🎨 【微信支付】服务商模式-支持公钥以及灰度切换

Author: SynchPj

weixin-java-pay/src/main/java/com/github/binarywang/wxpay/config/WxPayConfig.java

@@ -320,16 +320,7 @@ public CloseableHttpClient initApiV3HttpClient() throws WxPayException {
       //构造Http Proxy正向代理
       WxPayHttpProxy wxPayHttpProxy = getWxPayHttpProxy();
 
-      Verifier certificatesVerifier;
-      if (publicKey == null) {
-        certificatesVerifier =
-          new AutoUpdateCertificatesVerifier(
-            new WxPayCredentials(mchId, new PrivateKeySigner(certSerialNo, merchantPrivateKey)),
-            this.getApiV3Key().getBytes(StandardCharsets.UTF_8), this.getCertAutoUpdateTime(),
-            this.getPayBaseUrl(), wxPayHttpProxy);
-      } else {
-        certificatesVerifier = new PublicCertificateVerifier(publicKey, publicKeyId);
-      }
+      Verifier certificatesVerifier = getVerifier(merchantPrivateKey, wxPayHttpProxy, publicKey);
 
       WxPayV3HttpClientBuilder wxPayV3HttpClientBuilder = WxPayV3HttpClientBuilder.create()
         .withMerchant(mchId, certSerialNo, merchantPrivateKey)
@@ -355,6 +346,19 @@ public CloseableHttpClient initApiV3HttpClient() throws WxPayException {
     }
   }
 
+  private Verifier getVerifier(PrivateKey merchantPrivateKey, WxPayHttpProxy wxPayHttpProxy, PublicKey publicKey) {
+    Verifier certificatesVerifier = new AutoUpdateCertificatesVerifier(
+      new WxPayCredentials(mchId, new PrivateKeySigner(certSerialNo, merchantPrivateKey)),
+      this.getApiV3Key().getBytes(StandardCharsets.UTF_8), this.getCertAutoUpdateTime(),
+      this.getPayBaseUrl(), wxPayHttpProxy);
+    if (publicKey != null) {
+      Verifier publicCertificatesVerifier = new PublicCertificateVerifier(publicKey, publicKeyId);
+      publicCertificatesVerifier.setOtherVerifier(certificatesVerifier);
+      certificatesVerifier = publicCertificatesVerifier;
+    }
+    return certificatesVerifier;
+  }
+
   /**
    * 初始化一个WxPayHttpProxy对象
    *
@@ -382,7 +386,7 @@ private InputStream loadConfigInputStream(String configString, String configPath
     if (configContent != null) {
       return new ByteArrayInputStream(configContent);
     }
-    
+
     if (StringUtils.isNotEmpty(configString)) {
       configContent = Base64.getDecoder().decode(configString);
       return new ByteArrayInputStream(configContent);

weixin-java-pay/src/main/java/com/github/binarywang/wxpay/v3/auth/PublicCertificateVerifier.java

@@ -9,15 +9,24 @@ public class PublicCertificateVerifier implements Verifier{
 
     private final PublicKey publicKey;
 
+    private Verifier certificateVerifier;
+
     private final X509PublicCertificate publicCertificate;
 
     public PublicCertificateVerifier(PublicKey publicKey, String publicId) {
         this.publicKey = publicKey;
         this.publicCertificate = new X509PublicCertificate(publicKey, publicId);
     }
 
+   public void setOtherVerifier(Verifier verifier) {
+      this.certificateVerifier = verifier;
+   }
+
     @Override
     public boolean verify(String serialNumber, byte[] message, String signature) {
+        if (!serialNumber.contains("PUB_KEY_ID")) {
+            return this.certificateVerifier.verify(serialNumber, message, signature);
+        }
         try {
             Signature sign = Signature.getInstance("SHA256withRSA");
             sign.initVerify(publicKey);

weixin-java-pay/src/main/java/com/github/binarywang/wxpay/v3/auth/Verifier.java

@@ -7,4 +7,6 @@ public interface Verifier {
 
 
   X509Certificate getValidCertificate();
+
+  default void setOtherVerifier(Verifier verifier) {};
 }