Django 對接支付寶支付, 回調

時間 2019-12-01

標籤 django 對接支付寶支付欄目 Python 简体版

原文原文鏈接

平臺

點擊這裏進入螞蟻金服開放平臺python

沙箱

點擊這裏進入沙箱環境 git

初始界面

設置公鑰

下載建立祕鑰工具

1. 進入文檔中心這裏 github

2. 選中 電腦網站支付數據庫

3. 進入後選中 API 列表 中的統一收單下單並支付頁面接口json

4. 進入後點擊 sign 的簽名windows

5. 進入後選擇第一步, 而後選擇 windows 下載工具api

生成祕鑰

下載解壓後運行安全

會自動保存兩份 txt, 這兩個文件必定要妥善保管cookie

保存祕鑰

將兩個文件要作個修改, 最前和最後加上這兩行, 且不要用中文命名app

-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----

將兩個文件保存在在項目文件的訂單程序下

同時再吧頁面上的支付寶公鑰複製下來保存在本身的項目中, 和上面相似的格式

設置公鑰

注意是公鑰,

訂單URL 生成

目錄結構

訂單URL 生成邏輯文件

詳細的API對接處理這裏 (內含全部的詳細的參數選擇)

相關的 python 實現代碼 github 上都有,詳情這裏

Python 官方沒有提供指引, 可使用此文件代碼來實現 url 的生成

# _*_ coding:utf-8 _*_
__author__ = "yangtuo"
__date__ = "2019/4/24 16:25"

# -*- coding: utf-8 -*-

# pip install pycryptodome

from datetime import datetime
from Crypto.PublicKey import RSA
from Crypto.Signature import PKCS1_v1_5
from Crypto.Hash import SHA256
from base64 import b64encode, b64decode
from urllib.parse import quote_plus
from urllib.parse import urlparse, parse_qs
from urllib.request import urlopen
from base64 import decodebytes, encodebytes

import json


class AliPay(object):
    """
    支付寶支付接口
    """

    def __init__(self, appid, app_notify_url, app_private_key_path,
                 alipay_public_key_path, return_url, debug=False):
        self.appid = appid
        self.app_notify_url = app_notify_url
        self.app_private_key_path = app_private_key_path
        self.app_private_key = None
        self.return_url = return_url
        with open(self.app_private_key_path) as fp:
            self.app_private_key = RSA.importKey(fp.read())

        self.alipay_public_key_path = alipay_public_key_path
        with open(self.alipay_public_key_path) as fp:
            self.alipay_public_key = RSA.import_key(fp.read())

        if debug is True:
            self.__gateway = "https://openapi.alipaydev.com/gateway.do"
        else:
            self.__gateway = "https://openapi.alipay.com/gateway.do"

    def direct_pay(self, subject, out_trade_no, total_amount, return_url=None, **kwargs):
        biz_content = {
            "subject": subject,
            "out_trade_no": out_trade_no,
            "total_amount": total_amount,
            "product_code": "FAST_INSTANT_TRADE_PAY",
            # "qr_pay_mode":4
        }

        biz_content.update(kwargs)
        data = self.build_body("alipay.trade.page.pay", biz_content, self.return_url)
        return self.sign_data(data)

    def build_body(self, method, biz_content, return_url=None):
        data = {
            "app_id": self.appid,
            "method": method,
            "charset": "utf-8",
            "sign_type": "RSA2",
            "timestamp": datetime.now().strftime("%Y-%m-%d %H:%M:%S"),
            "version": "1.0",
            "biz_content": biz_content
        }

        if return_url is not None:
            data["notify_url"] = self.app_notify_url
            data["return_url"] = self.return_url

        return data

    def sign_data(self, data):
        data.pop("sign", None)
        # 排序後的字符串
        unsigned_items = self.ordered_data(data)
        unsigned_string = "&".join("{0}={1}".format(k, v) for k, v in unsigned_items)
        sign = self.sign(unsigned_string.encode("utf-8"))
        # ordered_items = self.ordered_data(data)
        quoted_string = "&".join("{0}={1}".format(k, quote_plus(v)) for k, v in unsigned_items)

        # 得到最終的訂單信息字符串
        signed_string = quoted_string + "&sign=" + quote_plus(sign)
        return signed_string

    def ordered_data(self, data):
        complex_keys = []
        for key, value in data.items():
            if isinstance(value, dict):
                complex_keys.append(key)

        # 將字典類型的數據dump出來
        for key in complex_keys:
            data[key] = json.dumps(data[key], separators=(',', ':'))

        return sorted([(k, v) for k, v in data.items()])

    def sign(self, unsigned_string):
        # 開始計算簽名
        key = self.app_private_key
        signer = PKCS1_v1_5.new(key)
        signature = signer.sign(SHA256.new(unsigned_string))
        # base64 編碼，轉換爲unicode表示並移除回車
        sign = encodebytes(signature).decode("utf8").replace("\n", "")
        return sign

    def _verify(self, raw_content, signature):
        # 開始計算簽名
        key = self.alipay_public_key
        signer = PKCS1_v1_5.new(key)
        digest = SHA256.new()
        digest.update(raw_content.encode("utf8"))
        if signer.verify(digest, decodebytes(signature.encode("utf8"))):
            return True
        return False

    def verify(self, data, signature):
        if "sign_type" in data:
            sign_type = data.pop("sign_type")
        # 排序後的字符串
        unsigned_items = self.ordered_data(data)
        message = "&".join(u"{}={}".format(k, v) for k, v in unsigned_items)
        return self._verify(message, signature)


if __name__ == "__main__":
    return_url = 'http://127.0.0.1:8000/?total_amount=100.00&timestamp=2017-08-15+23%3A53%3A34&sign=e9E9UE0AxR84NK8TP1CicX6aZL8VQj68ylugWGHnM79zA7BKTIuxxkf%2FvhdDYz4XOLzNf9pTJxTDt8tTAAx%2FfUAJln4WAeZbacf1Gp4IzodcqU%2FsIc4z93xlfIZ7OLBoWW0kpKQ8AdOxrWBMXZck%2F1cffy4Ya2dWOYM6Pcdpd94CLNRPlH6kFsMCJCbhqvyJTflxdpVQ9kpH%2B%2Fhpqrqvm678vLwM%2B29LgqsLq0lojFWLe5ZGS1iFBdKiQI6wZiisBff%2BdAKT9Wcao3XeBUGigzUmVyEoVIcWJBH0Q8KTwz6IRC0S74FtfDWTafplUHlL%2Fnf6j%2FQd1y6Wcr2A5Kl6BQ%3D%3D&trade_no=2017081521001004340200204115&sign_type=RSA2&auth_app_id=2016080600180695&charset=utf-8&seller_id=2088102170208070&method=alipay.trade.page.pay.return&app_id=2016080600180695&out_trade_no=20170202185&version=1.0'
    o = urlparse(return_url)
    query = parse_qs(o.query)
    processed_query = {}
    ali_sign = query.pop("sign")[0]

    alipay = AliPay(
        appid="",
        app_notify_url="http://127.0.0.1:8000/alipay/return/",
        app_private_key_path="../trade/keys/private_2048.txt",
        alipay_public_key_path="../trade/keys/alipay_key_2048.txt",  # 支付寶的公鑰，驗證支付寶回傳消息使用，不是你本身的公鑰,
        debug=True,  # 默認False,
        return_url="http://127.0.0.1:8000/alipay/return/"
    )

    for key, value in query.items():
        processed_query[key] = value[0]
    print(alipay.verify(processed_query, ali_sign))

    url = alipay.direct_pay(
        subject="測試訂單2",
        out_trade_no="20170202sss",
        total_amount=100,
        return_url="http://127.0.0.1:8000/alipay/return/"
    )
    re_url = "https://openapi.alipaydev.com/gateway.do?{data}".format(data=url)

    print(re_url)

alipay.py

https://openapi.alipaydev.com/gateway.do?app_id=2016100100636029&biz_content=%7B%22subject%22%3A%22%5Cu6d4b%5Cu8bd5%5Cu8ba2%5Cu53552%22%2C%22out_trade_no%22%3A%2220170202sss%22%2C%22total_amount%22%3A100%2C%22product_code%22%3A%22FAST_INSTANT_TRADE_PAY%22%7D&charset=utf-8&method=alipay.trade.page.pay&notify_url=http%3A%2F%2F127.0.0.1%3A8000%2Falipay%2Freturn%2F&return_url=http%3A%2F%2F127.0.0.1%3A8000%2Falipay%2Freturn%2F&sign_type=RSA2&timestamp=2019-04-24+16%3A40%3A17&version=1.0&sign=w4mdZOool9ne634Hf59g%2FV9cjj7ctzp37D5fs0U9xvOrDOBih%2FkpwrMXyWj5oVk%2FGETPx0RT7AkyOmnNSdF%2BTOCHkF4BAhABhbKLvaQfUqRdwIqGgvSKt18GGHVweg3BMh0hkrfzEuREVNkZlH2BpYD0UP5FS2PTVd90YnBJaWcJ%2BGyhizF5qlOAYIYFghbx9EKKo5e37peq%2BiVzme6Yui0FW%2ByGbtb54V2Slbo0iaPFq67pVUeBk%2BGprov6hBNxaVsz8O069z7IcIlzwFaSkYVxPB5dSAa6UWhMwCOdqMcO90LWCAhYYeF5yS%2BzJa1Mp95gQhHNTP2L5WfYp4T0uQ%3D%3D

生成的 url

訂單付款

訂單付款界面

基於alipay.py 中的參數進行相關的設置以後生成的 url 訪問便可進入付款界面

付款帳號

沙箱環境的付款只能基於特定的帳號或者指定的沙箱支付寶軟件才能夠進行付款操做, 利用此帳號付款後會基因而否設置回調決定下一步操做

付款成功回調

回調基於 return_url 以及 notify_url 兩字段都是非必填, 若是不設置支付成功後悔進入成功頁面無任何跳轉即回調

return_url 同步接口

此跳轉只在 PC 上支付成功後實現跳轉, 只支持當前一次的請求處理

用戶支付完成後, 支付寶基於此參數, 經過 GET 請求形式將部分支付結果參數通知到商戶系統

notify_url 異步接口

容許訂單的異步請求, 實現訂單的延遲或者另外平臺的後續付款請求

用戶支付完成後, 支付寶基於此參數, 經過 POST 請求形式將部分支付結果參數通知到商戶系統

簡述總結

notify_url 是支付寶模擬post數據給你,只要狀態改變就會post給你

return_url 是跳轉,用戶付款後跳轉到你的頁面.只有第一次會通知你,之後不會了.

訂單狀態

訂單狀態是支付寶指定的4種, 在本身的代碼中的訂單model 的訂單狀態字段也最好遵循

    ORDER_STATUS = (
        ("TRADE_SUCCESS", "成功"),
        ("TRADE_CLOSED", "超時關閉"),
        ("WAIT_BUYER_PAY", "交易建立"),
        ("TRADE_FINISHED", "交易結束"),
        ("paying", "待支付"),
    )

    pay_status = models.CharField(choices=ORDER_STATUS, default="paying", max_length=30, verbose_name="訂單狀態")

視圖編寫

前面又說兩個 URL 的請求方式不一樣, 所以咱們基於此進行區分, 而後經過在request 中取到相關的字段完成數據庫的更新以及相關的跳轉

return_url 最多見的請求是返回商戶, 或者返回首頁

notify_url 須要回傳一個 "success" 信息給支付寶, 否則支付寶會一直像咱們發送信息提示 ( 24h22m,8次 )

具體代碼

# 支付寶支付
class AlipayView(APIView):  # 沒有 model 就直接 APIView 就能夠了

    # 處理支付寶的return_url返回
    def get(self, request):
        processed_dict = {}
        for key, value in request.GET.items():
            processed_dict[key] = value

        sign = processed_dict.pop("sign", None)

        alipay = AliPay(
            appid="20xxxxxxx029",
            app_notify_url="http://127.0.0.1:8000/alipay/return/",
            app_private_key_path=private_key_path,
            alipay_public_key_path=ali_pub_key_path,  # 支付寶的公鑰，驗證支付寶回傳消息使用，不是你本身的公鑰,
            debug=True,  # 默認False,
            return_url="http://127.0.0.1:8000/alipay/return/"
        )

        verify_re = alipay.verify(processed_dict, sign)

        if verify_re is True:
            order_sn = processed_dict.get('out_trade_no', None)
            trade_no = processed_dict.get('trade_no', None)
            trade_status = processed_dict.get('trade_status', None)

            existed_orders = OrderInfo.objects.filter(order_sn=order_sn)
            for existed_order in existed_orders:
                existed_order.pay_status = trade_status
                existed_order.trade_no = trade_no
                existed_order.pay_time = datetime.now()
                existed_order.save()

            response = redirect("index")
            response.set_cookie("nextPath", "pay", max_age=3)
            return response
        else:
            response = redirect("index")
            return response

    # 處理支付寶的notify_url
    def post(self, request):
        processed_dict = {}
        for key, value in request.POST.items():
            processed_dict[key] = value

        sign = processed_dict.pop("sign", None)

        alipay = AliPay(
            appid="20xxxxxxx029",
            app_notify_url="http://127.0.0.1:8000/alipay/return/",
            app_private_key_path=private_key_path,
            alipay_public_key_path=ali_pub_key_path,  # 支付寶的公鑰，驗證支付寶回傳消息使用，不是你本身的公鑰,
            debug=True,  # 默認False,
            return_url="http://127.0.0.1:8000/alipay/return/"
        )

        verify_re = alipay.verify(processed_dict, sign)

        if verify_re is True:
            order_sn = processed_dict.get('out_trade_no', None)  # 商戶網站惟一訂單號
            trade_no = processed_dict.get('trade_no', None)  # 支付寶交易流水號
            trade_status = processed_dict.get('trade_status', None)  # 支付寶訂單狀態
            # 查詢本地是否有此訂單
            existed_orders = OrderInfo.objects.filter(order_sn=order_sn)
            # 更新訂單狀態
            for existed_order in existed_orders:
                order_goods = existed_order.goods.all()
                for order_good in order_goods:
                    goods = order_good.goods
                    goods.sold_num += order_good.goods_num
                    goods.save()

                existed_order.pay_status = trade_status
                existed_order.trade_no = trade_no
                existed_order.pay_time = datetime.now()
                existed_order.save()

            return Response("success")

其餘聯調

訂單的序列化組件中的 alipay_url 字段生成

    # 支付寶相關的字段
    alipay_url = serializers.SerializerMethodField(read_only=True)

    def get_alipay_url(self, obj):
        alipay = AliPay(
            appid="",
            app_notify_url="http://127.0.0.1:8000/alipay/return/",
            app_private_key_path=private_key_path,
            alipay_public_key_path=ali_pub_key_path,  # 支付寶的公鑰，驗證支付寶回傳消息使用，不是你本身的公鑰,
            debug=True,  # 默認False,
            return_url="http://127.0.0.1:8000/alipay/return/"
        )

        url = alipay.direct_pay(
            subject=obj.order_sn,
            out_trade_no=obj.order_sn,
            total_amount=obj.order_mount,
        )
        re_url = "https://openapi.alipaydev.com/gateway.do?{data}".format(data=url)

        return re_url

過後補充

支付寶改版後新版的支付寶的 return_url 返回數據中再也不包含 trade_status, 即沒法經過此參數進行訂單狀態的修改了.

可是 notify_url 不受影響, 對此的解釋很大多是安全問題, 須要商戶自行再次進行一個判斷狀態想的邏輯處理.

修正後源碼

class AlipayView(APIView):
    def get(self, request):
        """
        處理支付寶的return_url返回
        """
        processed_dict = {}
        # 1. 獲取GET中參數
        for key, value in request.GET.items():
            processed_dict[key] = value
        # 2. 取出sign
        sign = processed_dict.pop("sign", None)

        # 3. 生成ALipay對象
        alipay = AliPay(
            appid="2016091200490210",
            app_notify_url="http://115.159.122.64:8000/alipay/return/",
            app_private_key_path=private_key_path,
            alipay_public_key_path=ali_pub_key_path,  # 支付寶的公鑰，驗證支付寶回傳消息使用，不是你本身的公鑰,
            debug=True,  # 默認False,
            return_url="http://115.159.122.64:8000/alipay/return/"
        )

        verify_re = alipay.verify(processed_dict, sign)

        # 這裏能夠不作操做。由於無論發不發return url。notify url都會修改訂單狀態。
        if verify_re is True:
            order_sn = processed_dict.get('out_trade_no', None)
            trade_no = processed_dict.get('trade_no', None)

            existed_orders = OrderInfo.objects.filter(order_sn=order_sn)
            for existed_order in existed_orders:
                existed_order.trade_no = trade_no
                existed_order.pay_time = datetime.now()
                existed_order.save()

            response = redirect("/index/#/app/home/member/order")
            # response.set_cookie("nextPath","pay", max_age=3)
            return response
        else:
            response = redirect("index")
            return response

    def post(self, request):
        """
        處理支付寶的notify_url
        """
        # 1. 先將sign剔除掉
        processed_dict = {}
        for key, value in request.POST.items():
            processed_dict[key] = value

        sign = processed_dict.pop("sign", None)

        # 2. 生成一個Alipay對象
        alipay = AliPay(
            appid="2016091200490210",
            app_notify_url="http://115.159.122.64:8000/alipay/return/",
            app_private_key_path=private_key_path,
            alipay_public_key_path=ali_pub_key_path,  # 支付寶的公鑰，驗證支付寶回傳消息使用，不是你本身的公鑰,
            debug=True,  # 默認False,
            return_url="http://115.159.122.64:8000/alipay/return/"
        )

        # 3. 進行驗籤，確保這是支付寶給咱們的
        verify_re = alipay.verify(processed_dict, sign)

        # 若是驗籤成功
        if verify_re is True:
            order_sn = processed_dict.get('out_trade_no', None)
            trade_no = processed_dict.get('trade_no', None)
            trade_status = processed_dict.get('trade_status', None)

            # 查詢數據庫中存在的訂單
            existed_orders = OrderInfo.objects.filter(order_sn=order_sn)
            for existed_order in existed_orders:
                # 訂單商品項
                order_goods = existed_order.goods.all()
                # 商品銷量增長訂單中數值
                for order_good in order_goods:
                    goods = order_good.goods
                    goods.sold_num += order_good.goods_num
                    goods.save()

                # 更新訂單狀態，填充支付寶給的交易憑證號。
                existed_order.pay_status = trade_status
                existed_order.trade_no = trade_no
                existed_order.pay_time = datetime.now()
                existed_order.save()
            # 將success返回給支付寶，支付寶就不會一直不停的繼續發消息了。
            return Response("success")