Merge branch 'master' into v1.0

TheNorthMemory · Feb 18, 2024 · 252f944 · 252f944
2 parents a79d274 + d8fe421
commit 252f944
Show file tree

Hide file tree

Showing 9 changed files with 205 additions and 69 deletions.
diff --git a/.github/workflows/npm-test.yml b/.github/workflows/npm-test.yml
@@ -8,7 +8,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [10.15.x, 12.x, 14.x, 16.x, 18.x]
+        node-version: [10.15.x, 12.x, 14.x, 16.x, 18.x, 20.x]
         os: [ubuntu-latest, macOS-latest, windows-latest]
     runs-on: ${{ matrix.os }}
 
@@ -19,9 +19,11 @@ jobs:
           git config --global core.autocrlf false
           git config --global core.symlinks true
         if: runner.os == 'Windows'
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+        with:
+          show-progress: false
       - name: v${{ matrix.node-version }} on ${{ matrix.os }}
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
       - run: npm install

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,7 +1,23 @@
 # 变更历史
 
+## v0.8.10 (2024-02-14)
+
+- 升级依赖 `axios@^0.28.0` for the CVE-2023-45857;
+
+## v0.8.9 (2024-02-12)
+
+- 取消对`axios/lib/utils`的依赖。
+
+## v0.8.8 (2024-01-28)
+
+- 升级依赖 `[email protected]`, `[email protected]`;
+
+## v0.8.7 (2023-04-12)
+- 升级依赖 `xml2js@^0.5.0` for CVE-2023-0842;
+
 ## v0.8.6 (2022-08-25)
 - 修复多个 `uri_template` 占位符变量，无法正确替换问题；
+
 ## v0.8.5 (2022-03-09)
 - 优化`README`，增加v2版付款到零钱示例不验签使用方法；
 - 解决`CLI`下初始化参数`mchid`必须是字符串类型的遗留问题；

diff --git a/README.md b/README.md
@@ -4,11 +4,11 @@ The WeChatPay OpenAPI v2&v3' Smart Development Kit
 
 [![GitHub actions](https://github.com/TheNorthMemory/wechatpay-axios-plugin/workflows/npm%20test/badge.svg)](https://github.com/TheNorthMemory/wechatpay-axios-plugin/actions)
 [![GitHub release](https://img.shields.io/npm/v/wechatpay-axios-plugin)](https://github.com/TheNorthMemory/wechatpay-axios-plugin/releases)
-[![Vulnerabilities](https://img.shields.io/snyk/vulnerabilities/npm/wechatpay-axios-plugin?label=snyk.io)](https://snyk.io/advisor/npm-package/wechatpay-axios-plugin)
+[![Vulnerabilities](https://snyk.io/advisor/npm-package/wechatpay-axios-plugin/badge.svg)](https://snyk.io/advisor/npm-package/wechatpay-axios-plugin)
 [![types](https://img.shields.io/badge/types-included-blue)](https://www.npmjs.com/package/wechatpay-axios-plugin)
 [![Node](https://img.shields.io/node/v/wechatpay-axios-plugin)](https://www.npmjs.com/package/wechatpay-axios-plugin)
 [![NPM downloads per month](https://img.shields.io/npm/dm/wechatpay-axios-plugin)](https://www.npmjs.com/package/wechatpay-axios-plugin)
-[![NPM license](https://img.shields.io/npm/l/wechatpay-axios-plugin?color=blue)](https://www.npmjs.com/package/wechatpay-axios-plugin)
+[![NPM license](https://img.shields.io/npm/l/wechatpay-axios-plugin)](https://www.npmjs.com/package/wechatpay-axios-plugin)
 
 ## 主要功能
 
@@ -182,7 +182,7 @@ Options:
 
 1. 请求 `segments` 按照顺序作为级联对象，例如 `v3/pay/transactions/native` 即链接成 `v3.pay.transactions.native`;
 2. 每个 `segments` 所支持的 `HTTP METHOD`，即作为 请求对象的末尾执行方法，例如: `v3.pay.transactions.native.post({})`;
-3. 每个 `segments` 级联对象默认为HTTP`POST`方法，其同时隐式内置`GET/POST/PUT/PATCH/DELETE` 方法链，支持全大写及全小写两种编码方式，说明见`变更历史`;
+3. 每个 `segments` 级联对象默认为HTTP`POST`方法，其同时隐式内置`GET/POST/PUT/PATCH/DELETE` 方法链，小写`verb`格式，说明见`变更历史`;
 4. 每个 `segments` 有中线(dash)分隔符的，可以使用驼峰`camelCase`风格书写，例如: `merchant-service`可写成 `merchantService`，或者字面量属性，如 `v3['merchant-service']`;
 5. 每个 `segments` 中，若有动态参数，例如 `business_code/{business_code}` 可写成 `business_code.$business_code$` 或者字面量属性风格，如 `business_code['{business_code}']`;
 6. 如果 `segments` 以 `v2` 开始，其特殊标识为`APIv2`级联对象开始位，之后串接其他`segments`，如源 `pay/micropay` 即串接成 `v2.pay.micropay` 即以XML形式请求远端接口；
@@ -270,16 +270,25 @@ wxpay.v3.pay.transactions.native
 
 ### 查询订单
 ```js
-wxpay.v3.pay.transactions.id['{transaction_id}']
-  .get({params: {mchid: '1230000109'}, transaction_id: '1217752501201407033233368018'})
+wxpay.v3.pay.transactions.id._transaction_id_ // _placeholder_ 语法糖会转换成 '{placeholder}' 格式
+  .get({
+    params: {
+      mchid: '1230000109'
+    },
+    transaction_id: '1217752501201407033233368018'
+  })
   .then(({data}) => console.info(data))
   .catch(({response: {status, statusText, data}}) => console.error(status, statusText, data))
 ```
 
 ### 关闭订单
 ```js
-wxpay.v3.pay.transactions.outTradeNo['1217752501201407033233368018'].close
-  .post({mchid: '1230000109'})
+wxpay.v3.pay.transactions.outTradeNo.$transaction_id$.close // $placeholder$ 语法糖会转换成 '{placeholder}' 格式
+  .post({
+    mchid: '1230000109'
+  }, {
+    transaction_id: '1217752501201407033233368018'
+  })
   .then(({status, statusText}) => console.info(status, statusText))
   .catch(({response: {status, statusText, data}}) => console.error(status, statusText, data))
 ```
@@ -346,7 +355,7 @@ wxpay.v3.marketing.busifavor.stocks
   } catch({response: {status, statusText, data}}) {
     console.error(status, statusText, data)
   }
-}
+})()
 ```
 
 ### 服务商模式Native下单
@@ -385,7 +394,42 @@ wxpay.v3.marketing.busifavor.stocks
   } catch({response: {status, statusText, data}}) {
     console.error(status, statusText, data)
   }
-}
+})()
+```
+
+### 商家转账到零钱
+
+```js
+const {Rsa} = require('wechatpay-axios-plugin');
+
+;(async () => {
+  try {
+    const res = await wxpay.v3.transfer.batches.post({
+      appid: 'wxf636efh567hg4356',
+      out_batch_no: 'plfk2020042013',
+      batch_name: '2019年1月深圳分部报销单',
+      batch_remark: '2019年1月深圳分部报销单',
+      total_amount: 4000000,
+      total_num: 200,
+      transfer_detail_list: [
+        {
+          out_detail_no: 'x23zy545Bd5436',
+          transfer_amount: 200000,
+          transfer_remark: '2020年4月报销',
+          openid: 'o-MYE42l80oelYMDE34nYD456Xoy',
+          user_name: Rsa.encrypt('张三', platformCertificateInstance),
+        }
+      ],
+      transfer_scene_id: '1001',
+    }, {
+      headers: {
+        'Wechatpay-Serial' => platformCertificateSerial,
+      },
+    });
+  } catch({response: {status, statusText, data}}) {
+    console.error(status, statusText, data)
+  }
+})()
 ```
 
 ### 商业投诉查询
@@ -539,14 +583,14 @@ const {Hash: {sha1}} = require('wechatpay-axios-plugin')
 
 ;(async () => {
   try {
-    const {data: {download_url, hash_value}} = await wxpay.v3.bill.fundflowbill.GET({
+    const {data: {download_url, hash_value}} = await wxpay.v3.bill.fundflowbill.get({
       params: {
         bill_date: '2020-02-12',
         bill_type: 'BASIC',
         tar_type: 'GZIP',
       }
     })
-    const {data} = await wxpay.v3.billdownload.file.GET({
+    const {data} = await wxpay.v3.billdownload.file.get({
       params: (new URL(download_url)).searchParams,
       responseType: 'arraybuffer', // To prevent the axios:utils.stripBOM feature
       transformResponse: [function csvDigestValidator(data) {
@@ -569,7 +613,7 @@ const {Hash: {sha1}} = require('wechatpay-axios-plugin')
 ### 付款码(刷卡)支付
 
 ```js
-wxpay.v2.pay.micropay({
+wxpay.v2.pay.micropay.post({
   appid: 'wx8888888888888888',
   mch_id: '1900000109',
   nonce_str: Formatter.nonce(),
@@ -588,7 +632,7 @@ wxpay.v2.pay.micropay({
 ### H5支付
 
 ```js
-wxpay.v2.pay.unifiedorder({
+wxpay.v2.pay.unifiedorder.post({
   appid: 'wx2421b1c4370ec43b',
   attach: '支付测试',
   body: 'H5支付测试',
@@ -652,7 +696,7 @@ wxpay.v2.mmpaymkttransfers.sendredpack.post({
 ### 企业付款到零钱
 
 ```js
-wxpay.v2.mmpaymkttransfers.promotion.transfers({
+wxpay.v2.mmpaymkttransfers.promotion.transfers.post({
   mch_appid: 'wx8888888888888888',
   mchid: '1900000109',// 注意这个商户号，key是`mchid`非`mch_id`
   partner_trade_no: '10000098201411111234567890',
@@ -674,7 +718,7 @@ wxpay.v2.mmpaymkttransfers.promotion.transfers({
 ### 企业付款到银行卡-获取RSA公钥
 
 ```js
-wxpay.v2.risk.getpublickey({
+wxpay.v2.risk.getpublickey.post({
   mch_id: '1900000109',
   sign_type: 'MD5',
   nonce_str: Formatter.nonce(),
@@ -690,7 +734,7 @@ wxpay.v2.risk.getpublickey({
 ### 下载交易账单
 
 ```js
-wxpay.v2.pay.downloadbill({
+wxpay.v2.pay.downloadbill.post({
   mch_id,
   nonce_str: fmt.nonce(),
   appid,
@@ -741,7 +785,7 @@ Wechatpay.client.v2.defaults.transformRequest.unshift(function workwxredpack(dat
 ### 发放企业红包
 
 ```js
-wxpay.v2.mmpaymkttransfers.sendworkwxredpack({
+wxpay.v2.mmpaymkttransfers.sendworkwxredpack.post({
   mch_billno: '123456',
   wxappid: 'wx8888888888888888',
   sender_name: 'XX活动',
@@ -781,7 +825,7 @@ Wechatpay.client.v2.defaults.transformRequest.unshift(function wwsptrans2pocket(
 ### 向员工付款
 
 ```js
-wxpay.v2.mmpaymkttransfers.promotion.paywwsptrans2pocket({
+wxpay.v2.mmpaymkttransfers.promotion.paywwsptrans2pocket.post({
   appid: 'wxe062425f740c8888',
   device_info: '013467007045764',
   partner_trade_no: '100000982017072019616',

diff --git a/index.d.ts b/index.d.ts
@@ -1,6 +1,7 @@
 /// <reference types="node" />
 import { ReadStream } from "fs";
 import { Readable } from "stream";
+import { AgentOptions } from "https";
 import { AxiosInstance, AxiosRequestConfig, AxiosResponse } from "axios";
 import { CipherKey, BinaryLike } from 'crypto'
 
@@ -406,39 +407,35 @@ export namespace WechatpayAxiosPlugin {
     }
 
     /**
-     * @typedef {Object} apiConfig - The wechatpay consumer side configuration
-     * @prop {string} mchid - The merchant ID
-     * @prop {string} serial - The serial number of the merchant certificate
-     * @prop {string|Buffer} privateKey - The merchant private key certificate
-     * @prop {platformCertificates} certs - The wechatpay provider size configuration, `{serial: publicKey}` pair
+     * This SDK mandatory configuration
      */
     type apiConfig = {
+        /** The merchant ID */
         mchid: string,
+        /** The serial number of the merchant certificate, only for APIv3 */
         serial: string,
+        /** The merchant private key certificat, only for APIv3e */
         privateKey: string | Buffer,
+        /** The wechatpay platform certificates in {serial: publicKey} format, only for APIv3 */
         certs: platformCertificates,
+        /** The merchant secret key string, only for APIv2 */
         secret?: string,
-        merchant?: merchantCertificate
+        /** The merchant private key and certificate configuration for APIv2, while there were required in secure communication. */
+        merchant?: merchantCertificate & AgentOptions
     }
 
-    /**
-     * @typedef {Object} merchantCertificate - The merchant certification for APIv2
-     * @prop {string|Buffer} key - The merchant private key certificate as PEM format
-     * @prop {string|Buffer} cert - The merchant certificate as PEM format
-     * @prop {string|Buffer} pfx - The merchant private key and certificates as PKCS12 format
-     * @prop {string} passphase - The merchant PKCS12 certificates' passphase
-     */
+    /** @deprecated - use {@link AgentOptions} directly */
     type merchantCertificate = {
+        /** The merchant private key certificate as PEM format */
         key?: string | Buffer,
+        /** The merchant certificate as PEM format */
         cert?: string | Buffer,
+        /** The merchant private key and certificate buffer in PKCS12 format */
         pfx?: Buffer,
-        passphase?: string
+        /** The merchant private key and certificate's passphrase */
+        passphrase?: string
     }
 
-    /**
-     * @typedef {Object} platformCertificates - The wechatpay provider side configuration
-     * @prop {string} key - The serial number of the wechatpay certificate
-     */
     type platformCertificates = {
         [key: string]: string | Buffer
     }
@@ -732,7 +729,7 @@ export namespace WechatpayAxiosPlugin {
         * @param {object} config - configuration
         * @param {string} [config.mchid] - The merchant ID
         * @param {string} [config.secret] - The merchant secret key string
-        * @param {object} [config.merchant] - The merchant certificates, more @see {import('tls').createSecureContext}
+        * @param {object} [config.merchant] - The merchant private key and certificate AKA {@link AgentOptions} for APIv2, while there were required in secure communication.
         * @param {string|Buffer} [config.merchant.cert] - The merchant cert chains in PEM format
         * @param {string|Buffer} [config.merchant.key] - The merchant private keys in PEM format
         * @param {string|Buffer} [config.merchant.pfx] - The merchant PFX or PKCS12 encoded private key and certificate chain.
@@ -782,7 +779,7 @@ export namespace WechatpayAxiosPlugin {
         * @param {string|Buffer} config.privateKey - The merchant private key certificate
         * @param {object} config.certs - The wechatpay provider size configuration, `{serial: publicKey}` pair
         * @param {string} [config.secret] - The merchant secret key string
-        * @param {object} [config.merchant] - The merchant certificates, more @see {import('tls').createSecureContext}
+        * @param {object} [config.merchant] - The merchant private key and certificate AKA {@link AgentOptions} for APIv2, while there were required in secure communication.
         * @param {string|Buffer} [config.merchant.cert] - The merchant cert chains in PEM format
         * @param {string|Buffer} [config.merchant.key] - The merchant private keys in PEM format
         * @param {string|Buffer} [config.merchant.pfx] - The merchant PFX or PKCS12 encoded private key and certificate chain.

diff --git a/lib/decorator.js b/lib/decorator.js
@@ -96,8 +96,8 @@ class Decorator {
         Accept: 'text/xml, text/plain, application/x-gzip',
       },
       responseType: 'text',
-      transformRequest: Transformer.request,
-      transformResponse: Transformer.response,
+      transformRequest: [].concat(Transformer.request),
+      transformResponse: [].concat(Transformer.response),
     }));
   }
 
@@ -211,7 +211,7 @@ class Decorator {
 
     const instance = axios.create(this.withDefaults({
       ...config,
-      transformResponse: [this.responseVerifier(certs), ...axios.defaults.transformResponse],
+      transformResponse: [].concat(this.responseVerifier(certs), axios.defaults.transformResponse),
     }));
 
     instance.interceptors.request.use(this.requestInterceptor());