微信支付：Native 扫码支付（PC 网页扫码）

package example.payment;

import java.time.LocalDateTime;
import java.time.format.DateTimeFormatter;
import com.wechat.pay.java.core.RSAPublicKeyConfig;
import com.wechat.pay.java.core.notification.NotificationParser;
import com.wechat.pay.java.core.notification.RequestParam;
import com.wechat.pay.java.service.payments.model.Transaction;
import com.wechat.pay.java.service.payments.nativepay.NativePayService;
import com.wechat.pay.java.service.payments.nativepay.model.Amount;
import com.wechat.pay.java.service.payments.nativepay.model.CloseOrderRequest;
import com.wechat.pay.java.service.payments.nativepay.model.PrepayRequest;
import com.wechat.pay.java.service.payments.nativepay.model.QueryOrderByOutTradeNoRequest;

public final class WechatPayClient {
  private static final DateTimeFormatter RFC3339 = DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ssXXX");

  private final String appId = required("WECHAT_PAY_APP_ID");
  private final String mchId = required("WECHAT_PAY_MCH_ID");
  private final String notifyUrl = required("WECHAT_PAY_NOTIFY_URL");
  private final NativePayService service;
  private final NotificationParser parser;

  public WechatPayClient() {
    RSAPublicKeyConfig config = new RSAPublicKeyConfig.Builder()
        .merchantId(mchId)
        .privateKeyFromPath(required("WECHAT_PAY_PRIVATE_KEY_PATH"))
        .merchantSerialNumber(required("WECHAT_PAY_MERCHANT_SERIAL"))
        .publicKeyFromPath(required("WECHAT_PAY_PUBLIC_KEY_PATH"))
        .publicKeyId(required("WECHAT_PAY_PUBLIC_KEY_ID"))
        .apiV3Key(required("WECHAT_PAY_API_V3_KEY"))
        .build();
    service = new NativePayService.Builder().config(config).build();
    parser = new NotificationParser(config);
  }

  /** 下单，返回二维码内容 */
  public String prepay(String outTradeNo, String description, int totalFen, LocalDateTime expireTime) {
    if (totalFen <= 0) {
      throw new IllegalArgumentException("订单金额超出支持范围");
    }
    Amount amount = new Amount();
    amount.setTotal(totalFen);
    amount.setCurrency("CNY");

    PrepayRequest request = new PrepayRequest();
    request.setAppid(appId);
    request.setMchid(mchId);
    request.setDescription(description);
    request.setOutTradeNo(outTradeNo);
    request.setNotifyUrl(notifyUrl);
    if (expireTime != null) {
      // 二维码有效期由 time_expire 决定，格式为 RFC3339，例如 2026-01-01T12:30:00+08:00
      request.setTimeExpire(RFC3339.format(expireTime.atZone(java.time.ZoneId.of("Asia/Shanghai"))));
    }
    request.setAmount(amount);
    return service.prepay(request).getCodeUrl();
  }

  public Transaction query(String outTradeNo) {
    QueryOrderByOutTradeNoRequest request = new QueryOrderByOutTradeNoRequest();
    request.setMchid(mchId);
    request.setOutTradeNo(outTradeNo);
    return service.queryOrderByOutTradeNo(request);
  }

  /** 关闭订单，避免留下仍然可以付款的二维码 */
  public void close(String outTradeNo) {
    CloseOrderRequest request = new CloseOrderRequest();
    request.setMchid(mchId);
    request.setOutTradeNo(outTradeNo);
    service.closeOrder(request);
  }

  public Transaction parseNotification(String serial, String nonce,
      String signature, String timestamp, String rawBody) {
    RequestParam request = new RequestParam.Builder()
        .serialNumber(serial).nonce(nonce).signature(signature)
        .timestamp(timestamp).body(rawBody).build();
    return parser.parse(request, Transaction.class);
  }

  /** expected 参数必须来自本地保存的支付订单 */
  public boolean matches(Transaction tx, String outTradeNo, int expectedFen) {
    return tx != null
        && appId.equals(tx.getAppid()) && mchId.equals(tx.getMchid())
        && outTradeNo.equals(tx.getOutTradeNo())
        && tx.getTransactionId() != null && !tx.getTransactionId().isBlank()
        && tx.getAmount() != null && tx.getAmount().getTotal() != null
        && tx.getAmount().getTotal() == expectedFen
        && "CNY".equals(tx.getAmount().getCurrency());
  }

  private static String required(String name) {
    String value = System.getenv(name);
    if (value == null || value.isBlank()) {
      throw new IllegalStateException("缺少环境变量：" + name);
    }
    return value;
  }
}

package example.payment;

import java.util.Map;
import com.wechat.pay.java.service.payments.model.Transaction;
import nexus.io.tio.boot.http.TioRequestContext;
import nexus.io.tio.http.common.HttpRequest;
import nexus.io.tio.http.common.HttpResponse;

public final class WechatNotifyHandler {
  public interface PaidOrderService {
    // 正常返回表示核验通过且事务已提交；重复通知也必须核验
    void confirm(Transaction transaction);
  }

  private final WechatPayClient client;
  private final PaidOrderService orders;

  public WechatNotifyHandler(WechatPayClient client, PaidOrderService orders) {
    this.client = client;
    this.orders = orders;
  }

  public HttpResponse notify(HttpRequest request) {
    try {
      Transaction transaction = client.parseNotification(
          request.getHeader("wechatpay-serial"),
          request.getHeader("wechatpay-nonce"),
          request.getHeader("wechatpay-signature"),
          request.getHeader("wechatpay-timestamp"),
          request.getBodyString());
      orders.confirm(transaction);
      return TioRequestContext.getResponse().setStatus(200)
          .setJson(Map.of("code", "SUCCESS", "message", "成功"));
    } catch (RuntimeException e) {
      // 生产环境记录脱敏异常与请求编号，不记录密钥或通知全文
      return TioRequestContext.getResponse().setStatus(500)
          .setJson(Map.of("code", "FAIL", "message", "通知处理失败"));
    }
  }
}

WechatPayClient payClient = new WechatPayClient();
WechatNotifyHandler handler = new WechatNotifyHandler(payClient, paidOrderService);
router.add(HttpMethod.POST, "/api/payments/wechat/notify", handler::notify);