支付宝WAP支付接口开发

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

Alipay WAP pay flow

Browzer->+Site: 1. HTTP GET
note over Site: 2. create a new trade
Site->+Alipay: 3. create redirect
Alipay->-Site: 4. Token
note over Site: 5. build auth url
Site->-Browzer: 6. redirect to auth url
Browzer->Alipay: 7. redirect
Alipay->Browzer: 8. trade info
Browzer->Alipay: 9. auth and pay
Alipay->+Site: 10. HTTP POST notify
note over Site: 11. process trade
Site->-Alipay: 12. reply "success"
Alipay->Browzer: 13. pay success
Browzer->Site: 14. goto return url

1
2
3
4
5
6
7

getSign = (obj,key) ->
return null unless obj
arr = ([k,v] for k,v of obj when k isnt 'sign' and v? and v isnt '')
arr.sort()
src = ("#{i[0]}=#{i[1]}" for i in arr).join '&'
src = "#{src}#{key}"
crypto.createHash('md5').update(src,'utf8').digest 'hex'

1
2
3
4
5

getNotitySign = (obj,key) ->
return null unless obj
src = ("#{k}=#{obj[k]}" for k in ["service","v","sec_id","notify_data"]).join '&'
src = "#{src}#{key}"
crypto.createHash('md5').update(src,'utf8').digest 'hex'

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
1617
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

api_url = "http://wappaygw.alipay.com/service/rest.htm"
regexTokenXml = /<request_token>(.*)<\/request_token>/

module.exports = api =

services:
create: "alipay.wap.trade.create.direct"
auth: "alipay.wap.auth.authAndExecute"

toReqData: (name,obj) ->
arr = ["<#{name}>"]
arr.push "<#{k}>#{v}</#{k}>" for k,v of obj
arr.push "</#{name}>"
arr.join ''

createReq: (service,partner,req_data) ->
service : service
format  : 'xml'
v       : '2.0'
partner : partner
sec_id  : 'MD5'
sign    : null
req_data: req_data

parseTokenFromXml: (xml) ->
return null unless xml
m = regexTokenXml.exec xml
m?[1]?.trim()

getSign: (obj,key='') ->
return null unless obj
arr = ([k,v] for k,v of obj when k isnt 'sign' and v? and v isnt '')
arr.sort()
src = ("#{i[0]}=#{i[1]}" for i in arr).join '&'
src = "#{src}#{key}"
crypto.createHash('md5').update(src,'utf8').digest 'hex'

getNotitySign: (obj,key='') ->
return null unless obj
src = ("#{k}=#{obj[k]}" for k in ["service","v","sec_id","notify_data"]).join '&'
src = "#{src}#{key}"
crypto.createHash('md5').update(src,'utf8').digest 'hex'

sendCreate: (req,done) ->
opt =
url: createCreateUrl req
request.get opt, (err,res,body) ->
return done err if err
body = "" unless body
ret = querystring.parse body
body = null
done null,ret

createAuthUrl: (token='',key='') ->
req = api.createReq api.services.auth
req.req_data = "<auth_and_execute_req><request_token>#{token}</request_token></auth_and_execute_req>"
req.sign = api.getSign req, yes
createAuthUrl req

createCreateUrl = (req) ->
url = "#{api_url}?"
url += "req_data=#{encodeURIComponent req.req_data}"
url += "&service=#{encodeURIComponent req.service}"
url += "&sec_id=#{encodeURIComponent req.sec_id}"
url += "&partner=#{encodeURIComponent req.partner}"
url += "&req_id=#{encodeURIComponent req.req_id}"
url += "&sign=#{encodeURIComponent req.sign}"
url += "&format=#{encodeURIComponent req.format}"
url += "&v=#{encodeURIComponent req.v}"
url

createAuthUrl = (req) ->
url = "#{api_url}?"
url += "req_data=#{encodeURIComponent req.req_data}"
url += "&service=#{encodeURIComponent req.service}"
url += "&sec_id=#{encodeURIComponent req.sec_id}"
url += "&partner=#{encodeURIComponent req.partner}"
url += "&sign=#{encodeURIComponent req.sign}"
url += "&format=#{encodeURIComponent req.format}"
url += "&v=#{encodeURIComponent req.v}"
url

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
1617
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

demo.buy = (info,done) ->
return done 'bad user' unless info?.user_id?.length>10
req = api.createReq api.services.create, info.partner
ret =
redirect: ''
token: null
async.series [
(cb) ->
getRequestId req.service,(err,req_id) ->
req.req_id = req_id
cb err
(cb) ->
createTrade info,req.req_id,(err, tradeId) ->
return cb err if err
req.req_data =
subject            : info.subject  # 商品名称
out_trade_no       : tradeId.toString() # 网站订单号
total_fee          : info.total_fee  # 价钱(number)，单位元，例如 0.01 代表1分钱
seller_account_name: info.seller_account_name # 支付宝账号
call_back_url      : info.call_back_url # 支付成功后浏览器跳转地址
notify_url         : info.notify_url # 支付成功支付宝的通知将异步发送到此地址
out_user           : info.user_id # 网站的用户标识
merchant_url       : info.merchant_url # 商品展示页面， 只是实际测试时(ios)发现支付时没地方可以跳到这个页面
req.pay_expire = info.pay_expire if info.pay_expire? # 支付过期时间
req.req_data = api.toReqData 'direct_trade_create_req',req.req_data
req.sign = api.getSign req, info.key
cb null
(cb) ->
api.sendCreate req, (err,res) ->
return cb err if err
return cb 'bad sign from alipay server' unless req.sign is api.getSign req
ret.token = api.parseTokenFromXml res.res_data
ret.redirect = api.createAuthUrl ret.token
storeTradeInfo req.out_trade_no, req.total_fee, ret.token, (err,success) ->
return cb err if err
cb if success then null else 'store trade info fail'
],(err) ->
done err, ret.redirect

1
2
3
4
5
6
78
9
10
11
12
13
14
15

getRequestId = (service, done) ->
sql = "insert into alipay_requests(service,create_time,state) values(?,now(),'CREATE')"
db.queryAll sql,[service],(err,result) ->
done err, result?.insertId

createTrade = (info,req_id,callback) ->
sql = "insert into alipay_trades(user,req_id,create_time) values(?,?,now())"
db.queryAll sql,[info.user_id,req_id],(err,result) ->
callback err, result?.insertId

storeTradeInfo = (tradeId,rmb,token,callback) ->
sql = "update alipay_trades set rmb=?,token=?,state='WAIT_PAY' where id = ?"
args = [rmb,token,tradeId]
db.queryAll sql,args,(err,updateResult) ->
callback err,updateResult?.affectedRows is 1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
1617
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

xmlreader = require 'xmlreader'rr,updateResult?.affectedRows is 1
demo.onNotify = (req,callback) ->
xmlreader.read req.notify_data,(err,xdoc) ->
return done err if err
notify = xdoc.notify
notify_id = notify?.notify_id?.text()
return done 'bad notify_data' unless notify_id
done = (response) ->
unless 'string' is typeof response
console.error "response notify error: " + (response?.stack ? response ? '')
response = 'server error'
console.error "response notify: #{response}" unless response is 'success'
storeNotifyResponse notify_id,response, (err) ->
callback if response is 'success' then err else response
storeNotifyDetails notify_id, notify, req, (err,success) ->
return done err if err
unless success
return done "store detail error"
trade_status = notify.trade_status.text()
if trade_status is 'TRADE_FINISHED' or trade_status is 'TRADE_SUCCESS'
unless req.sign is api.getNotitySign req
return done 'bad sign'
out_trade_no = notify.out_trade_no.text()
getTradeUser out_trade_no,(err,user) ->
return done err if err
user_id = user?.user
return done 'unknown user' unless user_id
onPayed user_id,(err,success) ->
return done err if err
return done "onPayed error" unless success
storeTradeFinalState out_trade_no, no, console.error
done 'success'
else # TRADE_PENDING, TRADE_CLOSED, WAIT_BUYER_PAY, etc
return done 'unknown trade status'

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
1617
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

storeTradeFinalState = (tradeId,isError,callback) ->
state = if isError then 'FAILURE' else 'SUCCESS'
sql = "update alipay_trades set state=?,close_time=now() where id = ?"
args = [state,tradeId]
db.queryAll sql,args,(err,updateResult) ->
callback err,updateResult?.affectedRows is 1

getTradeUser = (out_trade_no,callback) ->
sql = "select id,user from alipay_trades where id=?"
db.queryOne sql,[out_trade_no],callback

onPayed = (user_id,callback) ->
sql = "update users set vip=1 where id=? and vip=0 limit 1"
db.queryAll sql,[user_id],(err,updateResult) ->
callback err, updateResult?.affectedRows is 1

storeNotifyDetails = (notify_id,notify,raw,callback) ->
sql = "insert ignore into alipay_notifies(id,recv_time,subject,trade_no,gmt_create,
quantity,out_trade_no,notify_time,total_fee,buyer_email,trade_status,
gmt_payment,gmt_close,raw) values(?,now(),?,?,?,?,?,?,?,?,?,?,?,? )"
args = [
notify_id,
notify.subject?.text()
notify.trade_no?.text()
notify.gmt_create?.text()
notify.quantity?.text()
notify.out_trade_no?.text()
notify.notify_time?.text()
notify.total_fee?.text()
notify.buyer_email?.text()
notify.trade_status?.text()
notify.gmt_payment?.text()
notify.gmt_close?.text()
JSON.stringify raw
]
db.queryAll sql,args,(err,updateResult) ->
callback err,updateResult?.affectedRows is 1

storeNotifyResponse = (notify_id,response,done) ->
sql = "update alipay_notifies set response=? where id=?"
db.queryAll sql,[response,notify_id],done

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
1617
18
19
20
21

Alipay WAP using platform pay flow

Browzer->+Site: 1. HTTP GET
note over Site: 2. create a new trade
Site->-Browzer: 3. trade info
Browzer->+Platform: 4. redirect
note over Platform: 5. create a new trade
Platform->+Alipay: 6. create redirect
Alipay->-Platform: 7. Token
note over Platform: 8. build auth url
Platform->-Browzer: 9. redirect to auth url
Browzer->Alipay: 10. redirect
Alipay->Browzer: 11. trade info
Browzer->Alipay: 12. auth and pay
Alipay->+Platform: 13. HTTP POST notify
Platform->Site: 14. proxy
note over Site: 15. process trade
Site->Platform: 16. reply "success"
Platform->-Alipay: 17. reply "success"
Alipay->Browzer: 18. pay success
Browzer->Site: 19. goto return url