
||||||
|
Timestamp string `json:"timestamp"`
|
||||||
|
Nonce string `json:"nonce"`
|
||||||
|
Method string `json:"method"`
|
||||||
|
Path string `json:"path"`
|
||||||
|
Body string `json:"body"`
|
||||||
|
Signature string `json:"signature"`
|
||||||
|
} `json:"cases"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestSignatureVectors(t *testing.T) {
|
||||||
|
data, err := os.ReadFile("../docs/test_vectors.json")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatalf("读取向量文件: %v", err)
|
||||||
|
}
|
||||||
|
var vf vectorFile
|
||||||
|
if err := json.Unmarshal(data, &vf); err != nil {
|
||||||
|
t.Fatalf("解析向量文件: %v", err)
|
||||||
|
}
|
||||||
|
if len(vf.Cases) == 0 {
|
||||||
|
t.Fatal("向量为空")
|
||||||
|
}
|
||||||
|
for i, c := range vf.Cases {
|
||||||
|
var got string
|
||||||
|
switch c.Type {
|
||||||
|
case "request":
|
||||||
|
got = signRequest(vf.Secret, c.Timestamp, c.Nonce, c.Method, c.Path, []byte(c.Body))
|
||||||
|
case "callback":
|
||||||
|
got = signCallback(vf.Secret, c.Timestamp, c.Nonce, []byte(c.Body))
|
||||||
|
default:
|
||||||
|
t.Fatalf("未知类型 %s", c.Type)
|
||||||
|
}
|
||||||
|
if got != c.Signature {
|
||||||
|
t.Errorf("case %d (%s): got %s want %s", i, c.Type, got, c.Signature)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
+470
@@ -0,0 +1,470 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"database/sql"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"math/rand"
|
||||||
|
"sync"
|
||||||
|
|
||||||
|
_ "modernc.org/sqlite"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
ErrDuplicate = errors.New("duplicate merchant_order_id")
|
||||||
|
ErrAlloc = errors.New("no unique amount available")
|
||||||
|
ErrNotFound = errors.New("not found")
|
||||||
|
ErrState = errors.New("invalid state")
|
||||||
|
)
|
||||||
|
|
||||||
|
type Order struct {
|
||||||
|
ID string
|
||||||
|
Token string
|
||||||
|
MerchantOrderID string
|
||||||
|
Currency string
|
||||||
|
BaseAmount int64
|
||||||
|
PayAmount int64
|
||||||
|
ActualAmount int64
|
||||||
|
Status string // pending|paid|underpaid|expired|closed
|
||||||
|
NoteCode string
|
||||||
|
BinanceOrderID string
|
||||||
|
BinanceTxnID string
|
||||||
|
PayerID string
|
||||||
|
PayerName string
|
||||||
|
MatchedBy string // amount|note|claim
|
||||||
|
CallbackURL string
|
||||||
|
ReturnURL string
|
||||||
|
CreatedAt int64
|
||||||
|
ExpiresAt int64
|
||||||
|
PaidAt int64
|
||||||
|
Overpaid bool
|
||||||
|
}
|
||||||
|
|
||||||
|
type cbJob struct {
|
||||||
|
ID int64
|
||||||
|
OrderID string
|
||||||
|
Event string
|
||||||
|
Attempt int
|
||||||
|
}
|
||||||
|
|
||||||
|
type Store struct {
|
||||||
|
db *sql.DB
|
||||||
|
mu sync.Mutex
|
||||||
|
}
|
||||||
|
|
||||||
|
const schema = `
|
||||||
|
CREATE TABLE IF NOT EXISTS orders(
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
token TEXT UNIQUE NOT NULL,
|
||||||
|
merchant_order_id TEXT UNIQUE NOT NULL,
|
||||||
|
currency TEXT NOT NULL,
|
||||||
|
base_amount INTEGER NOT NULL,
|
||||||
|
pay_amount INTEGER NOT NULL,
|
||||||
|
actual_amount INTEGER,
|
||||||
|
status TEXT NOT NULL,
|
||||||
|
note_code TEXT NOT NULL,
|
||||||
|
binance_order_id TEXT,
|
||||||
|
binance_txn_id TEXT,
|
||||||
|
payer_id TEXT,
|
||||||
|
payer_name TEXT,
|
||||||
|
matched_by TEXT,
|
||||||
|
callback_url TEXT,
|
||||||
|
return_url TEXT,
|
||||||
|
created_at INTEGER NOT NULL,
|
||||||
|
expires_at INTEGER NOT NULL,
|
||||||
|
paid_at INTEGER,
|
||||||
|
overpaid INTEGER NOT NULL DEFAULT 0
|
||||||
|
);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_orders_status ON orders(status);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_orders_amount ON orders(currency, pay_amount);
|
||||||
|
CREATE TABLE IF NOT EXISTS consumed(
|
||||||
|
binance_order_id TEXT PRIMARY KEY,
|
||||||
|
order_id TEXT NOT NULL,
|
||||||
|
at INTEGER NOT NULL
|
||||||
|
);
|
||||||
|
CREATE TABLE IF NOT EXISTS cooldown(
|
||||||
|
currency TEXT NOT NULL,
|
||||||
|
amount INTEGER NOT NULL,
|
||||||
|
until INTEGER NOT NULL,
|
||||||
|
PRIMARY KEY(currency, amount)
|
||||||
|
);
|
||||||
|
CREATE TABLE IF NOT EXISTS callbacks(
|
||||||
|
id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||||
|
order_id TEXT NOT NULL,
|
||||||
|
event TEXT NOT NULL,
|
||||||
|
attempt INTEGER NOT NULL DEFAULT 0,
|
||||||
|
next_at INTEGER NOT NULL,
|
||||||
|
done INTEGER NOT NULL DEFAULT 0,
|
||||||
|
last_err TEXT
|
||||||
|
);
|
||||||
|
CREATE INDEX IF NOT EXISTS idx_callbacks_due ON callbacks(done, next_at);
|
||||||
|
`
|
||||||
|
|
||||||
|
func openStore(path string) (*Store, error) {
|
||||||
|
db, err := sql.Open("sqlite", path)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
db.SetMaxOpenConns(1)
|
||||||
|
for _, p := range []string{
|
||||||
|
"PRAGMA journal_mode=WAL;",
|
||||||
|
"PRAGMA busy_timeout=5000;",
|
||||||
|
"PRAGMA synchronous=NORMAL;",
|
||||||
|
} {
|
||||||
|
if _, err := db.Exec(p); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if _, err := db.Exec(schema); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return &Store{db: db}, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *Store) Close() error { return s.db.Close() }
|
||||||
|
|
||||||
|
const orderCols = `id,token,merchant_order_id,currency,base_amount,pay_amount,COALESCE(actual_amount,0),status,note_code,
|
||||||
|
COALESCE(binance_order_id,''),COALESCE(binance_txn_id,''),COALESCE(payer_id,''),COALESCE(payer_name,''),COALESCE(matched_by,''),
|
||||||
|
COALESCE(callback_url,''),COALESCE(return_url,''),created_at,expires_at,COALESCE(paid_at,0),overpaid`
|
||||||
|
|
||||||
|
type rowScanner interface{ Scan(...any) error }
|
||||||
|
|
||||||
|
func scanOrder(row rowScanner) (*Order, error) {
|
||||||
|
var o Order
|
||||||
|
var overpaid int
|
||||||
|
err := row.Scan(&o.ID, &o.Token, &o.MerchantOrderID, &o.Currency, &o.BaseAmount, &o.PayAmount, &o.ActualAmount,
|
||||||
|
&o.Status, &o.NoteCode, &o.BinanceOrderID, &o.BinanceTxnID, &o.PayerID, &o.PayerName, &o.MatchedBy,
|
||||||
|
&o.CallbackURL, &o.ReturnURL, &o.CreatedAt, &o.ExpiresAt, &o.PaidAt, &overpaid)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
o.Overpaid = overpaid != 0
|
||||||
|
return &o, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *Store) orderBy(where string, arg any) (*Order, error) {
|
||||||
|
row := s.db.QueryRow(`SELECT `+orderCols+` FROM orders WHERE `+where, arg)
|
||||||
|
o, err := scanOrder(row)
|
||||||
|
if errors.Is(err, sql.ErrNoRows) {
|
||||||
|
return nil, ErrNotFound
|
||||||
|
}
|
||||||
|
return o, err
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *Store) OrderByID(id string) (*Order, error) { return s.orderBy("id=?", id) }
|
||||||
|
func (s *Store) OrderByToken(tok string) (*Order, error) { return s.orderBy("token=?", tok) }
|
||||||
|
func (s *Store) OrderByMerchantID(mid string) (*Order, error) {
|
||||||
|
return s.orderBy("merchant_order_id=?", mid)
|
||||||
|
}
|
||||||
|
|
||||||
|
// CandidateOrders 返回可被入账流水核销的订单：待支付，或过期但仍在宽限期内。
|
||||||
|
func (s *Store) CandidateOrders(now, graceMs int64) ([]*Order, error) {
|
||||||
|
rows, err := s.db.Query(`SELECT `+orderCols+` FROM orders
|
||||||
|
WHERE status='pending' OR (status='expired' AND expires_at+? > ?)`, graceMs, now)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
defer rows.Close()
|
||||||
|
var out []*Order
|
||||||
|
for rows.Next() {
|
||||||
|
o, err := scanOrder(rows)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
out = append(out, o)
|
||||||
|
}
|
||||||
|
return out, rows.Err()
|
||||||
|
}
|
||||||
|
|
||||||
|
// CreateOrder 分配唯一金额并落库。分配与插入在同一把锁内，杜绝并发撞金额。
|
||||||
|
func (s *Store) CreateOrder(cfg *Config, mid, currency string, base int64, ttlSec int64, callbackURL, returnURL string) (*Order, error) {
|
||||||
|
s.mu.Lock()
|
||||||
|
defer s.mu.Unlock()
|
||||||
|
now := nowMs()
|
||||||
|
|
||||||
|
var exist string
|
||||||
|
err := s.db.QueryRow(`SELECT id FROM orders WHERE merchant_order_id=?`, mid).Scan(&exist)
|
||||||
|
if err == nil {
|
||||||
|
return nil, ErrDuplicate
|
||||||
|
}
|
||||||
|
if !errors.Is(err, sql.ErrNoRows) {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
unit := int64(1)
|
||||||
|
for i := 0; i < 8-cfg.AmountDecimals; i++ {
|
||||||
|
unit *= 10
|
||||||
|
}
|
||||||
|
maxK := int64(1)
|
||||||
|
for i := 0; i < cfg.AmountDecimals; i++ {
|
||||||
|
maxK *= 10
|
||||||
|
}
|
||||||
|
maxK--
|
||||||
|
|
||||||
|
lo, hi := base+unit, base+maxK*unit
|
||||||
|
if cfg.SuffixMode == "sub" {
|
||||||
|
lo, hi = base-maxK*unit, base-unit
|
||||||
|
if lo < unit {
|
||||||
|
lo = unit
|
||||||
|
}
|
||||||
|
if hi < lo {
|
||||||
|
return nil, ErrAlloc
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
taken := map[int64]bool{}
|
||||||
|
graceMs := cfg.ExpiredGrace * 1000
|
||||||
|
rows, err := s.db.Query(`SELECT pay_amount FROM orders WHERE currency=? AND pay_amount BETWEEN ? AND ?
|
||||||
|
AND (status='pending' OR (status IN ('expired','underpaid') AND expires_at+? > ?))`,
|
||||||
|
currency, lo, hi, graceMs, now)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
for rows.Next() {
|
||||||
|
var v int64
|
||||||
|
if err := rows.Scan(&v); err != nil {
|
||||||
|
rows.Close()
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
taken[v] = true
|
||||||
|
}
|
||||||
|
rows.Close()
|
||||||
|
rows, err = s.db.Query(`SELECT amount FROM cooldown WHERE currency=? AND amount BETWEEN ? AND ? AND until > ?`,
|
||||||
|
currency, lo, hi, now)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
for rows.Next() {
|
||||||
|
var v int64
|
||||||
|
if err := rows.Scan(&v); err != nil {
|
||||||
|
rows.Close()
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
taken[v] = true
|
||||||
|
}
|
||||||
|
rows.Close()
|
||||||
|
|
||||||
|
// 递进式尾数：优先最小的两位档（付款方最多多付 0.0099），
|
||||||
|
// 该档用满自动升到三位、四位档，兼顾「多付最少」与并发容量。
|
||||||
|
candOf := func(k int64) int64 {
|
||||||
|
if cfg.SuffixMode == "sub" {
|
||||||
|
return base - k*unit
|
||||||
|
}
|
||||||
|
return base + k*unit
|
||||||
|
}
|
||||||
|
pick := int64(0)
|
||||||
|
rangeLo := int64(1)
|
||||||
|
for _, rangeHi := range []int64{99, 999, maxK} {
|
||||||
|
if rangeHi > maxK {
|
||||||
|
rangeHi = maxK
|
||||||
|
}
|
||||||
|
if rangeHi < rangeLo {
|
||||||
|
break
|
||||||
|
}
|
||||||
|
span := rangeHi - rangeLo + 1
|
||||||
|
for i := int64(0); i < 200 && i < span*2; i++ {
|
||||||
|
k := rangeLo + rand.Int63n(span)
|
||||||
|
c := candOf(k)
|
||||||
|
if c > 0 && !taken[c] {
|
||||||
|
pick = c
|
||||||
|
break
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if pick == 0 {
|
||||||
|
for k := rangeLo; k <= rangeHi; k++ {
|
||||||
|
c := candOf(k)
|
||||||
|
if c > 0 && !taken[c] {
|
||||||
|
pick = c
|
||||||
|
break
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if pick != 0 {
|
||||||
|
break
|
||||||
|
}
|
||||||
|
rangeLo = rangeHi + 1
|
||||||
|
}
|
||||||
|
if pick == 0 {
|
||||||
|
return nil, ErrAlloc
|
||||||
|
}
|
||||||
|
|
||||||
|
o := &Order{
|
||||||
|
ID: newOrderID(), Token: newToken(), MerchantOrderID: mid, Currency: currency,
|
||||||
|
BaseAmount: base, PayAmount: pick, Status: "pending", NoteCode: newNoteCode(),
|
||||||
|
CallbackURL: callbackURL, ReturnURL: returnURL,
|
||||||
|
CreatedAt: now, ExpiresAt: now + ttlSec*1000,
|
||||||
|
}
|
||||||
|
_, err = s.db.Exec(`INSERT INTO orders(id,token,merchant_order_id,currency,base_amount,pay_amount,status,note_code,callback_url,return_url,created_at,expires_at)
|
||||||
|
VALUES(?,?,?,?,?,?,?,?,?,?,?,?)`,
|
||||||
|
o.ID, o.Token, o.MerchantOrderID, o.Currency, o.BaseAmount, o.PayAmount, o.Status, o.NoteCode,
|
||||||
|
o.CallbackURL, o.ReturnURL, o.CreatedAt, o.ExpiresAt)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
return o, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Finish 用一笔币安流水核销订单（paid 或 underpaid）。以币安 orderId 幂等：已消费返回 false。
|
||||||
|
func (s *Store) Finish(o *Order, status, matchedBy, binanceOrderID, binanceTxnID, payerID, payerName string, actual int64, cooldownSec int64) (bool, error) {
|
||||||
|
s.mu.Lock()
|
||||||
|
defer s.mu.Unlock()
|
||||||
|
now := nowMs()
|
||||||
|
tx, err := s.db.Begin()
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
defer tx.Rollback()
|
||||||
|
if _, err := tx.Exec(`INSERT INTO consumed(binance_order_id,order_id,at) VALUES(?,?,?)`, binanceOrderID, o.ID, now); err != nil {
|
||||||
|
return false, nil // 已被消费（唯一键冲突），不视为错误
|
||||||
|
}
|
||||||
|
res, err := tx.Exec(`UPDATE orders SET status=?, matched_by=?, binance_order_id=?, binance_txn_id=?, payer_id=?, payer_name=?,
|
||||||
|
actual_amount=?, paid_at=?, overpaid=? WHERE id=? AND status IN ('pending','expired')`,
|
||||||
|
status, matchedBy, binanceOrderID, binanceTxnID, payerID, payerName,
|
||||||
|
actual, now, boolInt(actual > o.PayAmount), o.ID)
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
n, _ := res.RowsAffected()
|
||||||
|
if n == 0 {
|
||||||
|
return false, nil // 订单已被其他流水处理
|
||||||
|
}
|
||||||
|
if _, err := tx.Exec(`INSERT OR REPLACE INTO cooldown(currency,amount,until) VALUES(?,?,?)`,
|
||||||
|
o.Currency, o.PayAmount, now+cooldownSec*1000); err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
event := status // paid / underpaid
|
||||||
|
if _, err := tx.Exec(`INSERT INTO callbacks(order_id,event,next_at) VALUES(?,?,?)`, o.ID, event, now); err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
if err := tx.Commit(); err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func boolInt(b bool) int {
|
||||||
|
if b {
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
// ExpireDue 把到期订单置为 expired，并入冷却、发回调。返回处理条数。
|
||||||
|
func (s *Store) ExpireDue(cooldownSec int64) (int, error) {
|
||||||
|
s.mu.Lock()
|
||||||
|
defer s.mu.Unlock()
|
||||||
|
now := nowMs()
|
||||||
|
rows, err := s.db.Query(`SELECT `+orderCols+` FROM orders WHERE status='pending' AND expires_at < ?`, now)
|
||||||
|
if err != nil {
|
||||||
|
return 0, err
|
||||||
|
}
|
||||||
|
var due []*Order
|
||||||
|
for rows.Next() {
|
||||||
|
o, err := scanOrder(rows)
|
||||||
|
if err != nil {
|
||||||
|
rows.Close()
|
||||||
|
return 0, err
|
||||||
|
}
|
||||||
|
due = append(due, o)
|
||||||
|
}
|
||||||
|
rows.Close()
|
||||||
|
for _, o := range due {
|
||||||
|
tx, err := s.db.Begin()
|
||||||
|
if err != nil {
|
||||||
|
return 0, err
|
||||||
|
}
|
||||||
|
if _, err := tx.Exec(`UPDATE orders SET status='expired' WHERE id=? AND status='pending'`, o.ID); err != nil {
|
||||||
|
tx.Rollback()
|
||||||
|
return 0, err
|
||||||
|
}
|
||||||
|
if _, err := tx.Exec(`INSERT OR REPLACE INTO cooldown(currency,amount,until) VALUES(?,?,?)`,
|
||||||
|
o.Currency, o.PayAmount, now+cooldownSec*1000); err != nil {
|
||||||
|
tx.Rollback()
|
||||||
|
return 0, err
|
||||||
|
}
|
||||||
|
if _, err := tx.Exec(`INSERT INTO callbacks(order_id,event,next_at) VALUES(?, 'expired', ?)`, o.ID, now); err != nil {
|
||||||
|
tx.Rollback()
|
||||||
|
return 0, err
|
||||||
|
}
|
||||||
|
if err := tx.Commit(); err != nil {
|
||||||
|
return 0, err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return len(due), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// CloseOrder 商户主动关单。
|
||||||
|
func (s *Store) CloseOrder(id string, cooldownSec int64) (*Order, error) {
|
||||||
|
s.mu.Lock()
|
||||||
|
defer s.mu.Unlock()
|
||||||
|
o, err := s.OrderByID(id)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if o.Status != "pending" {
|
||||||
|
return nil, ErrState
|
||||||
|
}
|
||||||
|
now := nowMs()
|
||||||
|
tx, err := s.db.Begin()
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
defer tx.Rollback()
|
||||||
|
if _, err := tx.Exec(`UPDATE orders SET status='closed' WHERE id=? AND status='pending'`, id); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if _, err := tx.Exec(`INSERT OR REPLACE INTO cooldown(currency,amount,until) VALUES(?,?,?)`,
|
||||||
|
o.Currency, o.PayAmount, now+cooldownSec*1000); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
if err := tx.Commit(); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
o.Status = "closed"
|
||||||
|
return o, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *Store) Consumed(binanceOrderID string) (bool, error) {
|
||||||
|
var x string
|
||||||
|
err := s.db.QueryRow(`SELECT order_id FROM consumed WHERE binance_order_id=?`, binanceOrderID).Scan(&x)
|
||||||
|
if errors.Is(err, sql.ErrNoRows) {
|
||||||
|
return false, nil
|
||||||
|
}
|
||||||
|
if err != nil {
|
||||||
|
return false, err
|
||||||
|
}
|
||||||
|
return true, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *Store) DueCallbacks(limit int) ([]cbJob, error) {
|
||||||
|
rows, err := s.db.Query(`SELECT id,order_id,event,attempt FROM callbacks WHERE done=0 AND next_at<=? ORDER BY id LIMIT ?`, nowMs(), limit)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
defer rows.Close()
|
||||||
|
var out []cbJob
|
||||||
|
for rows.Next() {
|
||||||
|
var j cbJob
|
||||||
|
if err := rows.Scan(&j.ID, &j.OrderID, &j.Event, &j.Attempt); err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
out = append(out, j)
|
||||||
|
}
|
||||||
|
return out, rows.Err()
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *Store) CallbackDone(id int64) error {
|
||||||
|
_, err := s.db.Exec(`UPDATE callbacks SET done=1, last_err='' WHERE id=?`, id)
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *Store) CallbackRetry(id int64, attempt int, nextAt int64, lastErr string, giveUp bool) error {
|
||||||
|
if giveUp {
|
||||||
|
_, err := s.db.Exec(`UPDATE callbacks SET done=1, attempt=?, last_err=? WHERE id=?`, attempt, "GIVE_UP: "+lastErr, id)
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
_, err := s.db.Exec(`UPDATE callbacks SET attempt=?, next_at=?, last_err=? WHERE id=?`, attempt, nextAt, lastErr, id)
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *Store) String() string { return fmt.Sprintf("Store(%p)", s.db) }
|
||||||
@@ -0,0 +1,93 @@
|
|||||||
|
<!doctype html>
|
||||||
|
<html lang="zh-CN">
|
||||||
|
<head>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||||
|
<title>订单支付</title>
|
||||||
|
<style>
|
||||||
|
:root{--bg:#f6f7f9;--card:#fff;--fg:#16181d;--muted:#6b7280;--brand:#f0b90b;--ok:#16a34a;--err:#dc2626;--line:#e5e7eb}
|
||||||
|
@media(prefers-color-scheme:dark){:root{--bg:#101216;--card:#181b21;--fg:#e7e9ee;--muted:#9aa1ad;--line:#2a2f38}}
|
||||||
|
*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--fg);font:15px/1.6 -apple-system,"PingFang SC","Microsoft YaHei",sans-serif}
|
||||||
|
.wrap{max-width:460px;margin:0 auto;padding:20px 16px 40px}
|
||||||
|
.card{background:var(--card);border:1px solid var(--line);border-radius:14px;padding:20px;margin-bottom:14px}
|
||||||
|
h1{font-size:17px;margin:0 0 4px}.muted{color:var(--muted);font-size:13px}
|
||||||
|
.amt{font-size:34px;font-weight:700;margin:10px 0 2px;word-break:break-all}
|
||||||
|
.amt small{font-size:16px;font-weight:600;margin-left:4px}
|
||||||
|
.row{display:flex;justify-content:space-between;align-items:center;padding:9px 0;border-top:1px dashed var(--line);gap:10px}
|
||||||
|
.row:first-of-type{border-top:none}
|
||||||
|
.k{color:var(--muted);font-size:13px;white-space:nowrap}.v{font-weight:600;word-break:break-all;text-align:right}
|
||||||
|
button{border:0;border-radius:9px;padding:9px 14px;font-size:13px;cursor:pointer;background:var(--brand);color:#111;font-weight:600}
|
||||||
|
button.ghost{background:transparent;border:1px solid var(--line);color:var(--fg)}
|
||||||
|
.copy{padding:3px 10px;font-size:12px;margin-left:6px;background:transparent;border:1px solid var(--line);color:var(--fg)}
|
||||||
|
.qr{display:block;margin:12px auto 4px;width:210px;max-width:80%;border-radius:10px}
|
||||||
|
.tip{background:rgba(240,185,11,.12);border:1px solid rgba(240,185,11,.4);border-radius:10px;padding:10px 12px;font-size:13px;margin-top:12px}
|
||||||
|
.status{display:flex;align-items:center;gap:8px;font-weight:600}
|
||||||
|
.dot{width:9px;height:9px;border-radius:50%;background:var(--brand);animation:b 1.2s infinite}
|
||||||
|
@keyframes b{50%{opacity:.25}}
|
||||||
|
.paid .dot{background:var(--ok);animation:none}
|
||||||
|
.bad{color:var(--err)}.good{color:var(--ok)}
|
||||||
|
input{width:100%;padding:10px;border:1px solid var(--line);border-radius:9px;background:transparent;color:var(--fg);font-size:14px}
|
||||||
|
details summary{cursor:pointer;color:var(--muted);font-size:13px}
|
||||||
|
#claimMsg{font-size:13px;margin-top:8px}
|
||||||
|
.center{text-align:center}
|
||||||
|
</style>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<div class="wrap">
|
||||||
|
<div class="card center">
|
||||||
|
<h1>请用币安 App「支付」转账</h1>
|
||||||
|
<div class="muted">Binance Pay · 即时到账 · 0 手续费</div>
|
||||||
|
<div class="amt" id="payAmount">{{.PayAmount}}<small>{{.Currency}}</small></div>
|
||||||
|
<div class="muted">请务必按上方金额<strong>一分不差</strong>支付，用于自动确认</div>
|
||||||
|
<button class="copy" onclick="cp('{{.PayAmount}}',this)">复制金额</button>
|
||||||
|
{{if .HasQR}}<img class="qr" src="qr" alt="收款二维码"><div class="muted">币安 App 扫码，或用下方 UID 转账</div>{{end}}
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="card">
|
||||||
|
<div class="row"><span class="k">收款人币安 UID</span><span class="v">{{.UID}}<button class="copy" onclick="cp('{{.UID}}',this)">复制</button></span></div>
|
||||||
|
{{if .Email}}<div class="row"><span class="k">或收款邮箱</span><span class="v">{{.Email}}<button class="copy" onclick="cp('{{.Email}}',this)">复制</button></span></div>{{end}}
|
||||||
|
<div class="row"><span class="k">转账备注（可选）</span><span class="v">{{.NoteCode}}<button class="copy" onclick="cp('{{.NoteCode}}',this)">复制</button></span></div>
|
||||||
|
<div class="row"><span class="k">剩余时间</span><span class="v" id="cd">--:--</span></div>
|
||||||
|
<div class="row"><span class="k">状态</span><span class="v status" id="st"><span class="dot"></span><span id="stTxt">等待支付</span></span></div>
|
||||||
|
<div class="tip">路径：币安 App → 首页「支付」→ 转账 → 输入 UID → 选 {{.Currency}} → 输入金额。备注填 <b>{{.NoteCode}}</b> 可加速确认。</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div class="card">
|
||||||
|
<details>
|
||||||
|
<summary>已付款但长时间未确认？回填币安订单编号</summary>
|
||||||
|
<p class="muted" style="margin:10px 0 6px">币安 App → 支付 → 交易记录 → 点开这笔转账，复制「订单编号」（18 位数字）粘贴到此处：</p>
|
||||||
|
<input id="claimInput" inputmode="numeric" placeholder="例如 452021922068888888">
|
||||||
|
<div style="margin-top:10px"><button onclick="claim()">提交核验</button></div>
|
||||||
|
<div id="claimMsg"></div>
|
||||||
|
</details>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<script>
|
||||||
|
var expiresAt={{.ExpiresAt}}, token={{.Token}}, done=false;
|
||||||
|
function cp(t,btn){navigator.clipboard&&navigator.clipboard.writeText(t).then(function(){var o=btn.textContent;btn.textContent="已复制";setTimeout(function(){btn.textContent=o},1200)})}
|
||||||
|
function tick(){var left=Math.max(0,Math.floor((expiresAt-Date.now())/1000));var m=String(Math.floor(left/60)).padStart(2,"0"),s=String(left%60).padStart(2,"0");document.getElementById("cd").textContent=m+":"+s;if(left<=0&&!done){setTxt("已超时，若已付款请回填订单编号","bad")}}
|
||||||
|
function setTxt(t,cls){var el=document.getElementById("stTxt");el.textContent=t;el.className=cls||""}
|
||||||
|
function onPaid(d){done=true;document.getElementById("st").classList.add("paid");setTxt("支付成功 ✓","good");if(d.redirect){setTimeout(function(){location.href=d.redirect},1500)}}
|
||||||
|
function poll(){if(done)return;fetch("status",{cache:"no-store"}).then(function(r){return r.json()}).then(function(d){
|
||||||
|
if(d.status==="paid"){onPaid(d)}
|
||||||
|
else if(d.status==="underpaid"){done=true;setTxt("实付金额不足，请联系商家处理","bad")}
|
||||||
|
else if(d.status==="expired"){setTxt("订单已过期，若已付款请回填订单编号","bad")}
|
||||||
|
else if(d.status==="closed"){done=true;setTxt("订单已关闭","bad")}
|
||||||
|
}).catch(function(){})}
|
||||||
|
function claim(){var v=document.getElementById("claimInput").value.trim();var msg=document.getElementById("claimMsg");
|
||||||
|
if(!/^[0-9]{6,20}$/.test(v)){msg.textContent="请输入 6~20 位数字订单编号";msg.className="bad";return}
|
||||||
|
msg.textContent="核验中…";msg.className="";
|
||||||
|
fetch("claim",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({binance_order_id:v})})
|
||||||
|
.then(function(r){return r.json()}).then(function(d){
|
||||||
|
var c=(d.data&&d.data.code)||d.code;
|
||||||
|
if(c==="OK"){msg.textContent="核验成功，订单已支付 ✓";msg.className="good";poll()}
|
||||||
|
else if(c==="UNDERPAID"){msg.textContent="已到账但金额不足，请联系商家";msg.className="bad"}
|
||||||
|
else if(c==="NOT_FOUND"){msg.textContent="未找到这笔入账，请确认编号无误、稍等片刻再试";msg.className="bad"}
|
||||||
|
else if(c==="CONSUMED"){msg.textContent="该笔转账已被使用";msg.className="bad"}
|
||||||
|
else if(c==="ERR_RATE_LIMIT"){msg.textContent="操作过于频繁，请稍后再试";msg.className="bad"}
|
||||||
|
else{msg.textContent="核验失败："+(d.message||c||"未知错误");msg.className="bad"}
|
||||||
|
}).catch(function(){msg.textContent="网络错误，请重试";msg.className="bad"})}
|
||||||
|
tick();setInterval(tick,1000);poll();setInterval(poll,3000);
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
+119
@@ -0,0 +1,119 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"crypto/rand"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"strings"
|
||||||
|
"time"
|
||||||
|
)
|
||||||
|
|
||||||
|
const scale = int64(100000000) // 1e8，金额内部一律用 1e-8 定点整数，避免浮点误差
|
||||||
|
|
||||||
|
func nowMs() int64 { return time.Now().UnixMilli() }
|
||||||
|
|
||||||
|
// parseAmount 把十进制字符串解析为 1e-8 定点整数。拒绝科学计数法、超 8 位小数、非法字符。
|
||||||
|
func parseAmount(s string) (int64, error) {
|
||||||
|
s = strings.TrimSpace(s)
|
||||||
|
neg := false
|
||||||
|
if strings.HasPrefix(s, "-") {
|
||||||
|
neg = true
|
||||||
|
s = s[1:]
|
||||||
|
}
|
||||||
|
if s == "" {
|
||||||
|
return 0, errors.New("empty amount")
|
||||||
|
}
|
||||||
|
intPart, frac := s, ""
|
||||||
|
if i := strings.IndexByte(s, '.'); i >= 0 {
|
||||||
|
intPart, frac = s[:i], s[i+1:]
|
||||||
|
}
|
||||||
|
if intPart == "" {
|
||||||
|
intPart = "0"
|
||||||
|
}
|
||||||
|
if len(frac) > 8 {
|
||||||
|
return 0, errors.New("more than 8 decimals")
|
||||||
|
}
|
||||||
|
for _, c := range intPart + frac {
|
||||||
|
if c < '0' || c > '9' {
|
||||||
|
return 0, errors.New("invalid amount")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
var v int64
|
||||||
|
for _, c := range intPart {
|
||||||
|
v = v*10 + int64(c-'0')
|
||||||
|
if v > (int64(1)<<62)/scale {
|
||||||
|
return 0, errors.New("amount too large")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
v *= scale
|
||||||
|
f := int64(0)
|
||||||
|
for _, c := range frac {
|
||||||
|
f = f*10 + int64(c-'0')
|
||||||
|
}
|
||||||
|
for i := len(frac); i < 8; i++ {
|
||||||
|
f *= 10
|
||||||
|
}
|
||||||
|
v += f
|
||||||
|
if neg {
|
||||||
|
v = -v
|
||||||
|
}
|
||||||
|
return v, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// fmtAmount 定点整数转字符串，去掉小数尾零。
|
||||||
|
func fmtAmount(v int64) string {
|
||||||
|
neg := v < 0
|
||||||
|
if neg {
|
||||||
|
v = -v
|
||||||
|
}
|
||||||
|
ip := v / scale
|
||||||
|
fp := v % scale
|
||||||
|
s := fmt.Sprintf("%d", ip)
|
||||||
|
if fp > 0 {
|
||||||
|
fs := strings.TrimRight(fmt.Sprintf("%08d", fp), "0")
|
||||||
|
s = s + "." + fs
|
||||||
|
}
|
||||||
|
if neg {
|
||||||
|
s = "-" + s
|
||||||
|
}
|
||||||
|
return s
|
||||||
|
}
|
||||||
|
|
||||||
|
// decimalsOf 返回该定点金额实际用到的小数位数。
|
||||||
|
func decimalsOf(v int64) int {
|
||||||
|
if v < 0 {
|
||||||
|
v = -v
|
||||||
|
}
|
||||||
|
fp := v % scale
|
||||||
|
if fp == 0 {
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
d := 8
|
||||||
|
for fp%10 == 0 {
|
||||||
|
fp /= 10
|
||||||
|
d--
|
||||||
|
}
|
||||||
|
return d
|
||||||
|
}
|
||||||
|
|
||||||
|
const idAlphabet = "0123456789abcdefghjkmnpqrstvwxyz"
|
||||||
|
|
||||||
|
// codeAlphabet 去掉了易混淆的 0O1IL
|
||||||
|
const codeAlphabet = "ABCDEFGHJKMNPQRSTUVWXYZ23456789"
|
||||||
|
|
||||||
|
func randString(alphabet string, n int) string {
|
||||||
|
b := make([]byte, n)
|
||||||
|
if _, err := rand.Read(b); err != nil {
|
||||||
|
panic(err)
|
||||||
|
}
|
||||||
|
out := make([]byte, n)
|
||||||
|
for i, c := range b {
|
||||||
|
out[i] = alphabet[int(c)%len(alphabet)]
|
||||||
|
}
|
||||||
|
return string(out)
|
||||||
|
}
|
||||||
|
|
||||||
|
func newOrderID() string { return "o" + randString(idAlphabet, 25) }
|
||||||
|
func newToken() string { return randString(idAlphabet, 26) }
|
||||||
|
func newNoteCode() string { return randString(codeAlphabet, 6) }
|
||||||
|
func newNonce() string { return randString(idAlphabet, 24) }
|
||||||
@@ -0,0 +1,48 @@
|
|||||||
|
package main
|
||||||
|
|
||||||
|
import "testing"
|
||||||
|
|
||||||
|
func TestParseFmtAmount(t *testing.T) {
|
||||||
|
cases := []struct {
|
||||||
|
in string
|
||||||
|
want int64
|
||||||
|
err bool
|
||||||
|
}{
|
||||||
|
{"9500", 950000000000, false},
|
||||||
|
{"0.1234", 12340000, false},
|
||||||
|
{"10.0037", 1000370000, false},
|
||||||
|
{"0.00000001", 1, false},
|
||||||
|
{"-1", -100000000, false},
|
||||||
|
{"1.123456789", 0, true},
|
||||||
|
{"abc", 0, true},
|
||||||
|
{"", 0, true},
|
||||||
|
{"1e5", 0, true},
|
||||||
|
}
|
||||||
|
for _, c := range cases {
|
||||||
|
got, err := parseAmount(c.in)
|
||||||
|
if c.err {
|
||||||
|
if err == nil {
|
||||||
|
t.Errorf("parseAmount(%q) 应报错", c.in)
|
||||||
|
}
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
if err != nil || got != c.want {
|
||||||
|
t.Errorf("parseAmount(%q)=%d,%v want %d", c.in, got, err, c.want)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
for _, s := range []string{"9500", "0.1234", "10.0037", "0.00000001", "1"} {
|
||||||
|
v, _ := parseAmount(s)
|
||||||
|
if fmtAmount(v) != s {
|
||||||
|
t.Errorf("roundtrip %q → %q", s, fmtAmount(v))
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if fmtAmount(1000370000) != "10.0037" {
|
||||||
|
t.Errorf("fmtAmount 尾零处理错误: %s", fmtAmount(1000370000))
|
||||||
|
}
|
||||||
|
if d := decimalsOf(1000370000); d != 4 {
|
||||||
|
t.Errorf("decimalsOf=%d want 4", d)
|
||||||
|
}
|
||||||
|
if d := decimalsOf(950000000000); d != 0 {
|
||||||
|
t.Errorf("decimalsOf=%d want 0", d)
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,190 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
"""
|
||||||
|
币安支付（Binance Pay）流水探测脚本 —— 验证“个人账户 + 官方只读 API”方案是否可行。
|
||||||
|
|
||||||
|
调用官方接口: GET /sapi/v1/pay/transactions (签名接口, 权重 3000/UID, 默认最近 90 天)
|
||||||
|
文档: https://developers.binance.com/docs/pay/rest-api
|
||||||
|
|
||||||
|
用法（二选一）:
|
||||||
|
A. 环境变量:
|
||||||
|
export BINANCE_API_KEY=你的APIKey
|
||||||
|
export BINANCE_API_SECRET=你的Secret # 只需勾选 "Enable Reading"，不要开交易/提现权限
|
||||||
|
export BINANCE_UID=你的币安UID # 可选，用于判定收/付方向
|
||||||
|
B. 密钥文件（推荐，密钥不经过任何对话/终端历史）:
|
||||||
|
~/.binance_pay_probe.env 内容三行: BINANCE_API_KEY=... BINANCE_API_SECRET=... BINANCE_UID=...
|
||||||
|
chmod 600 ~/.binance_pay_probe.env
|
||||||
|
（可用 BINANCE_PROBE_ENV=/path/to/file 指定其他路径）
|
||||||
|
|
||||||
|
python3 tools/pay_history_probe.py --days 30 # 打印最近 30 天 Pay 流水
|
||||||
|
python3 tools/pay_history_probe.py --watch 5 # 每 5 秒轮询，打印新出现的收款
|
||||||
|
|
||||||
|
脚本从不打印密钥；测完请在币安后台删除该 API Key 并删掉密钥文件。
|
||||||
|
|
||||||
|
只用标准库，不依赖第三方包。
|
||||||
|
"""
|
||||||
|
from __future__ import annotations
|
||||||
|
|
||||||
|
import argparse
|
||||||
|
import hashlib
|
||||||
|
import hmac
|
||||||
|
import json
|
||||||
|
import os
|
||||||
|
import sys
|
||||||
|
import time
|
||||||
|
import urllib.error
|
||||||
|
import urllib.parse
|
||||||
|
import urllib.request
|
||||||
|
from datetime import datetime
|
||||||
|
|
||||||
|
BASE_URLS = [
|
||||||
|
"https://api.binance.com",
|
||||||
|
"https://api1.binance.com",
|
||||||
|
"https://api-gcp.binance.com",
|
||||||
|
]
|
||||||
|
|
||||||
|
WALLET_NAMES = {1: "Funding", 2: "Spot", 3: "Fiat", 4: "Card", 5: "Earn", 6: "Card"}
|
||||||
|
|
||||||
|
DEFAULT_ENV_FILE = os.path.expanduser("~/.binance_pay_probe.env")
|
||||||
|
|
||||||
|
|
||||||
|
def load_env_file() -> None:
|
||||||
|
"""若环境变量缺失，则从密钥文件读取 KEY=VALUE 行；不打印任何值。"""
|
||||||
|
path = os.environ.get("BINANCE_PROBE_ENV", DEFAULT_ENV_FILE)
|
||||||
|
if os.environ.get("BINANCE_API_KEY") and os.environ.get("BINANCE_API_SECRET"):
|
||||||
|
return
|
||||||
|
if not os.path.isfile(path):
|
||||||
|
return
|
||||||
|
mode = os.stat(path).st_mode & 0o777
|
||||||
|
if mode & 0o077:
|
||||||
|
print(f"[warn] {path} 权限为 {oct(mode)}，建议 chmod 600", file=sys.stderr)
|
||||||
|
with open(path, encoding="utf-8") as f:
|
||||||
|
for line in f:
|
||||||
|
line = line.strip()
|
||||||
|
if not line or line.startswith("#") or "=" not in line:
|
||||||
|
continue
|
||||||
|
k, v = line.split("=", 1)
|
||||||
|
k, v = k.strip(), v.strip().strip('"').strip("'")
|
||||||
|
if k in ("BINANCE_API_KEY", "BINANCE_API_SECRET", "BINANCE_UID") and v:
|
||||||
|
os.environ.setdefault(k, v)
|
||||||
|
|
||||||
|
|
||||||
|
def signed_get(path: str, params: dict, key: str, secret: str) -> dict:
|
||||||
|
params = dict(params)
|
||||||
|
params["timestamp"] = int(time.time() * 1000)
|
||||||
|
params.setdefault("recvWindow", 10000)
|
||||||
|
query = urllib.parse.urlencode(params)
|
||||||
|
sig = hmac.new(secret.encode(), query.encode(), hashlib.sha256).hexdigest()
|
||||||
|
last_err = None
|
||||||
|
for base in BASE_URLS:
|
||||||
|
url = f"{base}{path}?{query}&signature={sig}"
|
||||||
|
req = urllib.request.Request(url, headers={"X-MBX-APIKEY": key})
|
||||||
|
try:
|
||||||
|
with urllib.request.urlopen(req, timeout=15) as resp:
|
||||||
|
return json.loads(resp.read().decode())
|
||||||
|
except urllib.error.HTTPError as e:
|
||||||
|
body = e.read().decode(errors="replace")
|
||||||
|
# 4xx 是账号/参数/权限问题，换域名没意义，直接抛出
|
||||||
|
if 400 <= e.code < 500:
|
||||||
|
raise SystemExit(f"HTTP {e.code} from {base}: {body}")
|
||||||
|
last_err = f"HTTP {e.code} from {base}: {body}"
|
||||||
|
except (urllib.error.URLError, TimeoutError) as e:
|
||||||
|
last_err = f"{base}: {e}"
|
||||||
|
raise SystemExit(f"所有接入点均失败: {last_err}")
|
||||||
|
|
||||||
|
|
||||||
|
def fetch_pay_transactions(key, secret, start_ms=None, end_ms=None, limit=100):
|
||||||
|
params = {"limit": limit}
|
||||||
|
if start_ms is not None:
|
||||||
|
params["startTime"] = start_ms
|
||||||
|
if end_ms is not None:
|
||||||
|
params["endTime"] = end_ms
|
||||||
|
data = signed_get("/sapi/v1/pay/transactions", params, key, secret)
|
||||||
|
if not data.get("success", False) and data.get("code") != "000000":
|
||||||
|
raise SystemExit(f"接口返回失败: {json.dumps(data, ensure_ascii=False)}")
|
||||||
|
return data.get("data", [])
|
||||||
|
|
||||||
|
|
||||||
|
def direction(tx: dict, my_uid: str | None) -> str:
|
||||||
|
recv = (tx.get("receiverInfo") or {}).get("binanceId")
|
||||||
|
payer = (tx.get("payerInfo") or {}).get("binanceId")
|
||||||
|
if my_uid:
|
||||||
|
if str(recv) == my_uid:
|
||||||
|
return "收款 IN "
|
||||||
|
if str(payer) == my_uid:
|
||||||
|
return "付款 OUT"
|
||||||
|
amt = str(tx.get("amount", ""))
|
||||||
|
if amt.startswith("-"):
|
||||||
|
return "付款 OUT"
|
||||||
|
return "? "
|
||||||
|
|
||||||
|
|
||||||
|
def fmt(tx: dict, my_uid: str | None) -> str:
|
||||||
|
ts = datetime.fromtimestamp(tx.get("transactionTime", 0) / 1000).strftime("%Y-%m-%d %H:%M:%S")
|
||||||
|
payer = tx.get("payerInfo") or {}
|
||||||
|
recv = tx.get("receiverInfo") or {}
|
||||||
|
wallets = ",".join(WALLET_NAMES.get(w, str(w)) for w in (tx.get("walletTypes") or [tx.get("walletType")]) if w)
|
||||||
|
return (
|
||||||
|
f"{ts} | {direction(tx, my_uid)} | {tx.get('orderType'):<10} | "
|
||||||
|
f"{tx.get('amount'):>16} {tx.get('currency'):<6} | wallet={wallets:<12} | "
|
||||||
|
f"payer={payer.get('name')}({payer.get('type')},uid={payer.get('binanceId')}) -> "
|
||||||
|
f"recv={recv.get('name')}(uid={recv.get('binanceId')}) | txId={tx.get('transactionId')} | "
|
||||||
|
f"orderId={tx.get('orderId')} | cp={tx.get('counterpartyId')} | note={tx.get('note')!r}"
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
def main():
|
||||||
|
ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
|
||||||
|
ap.add_argument("--days", type=int, default=30, help="回溯天数 (<=90)，默认 30")
|
||||||
|
ap.add_argument("--watch", type=int, metavar="SECONDS", help="轮询模式：每 N 秒拉一次，打印新出现的流水")
|
||||||
|
ap.add_argument("--raw", action="store_true", help="同时打印原始 JSON（用于确认字段）")
|
||||||
|
args = ap.parse_args()
|
||||||
|
|
||||||
|
load_env_file()
|
||||||
|
key = os.environ.get("BINANCE_API_KEY")
|
||||||
|
secret = os.environ.get("BINANCE_API_SECRET")
|
||||||
|
my_uid = os.environ.get("BINANCE_UID")
|
||||||
|
if not key or not secret:
|
||||||
|
sys.exit("未找到密钥：请设置环境变量 BINANCE_API_KEY / BINANCE_API_SECRET，"
|
||||||
|
f"或创建密钥文件 {DEFAULT_ENV_FILE}（见脚本头部说明）")
|
||||||
|
|
||||||
|
if args.watch:
|
||||||
|
seen = set()
|
||||||
|
first = True
|
||||||
|
print(f"[watch] 每 {args.watch}s 轮询一次（接口权重 3000/次，UID 限额 180000/分钟，最快约 1 次/秒）")
|
||||||
|
while True:
|
||||||
|
try:
|
||||||
|
txs = fetch_pay_transactions(key, secret, start_ms=int((time.time() - 3600) * 1000))
|
||||||
|
except SystemExit as e:
|
||||||
|
print(f"[error] {e}")
|
||||||
|
time.sleep(args.watch)
|
||||||
|
continue
|
||||||
|
for tx in sorted(txs, key=lambda t: t.get("transactionTime", 0)):
|
||||||
|
tid = tx.get("transactionId")
|
||||||
|
if tid in seen:
|
||||||
|
continue
|
||||||
|
seen.add(tid)
|
||||||
|
if not first:
|
||||||
|
print("[NEW] " + fmt(tx, my_uid))
|
||||||
|
if args.raw:
|
||||||
|
print(json.dumps(tx, ensure_ascii=False, indent=2))
|
||||||
|
if first:
|
||||||
|
print(f"[watch] 初始基线 {len(seen)} 条（最近 1 小时），等待新流水…")
|
||||||
|
first = False
|
||||||
|
time.sleep(args.watch)
|
||||||
|
|
||||||
|
days = max(1, min(args.days, 90))
|
||||||
|
end_ms = int(time.time() * 1000)
|
||||||
|
start_ms = end_ms - days * 86400 * 1000
|
||||||
|
txs = fetch_pay_transactions(key, secret, start_ms=start_ms, end_ms=end_ms)
|
||||||
|
print(f"最近 {days} 天共 {len(txs)} 条 Pay 流水（单次最多 100 条）")
|
||||||
|
for tx in sorted(txs, key=lambda t: t.get("transactionTime", 0)):
|
||||||
|
print(fmt(tx, my_uid))
|
||||||
|
if args.raw:
|
||||||
|
print(json.dumps(txs, ensure_ascii=False, indent=2))
|
||||||
|
if not txs:
|
||||||
|
print("\n提示：返回为空可能是 (a) 该时间段确实没有 Pay 交易 (b) 账号所在地区不支持 Binance Pay，"
|
||||||
|
"建议先用 App 给自己/朋友转 0.1 USDT 做一笔 C2C 后再跑一次。")
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
main()
|
||||||
Reference in new issue
Block a user