沙箱查询退款请求并验签

import { readFileSync } from 'node:fs';
import { constants, createPrivateKey, createPublicKey, sign, verify } from 'node:crypto';
const required = (name) => {
  const value = process.env[name];
  if (!value) throw new Error(`缺少环境变量 ${name}`);
  return value;
};
const appId = required('ALIPAY_APP_ID');
if (!/^\d{16}$/.test(appId)) throw new Error('请填写自己的沙箱 AppID');
const privateKey = createPrivateKey(readFileSync(required('ALIPAY_PRIVATE_KEY_PATH')));
const alipayKey = createPublicKey(readFileSync(required('ALIPAY_PUBLIC_KEY_PATH')));
if (privateKey.asymmetricKeyType !== 'rsa' || privateKey.asymmetricKeyDetails.modulusLength < 2048) {
  throw new Error('本例需要 RSA 2048 位或更长的应用私钥');
}
// 网关固定为官方当前沙箱；本例不允许配置正式网关。
const gateway = 'https://openapi-sandbox.dl.alipaydev.com/gateway.do';
const outTradeNo = required('ALIPAY_OUT_TRADE_NO');
if (!outTradeNo || outTradeNo.length > 64) throw new Error('商户订单号最长 64 字符');
const outRequestNo = required('ALIPAY_OUT_REQUEST_NO');
if (!outRequestNo || outRequestNo.length > 64) throw new Error('退款请求号最长 64 字符');
const bizContent = { out_trade_no: outTradeNo, out_request_no: outRequestNo };
// 生成北京时间 yyyy-MM-dd HH:mm:ss；机器时钟应保持同步。
const parts = Object.fromEntries(new Intl.DateTimeFormat('en-CA', {
  timeZone: 'Asia/Shanghai', year: 'numeric', month: '2-digit', day: '2-digit',
  hour: '2-digit', minute: '2-digit', second: '2-digit', hourCycle: 'h23',
}).formatToParts(new Date()).map((part) => [part.type, part.value]));
const timestamp = `${parts.year}-${parts.month}-${parts.day} ${parts.hour}:${parts.minute}:${parts.second}`;
const parameters = { app_id: appId, method: 'alipay.trade.fastpay.refund.query', format: 'JSON',
  charset: 'utf-8', sign_type: 'RSA2', timestamp, version: '1.0',
  biz_content: JSON.stringify(bizContent) };
// 先按键名 ASCII 顺序拼接原始值；签名后再做表单 URL 编码。
const signingText = Object.keys(parameters).filter((key) => parameters[key] !== '')
  .sort().map((key) => `${key}=${parameters[key]}`).join('&');
parameters.sign = sign('RSA-SHA256', Buffer.from(signingText, 'utf8'), {
  key: privateKey, padding: constants.RSA_PKCS1_PADDING,
}).toString('base64');
const response = await fetch(gateway, { method: 'POST', redirect: 'error',
  signal: AbortSignal.timeout(20000),
  headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8' },
  body: new URLSearchParams(parameters).toString() });
const raw = await response.text();
if (!response.ok) throw new Error(`HTTP ${response.status}`);
const envelope = JSON.parse(raw);
const responseKey = 'alipay_trade_fastpay_refund_query_response';
if (!envelope[responseKey] || typeof envelope.sign !== 'string') {
  throw new Error('响应缺少预期业务节点或签名，不能作为可信业务结果');
}
// 只提取响应节点的原始 JSON 字符串，不对业务对象重新序列化。
// 扫描时处理 JSON 字符串内的引号与转义，避免正文中的大括号截断节点。
const marker = new RegExp('"' + responseKey + '"\\s*:\\s*').exec(raw);
if (!marker) throw new Error('找不到原始响应节点');
const start = marker.index + marker[0].length;
if (raw[start] !== '{') throw new Error('业务响应节点不是对象');
let depth = 0, inString = false, escaped = false, end = -1;
for (let i = start; i < raw.length; i++) {
  const char = raw[i];
  if (inString) {
    if (escaped) escaped = false;
    else if (char === '\\') escaped = true;
    else if (char === '"') inString = false;
    continue;
  }
  if (char === '"') inString = true;
  else if (char === '{' || char === '[') depth++;
  else if (char === '}' || char === ']') {
    depth--;
    if (depth === 0) { end = i + 1; break; }
  }
}
if (end < 0) throw new Error('业务响应 JSON 不完整');
const signedText = raw.slice(start, end);
if (!verify('RSA-SHA256', Buffer.from(signedText, 'utf8'), {
  key: alipayKey, padding: constants.RSA_PKCS1_PADDING,
}, Buffer.from(envelope.sign, 'base64'))) {
  throw new Error('支付宝响应验签失败，不更新业务记录');
}
// 业务数据仅来自已验签的原始节点，避免重排、转义或未验证字段影响结果。
const result = JSON.parse(signedText);
if (result.code !== '10000') {
  throw new Error(`${result.code}: ${result.sub_code || ''} ${result.sub_msg || result.msg || ''}`);
}
if (result.out_trade_no !== outTradeNo) throw new Error('返回订单号与查询订单不匹配');
if (result.out_request_no !== outRequestNo) throw new Error('返回退款请求号不匹配');
console.log(JSON.stringify({ out_trade_no: result.out_trade_no, out_request_no: result.out_request_no,
  refund_status: result.refund_status || 'NOT_CONFIRMED', refund_amount: result.refund_amount }, null, 2));
// 正式业务还必须核对商户、应用、金额和币种，幂等处理；本例只输出沙箱查询结果。