From ef8b8a721362427b3566ef5ddbe09c319c6bfdff Mon Sep 17 00:00:00 2001
From: yml2213 <a2213290201@gmail.com>
Date: Mon, 3 Aug 2026 11:48:10 +0800
Subject: [PATCH] =?UTF-8?q?=E5=9B=9E=E8=B0=83=E7=AD=BE=E5=90=8D=E6=94=B9?=
 =?UTF-8?q?=E4=B8=BA=E4=B8=8E=E5=BC=80=E6=94=BE=20API=20=E4=B8=80=E8=87=B4?=
 =?UTF-8?q?=E7=9A=84=E5=AD=97=E5=85=B8=E5=BA=8F=E6=8B=BC=E6=8E=A5=E9=A3=8E?=
 =?UTF-8?q?=E6=A0=BC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 签名串由 timestamp+换行+bodyhash 改为 body_sha256=<hash>&timestamp=<unix秒>（ASCII 字典序 & 拼接）
- 同步更新对接文档
---
 backend/internal/service/callback.go | 8 ++++++--
 frontend/src/pages/OpenApiDocs.tsx   | 4 ++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/backend/internal/service/callback.go b/backend/internal/service/callback.go
index b117320..b4ae3ea 100644
--- a/backend/internal/service/callback.go
+++ b/backend/internal/service/callback.go
@@ -379,10 +379,14 @@ func (s *CallbackService) Run(ctx context.Context) {
 	}
 }
 
-// BuildCallbackSign 供接收方校验：HMAC-SHA256(secret, timestamp + "\n" + sha256(body))。
+// BuildCallbackSign 供接收方校验。签名风格与开放 API 一致：
+// 参数按 ASCII 字典序 + "&" 拼接，body 以 SHA256 摘要参与签名。
+//
+//	content = body_sha256=<sha256hex(body)>&timestamp=<unix秒>
+//	X-Sign  = hex(HMAC-SHA256(secret, content))
 func BuildCallbackSign(secret, timestamp, body string) string {
 	bodyHash := sha256.Sum256([]byte(body))
-	content := timestamp + "\n" + hex.EncodeToString(bodyHash[:])
+	content := "body_sha256=" + hex.EncodeToString(bodyHash[:]) + "&timestamp=" + timestamp
 	mac := hmac.New(sha256.New, []byte(secret))
 	_, _ = mac.Write([]byte(content))
 	return hex.EncodeToString(mac.Sum(nil))
diff --git a/frontend/src/pages/OpenApiDocs.tsx b/frontend/src/pages/OpenApiDocs.tsx
index e3bd85c..87ced60 100644
--- a/frontend/src/pages/OpenApiDocs.tsx
+++ b/frontend/src/pages/OpenApiDocs.tsx
@@ -615,7 +615,7 @@ function CallbackSignSection() {
             <Text code>sha256hex(body)</Text> —— 原始请求体字节的 SHA256 十六进制（小写）
           </Descriptions.Item>
           <Descriptions.Item label="签名串">
-            <Text code>timestamp + "\n" + sha256hex(body)</Text>，换行符拼接
+            <Text code>body_sha256=&lt;hash&gt;&amp;timestamp=&lt;unix秒&gt;</Text>，按 ASCII 字典序 <Text code>&amp;</Text> 拼接（与开放 API 鉴权同一风格）
           </Descriptions.Item>
           <Descriptions.Item label="X-Sign">
             <Text code>hex( HMAC-SHA256( secret, 签名串 ) )</Text>，小写十六进制
@@ -624,7 +624,7 @@ function CallbackSignSection() {
       </Card>
       <Card className="api-docs__card" size="small" title="校验伪代码">
         <pre className="api-docs__pre">{`bodyHash = sha256Hex(rawBody)
-content = timestamp + "\\n" + bodyHash
+content = "body_sha256=" + bodyHash + "&timestamp=" + timestamp
 expected = hmacSHA256Hex(secret, content)
 ok = (X-Sign == expected)`}</pre>
       </Card>