wx-pay

Interact with WeChat Pay.

Designed following principles of low coupling and high cohesion, minimizing external dependencies and avoiding features with side effects, such as caching.

WeChat Pay has adjusted the way notification signatures are verified.

Only legacy merchants should use platform certificates for signature verification. Please use version v0.1.1.

New merchants should use WeChat Pay public keys for signature verification.

Certificates and Keys

WeChat Pay implements a complex encryption, signing, and decryption process to ensure security.

• Merchant API Certificate, usually in the form of apiclient_cert.p12 and apiclient_cert.pem.
  • The password for apiclient_cert.p12 is the merchant ID, and it contains certificate serial number details.
• Merchant API Private Key, usually in the form of apiclient_key.pem.
• WeChat Pay Public Key, a separately requested key.
• APIv3 Key, a separately set decryption key.

https://pay.weixin.qq.com/wiki/doc/apiv3/wechatpay/wechatpay3_0.shtml

https://pay.weixin.qq.com/docs/merchant/products/platform-certificate/wxp-pub-key-guide.html#%E8%8E%B7%E5%8F%96%E5%BE%AE%E4%BF%A1%E6%94%AF%E4%BB%98%E5%85%AC%E9%92%A5

The general process is as follows:

1. The merchant uses the Merchant API Private Key to sign the request.
2. The signed request is sent to WeChat Pay for processing.
3. WeChat Pay sends a notification and a notification signature to the callback URL.
4. The merchant uses the WeChat Pay Public Key to verify the notification signature.
5. The merchant decrypts the notification using the APIv3 Key.

范例

import { WxPay } from "@liuhlightning/wx-pay";
import {
  NotifyTransactionHeaders,
  PostOrderData,
} from "@liuhlightning/wx-pay/dist/lib/transaction";
import { Request, Response } from "express";

const wxPay = new WxPay({
  appId: "The appid associated with WeChat Pay",
  apiv3Key: "APIv3 key",
  mchId: "Merchant ID",
  notifyUrl: "Callback URL",
  wxPayPublicKeyPath: "File path to the WeChat Pay public key",
  privateKeyPath: "File path to the Merchant API private key",
  certSerial: "Merchant API certificate serial number",
  debug: process.env.NODE_ENV !== "production",
});

// Initiating a Payment
export async function postPay() {
  const data: PostOrderData = {
    description: "Payment description",
    out_trade_no: "Order number in merchant's system",
    amount: {
      // Payment amount
      total: 0.01,
      currency: "CNY",
    },
  };

  // Initiate payment
  const { status, data: pd } = await wxPay.postTransactionNative(data);
  if (status !== 200) {
    throw new Error(`WeChat Pay request error ${status}`);
  }
  return pd;
}

// Payment Notification
export async function postNotify(req: Request, res: Response) {
  // Verify signature and decrypt data
  const n = wxPay.notifyTransaction(
    req.headers as unknown as NotifyTransactionHeaders,
    req.body,
  );
  if (!n) {
    // Signature verification failed
    res.status(401).send({
      code: "FAIL",
      message: "Signature error",
    });
  } else {
    // Handle business logic here

    res.sendStatus(204);
  }
}