接入文档

<?php
// 商户号、商户公钥序列号（在「密钥管理」中查看）、接口域名
const MCH_NO = '你的商户号';
const SERIAL_NO = '你的商户公钥序列号';
const API_HOST = 'https://pay.siyun223.com';

/** 发起请求并验证应答签名。$path 含查询串，例如 /api/v1/orders/out-trade-no/M2026102100001 */
function siyun_request(string $method, string $path, ?array $data = null): array
{
    $body = $data === null ? '' : json_encode($data, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
    $timestamp = (string) time();
    $nonce = bin2hex(random_bytes(16));
    $message = $method . "\n" . $path . "\n" . $timestamp . "\n" . $nonce . "\n" . $body . "\n";

    $privateKey = openssl_pkey_get_private(file_get_contents('/path/to/merchant_private.pem'));
    openssl_sign($message, $signature, $privateKey, OPENSSL_ALGO_SHA256);

    $authorization = sprintf(
        'SIYUN-SHA256-RSA mch_no="%s",serial_no="%s",timestamp="%s",nonce_str="%s",signature="%s"',
        MCH_NO, SERIAL_NO, $timestamp, $nonce, base64_encode($signature)
    );

    $ch = curl_init(API_HOST . $path);
    $options = [
        CURLOPT_CUSTOMREQUEST => $method,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HEADER => true,
        CURLOPT_TIMEOUT => 15,
        CURLOPT_HTTPHEADER => ['Authorization: ' . $authorization, 'Content-Type: application/json', 'Accept: application/json'],
    ];
    if ($body !== '') {
        $options[CURLOPT_POSTFIELDS] = $body;
    }
    curl_setopt_array($ch, $options);
    $raw = curl_exec($ch);
    if ($raw === false) {
        throw new RuntimeException('请求失败：' . curl_error($ch));
    }
    $headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);

    $headers = [];
    foreach (explode("\r\n", substr($raw, 0, $headerSize)) as $line) {
        if (strpos($line, ':') !== false) {
            [$name, $value] = explode(':', $line, 2);
            $headers[strtolower(trim($name))] = trim($value);
        }
    }
    $responseBody = substr($raw, $headerSize);

    // 验证应答签名，确认应答来自平台且未被篡改；平台公钥按应答头 Siyun-Serial 选择
    $platformKey = file_get_contents('/path/to/siyun_platform_public_' . ($headers['siyun-serial'] ?? '') . '.pem');
    if (! siyun_verify($headers['siyun-timestamp'] ?? '', $headers['siyun-nonce'] ?? '', $responseBody, $headers['siyun-signature'] ?? '', $platformKey)) {
        throw new RuntimeException('应答验签失败');
    }

    return ['status' => $status, 'data' => json_decode($responseBody, true)];
}

/** 验签：应答与通知共用。签名串为「时间戳\n随机串\n报文主体\n」 */
function siyun_verify(string $timestamp, string $nonce, string $body, string $signature, string $platformPublicKey): bool
{
    if ($timestamp === '' || abs(time() - (int) $timestamp) > 300) {
        return false;
    }
    $message = $timestamp . "\n" . $nonce . "\n" . $body . "\n";

    return openssl_verify($message, base64_decode($signature), $platformPublicKey, OPENSSL_ALGO_SHA256) === 1;
}

/** 解密通知中的 resource：AES-256-GCM，密文末尾 16 字节为认证标签 */
function siyun_decrypt(array $resource, string $callbackSecret): array
{
    $raw = base64_decode($resource['ciphertext']);
    $plain = openssl_decrypt(
        substr($raw, 0, -16), 'aes-256-gcm', $callbackSecret, OPENSSL_RAW_DATA,
        base64_decode($resource['nonce']), substr($raw, -16), $resource['associated_data']
    );
    if ($plain === false) {
        throw new RuntimeException('通知解密失败，请检查回调密钥');
    }

    return json_decode($plain, true);
}

// ---------- 下单 ----------
$result = siyun_request('POST', '/api/v1/orders', [
    'out_trade_no' => 'M' . date('YmdHis') . mt_rand(1000, 9999),
    'amount' => 100,                      // 金额，单位分
    'subject' => '会员充值',
    'notify_url' => 'https://example.com/pay/notify',
    'return_url' => 'https://example.com/pay/done',
]);
// 收银台地址：$result['data']['cashier_url']

// ---------- 接收通知（notify_url 对应的处理程序） ----------
// 必须用原始请求体验签，不要先 json_decode 再重新编码
$body = file_get_contents('php://input');
$serial = $_SERVER['HTTP_SIYUN_SERIAL'] ?? '';
$platformKey = file_get_contents('/path/to/siyun_platform_public_' . $serial . '.pem');
if (! siyun_verify($_SERVER['HTTP_SIYUN_TIMESTAMP'] ?? '', $_SERVER['HTTP_SIYUN_NONCE'] ?? '', $body, $_SERVER['HTTP_SIYUN_SIGNATURE'] ?? '', $platformKey)) {
    http_response_code(401);
    exit;
}
$notify = json_decode($body, true);
$data = siyun_decrypt($notify['resource'], '你的回调密钥');
switch ($notify['event_type']) {
    case 'TRANSACTION.SUCCESS':
        // 按 out_trade_no 更新订单为已支付（注意幂等：同一订单可能收到多次通知）
        break;
    case 'REFUND.SUCCESS':
    case 'REFUND.FAILED':
        // 按 out_refund_no 更新退款结果
        break;
    case 'NOTIFY.TEST':
        // 控制台发送的测试通知，不做业务处理
        break;
}
http_response_code(200);
echo 'success';

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.Signature;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.time.Duration;
import java.util.Base64;
import java.util.UUID;
import javax.crypto.Cipher;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;

public final class SiyunPay {
    public static final String MCH_NO = "你的商户号";
    public static final String SERIAL_NO = "你的商户公钥序列号";
    public static final String API_HOST = "https://pay.siyun223.com";

    private static final HttpClient HTTP = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(5)).build();

    /** 加载 PKCS#8 格式的商户私钥（-----BEGIN PRIVATE KEY-----） */
    public static PrivateKey loadPrivateKey(String pem) throws Exception {
        String base64 = pem.replaceAll("-----(BEGIN|END) PRIVATE KEY-----", "").replaceAll("\\s", "");
        return KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(Base64.getDecoder().decode(base64)));
    }

    /** 加载平台公钥（-----BEGIN PUBLIC KEY-----） */
    public static PublicKey loadPublicKey(String pem) throws Exception {
        String base64 = pem.replaceAll("-----(BEGIN|END) PUBLIC KEY-----", "").replaceAll("\\s", "");
        return KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(Base64.getDecoder().decode(base64)));
    }

    /** 生成 Authorization 请求头。path 含查询串，body 为实际发送的请求体（GET 为空字符串） */
    public static String authorization(PrivateKey key, String method, String path, String body) throws Exception {
        String timestamp = String.valueOf(System.currentTimeMillis() / 1000);
        String nonce = UUID.randomUUID().toString().replace("-", "");
        String message = method + "\n" + path + "\n" + timestamp + "\n" + nonce + "\n" + body + "\n";

        Signature signer = Signature.getInstance("SHA256withRSA");
        signer.initSign(key);
        signer.update(message.getBytes(StandardCharsets.UTF_8));
        String signature = Base64.getEncoder().encodeToString(signer.sign());

        return String.format("SIYUN-SHA256-RSA mch_no=\"%s\",serial_no=\"%s\",timestamp=\"%s\",nonce_str=\"%s\",signature=\"%s\"",
            MCH_NO, SERIAL_NO, timestamp, nonce, signature);
    }

    /** 验签：应答与通知共用，签名串为「时间戳\n随机串\n报文主体\n」 */
    public static boolean verify(String timestamp, String nonce, String body, String signature, PublicKey platformKey) throws Exception {
        if (!timestamp.matches("\\d{10}") || Math.abs(System.currentTimeMillis() / 1000 - Long.parseLong(timestamp)) > 300) {
            return false;
        }
        Signature verifier = Signature.getInstance("SHA256withRSA");
        verifier.initVerify(platformKey);
        verifier.update((timestamp + "\n" + nonce + "\n" + body + "\n").getBytes(StandardCharsets.UTF_8));
        return verifier.verify(Base64.getDecoder().decode(signature));
    }

    /** 解密通知中的 resource（AES-256-GCM，密文末尾带 16 字节认证标签） */
    public static String decrypt(String ciphertext, String nonce, String associatedData, String callbackSecret) throws Exception {
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.DECRYPT_MODE,
            new SecretKeySpec(callbackSecret.getBytes(StandardCharsets.UTF_8), "AES"),
            new GCMParameterSpec(128, Base64.getDecoder().decode(nonce)));
        cipher.updateAAD(associatedData.getBytes(StandardCharsets.UTF_8));
        return new String(cipher.doFinal(Base64.getDecoder().decode(ciphertext)), StandardCharsets.UTF_8);
    }

    /** 发起请求并验证应答签名，返回应答体（JSON）。path 含查询串，body 为 JSON 字符串（无请求体时传空字符串） */
    public static String request(PrivateKey key, String method, String path, String body) throws Exception {
        HttpRequest.Builder builder = HttpRequest.newBuilder(URI.create(API_HOST + path))
            .timeout(Duration.ofSeconds(15))
            .header("Authorization", authorization(key, method, path, body))
            .header("Accept", "application/json");
        if (body.isEmpty()) {
            builder.method(method, HttpRequest.BodyPublishers.noBody());
        } else {
            builder.header("Content-Type", "application/json")
                .method(method, HttpRequest.BodyPublishers.ofString(body, StandardCharsets.UTF_8));
        }
        HttpResponse<String> response = HTTP.send(builder.build(), HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));

        // 平台公钥按应答头 Siyun-Serial 选择
        String serial = response.headers().firstValue("Siyun-Serial").orElse("");
        PublicKey platformKey = loadPublicKey(Files.readString(Path.of("/path/to/siyun_platform_public_" + serial + ".pem")));
        boolean valid = verify(
            response.headers().firstValue("Siyun-Timestamp").orElse(""),
            response.headers().firstValue("Siyun-Nonce").orElse(""),
            response.body(),
            response.headers().firstValue("Siyun-Signature").orElse(""),
            platformKey);
        if (!valid) {
            throw new IllegalStateException("应答验签失败");
        }
        return response.body();
    }

    public static void main(String[] args) throws Exception {
        PrivateKey key = loadPrivateKey(Files.readString(Path.of("/path/to/merchant_private.pem")));
        // 下单（金额单位为分），应答中的 cashier_url 为收银台地址
        String body = "{\"out_trade_no\":\"M" + System.currentTimeMillis() + "\",\"amount\":100,"
            + "\"subject\":\"会员充值\",\"notify_url\":\"https://example.com/pay/notify\"}";
        System.out.println(request(key, "POST", "/api/v1/orders", body));
    }

    // 接收通知：用原始请求体与请求头 Siyun-Timestamp、Siyun-Nonce、Siyun-Signature 调用 verify()，
    // 通过后解析 JSON，取 resource 的 ciphertext、nonce、associated_data 调用 decrypt()，处理完成后返回 HTTP 200。
}

import base64
import json
import secrets
import time
from typing import Optional

import requests
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

MCH_NO = "你的商户号"
SERIAL_NO = "你的商户公钥序列号"
API_HOST = "https://pay.siyun223.com"

with open("/path/to/merchant_private.pem", "rb") as f:
    PRIVATE_KEY = serialization.load_pem_private_key(f.read(), password=None)


def authorization(method: str, path: str, body: str = "") -> str:
    """path 含查询串；body 必须与实际发送的请求体完全一致"""
    timestamp = str(int(time.time()))
    nonce = secrets.token_hex(16)
    message = f"{method}\n{path}\n{timestamp}\n{nonce}\n{body}\n".encode("utf-8")
    signature = base64.b64encode(PRIVATE_KEY.sign(message, padding.PKCS1v15(), hashes.SHA256())).decode()
    return (f'SIYUN-SHA256-RSA mch_no="{MCH_NO}",serial_no="{SERIAL_NO}",'
            f'timestamp="{timestamp}",nonce_str="{nonce}",signature="{signature}"')


def verify(timestamp: str, nonce: str, body: str, signature: str, platform_public_pem: bytes) -> bool:
    """验签：应答与通知共用"""
    if not timestamp or abs(time.time() - int(timestamp)) > 300:
        return False
    key = serialization.load_pem_public_key(platform_public_pem)
    try:
        key.verify(base64.b64decode(signature), f"{timestamp}\n{nonce}\n{body}\n".encode("utf-8"),
                   padding.PKCS1v15(), hashes.SHA256())
        return True
    except Exception:
        return False


def decrypt(resource: dict, callback_secret: str) -> dict:
    """解密通知中的 resource（AES-256-GCM）"""
    plain = AESGCM(callback_secret.encode("utf-8")).decrypt(
        base64.b64decode(resource["nonce"]),
        base64.b64decode(resource["ciphertext"]),
        resource["associated_data"].encode("utf-8"),
    )
    return json.loads(plain)


def request(method: str, path: str, data: Optional[dict] = None) -> dict:
    body = "" if data is None else json.dumps(data, ensure_ascii=False, separators=(",", ":"))
    resp = requests.request(
        method, API_HOST + path,
        data=body.encode("utf-8") if body else None,
        headers={"Authorization": authorization(method, path, body),
                 "Content-Type": "application/json", "Accept": "application/json"},
        timeout=15,
    )
    text = resp.content.decode("utf-8")
    # 平台公钥按应答头 Siyun-Serial 选择
    with open(f"/path/to/siyun_platform_public_{resp.headers.get('Siyun-Serial', '')}.pem", "rb") as f:
        if not verify(resp.headers.get("Siyun-Timestamp", ""), resp.headers.get("Siyun-Nonce", ""),
                      text, resp.headers.get("Siyun-Signature", ""), f.read()):
            raise RuntimeError("应答验签失败")
    return json.loads(text)


# 下单（金额单位为分）
order = request("POST", "/api/v1/orders", {
    "out_trade_no": "M" + time.strftime("%Y%m%d%H%M%S"),
    "amount": 100,
    "subject": "会员充值",
    "notify_url": "https://example.com/pay/notify",
})
print(order.get("cashier_url"))

# 接收通知：用原始请求体（例如 Flask 的 request.get_data(as_text=True)）调用 verify()，
# 通过后 decrypt(json.loads(raw)["resource"], "你的回调密钥")，处理完成后返回 HTTP 200。

const crypto = require('crypto');
const fs = require('fs');

const MCH_NO = '你的商户号';
const SERIAL_NO = '你的商户公钥序列号';
const API_HOST = 'https://pay.siyun223.com';
const privateKey = fs.readFileSync('/path/to/merchant_private.pem', 'utf8');

// path 含查询串；body 必须与实际发送的请求体完全一致（GET 为空字符串）
function authorization(method, path, body = '') {
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const nonce = crypto.randomBytes(16).toString('hex');
  const message = `${method}\n${path}\n${timestamp}\n${nonce}\n${body}\n`;
  const signature = crypto.createSign('RSA-SHA256').update(message, 'utf8').sign(privateKey, 'base64');
  return `SIYUN-SHA256-RSA mch_no="${MCH_NO}",serial_no="${SERIAL_NO}",timestamp="${timestamp}",nonce_str="${nonce}",signature="${signature}"`;
}

// 验签：应答与通知共用
function verify(timestamp, nonce, body, signature, platformPublicKey) {
  if (!timestamp || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  return crypto.createVerify('RSA-SHA256')
    .update(`${timestamp}\n${nonce}\n${body}\n`, 'utf8')
    .verify(platformPublicKey, signature, 'base64');
}

// 解密通知中的 resource（AES-256-GCM，密文末尾 16 字节为认证标签）
function decrypt(resource, callbackSecret) {
  const raw = Buffer.from(resource.ciphertext, 'base64');
  const decipher = crypto.createDecipheriv('aes-256-gcm', Buffer.from(callbackSecret, 'utf8'), Buffer.from(resource.nonce, 'base64'));
  decipher.setAuthTag(raw.subarray(raw.length - 16));
  decipher.setAAD(Buffer.from(resource.associated_data, 'utf8'));
  const plain = Buffer.concat([decipher.update(raw.subarray(0, raw.length - 16)), decipher.final()]);
  return JSON.parse(plain.toString('utf8'));
}

async function request(method, path, data) {
  const body = data === undefined ? '' : JSON.stringify(data);
  const res = await fetch(API_HOST + path, {
    method,
    headers: { Authorization: authorization(method, path, body), 'Content-Type': 'application/json', Accept: 'application/json' },
    body: body || undefined,
  });
  const text = await res.text();
  // 平台公钥按应答头 Siyun-Serial 选择
  const platformKey = fs.readFileSync(`/path/to/siyun_platform_public_${res.headers.get('siyun-serial')}.pem`, 'utf8');
  if (!verify(res.headers.get('siyun-timestamp'), res.headers.get('siyun-nonce'), text, res.headers.get('siyun-signature'), platformKey)) {
    throw new Error('应答验签失败');
  }
  return { status: res.status, data: JSON.parse(text) };
}

// 下单（金额单位为分）
request('POST', '/api/v1/orders', {
  out_trade_no: 'M' + Date.now(),
  amount: 100,
  subject: '会员充值',
  notify_url: 'https://example.com/pay/notify',
}).then((r) => console.log(r.data.cashier_url));

// 接收通知：用原始请求体字符串（不要先 JSON.parse 再 JSON.stringify）调用 verify()，
// 通过后 decrypt(JSON.parse(raw).resource, '你的回调密钥')，处理完成后返回 HTTP 200。

package siyun

import (
	"crypto"
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"crypto/rsa"
	"crypto/sha256"
	"crypto/x509"
	"encoding/base64"
	"encoding/hex"
	"encoding/pem"
	"errors"
	"fmt"
	"strconv"
	"time"
)

const (
	MchNo    = "你的商户号"
	SerialNo = "你的商户公钥序列号"
	APIHost  = "https://pay.siyun223.com"
)

// ParsePrivateKey 解析商户私钥（PKCS#8 或 PKCS#1）
func ParsePrivateKey(pemBytes []byte) (*rsa.PrivateKey, error) {
	block, _ := pem.Decode(pemBytes)
	if block == nil {
		return nil, errors.New("私钥格式不正确")
	}
	if key, err := x509.ParsePKCS8PrivateKey(block.Bytes); err == nil {
		if rsaKey, ok := key.(*rsa.PrivateKey); ok {
			return rsaKey, nil
		}
	}
	return x509.ParsePKCS1PrivateKey(block.Bytes)
}

// ParsePublicKey 解析平台公钥
func ParsePublicKey(pemBytes []byte) (*rsa.PublicKey, error) {
	block, _ := pem.Decode(pemBytes)
	if block == nil {
		return nil, errors.New("公钥格式不正确")
	}
	key, err := x509.ParsePKIXPublicKey(block.Bytes)
	if err != nil {
		return nil, err
	}
	rsaKey, ok := key.(*rsa.PublicKey)
	if !ok {
		return nil, errors.New("不是 RSA 公钥")
	}
	return rsaKey, nil
}

// Authorization 生成请求头。path 含查询串，body 为实际发送的请求体（GET 为空字符串）
func Authorization(key *rsa.PrivateKey, method, path, body string) (string, error) {
	timestamp := strconv.FormatInt(time.Now().Unix(), 10)
	buf := make([]byte, 16)
	if _, err := rand.Read(buf); err != nil {
		return "", err
	}
	nonce := hex.EncodeToString(buf)
	digest := sha256.Sum256([]byte(method + "\n" + path + "\n" + timestamp + "\n" + nonce + "\n" + body + "\n"))
	sig, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, digest[:])
	if err != nil {
		return "", err
	}
	return fmt.Sprintf(`SIYUN-SHA256-RSA mch_no="%s",serial_no="%s",timestamp="%s",nonce_str="%s",signature="%s"`,
		MchNo, SerialNo, timestamp, nonce, base64.StdEncoding.EncodeToString(sig)), nil
}

// Verify 验签：应答与通知共用，签名串为「时间戳\n随机串\n报文主体\n」
func Verify(timestamp, nonce, body, signature string, platformKey *rsa.PublicKey) error {
	ts, err := strconv.ParseInt(timestamp, 10, 64)
	if err != nil {
		return errors.New("时间戳无效")
	}
	if diff := time.Now().Unix() - ts; diff > 300 || diff < -300 {
		return errors.New("时间戳已过期")
	}
	sig, err := base64.StdEncoding.DecodeString(signature)
	if err != nil {
		return err
	}
	digest := sha256.Sum256([]byte(timestamp + "\n" + nonce + "\n" + body + "\n"))
	return rsa.VerifyPKCS1v15(platformKey, crypto.SHA256, digest[:], sig)
}

// Decrypt 解密通知中的 resource（AES-256-GCM，密文末尾带 16 字节认证标签）
func Decrypt(ciphertext, nonce, associatedData, callbackSecret string) ([]byte, error) {
	raw, err := base64.StdEncoding.DecodeString(ciphertext)
	if err != nil {
		return nil, err
	}
	iv, err := base64.StdEncoding.DecodeString(nonce)
	if err != nil {
		return nil, err
	}
	block, err := aes.NewCipher([]byte(callbackSecret))
	if err != nil {
		return nil, err
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}
	if len(iv) != gcm.NonceSize() {
		return nil, errors.New("nonce 长度不正确")
	}
	return gcm.Open(nil, iv, raw, []byte(associatedData))
}

// 发起请求：用 Authorization() 生成请求头后通过 net/http 发送；
// 收到应答后用应答头 Siyun-Timestamp、Siyun-Nonce、Siyun-Signature 与应答体调用 Verify()，平台公钥按 Siyun-Serial 选择。
// 接收通知：用原始请求体调用 Verify()，通过后取 resource 调用 Decrypt()，处理完成后返回 HTTP 200。