摘要：近期在做微信支付那方面的工作由于要在之前開(kāi)發(fā)人員的基礎(chǔ)上進(jìn)行開(kāi)發(fā)其中使用到了這個(gè)第方支付的。下面梳理下正常開(kāi)發(fā)的流程請(qǐng)點(diǎn)擊下面的鏈接付款。結(jié)果總是提示必須是組鍵值對(duì)。主要是官方?jīng)]有提供明確的請(qǐng)求頭信息給我們導(dǎo)致我們一直在兜圈。

近期在做微信支付那方面的工作,由于要在之前開(kāi)發(fā)人員的基礎(chǔ)上進(jìn)行開(kāi)發(fā),其中使用到了ping++這個(gè)第3方支付的SDK。不得不說(shuō),ping++的SDK做的挺簡(jiǎn)單的,但是其文檔真心寫(xiě)的有點(diǎn)坑。不過(guò)相對(duì)其他的接入,坑少了那么一些。
下面梳理下正常開(kāi)發(fā)的流程,請(qǐng)點(diǎn)擊下面的鏈接付款。
可以看到主要有5個(gè)步驟:

設(shè)置 API-Key

SDK 驗(yàn)證簽名設(shè)置

發(fā)起支付請(qǐng)求獲取支付憑據(jù)

將獲得的支付憑據(jù)傳給 Client

接收 Webhooks通知(開(kāi)啟Live模式才有用)

然后再看下SDK交易流程,可以發(fā)現(xiàn)寫(xiě)的還是挺通俗易懂的。
個(gè)人覺(jué)得比較坑爹的是它API文檔的部分,完全就是逗你玩的。為什么這么說(shuō),請(qǐng)往下看。
官方說(shuō)Ping++的API采用REST風(fēng)格設(shè)計(jì),真的是REST風(fēng)格,完全停留在CURD的階段,離后面的發(fā)展還有很長(zhǎng)的路要走。實(shí)話說(shuō),Github API寫(xiě)的還比較像REST些,而這個(gè)ping++的就不想說(shuō)了。

下面我們正式入坑,其最簡(jiǎn)單的方式如下,使用curl進(jìn)行請(qǐng)求:

curl https://api.pingxx.com/v1/charges 
  -u sk_test_ibbTe5jLGCi5rzfH4OqPW9KC:

官方采用Authentication Basic的方式進(jìn)行驗(yàn)證,一般都會(huì)過(guò)的,返回你要的數(shù)據(jù)。但是官方提供的例子真心的簡(jiǎn)單,而且只用uncap這種方式,而我們公司要使用的是微信公眾支付,那么坑就出來(lái)了。當(dāng)時(shí)我是這樣請(qǐng)求的:

c@y-pc:~$ curl https://api.pingxx.com/v1/charges   -u sk_test_ibbTe5jLGi5rzfH4OqPW9KC:   -d order_no=123456789   -d amount=100   -d app[id]=app_1Gqj58ynP0mHeX1q   -d channel=wx_pub   -d currency=cny   -d client_ip=127.0.0.1   -d subject="Your Subject"   -d body="Your Body"   -d extra="{"open_id":"xxxxx"}"
{
    "error": {
        "type": "invalid_request_error",
        "message": " 無(wú)效的參數(shù) extra: 必須是一組鍵值對(duì)",
        "param": "extra"
    }

注意,這里我們將channel修改為wx_pub了,因此必須添加1個(gè)extra字段,在該字段中有1個(gè)open_id必填的玩意。結(jié)果,總是提示extra必須是1組鍵值對(duì)。很明顯,難道extra="{"open_id":"xxxxx"}不是1個(gè)鍵值對(duì)嗎,但是機(jī)器看不出來(lái)它是。

后面,我們準(zhǔn)備跳出這個(gè)坑,我們?nèi)タ垂俜浇o我們提供的SDK中的例子,可以發(fā)現(xiàn)app[id]這里的id是以{"id":"xxxx"}這樣的方式存在的,而不是理解為app[id]這樣1個(gè)字段,因此我們換個(gè)方式進(jìn)行請(qǐng)求:

curl https://api.pingxx.com/v1/charges   -u sk_test_ibbTe5jLGi5rzfH4OqPW9KC:   -d order_no=123456789   -d amount=100   -d app[id]=app_1Gqj58ynP0mHeX1q   -d channel=wx_pub   -d currency=cny   -d client_ip=127.0.0.1   -d subject="Your Subject"   -d body="Your Body"   -d extra[open_id]=xxxxx
{
    "id": "ch_C4O4CKXHCK48rnvn5CH8iP4G",
    "object": "charge",
    "created": 1460257030,
    "livemode": false,
    "paid": false,
    "refunded": false,
    "app": "app_1Gqj58ynP0mHeX1q",
    "channel": "wx_pub",
    "order_no": "123456789",
    "client_ip": "127.0.0.1",
    "amount": 100,
    "amount_settle": 100,
    "currency": "cny",
    "subject": "Your Subject",
    "body": "Your Body",
    "extra": {
        "open_id": "xxxxx"
    },
    "time_paid": null,
    "time_expire": 1460264230,
    "time_settle": null,
    "transaction_no": null,
    "refunds": {
        "object": "list",
        "url": "/v1/charges/ch_C4O4CKXHCK48rnvn5CH8iP4G/refunds",
        "has_more": false,
        "data": []
    },
    "amount_refunded": 0,
    "failure_code": null,
    "failure_msg": null,
    "metadata": {},
    "credential": {
        "object": "credential",
        "wx_pub": {
            "appId": "wxmbrpg8tm1k04yzbt",
            "timeStamp": 1460257030,
            "nonceStr": "25c7de13570a1b5f6d23614bdf49443d",
            "package": "prepay_id=1101000000160410rtepylz1surl5uzd",
            "signType": "MD5",
            "paySign": "10F1AACE79C0ED0E10EB4080D140F913"
        }
    },
    "description": null

這里我們將open_id放在extra中就成功了,這樣才可以接收到。不得不說(shuō),這API調(diào)用完全就是1個(gè)坑。主要是官方?jīng)]有提供明確的請(qǐng)求頭信息給我們,導(dǎo)致我們一直在兜圈。
所以,我不排除這文檔就是1個(gè)實(shí)習(xí)生寫(xiě)的。不得不說(shuō),官方給我們提供了1個(gè)不知名的REST的scheme,如果不是過(guò)這個(gè)坑完全就是不知道它在弄哪樣。比如jsonapi提供了這樣1種請(qǐng)求方式,預(yù)計(jì)如果不說(shuō)明,你也看不懂它寫(xiě)的是什么:

GET /posts?include=author&sort[posts]=-created,title&sort[people]=name

下面是上述請(qǐng)求的響應(yīng)頭信息:

c@y-pc:~$ curl https://api.pingxx.com/v1/charges   -u sk_test_ibbTe5jLGCi5rzfH4OqPW9KC:   -d order_no=123456789   -d amount=100   - app[id]=app_1Gqj58ynP0mHeX1q   -d channel=wx_pub   -d currency=cny   -d client_ip=127.0.0.1   -d subject="Your Subject"   -d body="Your Body"   -d extra[open_id]=xxxxx -v
*   Trying 121.43.74.100...
* Connected to api.pingxx.com (121.43.74.100) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* NPN, negotiated HTTP1.1
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Unknown (67):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
*      subject: C=CN; ST=Shanghai; L=Shanghai; O=Shanghai Jianmi Network Technology Co., LTD; OU=IT; CN=api.pingxx.com
*      start date: Nov 19 00:00:00 2015 GMT
*      expire date: Jan 17 23:59:59 2017 GMT
*      subjectAltName: api.pingxx.com matched
*      issuer: C=US; O=Symantec Corporation; OU=Symantec Trust Network; CN=Symantec Class 3 Secure Server CA - G4
*      SSL certificate verify ok.
* Server auth using Basic with user "sk_test_ibbTe5jLGCi5rzfH4OqPW9KC"
> POST /v1/charges HTTP/1.1
> Host: api.pingxx.com
> Authorization: Basic c2tfdGVzdF9pYmJUZTVqTEdDaTVyemZINE9xUFc5S0M6
> User-Agent: curl/7.47.1
> Accept: */*
> Content-Length: 163
> Content-Type: application/x-www-form-urlencoded
> 
* upload completely sent off: 163 out of 163 bytes
< HTTP/1.1 200 OK
< Date: Sun, 10 Apr 2016 03:26:51 GMT
< Content-Type: application/json;charset=utf-8
< Content-Length: 1229
< Connection: keep-alive
< X-Powered-By: PHP/5.6.2
< Access-Control-Allow-Methods: GET, POST, HEAD, OPTIONS, DELETE
< Access-Control-Max-Age: 300
< Access-Control-Allow-Credentials: true
< Cache-Control: no-cache, no-store
< Strict-Transport-Security: max-age=31536000; includeSubDomains

我們使用-v選項(xiàng)查看了其詳細(xì)的內(nèi)容,甚至連TCP的3次握手過(guò)程都可以看到。
還有就是出錯(cuò)信息,最好看下面的鏈接報(bào)錯(cuò)信息。

參考文章:

https://www.pingxx.com/document/api/#api-charges