34 lines
1.6 KiB
Go
34 lines
1.6 KiB
Go
package payment
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestChinaumsCallbackAuthorizationVerification(t *testing.T) {
|
|
profile := &vendorPaymentAdapter{profile: vendorChinaums}
|
|
config := map[string]any{"app_id": "china-app", "app_key": "china-secret"}
|
|
raw := []byte(`{"status":"SUCCESS","trade_no":"T-1"}`)
|
|
timestamp, nonceValue := "1700000000", "nonce-1"
|
|
digest := sha256.Sum256([]byte("china-app" + timestamp + nonceValue + string(raw) + "china-secret"))
|
|
headers := map[string]string{
|
|
"authorization": "OPEN-BODY-SIG AppId=china-app, Timestamp=" + timestamp + ", Nonce=" + nonceValue + ", Signature=" + hex.EncodeToString(digest[:]),
|
|
}
|
|
if err := profile.verify(nil, raw, headers, config); err != nil {
|
|
t.Fatalf("valid Chinaums callback rejected: %v", err)
|
|
}
|
|
if err := profile.verify(nil, []byte(`{"status":"FAILED","trade_no":"T-1"}`), headers, config); err == nil {
|
|
t.Fatal("tampered Chinaums callback accepted")
|
|
}
|
|
missingNonce := map[string]string{"Authorization": "OPEN-BODY-SIG AppId=china-app, Timestamp=" + timestamp + ", Signature=" + hex.EncodeToString(digest[:])}
|
|
if err := profile.verify(nil, raw, missingNonce, config); err == nil || !strings.Contains(err.Error(), "信息不完整") {
|
|
t.Fatalf("missing Chinaums signature component error = %v", err)
|
|
}
|
|
mismatchedApp := map[string]string{"Authorization": "OPEN-BODY-SIG AppId=other-app, Timestamp=" + timestamp + ", Nonce=" + nonceValue + ", Signature=" + hex.EncodeToString(digest[:])}
|
|
if err := profile.verify(nil, raw, mismatchedApp, config); err == nil || !strings.Contains(err.Error(), "AppId") {
|
|
t.Fatalf("mismatched Chinaums AppId error = %v", err)
|
|
}
|
|
}
|