ca认证 V2

2026-04-27 15:26:42 +08:00
parent 207bd2a0c6
commit 1bd00bdcea
14 changed files with 1044 additions and 20 deletions
@@ -0,0 +1,37 @@
+<?php
+
+namespace Extend\Ca;
+
+use App\Exception\BusinessException;
+use Extend\Ca_V2\CaOffline as CaOfflineV2;
+use Extend\Ca_V2\CaOnline as CaOnlineV2;
+
+class CaGatewayFactory
+{
+    public static function makeScene(string $scene): Ca
+    {
+        $sceneConfig = config("ca.gateway.{$scene}", []);
+        if (!is_array($sceneConfig)) {
+            throw new BusinessException("不支持的CA场景配置: {$scene}");
+        }
+
+        $driver = (string) ($sceneConfig['driver'] ?? config('ca.gateway.driver', 'legacy'));
+        $mode = (string) ($sceneConfig['mode'] ?? config('ca.gateway.mode', 'online'));
+
+        return self::make($mode, $driver);
+    }
+
+    public static function make(?string $mode = null, ?string $driver = null): Ca
+    {
+        $resolvedMode = strtolower($mode ?: (string) config('ca.gateway.mode', 'online'));
+        $resolvedDriver = strtolower($driver ?: (string) config('ca.gateway.driver', 'legacy'));
+
+        return match ([$resolvedDriver, $resolvedMode]) {
+            ['legacy', 'online'] => new CaOnline(),
+            ['legacy', 'offline'] => new CaOffline(),
+            ['v2', 'online'] => new CaOnlineV2(),
+            ['v2', 'offline'] => new CaOfflineV2(),
+            default => throw new BusinessException("不支持的CA驱动配置: {$resolvedDriver}/{$resolvedMode}"),
+        };
+    }
+}
@@ -0,0 +1,247 @@
+<?php
+
+namespace Extend\Ca_V2;
+
+use App\Constants\HttpEnumCode;
+use App\Exception\BusinessException;
+use Extend\Ca\Ca as LegacyCa;
+use GuzzleHttp\Exception\GuzzleException;
+use Hyperf\Snowflake\IdGeneratorInterface;
+
+abstract class Ca extends LegacyCa
+{
+    protected array $config = [];
+
+    protected function initConfig(string $configKey, string $label): void
+    {
+        $config = config($configKey, []);
+        if (!$this->isValidConfig($config)) {
+            throw new BusinessException("缺少{$label}配置");
+        }
+
+        $this->config = $config;
+        $this->app_id = $config['app_id'];
+        $this->api_url = rtrim($config['api_url'], '/');
+        $this->secret = $config['secret'];
+    }
+
+    protected function isValidConfig(mixed $config): bool
+    {
+        if (!is_array($config)) {
+            return false;
+        }
+
+        return !empty($config['app_id']) && !empty($config['api_url']) && !empty($config['secret']);
+    }
+
+    protected function buildSignPayload(array $data): string
+    {
+        $signData = [];
+        if (isset($data['form_params'])) {
+            $signData = $data['form_params'];
+        }
+
+        if (isset($data['multipart'])) {
+            foreach ($data['multipart'] as $item) {
+                if (($item['name'] ?? '') === 'pdfFile') {
+                    continue;
+                }
+
+                $signData[$item['name']] = $item['contents'];
+            }
+        }
+
+        if (empty($signData)) {
+            return '';
+        }
+
+        ksort($signData);
+        return implode('&', $signData);
+    }
+
+    protected function getAuthSignature(array $data): string
+    {
+        return hash('sha256', $this->buildSignPayload($data));
+    }
+
+    protected function shouldAttachAuthSignature(string $path): bool
+    {
+        $enabled = filter_var((string) ($this->config['enable_auth_signature'] ?? false), FILTER_VALIDATE_BOOLEAN);
+        if (!$enabled) {
+            return false;
+        }
+
+        return str_contains($path, '/api/cloudCert/open/v2/cert/')
+            || str_contains($path, '/api/cloudCert/open/v3/cert/')
+            || str_contains($path, '/api/certgw/certapi/')
+            || str_contains($path, '/v5/api/certgw/certapi/');
+    }
+
+    protected function buildCertSignPayload(array $data): string
+    {
+        $payload = json_encode($data, JSON_UNESCAPED_UNICODE);
+        if ($payload === false) {
+            throw new BusinessException('CA V2签名原文序列化失败');
+        }
+
+        return $payload;
+    }
+
+    protected function buildCertSignTransportPayload(array $data): string
+    {
+        return base64_encode($this->buildCertSignPayload($data));
+    }
+
+    protected function resolveCertSerialnumber(string $entityId, array $response): string
+    {
+        return (string) ($response['certSerialnumber'] ?? $response['certSn'] ?? '');
+    }
+
+    protected function normalizeCertSignResponse(string $entityId, array $response): array
+    {
+        if (empty($response['signP7']) && !empty($response['requestId'])) {
+            $result = $this->getCertSignResult((string) $response['requestId']);
+            if (is_array($result) && !empty($result['signP7'])) {
+                $response = array_merge($response, $result);
+            }
+        }
+
+        if (empty($response['signP7'])) {
+            if (!empty($response['signUrl'])) {
+                throw new BusinessException('当前证书未开启免密签署，返回的是页面签署链接，暂不支持服务端自动完成');
+            }
+
+            throw new BusinessException('CA V2签名响应缺少signP7');
+        }
+
+        if (empty($response['certSerialnumber'])) {
+            $response['certSerialnumber'] = $this->resolveCertSerialnumber($entityId, $response);
+        }
+
+        return $response;
+    }
+
+    protected function getOptionalConfig(string $key): string
+    {
+        return trim((string) ($this->config[$key] ?? ''));
+    }
+
+    public function getCertSign(string $user_id, string $pin, array $data): mixed
+    {
+        $generator = $this->container->get(IdGeneratorInterface::class);
+        $payload = $this->buildCertSignTransportPayload($data);
+
+        $option = [
+            'form_params' => [
+                'entityId' => $user_id,
+                'requestId' => (string) $generator->generate(),
+                'businessType' => 'certSign',
+                'toSign' => $payload,
+                'extParam' => json_encode(['toSignEncoding' => 'base64'], JSON_UNESCAPED_UNICODE),
+            ],
+        ];
+
+        $notifyUrl = $this->getOptionalConfig('notify_url');
+        if ($notifyUrl !== '') {
+            $option['form_params']['notifyUrl'] = $notifyUrl;
+        }
+
+        $jumpUrl = $this->getOptionalConfig('jump_url');
+        if ($jumpUrl !== '') {
+            $option['form_params']['jumpUrl'] = $jumpUrl;
+        }
+
+        try {
+            $response = $this->httpRequest($this->api_url . '/open/api/data/certSign', $option);
+            if (empty($response)) {
+                throw new BusinessException(HttpEnumCode::getMessage(HttpEnumCode::SERVER_ERROR));
+            }
+
+            return $this->normalizeCertSignResponse($user_id, $response);
+        } catch (GuzzleException $e) {
+            throw new BusinessException($e->getMessage());
+        }
+    }
+
+    public function getCertSignResult(string $requestId): mixed
+    {
+        $option = [
+            'form_params' => [
+                'requestId' => $requestId,
+            ],
+        ];
+
+        try {
+            return $this->httpRequest($this->api_url . '/open/api/data/getCertSignResult', $option);
+        } catch (GuzzleException $e) {
+            throw new BusinessException($e->getMessage());
+        }
+    }
+
+    public function verifyPkcs7(string $sign_p7, array $data)
+    {
+        $generator = $this->container->get(IdGeneratorInterface::class);
+
+        $option = [
+            'form_params' => [
+                'opType' => '签名验证',
+                'requestId' => $generator->generate(),
+                'signedData' => $sign_p7,
+                'toSign' => $this->buildCertSignTransportPayload($data),
+            ],
+        ];
+
+        try {
+            $response = $this->httpRequest(
+                $this->api_url . '/signgw-service/api/signature/verifyPkcs7',
+                $option
+            );
+            if (empty($response)) {
+                throw new BusinessException(HttpEnumCode::getMessage(HttpEnumCode::SERVER_ERROR));
+            }
+
+            return $response;
+        } catch (GuzzleException $e) {
+            throw new BusinessException($e->getMessage());
+        }
+    }
+
+    public function httpRequest(string $path, array $arg = []): mixed
+    {
+        $headers = [
+            'app_id' => $this->app_id,
+            'signature' => $this->getRequestSign($arg),
+        ];
+
+        if ($this->shouldAttachAuthSignature($path)) {
+            $headers['authSignature'] = $this->getAuthSignature($arg);
+        }
+
+        $arg['headers'] = array_merge($arg['headers'] ?? [], $headers);
+
+        $response = $this->client->post($path, $arg);
+        if ($response->getStatusCode() != '200') {
+            throw new BusinessException($response->getBody()->getContents());
+        }
+
+        $body = json_decode($response->getBody(), true);
+        if (empty($body)) {
+            throw new BusinessException(HttpEnumCode::getMessage(HttpEnumCode::SERVER_ERROR));
+        }
+
+        if ($body['result_code'] != 0) {
+            if (!empty($body['result_msg'])) {
+                throw new BusinessException($body['result_msg']);
+            }
+
+            throw new BusinessException(HttpEnumCode::getMessage(HttpEnumCode::SERVER_ERROR));
+        }
+
+        return $body['body'];
+    }
+
+    public function getRequestSign(array $data): string
+    {
+        return hash_hmac('sha1', $this->buildSignPayload($data), $this->secret);
+    }
+}
@@ -0,0 +1,42 @@
+<?php
+
+namespace Extend\Ca_V2;
+
+use App\Constants\HttpEnumCode;
+use App\Exception\BusinessException;
+use GuzzleHttp\Exception\GuzzleException;
+
+class CaOffline extends Ca
+{
+    public function __construct()
+    {
+        parent::__construct();
+        $this->initConfig('ca.v2.offline', 'ca_v2_offline');
+    }
+
+    public function getCloudCert(array $data, string $type = 'Personal'): mixed
+    {
+        $option = [
+            'form_params' => [
+                'entityId' => $data['user_id'],
+                'entityType' => $type,
+                'pin' => $data['user_id'],
+                'cardNumber' => $data['card_num'],
+            ],
+        ];
+
+        try {
+            $response = $this->httpRequest(
+                $this->api_url . '/cloud-certificate-service/api/cloudCert/open/v2/cert/offlineAuthCertEnroll',
+                $option
+            );
+            if (empty($response)) {
+                throw new BusinessException(HttpEnumCode::getMessage(HttpEnumCode::SERVER_ERROR));
+            }
+
+            return $response;
+        } catch (GuzzleException $e) {
+            throw new BusinessException($e->getMessage());
+        }
+    }
+}
@@ -0,0 +1,152 @@
+<?php
+
+namespace Extend\Ca_V2;
+
+use App\Constants\HttpEnumCode;
+use App\Exception\BusinessException;
+use GuzzleHttp\Exception\GuzzleException;
+
+class CaOnline extends Ca
+{
+    public function __construct()
+    {
+        parent::__construct();
+        $this->initConfig('ca.v2.online', 'ca_v2_online');
+    }
+
+    public function getCloudCert(array $data, string $type = 'Personal'): mixed
+    {
+        $option = [
+            'form_params' => [
+                'entityId' => $data['user_id'],
+                'entityType' => $type,
+                'personalPhone' => (string) $data['mobile'],
+                'personalName' => $data['card_name'] ?? '',
+                'personalIdNumber' => $data['card_num'] ?? '',
+                'orgName' => $data['org_name'] ?? '',
+                'orgNumber' => $data['org_number'] ?? '',
+                'pin' => $data['user_id'],
+                'province' => '四川省',
+                'locality' => '成都市',
+                'authType' => '实人认证',
+                'authTime' => $this->getAuthTime(),
+                'authResult' => '认证通过',
+                'authNoticeType' => '数字证书申请告知',
+            ],
+        ];
+
+        try {
+            $response = $this->httpRequest(
+                $this->api_url . '/cloud-certificate-service/api/cloudCert/open/v2/cert/certEnroll',
+                $option
+            );
+            if (empty($response)) {
+                throw new BusinessException(HttpEnumCode::getMessage(HttpEnumCode::SERVER_ERROR));
+            }
+
+            return $response;
+        } catch (GuzzleException $e) {
+            throw new BusinessException($e->getMessage());
+        }
+    }
+
+    public function removeCloudCert(array $data): mixed
+    {
+        $option = [
+            'form_params' => [
+                'entityId' => $data['user_id'],
+                'pin' => $data['user_id'],
+                'authType' => '实人认证',
+                'authTime' => $this->getAuthTime(),
+                'authResult' => '认证通过',
+                'authNoticeType' => '数字证书吊销告知',
+            ],
+        ];
+
+        try {
+            $response = $this->httpRequest(
+                $this->api_url . '/cloud-certificate-service/api/cloudCert/open/v2/cert/certRevoke',
+                $option
+            );
+            if (empty($response)) {
+                throw new BusinessException(HttpEnumCode::getMessage(HttpEnumCode::SERVER_ERROR));
+            }
+
+            return $response;
+        } catch (GuzzleException $e) {
+            throw new BusinessException($e->getMessage());
+        }
+    }
+
+    public function renewCloudCert(array $data): mixed
+    {
+        $option = [
+            'form_params' => [
+                'entityId' => $data['user_id'],
+                'pin' => $data['user_id'],
+                'authType' => '实人认证',
+                'authTime' => $this->getAuthTime(),
+                'authResult' => '认证通过',
+                'authNoticeType' => '数字证书更新告知',
+            ],
+        ];
+
+        try {
+            $response = $this->httpRequest(
+                $this->api_url . '/cloud-certificate-service/api/cloudCert/open/v2/cert/certRenew',
+                $option
+            );
+            if (empty($response)) {
+                throw new BusinessException(HttpEnumCode::getMessage(HttpEnumCode::SERVER_ERROR));
+            }
+
+            return $response;
+        } catch (GuzzleException $e) {
+            throw new BusinessException($e->getMessage());
+        }
+    }
+
+    public function getServiceUrl(array $data): mixed
+    {
+        $option = [
+            'form_params' => $data,
+        ];
+
+        try {
+            return $this->httpRequest($this->api_url . '/open/api/data/getServiceUrl', $option);
+        } catch (GuzzleException $e) {
+            throw new BusinessException($e->getMessage());
+        }
+    }
+
+    public function getPasswordLessSignInfo(string $entityId): mixed
+    {
+        $option = [
+            'form_params' => [
+                'entityId' => $entityId,
+            ],
+        ];
+
+        try {
+            return $this->httpRequest($this->api_url . '/open/api/data/passwordLessSignInfo', $option);
+        } catch (GuzzleException $e) {
+            throw new BusinessException($e->getMessage());
+        }
+    }
+
+    protected function resolveCertSerialnumber(string $entityId, array $response): string
+    {
+        $serialNumber = parent::resolveCertSerialnumber($entityId, $response);
+        if ($serialNumber !== '') {
+            return $serialNumber;
+        }
+
+        $signInfo = $this->getPasswordLessSignInfo($entityId);
+        return (string) ($signInfo['certSn'] ?? '');
+    }
+
+    protected function getAuthTime(): string
+    {
+        return (string) round(microtime(true) * 1000);
+    }
+}