我要评论简介
项目中使用的是 google play 和 appstore iap
google play采用了 支付完成后由google服务器通知游戏服务器 的方式,游戏服务器提供的接口必须为 https,请求类型为 post
appstore 采用了客户端给游戏服务器收据,之后服务器自己拿着 收据向第三方服务器验证 的方式, （只有订阅商品可以走苹果的通知）
使用 go 库
url: https://github.com/awa/go-iap
title: "github - awa/go-iap: go-iap verifies the purchase receipt via appstore, googleplaystore, amazonappstore and huawei hms."
description: "go-iap verifies the purchase receipt via appstore, googleplaystore, amazonappstore and huawei hms. - github - awa/go-iap: go-iap verifies the purchase receipt via appstore, googleplaystore, amazona..."
host: github.com
favicon: https://github.githubassets.com/favicons/favicon.svg
image: https://opengraph.githubassets.com/082874903e0ef0aef0e79326afb5af592c8b90cf84aff0bb1dc6a0e2cb379311/awa/go-iap
google play
文档
url: https://developer.android.com/google/play/billing/rtdn-reference?hl=zh-cn&authuser=1
title: "实时开发者通知参考指南 | google play 结算系统 | android developers"
host: developer.android.com
image: https://developer.android.com/static/images/social/android-developers.png?authuser=1&hl=zh-cn
url: https://developers.google.com/android-publisher/api-ref/rest/v3/purchases.products/get?hl=zh-cn
title: "method: purchases.products.get | google play developer api | google for developers"
host: developers.google.com
image: https://www.gstatic.com/devrel-devsite/prod/vf713985d8e62ba7506345995097e4b76a060f9dc558a369e9b889efae740fb5f/developers/images/opengraph/google-blue.png
配置流程
- 去 google cloud 的 api 和服务 配置 服务账号,下载 google 认证文件
- 在 pub/sub 页面,创建 主题和订阅,订阅里设置传送类型为 推送,同时填写要通知的服务器的 url
- 为主题和订阅添加权限 pub/sub admin,账号为
google-play-developer-notifications@system.gserviceaccount.com - 去 google play console,用开发者账户 (项目创建者,需支付 25 刀) ,在 api 权限里启用 google play developer api
- 选择程序,在 营利设定 里可以找到 google play 付款服务,把之前创建的 主题 填上去,发送测试通知
- 如果成功的话服务器将会收到一条测试消息,格式为 json,其中 data 字段被 base64 加密过,需要解码之后查看内容
相关代码
解析消息
type googleplaydata struct {
version string `json:"version"`
packagename string `json:"packagename"`
eventtimemillis string `json:"eventtimemillis"`
onetimeproductnotification *onetimeproductnotification `json:"onetimeproductnotification,omitempty"`
subscriptionnotification *subscriptionnotification `json:"subscriptionnotification,omitempty"`
testnotification *testnotification `json:"testnotification,omitempty"`
}
type subscriptionnotification struct {
version string `json:"version"`
notificationtype int `json:"notificationtype"`
purchasetoken string `json:"purchasetoken"`
subscriptionid string `json:"subscriptionid"`
}
type onetimeproductnotification struct {
version string `json:"version"`
notificationtype int `json:"notificationtype"`
purchasetoken string `json:"purchasetoken"`
sku string `json:"sku"`
}
type testnotification struct {
version string `json:"version"`
}
-------------------------------------------------------------------------------------------------------------------------------------------------
decodestring, err := base64.stdencoding.decodestring("data字段")
if err != nil {
return nil, err
}
var gpd googleplaydata
err = json.unmarshal(decodestring, &gpd)
if err != nil {
return nil, err
}
认证
googleclient, err = playstore.new("key文件")
if err != nil {
log.fatal(err)
}
// 获取订单信息
googleclient.verifyproduct(context.background(), packagename, productid, token)
// 确认订单
googleclient.acknowledgeproduct(ctx, packagename, productid, purchasetoken, developerpayload)
// 消费订单
googleclient.consumeproduct(ctx, packagename, productid, purchasetoken)
踩坑
- 不是所有订单都会触发通知,只有当购买交易从 pending 过渡到 purchased 时,应用才会收到
one_time_product_purchased通知.如果购买交易被取消,应用会收到one_time_product_canceled通知.也就是说,在用测试卡进行支付测试时,如果选择 " 一律批准 " 的交易方式,就不会触发通知,因为没有触发 pending 的过渡. - 使用测试订单进行支付流程的验证时,使用 verifyproduct 获取到订单信息,里边的 purchasetoken 是空的,进而导致请求时报错,所以要 使用通知消息内带来的 token.
appstore iap
文档
适用于苹果订阅
url: https://developer.apple.com/documentation/appstoreservernotifications/responsebodyv2decodedpayload
title: "responsebodyv2decodedpayload | apple developer documentation"
description: "a decoded payload containing the version 2 notification data."
host: developer.apple.com
favicon: /favicon.ico
image: https://docs.developer.apple.com/tutorials/developer-og.jpg
配置流程
- 去 app store connection 创建 app 内购买项目 的密钥,下载 下来保存,名称为
subscriptionkey_*.p8
以下流程为订阅类型商品适用:
- 用管理账户在 app 内的 app 信息 页面,在 app store 服务器通知 填写生产和沙盒服务器的 url
- 发送一个测试消息,需要设置 jwt 请求头,用的是第 1 步设置的密钥,详情点 这里
- 如果成功的话,服务器将会收到收到一条 json 格式的
testnotificationtoken,内容为 jwt 加密后的一串数据signedpayload,解码过后可以看到一些 数据
以下流程为消耗型商品适用:
- 客户端收到苹果的支付成功的回调后,将
transactionid传给服务端 - 服务端拿着
transactionid去 app store 服务器获取订单信息,验证transactionid是否一致等操作判断订单合法性
相关代码
发起请求
url: https://developer.apple.com/documentation/appstoreserverapi/generating_tokens_for_api_requests
title: "generating tokens for api requests | apple developer documentation"
description: "create json web tokens signed with your private key to authorize app store server api requests."
host: developer.apple.com
favicon: /favicon.ico
image: https://docs.developer.apple.com/tutorials/developer-og.jpg
所有请求都需要一个 bearer token, 具体的加密方式为
- 定义
jwt header和jwt payload - 使用密钥对
jwt对象进行加密,方式为es256,得到加密字符串 - 之后在请求头中加入
authorization,值为bearer 加密字符串
demo:
package main
import (
"crypto/ecdsa"
"crypto/x509"
"encoding/pem"
"errors"
"fmt"
"os"
"sync"
"time"
"github.com/golang-jwt/jwt/v4"
"github.com/google/uuid")
func main() {
key, err := os.readfile("./subscriptionkey_wry3waf666.p8")
if err != nil {
panic(err)
}
c := &storeconfig{
keycontent: key, // loads a .p8 certificate
keyid: "2x9r4hxf34", // your private key id from app store connect (ex: 2x9r4hxf34)
bundleid: "com.xxx.xxx", // your app’s bundle id
issuer: "93fe111e-7a12-426b-bb79-53ce456c183e", // your issuer id from the keys page in app store connect (ex: "57246542-96fe-1a63-e053-0824d011072a")
sandbox: true, // default is production
}
t := token{}
t.withconfig(c)
err = t.generate()
if err != nil {
panic(err)
}
fmt.println(t.bearer) // 生成的token
}
type token struct {
sync.mutex
keycontent []byte // loads a .p8 certificate
keyid string // your private key id from app store connect (ex: 2x9r4hxf34)
bundleid string // your app’s bundle id
issuer string // your issuer id from the keys page in app store connect (ex: "57246542-96fe-1a63-e053-0824d011072a")
sandbox bool // default is production
// internal variables authkey *ecdsa.privatekey // .p8 private key
expiredat int64 // the token’s expiration time, in unix time. tokens that expire more than 60 minutes after the time in iat are not valid (ex: 1623086400)
bearer string // authorized bearer token
}
type storeconfig struct {
keycontent []byte // loads a .p8 certificate
keyid string // your private key id from app store connect (ex: 2x9r4hxf34)
bundleid string // your app’s bundle id
issuer string // your issuer id from the keys page in app store connect (ex: "57246542-96fe-1a63-e053-0824d011072a")
sandbox bool // default is production
}
func (t *token) withconfig(c *storeconfig) {
t.keycontent = append(t.keycontent[:0:0], c.keycontent…)
t.keyid = c.keyid
t.bundleid = c.bundleid
t.issuer = c.issuer
t.sandbox = c.sandbox
}
func (t *token) generate() error {
key, err := t.passkeyfrombyte(t.keycontent)
if err != nil {
return err
}
t.authkey = key
issuedat := time.now().unix()
expiredat := time.now().add(time.duration(1) * time.hour).unix()
jwttoken := &jwt.token{
header: map[string]interface{}{
"alg": "es256",
"kid": t.keyid,
"typ": "jwt",
},
claims: jwt.mapclaims{
"iss": t.issuer,
"iat": issuedat,
"exp": expiredat,
"aud": "appstoreconnect-v1",
"nonce": uuid.new(),
"bid": t.bundleid,
},
method: jwt.signingmethodes256,
}
bearer, err := jwttoken.signedstring(t.authkey)
if err != nil {
return err
}
t.expiredat = expiredat
t.bearer = bearer
return nil
}
// passkeyfrombyte loads a .p8 certificate from an in memory byte array and returns an *ecdsa.privatekey.
func (t *token) passkeyfrombyte(bytes []byte) (*ecdsa.privatekey, error) {
block, _ := pem.decode(bytes)
if block == nil {
return nil, errauthkeyinvalidpem
}
key, err := x509.parsepkcs8privatekey(block.bytes)
if err != nil {
return nil, err
}
switch pk := key.(type) {
case *ecdsa.privatekey:
return pk, nil
default:
return nil, errauthkeyinvalidtype
}
}
var (
errauthkeyinvalidpem = errors.new("token: authkey must be a valid .p8 pem file")
errauthkeyinvalidtype = errors.new("token: authkey must be of type ecdsa.privatekey")
)
解析 signedtransactioninfo
- 分成三部分, 以
.分开, 分别是header,payload,signature - 如果只想查看数据, 只需要用
无填充base64解码payload即可,详情 header用无填充base64解码后, 里边有alg和x5c,用来验证签名,详情- 证书地址
https://www.apple.com/certificateauthority/,一般是用 apple root ca - g3 root
解析 signedpayload
适用于订阅商品
type platformapplesubscribeiap struct {
signedpayload string `json:"signedpayload"`
payloaddata payloaddata `json:"payloaddata"`
}
type payloaddata struct {
notificationtype string `json:"notificationtype"` //app store 发送此版本 2 通知的应用内购买事件。
notificationuuid string `json:"notificationuuid"` //通知的唯一标识符。使用此值来识别重复的通知。
version string `json:"version"` //app store 服务器通知版本号，."2.0"
signeddate float64 `json:"signeddate"` //app store 签署 json web 签名数据的 unix 时间（以毫秒为单位）。
subtype string `json:"subtype"` //标识通知事件的附加信息。该subtype字段仅针对特定版本 2 通知出现。
summary *summary `json:"summary,omitempty"` //当 app store 服务器完成您为符合条件的订阅者延长订阅续订日期的请求时显示的摘要数据.与data互斥
data *data `json:"data,omitempty"` //包含应用程序元数据以及签名的续订和交易信息的对象。与summary互斥
}
type summary struct {
requestidentifier string `json:"requestidentifier,omitempty"`
environment string `json:"environment,omitempty"`
appappleid int64 `json:"appappleid,omitempty"`
bundleid string `json:"bundleid,omitempty"`
productid string `json:"productid,omitempty"`
storefrontcountrycodes []string `json:"storefrontcountrycodes,omitempty"`
failedcount int64 `json:"failedcount,omitempty"`
succeededcount int64 `json:"succeededcount,omitempty"`
}
type data struct {
appappleid int64 `json:"appappleid,omitempty"`
bundleid string `json:"bundleid,omitempty"`
bundleversion string `json:"bundleversion,omitempty"`
environment string `json:"environment,omitempty"`
signedrenewalinfo string `json:"signedrenewalinfo,omitempty"`
signedtransactioninfo string `json:"signedtransactioninfo,omitempty"`
status int32 `json:"status,omitempty"`
}
appleparseclient = appstore.new()
token := jwt.token{}
err := appleparseclient.parsenotificationv2(p.signedpayload, &token)
if err != nil {
return nil, err
}
bytes, err := json.marshal(token.claims.(jwt.mapclaims))
if err != nil {
return nil, err
}
err = json.unmarshal(bytes, &p.payloaddata)
if err != nil {
return nil, err
}
验证 transaction
消耗型商品和订阅商品通用
key, err := os.readfile(fmt.sprintf("configs/subscriptionkey_%s.p8", configs.getcfg().appleiap.kid))
if err != nil {
panic(err)
}
c := &api.storeconfig{
keycontent: key, // loads a .p8 certificate
keyid: configs.getcfg().appleiap.kid, // your private key id from app store connect (ex: 2x9r4hxf34)
bundleid: configs.getcfg().appleiap.bid, // your app’s bundle id
issuer: configs.getcfg().appleiap.iss, // your issuer id from the keys page in app store connect (ex: "57246542-96fe-1a63-e053-0824d011072a")
sandbox: configs.getcfg().appleiap.issandbox, // default is production
}
appleclient := api.newstoreclient(c)
// 消耗型商品
res, _ := appleclient.gettransactioninfo(ctx, p.transactionid) // 需要先去获取transaction信息
// 通用
// 订阅型商品:苹果通知会直接把signedtransactioninfo信息带过来,可以直接解析
// 消耗型商品:拿到上一步的transaction信息中的signedtransactioninfo解析
transaction, err := appleclient.parsesignedtransaction(signedtransactioninfo)
if transaction.transactionid == p.transactionid {
// valid
}
发表评论