微信支付与交易闭环：统一下单、回调与退款

// 服务端 Node.js：统一下单
const axios = require('axios');
const { wxPaySign } = require('./sign');   // v3 请求签名工具

async function createJsapiOrder({ openid, outTradeNo, totalFee, description }) {
  const url = 'https://api.mch.weixin.qq.com/v3/pay/transactions/jsapi';
  const body = {
    appid: APPID,                 // 小程序 AppID
    mchid: MCHID,                 // 商户号
    description,                  // 商品描述
    out_trade_no: outTradeNo,     // 商户订单号，唯一
    notify_url: NOTIFY_URL,       // 支付结果回调地址
    amount: {
      total: totalFee,            // 金额，单位：分
      currency: 'CNY'
    },
    payer: { openid }             // 下单用户的 openid
  };

  const resp = await axios.post(url, body, {
    headers: wxPaySign('POST', url, body)   // 注入 v3 签名头
  });
  return resp.data.prepay_id;              // 用于拉起支付
}

// 服务端：生成 wx.requestPayment 参数
function buildPayParams(prepayId) {
  const timeStamp = String(Math.floor(Date.now() / 1000));
  const nonceStr = crypto.randomBytes(16).toString('hex');
  const package_ = `prepay_id=${prepayId}`;
  const signStr = `${APPID}\n${timeStamp}\n${nonceStr}\n${package_}\n`;

  const paySign = crypto
    .createSign('RSA-SHA256')
    .update(signStr)
    .sign(process.env.MCH_PRIVATE_KEY, 'base64');

  return { appId: APPID, timeStamp, nonceStr, package: package_, signType: 'RSA', paySign };
}

// 小程序端
async function payOrder(orderId) {
  // 1. 请求后端统一下单，拿到支付参数
  const payParams = await request({ url: '/api/pay/create', data: { orderId } });

  // 2. 拉起微信支付面板
  wx.requestPayment({
    timeStamp: payParams.timeStamp,     // 秒级时间戳字符串
    nonceStr: payParams.nonceStr,
    package: payParams.package,         // prepay_id=xxx
    signType: 'RSA',                    // v3 为 RSA，v2 为 MD5
    paySign: payParams.paySign,
    success() {
      // 注意：success 不代表支付成功，只代表用户完成了支付动作
      // 真正以回调为准
      wx.showToast({ title: '支付完成', icon: 'success' });
    },
    fail(err) {
      if (err.errMsg.includes('cancel')) {
        wx.showToast({ title: '已取消支付', icon: 'none' });
      } else {
        wx.showToast({ title: '支付失败', icon: 'none' });
      }
    }
  });
}

// 服务端：处理 v3 支付回调
async function handlePayNotify(req, res) {
  const headers = req.headers;
  // 验签：Wechatpay-Signature 用平台证书公钥验签
  const valid = verifySignature(
    headers['wechatpay-timestamp'],
    headers['wechatpay-nonce'],
    headers['wechatpay-signature'],
    headers['wechatpay-serial']
  );
  if (!valid) return res.status(401).end();

  // 解密：AES-256-GCM，key 为 APIv3 密钥
  const plain = decryptNotify(req.rawBody);   // 得到明文 JSON
  const { out_trade_no, transaction_id, trade_state, amount } = plain;

  if (trade_state === 'SUCCESS') {
    // 幂等处理：先查本地订单状态，避免重复回调
    const order = await orderService.getByOutTradeNo(out_trade_no);
    if (order && order.status === 'pending_pay' && order.totalFee === amount.total) {
      await orderService.markPaid(order, transaction_id);
    }
  }
  res.json({ code: 'SUCCESS', message: '成功' });   // 必须返回 SUCCESS
}

// 服务端：按商户订单号主动查单
async function queryOrder(outTradeNo) {
  const url = `https://api.mch.weixin.qq.com/v3/pay/transactions/out-trade-no/${outTradeNo}?mchid=${MCHID}`;
  const resp = await axios.get(url, { headers: wxPaySign('GET', url, '') });
  const { trade_state, transaction_id } = resp.data;
  if (trade_state === 'SUCCESS') {
    await orderService.markPaidByIdempotent(outTradeNo, transaction_id);
  }
  return trade_state;   // SUCCESS / NOTPAY / CLOSED / REFUND 等
}

// 服务端：发起退款
async function createRefund({ outTradeNo, refundNo, refundFee, totalFee }) {
  const url = 'https://api.mch.weixin.qq.com/v3/refund/domestic/refunds';
  const body = {
    out_trade_no: outTradeNo,          // 原支付订单号
    out_refund_no: refundNo,           // 商户退款单号
    notify_url: REFUND_NOTIFY_URL,     // 退款结果回调（可配置）
    amount: {
      refund: refundFee,               // 退款金额（分）
      total: totalFee,                 // 原订单金额（分）
      currency: 'CNY'
    }
  };
  const resp = await axios.post(url, body, { headers: wxPaySign('POST', url, body) });
  return resp.data;                    // { refund_id, status: 'PROCESSING'|'SUCCESS' }
}

// 状态机校验示例
const ALLOWED_TRANSITIONS = {
  'pending_pay': ['pending_confirm', 'cancelled'],
  'pending_confirm': ['paid', 'cancelled'],
  'paid': ['refunding', 'completed'],
  'refunding': ['refunded'],
  'cancelled': [],
  'refunded': [],
  'completed': []
};

function transitionOrder(order, nextStatus) {
  if (!ALLOWED_TRANSITIONS[order.status].includes(nextStatus)) {
    throw new Error(`非法状态流转：${order.status} → ${nextStatus}`);
  }
  return { ...order, status: nextStatus, updatedAt: new Date() };
}

// 服务端：定时扫描超时未支付订单
const TIMEOUT_MS = 30 * 60 * 1000;   // 30 分钟未支付自动关闭

async function closeExpiredOrders() {
  const expired = await db.orders.find({
    status: 'pending_pay',
    createdAt: { $lt: new Date(Date.now() - TIMEOUT_MS) }
  });
  for (const order of expired) {
    await transitionOrder(order, 'cancelled');
  }
  console.log(`已关闭 ${expired.length} 笔超时订单`);
}

// cloudfunctions/pay/index.js
const cloud = require('wx-server-sdk');
cloud.init({ env: cloud.DYNAMIC_CURRENT_ENV });

exports.main = async (event) => {
  const { orderId, totalFee } = event;
  const wxContext = cloud.getWXContext();

  const res = await cloud.cloudPay.unifiedOrder({
    body: '商品购买',
    outTradeNo: orderId,
    spbillCreateIp: '127.0.0.1',
    subMchId: '商户号',
    totalFee,                        // 单位：分
    envId: '你的云环境 ID',
    functionName: 'pay-callback'     // 支付回调云函数
  });

  return res.payment;   // { timeStamp, nonceStr, package, signType, paySign }
};