修改支付相关

internal/integration/payment/wechat_v3.go

@@ -418,23 +418,10 @@ func newWechatV3Client(c map[string]any, endpointKey string) (*gopayWechatV3.Cli
 		return nil, err
 	}
 
-	platformCert := firstAny(c, "platform_cert", "platform_certificate", "wechatpay_platform_cert")
-	if platformCert == "" {
-		return nil, errors.New("微信支付 v3 缺少 platform_cert")
-	}
-	platformSerial := firstAny(c, "platform_serial_no", "platform_cert_serial", "wechatpay_serial_no")
-	if platformSerial == "" {
-		platformSerial, err = wechatV3PlatformSerial(platformCert)
-		if err != nil {
-			return nil, err
-		}
-	}
-	if err = client.AutoVerifySignByCert([]byte(platformCert), platformSerial); err != nil {
-		return nil, err
-	}
 	client.SetBodySize(8)
 	client.GetHttpClient().SetTimeout(20 * time.Second)
 
+	endpointConfigured := false
 	if endpointKey != "" {
 		if endpoint := strings.TrimSpace(text(c, endpointKey)); endpoint != "" {
 			parsed, parseErr := url.Parse(endpoint)
@@ -446,15 +433,37 @@ func newWechatV3Client(c map[string]any, endpointKey string) (*gopayWechatV3.Cli
 			}
 			httpClient := client.GetHttpClient()
 			httpClient.SetTransport(&wechatV3EndpointTransport{base: httpClient.HttpClient.Transport, endpoint: parsed})
-			return client, nil
+			endpointConfigured = true
 		}
 	}
-	if baseURL := strings.TrimRight(firstAny(c, "base_url", "api_base_url", "proxy_url"), "/"); baseURL != "" {
-		parsed, parseErr := url.Parse(baseURL)
-		if parseErr != nil || parsed.Scheme == "" || parsed.Host == "" {
-			return nil, errors.New("微信支付 v3 base_url 配置无效")
+	if !endpointConfigured {
+		if baseURL := strings.TrimRight(firstAny(c, "base_url", "api_base_url", "proxy_url"), "/"); baseURL != "" {
+			parsed, parseErr := url.Parse(baseURL)
+			if parseErr != nil || parsed.Scheme == "" || parsed.Host == "" {
+				return nil, errors.New("微信支付 v3 base_url 配置无效")
+			}
+			client.SetProxyHost(baseURL)
+		}
+	}
+
+	platformCert := firstAny(c, "platform_cert", "platform_certificate", "wechatpay_platform_cert")
+	if platformCert == "" {
+		// Fetch the current platform certificates using the merchant credentials.
+		// This client is request-scoped, so avoid starting a background refresher.
+		if err = client.AutoVerifySign(false); err != nil {
+			return nil, fmt.Errorf("微信支付 v3 自动获取平台证书失败: %w", err)
+		}
+	} else {
+		platformSerial := firstAny(c, "platform_serial_no", "platform_cert_serial", "wechatpay_serial_no")
+		if platformSerial == "" {
+			platformSerial, err = wechatV3PlatformSerial(platformCert)
+			if err != nil {
+				return nil, err
+			}
+		}
+		if err = client.AutoVerifySignByCert([]byte(platformCert), platformSerial); err != nil {
+			return nil, err
 		}
-		client.SetProxyHost(baseURL)
 	}
 	return client, nil
 }

internal/integration/payment/wechat_v3_certificate_test.go

@@ -0,0 +1,79 @@
+package payment
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"encoding/base64"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestWechatV3WithoutPlatformCertificateLoadsVerificationKey(t *testing.T) {
+	_, merchantPrivatePEM, _ := testRSAKeyPair(t)
+	_, _, platformPublicPEM := testRSAKeyPair(t)
+	apiV3Key := "01234567890123456789012345678901"
+	block, err := aes.NewCipher([]byte(apiV3Key))
+	if err != nil {
+		t.Fatal(err)
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		t.Fatal(err)
+	}
+	nonce, associatedData := "0123456789ab", "certificate"
+	ciphertext := base64.StdEncoding.EncodeToString(gcm.Seal(nil, []byte(nonce), []byte(platformPublicPEM), []byte(associatedData)))
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/v3/certificates" {
+			t.Errorf("unexpected path %q", r.URL.Path)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{"data": []any{map[string]any{
+			"serial_no":      "platform-serial",
+			"effective_time": time.Now().Add(-time.Hour).Format(time.RFC3339),
+			"expire_time":    time.Now().Add(24 * time.Hour).Format(time.RFC3339),
+			"encrypt_certificate": map[string]any{
+				"algorithm": "AEAD_AES_256_GCM", "nonce": nonce,
+				"associated_data": associatedData, "ciphertext": ciphertext,
+			},
+		}}})
+	}))
+	defer server.Close()
+
+	client, err := newWechatV3Client(map[string]any{
+		"merchant_id": "merchant", "serial_no": "merchant-serial",
+		"api_v3_key": apiV3Key, "private_key": merchantPrivatePEM,
+		"create_url": server.URL,
+	}, "create_url")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if client.WxPublicKeyMap()["platform-serial"] == nil {
+		t.Fatal("fetched platform key was not installed for signature verification")
+	}
+}
+
+func TestWechatV3WithoutPlatformCertificateFetchesFromConfiguredEndpoint(t *testing.T) {
+	_, merchantPrivatePEM, _ := testRSAKeyPair(t)
+	requestPath := ""
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requestPath = r.URL.Path
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}))
+	defer server.Close()
+
+	_, err := newWechatV3Client(map[string]any{
+		"merchant_id": "merchant", "serial_no": "merchant-serial",
+		"api_v3_key":  "01234567890123456789012345678901",
+		"private_key": merchantPrivatePEM, "create_url": server.URL,
+	}, "create_url")
+	if requestPath != "/v3/certificates" {
+		t.Fatalf("certificate request path = %q", requestPath)
+	}
+	if err == nil || !strings.Contains(err.Error(), "自动获取平台证书失败") {
+		t.Fatalf("certificate fetch error = %v", err)
+	}
+}