diff --git a/video-gen-api/app/api/v1/payments.py b/video-gen-api/app/api/v1/payments.py index 92c09466..490d2533 100644 --- a/video-gen-api/app/api/v1/payments.py +++ b/video-gen-api/app/api/v1/payments.py @@ -125,11 +125,13 @@ async def wechat_callback(request: Request, db: AsyncSession = Depends(get_db)): timestamp = headers.get("Wechatpay-Timestamp", "") nonce = headers.get("Wechatpay-Nonce", "") signature = headers.get("Wechatpay-Signature", "") + serial_no = headers.get("Wechatpay-Serial", "") # 验证签名:使用平台公钥验证 - if public_key: + if public_key and serial_no: try: - # 使用 wechatpayv3.utils.rsa_verify 验证签名 + # 构造签名串:timestamp + "\n" + nonce + "\n" + body + "\n" + # 符合微信支付官方文档规范:https://pay.weixin.qq.com/doc/v3/merchant/4013053249 is_verified = rsa_verify( timestamp=timestamp, nonce=nonce, @@ -138,13 +140,17 @@ async def wechat_callback(request: Request, db: AsyncSession = Depends(get_db)): public_key=load_public_key(public_key) ) if not is_verified: - logger.warning("WeChat callback signature verification failed") + logger.warning(f"WeChat callback signature verification failed: serial={serial_no}") raise HTTPException(status_code=400, detail="签名验证失败") + logger.debug(f"WeChat callback signature verified: serial={serial_no}") except Exception as e: - logger.warning(f"WeChat signature verification error: {e}") + logger.warning(f"WeChat signature verification error: {e}, serial={serial_no}") raise HTTPException(status_code=400, detail="签名验证失败") else: - logger.warning("WeChat platform public key not configured, skipping signature verification") + if not public_key: + logger.warning("WeChat platform public key not configured, skipping signature verification") + if not serial_no: + logger.warning("Wechatpay-Serial header missing, skipping signature verification") # 解密回调数据:使用 API v3 key import json