按商户订单号查单并验证响应

import { readFileSync } from 'node:fs';
import { constants, randomBytes, sign, verify } from 'node:crypto';
const required = (name) => {
  const value = process.env[name];
  if (!value) throw new Error(`缺少环境变量 ${name}`);
  return value;
};
const mchid = required('WX_MCH_ID');
const mchSerial = required('WX_MCH_SERIAL');
const payPublicKeyId = required('WX_PAY_PUBLIC_KEY_ID');
if (!/^\d+$/.test(mchid)) throw new Error('商户号应为数字字符串');
if (!/^[A-Fa-f0-9]+$/.test(mchSerial)) throw new Error('请填写真实商户 API 证书序列号');
if (!/^PUB_KEY_ID_\d+$/.test(payPublicKeyId)) throw new Error('本例仅支持已配置的微信支付公钥模式');
const privateKey = readFileSync(required('WX_PRIVATE_KEY_PATH'));
const payPublicKey = readFileSync(required('WX_PAY_PUBLIC_KEY_PATH'));

const outTradeNo = required('WX_OUT_TRADE_NO');
if (!/^[A-Za-z0-9_\-*|@]{6,32}$/.test(outTradeNo)) throw new Error('请填写自己的合法商户订单号');
const url = new URL('https://api.mch.weixin.qq.com/v3/pay/transactions/out-trade-no/' + encodeURIComponent(outTradeNo));
url.searchParams.set('mchid', mchid);

const timestamp = String(Math.floor(Date.now() / 1000));
const nonce = randomBytes(16).toString('hex');
// 五行都以换行结束；GET 的最后一行是空 body，仍保留末尾换行。
const message = `GET\n${url.pathname}${url.search}\n${timestamp}\n${nonce}\n\n`;
const signature = sign('RSA-SHA256', Buffer.from(message), {
  key: privateKey, padding: constants.RSA_PKCS1_PADDING,
}).toString('base64');
const authorization = `WECHATPAY2-SHA256-RSA2048 mchid="${mchid}",nonce_str="${nonce}",timestamp="${timestamp}",serial_no="${mchSerial}",signature="${signature}"`;
const response = await fetch(url, {
  method: 'GET', redirect: 'error', signal: AbortSignal.timeout(20000),
  headers: { Authorization: authorization, Accept: 'application/json',
    'Wechatpay-Serial': payPublicKeyId, 'User-Agent': 'MerchantReadOnlyExample/1.0' },
});
const raw = Buffer.from(await response.arrayBuffer());
if (!response.ok) {
  // 非 2xx 只作为错误提示，不将错误体作为可信业务结果。
  throw new Error(`HTTP ${response.status}: ${raw.toString('utf8')}`);
}
const respSerial = response.headers.get('Wechatpay-Serial');
const respTimestamp = response.headers.get('Wechatpay-Timestamp') || '';
const respNonce = response.headers.get('Wechatpay-Nonce');
const respSignature = response.headers.get('Wechatpay-Signature');
if (respSerial !== payPublicKeyId) throw new Error('验签公钥 ID 不匹配，请从可信渠道核对轮换材料');
if (!/^\d+$/.test(respTimestamp) || !respNonce || !respSignature) throw new Error('响应缺少有效签名头');
if (Math.abs(Date.now() / 1000 - Number(respTimestamp)) > 300) throw new Error('响应时间偏差超过 5 分钟');
// 验签使用收到的原始字节；不能 JSON.parse 后重新序列化再验签。
const verificationMessage = Buffer.concat([
  Buffer.from(`${respTimestamp}\n${respNonce}\n`), raw, Buffer.from('\n'),
]);
const verified = verify('RSA-SHA256', verificationMessage, {
  key: payPublicKey, padding: constants.RSA_PKCS1_PADDING,
}, Buffer.from(respSignature, 'base64'));
if (!verified) throw new Error('响应验签失败，丢弃响应，不更新业务状态');
const data = JSON.parse(raw.toString('utf8'));

if (data.mchid !== mchid || data.out_trade_no !== outTradeNo) throw new Error('返回的商户号或订单号不匹配');
console.log(JSON.stringify({ out_trade_no: data.out_trade_no, transaction_id: data.transaction_id,
  trade_state: data.trade_state, amount: data.amount }, null, 2));
// 正式业务还必须核对 AppID、订单金额和币种，再幂等更新本地订单。