<dependency>
    <groupId>com.github.wechatpay-apiv3</groupId>
    <artifactId>wechatpay-java</artifactId>
    <version>0.4.13</version> <!-- 注意檢查最新版本 -->
</dependency>

@Configuration
public class WeChatPayConfig {

    @Value("${wechat.pay.mchid}")
    private String mchId;

    @Value("${wechat.pay.mchSerialNo}") // 你的商戶API證書(shū)序列號(hào)
    private String mchSerialNo;

    @Value("${wechat.pay.privateKeyPath}") // 你的.p12證書(shū)中的私鑰文件路徑 (.pem格式更佳)
    private String privateKeyPath;

    @Value("${wechat.pay.apiV3Key}")
    private String apiV3Key;

    @Value("${wechat.pay.certPath}") // 下載的微信平臺(tái)證書(shū)路徑
    private String certPath;

    /**
     * 創(chuàng)建私鑰簽名對(duì)象
     */
    @Bean
    public PrivateKey getPrivateKey() throws Exception {
        return PemUtil.loadPrivateKey(
            new FileInputStream(privateKeyPath));
    }

    /**
     * 創(chuàng)建自動(dòng)更新的Verifier (驗(yàn)證微信響應(yīng)簽名)
     */
    @Bean
    public Verifier getVerifier() throws Exception {
        // 方式1: 使用本地已下載的平臺(tái)證書(shū) (簡(jiǎn)單，需手動(dòng)更新)
        // X509Certificate certificate = PemUtil.loadCertificate(new FileInputStream(certPath));
        // return new StaticVerifier(mchId, mchSerialNo, certificate);

        // 方式2: 使用自動(dòng)更新機(jī)制 (推薦)
        ScheduledUpdateCertificatesVerifier verifier = 
            new ScheduledUpdateCertificatesVerifier(
                new WechatPay2Credentials(mchId, new PrivateKeySigner(mchSerialNo, getPrivateKey())),
                apiV3Key.getBytes(StandardCharsets.UTF_8));
        return verifier;
    }

    /**
     * 創(chuàng)建HttpClient (用于調(diào)用微信API)
     */
    @Bean
    public CloseableHttpClient getWxPayClient() throws Exception {
        return WechatPayHttpClientBuilder.create()
            .withMerchant(mchId, mchSerialNo, getPrivateKey())
            .withValidator(new WechatPay2Validator(getVerifier()))
            .build();
    }
}

@Override
public String createNativeOrder(String outTradeNo, int totalFee, String body) {
    // ... 構(gòu)建請(qǐng)求參數(shù) (類(lèi)似JSAPI，但去掉payer，增加scene_info等)
    json.put("appid", appid); // Native也需要appid
    json.put("mchid", mchId);
    json.put("description", body);
    json.put("out_trade_no", outTradeNo);
    json.put("notify_url", "https://yourdomain.com/api/wxpay/notify");

    JSONObject amount = new JSONObject();
    amount.put("total", totalFee);
    amount.put("currency", "CNY");
    json.put("amount", amount);

    // 場(chǎng)景信息 (可選)
    JSONObject sceneInfo = new JSONObject();
    sceneInfo.put("payer_client_ip", "用戶IP"); // 必須傳真實(shí)IP
    json.put("scene_info", sceneInfo);

    // 發(fā)送請(qǐng)求到 Native 接口
    try {
        HttpPost httpPost = new HttpPost("https://api.mch.weixin.qq.com/v3/pay/transactions/native");
        // ... 同上設(shè)置請(qǐng)求頭和實(shí)體
        // 解析響應(yīng)，獲取 code_url
        JSONObject result = JSON.parseObject(responseString);
        return result.getString("code_url"); // 返回二維碼鏈接
    } catch (Exception e) {
        throw new RuntimeException("創(chuàng)建Native訂單失敗", e);
    }
}

@RestController
@RequestMapping("/api/wxpay")
public class WeChatPayController {

    @Autowired
    private WeChatPayService weChatPayService;

    @PostMapping("/create-jsapi-order")
    public ResponseEntity<Map<String, String>> createJsapiOrder(@RequestBody PayRequest request) {
        // 獲取用戶openid (通常由前端通過(guò)登錄態(tài)傳遞或后端通過(guò)code換取)
        String openid = getUserOpenidFromSessionOrToken(request.getToken());
        Map<String, String> result = weChatPayService.createJsapiOrder(
            openid, request.getOutTradeNo(), request.getTotalFee(), request.getBody());
        return ResponseEntity.ok(result);
    }

    @PostMapping("/notify")
    public ResponseEntity<String> handleNotify(@RequestBody String notifyData, 
                                              HttpServletRequest request) {
        try {
            // 1. 驗(yàn)證通知的簽名和有效性 (SDK提供了工具類(lèi))
            // 這里需要解析請(qǐng)求頭中的 Wechatpay-Signature, Wechatpay-Nonce, Wechatpay-Timestamp
            String signature = request.getHeader("Wechatpay-Signature");
            String nonce = request.getHeader("Wechatpay-Nonce");
            String timestamp = request.getHeader("Wechatpay-Timestamp");
            String body = notifyData; // 請(qǐng)求體

            // 使用之前配置的Verifier來(lái)驗(yàn)證
            // boolean isValid = verifier.verify(timestamp, nonce, body, signature);
            // if (!isValid) {
            //     return ResponseEntity.status(HttpStatus.BAD_REQUEST).body("簽名驗(yàn)證失敗");
            // }

            // 2. 解密通知數(shù)據(jù) (APIv3通知體是加密的)
            AesUtil aesUtil = new AesUtil(apiV3Key.getBytes(StandardCharsets.UTF_8));
            String plainText = aesUtil.decryptToString(
                nonce.getBytes(StandardCharsets.UTF_8),
                associatedData.getBytes(StandardCharsets.UTF_8), // 關(guān)聯(lián)數(shù)據(jù)
                ciphertext.getBytes(StandardCharsets.UTF_8)); // 密文

            // 3. 解析解密后的JSON數(shù)據(jù)
            JSONObject notifyDataObj = JSON.parseObject(plainText);
            String eventType = notifyDataObj.getString("event_type");
            JSONObject resource = notifyDataObj.getJSONObject("resource");
            String ciphertext = resource.getString("ciphertext"); // 加密的數(shù)據(jù)包
            String associatedData = resource.getString("associated_data");
            String nonce = resource.getString("nonce");

            // 再次解密ciphertext得到最終的訂單信息
            String orderInfo = aesUtil.decryptToString(nonce.getBytes(), 
                associatedData.getBytes(), ciphertext.getBytes());
            JSONObject orderData = JSON.parseObject(orderInfo);

            String outTradeNo = orderData.getString("out_trade_no");
            String transactionId = orderData.getString("transaction_id");
            String tradeState = orderData.getString("trade_state"); // SUCCESS為支付成功

            // 4. 業(yè)務(wù)處理
            if ("SUCCESS".equals(tradeState)) {
                // TODO: 更新你的數(shù)據(jù)庫(kù)訂單狀態(tài)為"已支付"
                // TODO: 執(zhí)行發(fā)貨、積分發(fā)放等后續(xù)業(yè)務(wù)邏輯
                // TODO: 記錄日志
            } else if ("CLOSED".equals(tradeState) || "REVOKED".equals(tradeState)) {
                // 支付失敗或關(guān)閉
            }

            // 5. 返回成功響應(yīng) (必須是200且內(nèi)容為"success")
            return ResponseEntity.ok().body("{\"code\":\"SUCCESS\",\"message\":\"成功\"}");
        } catch (Exception e) {
            // 記錄詳細(xì)的錯(cuò)誤日志
            log.error("處理微信支付通知失敗", e);
            // 返回失敗，微信會(huì)在一段時(shí)間后重試
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).body("");
        }
    }
}

public class WeChatPayUtil {
    // 生成JSAPI調(diào)用所需參數(shù)的簽名 (注意：這是RSA-SHA256，不是APIv3的HMAC-SHA256)
    public static String sign(Map<String, String> params, String apiKey) {
        // 1. 參數(shù)按key ASCII排序
        List<String> keys = new ArrayList<>(params.keySet());
        Collections.sort(keys);

        StringBuilder sb = new StringBuilder();
        for (String key : keys) {
            String value = params.get(key);
            if (value != null && !value.trim().isEmpty() && !"sign".equals(key)) {
                sb.append(key).append("=").append(value).append("&");
            }
        }
        sb.append("key=").append(apiKey);

        // 2. 計(jì)算MD5 (舊版) 或 HMAC-SHA256 (新版推薦，但JSAPI仍多用MD5？實(shí)際看文檔)
        // 注意：微信JSAPI目前主流仍是MD5，但請(qǐng)查閱最新官方文檔確認(rèn)！
        String stringA = sb.toString();
        String sign = DigestUtils.md5Hex(stringA).toUpperCase();

        return sign;
    }
}