Golang on GAE集成PayPal IPN：解决参数顺序验证挑战

// url.Values的文档说明
// Encode encodes the values into “URL encoded” form ("bar=baz&foo=quux") sorted by key.
// 这意味着顺序会被打乱

package main

import (
    "bytes"
    "io"
    "log"
    "net/http"

    "google.golang.org/appengine"
    "google.golang.org/appengine/urlfetch"
)

func ipnHandler(w http.ResponseWriter, r *http.Request) {
    // 确保请求方法是POST
    if r.Method != http.MethodPost {
        http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
        return
    }

    // 创建GAE上下文和urlfetch客户端
    c := appengine.NewContext(r)
    client := urlfetch.Client(c)

    // 1. 准备用于回传的请求体
    var buf bytes.Buffer
    // 首先添加PayPal要求的验证参数
    _, err := buf.WriteString("cmd=_notify-validate&")
    if err != nil {
        log.Errorf(c, "Error writing cmd parameter: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }

    // 2. 将原始请求体内容复制到缓冲区，保持原始顺序
    // 注意：r.Body只能读取一次，如果之前已经读取过（例如通过r.ParseForm()），则需要处理
    // 在本例中，我们假设r.Body尚未被读取
    _, err = io.Copy(&buf, r.Body)
    if err != nil {
        log.Errorf(c, "Error copying request body: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }

    // 3. 定义PayPal的验证端点
    // 注意：在生产环境中应使用 live.paypal.com，此处为沙箱环境
    paypalValidationURL := "https://www.sandbox.paypal.com/cgi-bin/webscr"

    // 4. 使用 client.Post 发送请求
    // 指定正确的Content-Type
    resp, err := client.Post(paypalValidationURL, "application/x-www-form-urlencoded", &buf)
    if err != nil {
        log.Errorf(c, "Error posting to PayPal: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }
    defer resp.Body.Close()

    // 5. 读取PayPal的验证响应
    paypalResponse, err := io.ReadAll(resp.Body)
    if err != nil {
        log.Errorf(c, "Error reading PayPal response: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }

    // 6. 处理PayPal的响应
    // 通常会检查响应是否为 "VERIFIED" 或 "INVALID"
    responseString := string(paypalResponse)
    log.Infof(c, "PayPal IPN verification response: %s", responseString)

    if responseString == "VERIFIED" {
        // IPN已验证，可以安全地处理交易逻辑
        log.Infof(c, "IPN VERIFIED. Proceed with transaction processing.")
        w.WriteHeader(http.StatusOK)
        // 可以在这里添加具体的业务逻辑
    } else if responseString == "INVALID" {
        // IPN验证失败，可能是伪造的请求
        log.Warningf(c, "IPN INVALID. Possible fraudulent request.")
        http.Error(w, "IPN Invalid", http.StatusBadRequest)
    } else {
        // 未知的PayPal响应
        log.Errorf(c, "Unexpected PayPal response: %s", responseString)
        http.Error(w, "Unexpected PayPal Response", http.StatusInternalServerError)
    }
}

func main() {
    http.HandleFunc("/paypal/ipn", ipnHandler)
    appengine.Main() // 启动GAE应用
}