PHP 支付集成实战：Stripe、支付宝与微信支付的状态机与回调

$stripe = new \Stripe\StripeClient(config('services.stripe.secret'));

$session = $stripe->checkout->sessions->create([
    'mode' => 'payment',
    'line_items' => [[
        'price_data' => [
            'currency' => 'usd',
            'unit_amount' => 2000,                 // 单位：分
            'product_data' => ['name' => 'Pro 会员'],
        ],
        'quantity' => 1,
    ]],
    'success_url' => route('pay.success') . '?session_id={CHECKOUT_SESSION_ID}',
    'client_reference_id' => $outTradeNo,          // 回传自己的订单号
    'metadata' => ['order_id' => $order->id],
], ['idempotency_key' => 'order_' . $order->id]);  // 幂等键，防重复创建

$intent = $stripe->paymentIntents->create([
    'amount' => 2000,
    'currency' => 'usd',
    'automatic_payment_methods' => ['enabled' => true],
    'metadata' => ['order_id' => $order->id],
]);
// 前端用 $intent->client_secret 调 Stripe.js 完成支付

use Stripe\Webhook;
use Stripe\Exception\SignatureVerificationException;

$payload = file_get_contents('php://input');       // 原始 body，切勿先 json_decode
$sigHeader = $_SERVER['HTTP_STRIPE_SIGNATURE'] ?? '';

try {
    $event = Webhook::constructEvent($payload, $sigHeader, config('services.stripe.webhook_secret'));
} catch (SignatureVerificationException $e) {
    abort(400, 'invalid signature');
}

if (ProcessedEvent::where('event_id', $event->id)->exists()) {
    return response('ok');                          // 幂等：已处理，直接返回 200
}

match ($event->type) {
    'checkout.session.completed',
    'payment_intent.succeeded' => OrderService::markPaid(
        $event->data->object->metadata->order_id,
        $event->data->object->amount_received,
    ),
    'charge.refunded' => RefundService::handleRefund($event->data->object),
    default => null,                                // 未订阅的事件直接忽略
};

ProcessedEvent::create(['event_id' => $event->id]);
return response('ok');

function alipayVerify(array $params, string $alipayPublicKey): bool
{
    $sign = $params['sign'];
    unset($params['sign'], $params['sign_type']);

    ksort($params);                                  // 1. 按键名排序
    $pairs = [];
    foreach ($params as $k => $v) {
        if ($v !== '' && $v !== null) { $pairs[] = $k . '=' . $v; }   // 2. 拼 k=v
    }
    $content = implode('&', $pairs);                 // 3. 待验签串

    return openssl_verify($content, base64_decode($sign),
        $alipayPublicKey,                            // 支付宝公钥（非应用公钥）
        OPENSSL_ALGO_SHA256                          // 4. RSA2 = SHA256
    ) === 1;
}

if (!alipayVerify($_POST, $publicKey)) {
    echo 'fail';                                     // 验签失败，让支付宝重试
    return;
}
if (in_array($_POST['trade_status'], ['TRADE_SUCCESS', 'TRADE_FINISHED'], true)) {
    OrderService::markPaid($_POST['out_trade_no'], $_POST['total_amount']);
}
echo 'success';                                      // 必须返回纯文本 success

$timestamp = $_SERVER['HTTP_WECHATPAY_TIMESTAMP'];
$nonce     = $_SERVER['HTTP_WECHATPAY_NONCE'];
$signature = $_SERVER['HTTP_WECHATPAY_SIGNATURE'];
$body      = file_get_contents('php://input');

$message = "{$timestamp}\n{$nonce}\n{$body}\n";
$ok = openssl_verify($message, base64_decode($signature), $platformCert, OPENSSL_ALGO_SHA256) === 1;

$payload    = json_decode($body, true)['resource'];
$ciphertext = base64_decode($payload['ciphertext']);
$tag        = substr($ciphertext, -16);              // 末 16 字节是 GCM tag
$data       = substr($ciphertext, 0, -16);

$plain = openssl_decrypt($data, 'aes-256-gcm', config('wechat.apiv3_key'),
    OPENSSL_RAW_DATA, $payload['nonce'], $tag, $payload['associated_data']);
$notify = json_decode($plain, true);                 // out_trade_no / trade_state

if ($notify['trade_state'] === 'SUCCESS') {
    OrderService::markPaid($notify['out_trade_no'], $notify['amount']['total']);
}
return response()->json(['code' => 'SUCCESS', 'message' => '成功']);   // HTTP 200

// 乐观更新：只有当前是 PENDING 才改成 PAID，天然幂等
$affected = Order::where('id', $id)->where('status', 'PENDING')
    ->update(['status' => 'PAID', 'paid_at' => now()]);
// $affected === 0 说明已支付过或状态不对——记录日志但不报错