f

internal/infrastructure/external/yuyuecha/crypto.go

@@ -0,0 +1,79 @@
+package yuyuecha
+
+import (
+	"crypto/hmac"
+	"crypto/md5"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+	"unicode"
+)
+
+// HashIDCard 将身份证号转为上游要求的身份摘要。
+// 规则：已是 32 位 MD5 / 64 位 SHA-256 十六进制则原样小写返回；否则对规范化身份证号做 MD5。
+func HashIDCard(idCard string) string {
+	id := strings.TrimSpace(idCard)
+	if isHexDigest(id, 32) || isHexDigest(id, 64) {
+		return strings.ToLower(id)
+	}
+	// 末位校验码 X 统一大写后再摘要，与授权侧常见落库一致
+	sum := md5.Sum([]byte(strings.ToUpper(id)))
+	return hex.EncodeToString(sum[:])
+}
+
+func isHexDigest(s string, length int) bool {
+	if len(s) != length {
+		return false
+	}
+	for _, r := range s {
+		if !unicode.Is(unicode.ASCII_Hex_Digit, r) {
+			return false
+		}
+	}
+	return true
+}
+
+// SignHeaders 按 OpenAPI 规范生成签名请求头
+// canonical:
+//
+//	clientId={id}\ntimestamp={ms}\nnonce={hex}\nmethod={METHOD}\npath={path}\nbodySha256={sha256}
+func SignHeaders(clientID, clientSecret, method, path string, body []byte) (map[string]string, error) {
+	timestamp := strconv.FormatInt(time.Now().UnixMilli(), 10)
+	nonce, err := randomNonce(16)
+	if err != nil {
+		return nil, fmt.Errorf("生成 nonce 失败: %w", err)
+	}
+
+	sum := sha256.Sum256(body)
+	bodySHA256 := hex.EncodeToString(sum[:])
+
+	canonical := "clientId=" + clientID +
+		"\ntimestamp=" + timestamp +
+		"\nnonce=" + nonce +
+		"\nmethod=" + method +
+		"\npath=" + path +
+		"\nbodySha256=" + bodySHA256
+
+	mac := hmac.New(sha256.New, []byte(clientSecret))
+	mac.Write([]byte(canonical))
+	signature := hex.EncodeToString(mac.Sum(nil))
+
+	return map[string]string{
+		"clientId":  clientID,
+		"timestamp": timestamp,
+		"nonce":     nonce,
+		"signature": signature,
+	}, nil
+}
+
+func randomNonce(nBytes int) (string, error) {
+	buf := make([]byte, nBytes)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(buf), nil
+}