苹果（apple）支付退款通知、api

背景：

用户在使用苹果支付购买商品后，可以直接像苹果申请退款，如果申请成功将导致商户直接构成损失。甚至某网络平台有这种专门薅羊毛的店铺，低价出售虚拟商品，再申请退款。所以有必要对用户发起的退款订单做及时响应，比如扣除对应的虚拟商品或像apple官方提供凭证使其退款不成功。

方案选型：

主动查询退款订单，文档地址
被动接收服务器通知，文档地址

主动请求退款api：

生成jwt身份标识，文档地址

添加依赖项

 <!-- jwt -->
		<dependency>
			<groupId>com.auth0</groupId>
			<artifactId>java-jwt</artifactId>
			<version>3.8.1</version>
		</dependency>复制

示例代码

  private String generateJwtToken() throws Exception {
        Map<String, Object> headers = new HashMap<>();
        // apple指定ES256算法
        headers.put("alg", "ES256");
        // 密钥ID
        headers.put("kid", "***********");
        // jwt格式
        headers.put("typ", "JWT");
        return JWT.create()
                .withHeader(headers)
                // issId：见apple connect后台右上角
                .withIssuer("*******-4f2e-4296-b2c7-**********")
                // 签名日期
                .withIssuedAt(new Date())
                // 失效日期：最晚一个小时，否则报错401
                .withExpiresAt(DateUtils.addHours(new Date(), 1))
                // 目标接收者，固定值
                .withAudience("appstoreconnect-v1")
                // 包名，bundleId
                .withClaim("bid", "com.********")
                // 签名密钥，需要用到apple connect下载p8文件
                .sign(Algorithm.ECDSA256(null, (ECPrivateKey) getPrivateKey("/payment/apple/AuthKey_****.p8")));
    }
 
    /**
     * 获取私钥
     * @param filename apple connect下载的p8文件路径
     * @return
     * @throws Exception
     */
    private PrivateKey getPrivateKey(String filename) throws Exception {
        String content = new String(Files.readAllBytes(Paths.get(filename)), StandardCharsets.UTF_8);
        try {
            String privateKey = content.replace("-----BEGIN PRIVATE KEY-----", "")
                    .replace("-----END PRIVATE KEY-----", "")
                    .replaceAll("\\s+", "");
 
            KeyFactory kf = KeyFactory.getInstance("EC");
            return kf.generatePrivate(new PKCS8EncodedKeySpec(Base64.getDecoder().decode(privateKey)));
        } catch (InvalidKeySpecException e) {
            throw new RuntimeException("Invalid key format");
        }
    }复制

请求、解析数据：

API地址：生产环境：GET https://api.storekit.itunes.apple.com/inApps/v2/refund/lookup/{originalTransactionId}；沙盒环境：GET https://api.storekit-sandbox.itunes.apple.com/inApps/v2/refund/lookup/{originalTransactionId}

示例代码和返回值：

   private RefundHistResponseVO getRefundHist() throws Exception {
        String token = generateToken();
        HttpHeaders header = new HttpHeaders();
        header.set("Authorization", "Bearer "+ token);
        RequestEntity<Map<String, String>> requestEntity = new RequestEntity<>(header, HttpMethod.GET, URI.create("https://api.storekit-sandbox.itunes.apple.com/inApps/v2/refund/lookup/2000000308586738"));
        ResponseEntity<RefundHistResponseVO> exchange = restTemplate.exchange(requestEntity, RefundHistResponseVO.class);
        return exchange.getBody();
 }
 
		@Data
    public static class RefundHistResponseVO{
        /**
         * 同一个用户的下的退款订单列表，jws格式
         */
        private List<String> signedTransactions;
 
        /**
         * 分页token
         * signedTransactions最大数量是20条，超过20条需要下一次请求带上分页token
      */
        private String revision;
 
        /**
         * 是否有下一页
         */
        private Boolean hasMore;
    }复制

 {
    "signedTransactions": [
       "eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTURDQ0E3YWdBd0lCQWdJUWFQb1BsZHZwU29FSDBsQnJqRFB2OWpBS0JnZ3Foa2pPUFFRREF6QjFNVVF3UWdZRFZRUURERHRCY0hCc1pTQlhiM0pzWkhkcFpHVWdSR1YyWld4dmNHVnlJRkpsYkdGMGFXOXVjeUJEWlhKMGFXWnBZMkYwYVc5dUlFRjFkR2h2Y21sMGVURUxNQWtHQTFVRUN3d0NSell4RXpBUkJnTlZCQW9NQ2tGd2NHeGxJRWx1WXk0eEN6QUpCZ05WQkFZVEFsVlRNQjRYRFRJeE1EZ3lOVEF5TlRBek5Gb1hEVEl6TURreU5EQXlOVEF6TTFvd2daSXhRREErQmdOVkJBTU1OMUJ5YjJRZ1JVTkRJRTFoWXlCQmNIQWdVM1J2Y21VZ1lXNWtJR2xVZFc1bGN5QlRkRzl5WlNCU1pXTmxhWEIwSUZOcFoyNXBibWN4TERBcUJnTlZCQXNNST...",
        "eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTURDQ0E3YWdBd0lCQWdJUWFQb1BsZHZwU29FSDBsQnJqRFB2OWpBS0JnZ3Foa2pPUFFRREF6QjFNVVF3UWdZRFZRUURERHRCY0hCc1pTQlhiM0pzWkhkcFpHVWdSR1YyWld4dmNHVnlJRkpsYkdGMGFXOXVjeUJEWlhKMGFXWnBZMkYwYVc5dUlFRjFkR2h2Y21sMGVURUxNQWtHQTFVRUN3d0NSell4RXpBUkJnTlZCQW9NQ2tGd2NHeGxJRWx1WXk0eEN6QUpCZ05WQkFZVEFsVlRNQjRYRFRJeE1EZ3lOVEF5TlRBek5Gb1hEVEl6TURreU5EQXlOVEF6TTFvd2daSXhRREErQmdOVkJBTU1OMUJ5YjJRZ1JVTkRJRTFoWXlCQmNIQWdVM1J2Y21VZ1lXNWtJR2xVZFc1bGN5QlRkRzl5WlNCU1pXTmxhWEIwSUZOcFoyNXBibWN4TERBcUJnTlZCQXNNSTBGd2NHeGxJRmR2Y214a2QybGtaU0JFWlhabGJHOXdaWElnVW1Wc1lYUnBiMjV6TVJNd0VRWURWUVFLREFwQmNIQnNaU0JKYm1NdU...",
        "eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTURDQ0E3YWdBd0lCQWdJUWFQb1BsZHZwU29FSDBsQnJqRFB2OWpBS0JnZ3Foa2pPUFFRREF6QjFNVVF3UWdZRFZRUURERHRCY0hCc1pTQlhiM0pzWkhkcFpHVWdSR1YyWld4dmNHVnlJRkpsYkdGMGFXOXVjeUJEWlhKMGFXWnBZMkYwYVc5dUlFRjFkR2h2Y21sMGVURUxNQWtHQTFVRUN3d0NSell4RXpBUkJnTlZCQW9NQ2tGd2NHeGxJRWx1WXk0eEN6QUpCZ05WQkFZVEFsVlRNQjRYRFRJeE1EZ3lOVEF5TlRBek5Gb1hEVEl6TURreU5EQXlOVEF6TTFvd2daSXhRREErQmdOVkJBTU1OMUJ5YjJRZ1JVTkRJRTFoWXlCQmNIQWdVM1J2Y21VZ1lXNWtJR2xVZFc1bGN5QlRkRzl5WlNCU1pXTmxhWEIwSUZOcFoyNXBibWN4TERBcUJnTlZCQXNNSTBGd2NHeGxJRm..."
    ],
    "revision": "1680777292000_2000000308641111",
    "hasMore": false
}复制

附上jws格式解析代码和解析后的参数示例：

  public void handleRefundOrder() throws Exception {
        RefundHistResponseVO refundHist = getRefundHist();
        for (String signedTransaction : refundHist.getSignedTransactions()) {
            DecodedJWT decode = JWT.decode(signedTransaction);
            TransactionResponseVO responseVO = JSONObject.parseObject(new String(Base64.getDecoder().decode(decode.getPayload())), TransactionResponseVO.class);
            // do something
        }
    }
 
		@Data
    public static class TransactionResponseVO{
        private String transactionId; // 交易订单号
        private String originalTransactionId; // 原始交易订单号
        private String bundleId; // 包名
        private String productId; // 商品编号
        private Date purchaseDate; // 购买日期
        private Date originalPurchaseDate; // 原始订单购买日期
        private Integer quantity; // 商品数量
        /**
         *  <a href="https://developer.apple.com/documentation/appstoreserverapi/type/">消费类型</a>
         *  Consumable 消耗品
         */
        private String type;
        /**
         *  <a href="https://developer.apple.com/documentation/appstoreserverapi/type/">所有类型</a>
         * FAMILY_SHARED 交易属于受益于服务的家庭成员。
         * PURCHASED 交易属于买方。
         */
        private String inAppOwnershipType;
        private Date signedDate; // 签名日期
        private Integer revocationReason; // 退款方 1: apple ；0：客户
        private Date revocationDate; // 退款时间
        private String environment; //环境
    }复制

 {
  "transactionId": "2000000308611111",
  "originalTransactionId": "2000000308611111",
  "bundleId": "com.******",
  "productId": "a10001",
  "purchaseDate": 1680773327000,
  "originalPurchaseDate": 1680773327000,
  "quantity": 1,
  "type": "Consumable",
  "inAppOwnershipType": "PURCHASED",
  "signedDate": 1681198157817,
  "revocationReason": 0,
  "revocationDate": 1680777292000,
  "environment": "Sandbox"
}
 复制

这里使用的是v2版本的api接口，有几个注意点：
1. 返回每页大小是20，下一页请求需带上revision参数，v1版本接口是50条且明文显示，官方不建议使用，文档地址
2. 此接口只能查询已成功的退款订单（在生产环境，用户发起退款会有12小时的审核时间，开发者可以提供凭证证明商品发放成功），不能查询已发起但未通过的退款申请。
3. original_transaction_id是必传参数，可以是任意一笔交易id，重点是交易id所关联的用户：apple ID，也就是说同一个appleId产生的订单在这个接口返回的结果是一样的。（吐槽一下苹果的api。。这个接口不能查询app范围内的所有退款订单，因为订单id是必传字段，但返回值跟这笔订单又没有强关联，而是关联用户）
4. 如果需要做邮件实时通知、用户发起退款申请后自动响应。建议使用另外一种方法：接收服务器通知

接收服务器通知：

配置服务器通知url：文档地址，步骤挺简单的，打开应用配置，设置沙盒和生产环境的服务器接口地址即可。注意这里也选择V2版本通知，不建议使用V1版本。
通知类型：文档地址，这里主要关注几个消耗品商品购买的类型（其他类型包含订阅类型购买的变更通知有需要的可以自行对接）：
- CONSUMPTION_REQUEST：用户发起退款
- REFUND：用户退款成功
- TEST：通过api发起的测试通知，测试服务器的通知url是否配置成功
官方提供的沙盒环境测试退款方法：文档地址，需要在本地xcode跑StoreKit Test，挺麻烦的需要ios开发人员支持。这里提供一个免费的webhook网址，可以用于本地测试接收通知：https://webhook.site/
用户发起退款申请后，服务器会收到一个notificationType = CONSUMPTION_REQUEST 的通知，代表用户发起退款，开发者可以在接收通知的逻辑中调用发送消费信息的api，以证明用户退款无效：文档地址

苹果审核退款申请通过后，服务器会收到一个notificationType = REFUND 的通知，代表退款成功，开发者可以在处理扣除虚拟商品等操作。下面是退款通知的数据示例及验证签名代码：

请求报文：

 {"signedPayload":"eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTURDQ0E3YWdBd0lCQWdJUWFQb1BsZHZwU29FSDBsQnJqRFB2OWpBS0JnZ3Foa2pPUFFRREF6QjFNVVF3UWdZRFZRUURERHRCY0hCc1pTQlhiM0pzWkhkcFpHVWdSR1YyWld4dmNHVnlJRkpsYkdGMGFXOXVjeUJEWlhKMGFXWnBZMkYwYVc5dUlFRjFkR2h2Y21sMGVURUxNQWtHQTFVRUN3d0NSell4RXpBUkJnTlZCQW9NQ2tGd2NHeGxJRWx1WXk0eEN6QUpCZ05WQkFZVEFsVlRNQjRYRFRJeE1EZ3lOVEF5TlRBek5Gb1hEVEl6TURreU5EQXlOVEF6TTFvd2daSXhRREErQm..."}复制

验签并解析数据

 		/**
     * 验证签名
     * @param decodedJWT
     * @return
     * @throws CertificateException
     */ 		
		private JSONObject verifyAndGet(String jws) throws CertificateException {
    		DecodedJWT decodedJWT = JWT.decode(jws);
        // 拿到 header 中 x5c 数组中第一个
        String header = new String(java.util.Base64.getDecoder().decode(decodedJWT.getHeader()));
        String x5c = JSONObject.parseObject(header).getJSONArray("x5c").getString(0);
 
        // 获取公钥
        PublicKey publicKey = getPublicKeyByX5c(x5c);
 
        // 验证 token
        Algorithm algorithm = Algorithm.ECDSA256((ECPublicKey) publicKey, null);
 
        try {
            algorithm.verify(decodedJWT);
        } catch (SignatureVerificationException e) {
            return throw new RunTimeException();
        }
				// 解析数据
        JSONObject payload = JSONObject.parseObject(new String(java.util.Base64.getDecoder().decode(decodedJWT.getPayload()));
			
    }
 
 
		/**
     * 获取公钥
     * @param x5c
     * @return
     * @throws CertificateException
     */
    private PublicKey getPublicKeyByX5c(String x5c) throws CertificateException {
        byte[] x5c0Bytes = java.util.Base64.getDecoder().decode(x5c);
        CertificateFactory fact = CertificateFactory.getInstance("X.509");
        X509Certificate cer = (X509Certificate) fact.generateCertificate(new ByteArrayInputStream(x5c0Bytes));
        return cer.getPublicKey();
    }
 复制

解析的json示例

 {
  "notificationType": "REFUND",
  "notificationUUID": "334d1548-****-4ea9-****-e104731870b9",
  "data": {
    "appAppleId": 1617026651,
    "bundleId": "com.*****",
    "bundleVersion": "1",
    "environment": "Sandbox",
    "signedTransactionInfo": "eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTURDQ0E3YWdBd0lCQWdJUWFQb1BsZHZwU29FSDBsQnJqRFB2OWpBS0JnZ3Foa2pPUFFRREF6QjFNVVF3UWdZRFZRUURERHRCY0hCc1pTQlhiM0pzWkhkcFpHVWdSR1YyWld4dmNHVnlJRkpsYkdGMGFXOXVjeUJEWlhKMGFXWnBZMkYwYVc5dUlFRjFkR2h2Y21sMGVURUxNQWtHQTFVRUN3d0NSell4RXpBUkJnTlZCQW9NQ2tGd2NHeGxJRWx1WXk0eEN6QUpCZ05WQkFZVEFsVlRNQjRYRFRJeE1EZ3lOVEF5TlRBek5Gb1hEVEl6TURreU5EQXlOVEF6TTFvd2daSXhRREErQmdOVkJBTU1OMUJ5YjJRZ1JVTkRJRTFoWXlCQmNIQWdVM1J2Y21VZ1lXNWtJR2xVZFc1bGN5QlRkRzl5WlNCU1pXTmxhWEIwSUZOcFoyNXBibWN4TERBcUJnTlZCQXNNSTBGd2NHeGxJRmR2Y214a2QybGtaU0JFWlhabGJHOXdaWElnVW1Wc1lYUnBi..."
  },
  "version": "2.0",
  "signedDate": 1680778196476
}复制

需要注意的是这里的signedTransactionInfo依然是一个jws格式，且字段与主动查询的结果一致，用上面的代码和vo类再解码一次

  DecodedJWT decode = JWT.decode(signedTransactionInfo);
            TransactionResponseVO responseVO = JSONObject.parseObject(new String(Base64.getDecoder().decode(decode.getPayload())), TransactionResponseVO.class);复制

关于后置的业务处理就不过多赘述了，毕竟每个公司的业务不同，需要处理的逻辑也不同，没有参考价值。与产品沟通即可。

苹果（apple）支付退款通知、api

苹果（apple）支付退款通知、api

背景：

方案选型：

主动请求退款api：

接收服务器通知：

前端提高篇（102）：jQuery高级方法callbacks、deferred

基于Java SpringBoot Vue HTML5药店管理系统(源码 LW 调试文档讲解等)/药店管理软件/药店进销存系统/药店库存管理系统/药店销售系统/药品管理系统/药店收银系统

基于Java SpringBoot Vue HTML5宠物健康顾问系统(源码 LW 调试文档讲解等)/宠物健康/顾问系统/宠物护理/宠物医疗/宠物保健/宠物咨询/宠物医生/宠物健康管理/宠物健康服务

HTML/SSM-实验室预约管理系统-99299（免费领源码开发文档）可做计算机毕业设计JAVA、PHP、爬虫、APP、小程序、C#、C 、python、数据可视化、大数据、全套文案

SSM基于html的网上购物系统2nluo 在线充值

html 无序标签有序标签及表单

在IntelliJ IDEA中创建一个HTML项目

CSS3新增属性(15个案例代码效果图素材)

基于CSS3媒体查询的响应式旅游网站设计与实现-计算机毕设附源码 12755

Postman导出JSON文件轻松转换为HTML或Markdown

前端哥

C#解析JSON的常用库--Newtonsoft.Json

jsonfield 项目常见问题解决方案

【SpringMVC】_SpringMVC项目返回HTML与JSON

BugJson因为json格式问题OOM怎么办

python 解读JSON文件，一文搞懂！

Redisson同时使用jackson、fastjson、kryo、protostuff序列化（含效率对比）

开源项目“Pretty JSON”安装与配置完全指南

2024年前端最新Nodejs基础之包管理工具npm(二)(2)，微软面试题及答案

解决全局安装pnpm后无法使用的问题

安装Nodejs后，npm无法使用

1
【Echarts系列】—— 实现电池图、3D立体圆形柱状图

2024-03-03 11:03:011001

2
CSS常用属性（文本属性）

2024-11-04 09:11:111000

3
TypeScript 中的 Number 类型，Number 类型的特性、常见操作和注意事项

2024-09-30 23:09:061000

4
CSS写代码使页面划分为左右两个区域

2024-09-09 00:09:071000

5
vue使用datav echarts

2024-09-06 00:09:381000

6
使用TweenMax.js和CSS3创建冰球运动员动画效果教程

2024-09-04 23:09:411000

7
使用CDN提高jQuery加载速度

2024-08-24 23:08:211000

8
小兔鲜儿网页首页制作黑马程序员前端基础项目自学笔记

2024-08-19 22:08:161000

9
《Vue》你的弹窗能拖动吗？Vue自定义指令实现可拖动弹窗

2024-08-19 22:08:121000

10
npm的使用

2024-08-18 00:08:131000

	<!-- jwt -->
	<dependency>
	<groupId>com.auth0</groupId>
	<artifactId>java-jwt</artifactId>
	<version>3.8.1</version>
	</dependency>

	private String generateJwtToken() throws Exception {
	Map<String, Object> headers = new HashMap<>();
	// apple指定ES256算法
	headers.put("alg", "ES256");
	// 密钥ID
	headers.put("kid", "***********");
	// jwt格式
	headers.put("typ", "JWT");
	return JWT.create()
	.withHeader(headers)
	// issId：见apple connect后台右上角
	.withIssuer("*****-4f2e-4296-b2c7-********")
	// 签名日期
	.withIssuedAt(new Date())
	// 失效日期：最晚一个小时，否则报错401
	.withExpiresAt(DateUtils.addHours(new Date(), 1))
	// 目标接收者，固定值
	.withAudience("appstoreconnect-v1")
	// 包名，bundleId
	.withClaim("bid", "com.********")
	// 签名密钥，需要用到apple connect下载p8文件
	.sign(Algorithm.ECDSA256(null, (ECPrivateKey) getPrivateKey("/payment/apple/AuthKey_****.p8")));
	}

	/**
	* 获取私钥
	* @param filename apple connect下载的p8文件路径
	* @return
	* @throws Exception
	*/
	private PrivateKey getPrivateKey(String filename) throws Exception {
	String content = new String(Files.readAllBytes(Paths.get(filename)), StandardCharsets.UTF_8);
	try {
	String privateKey = content.replace("-----BEGIN PRIVATE KEY-----", "")
	.replace("-----END PRIVATE KEY-----", "")
	.replaceAll("\\s+", "");

	KeyFactory kf = KeyFactory.getInstance("EC");
	return kf.generatePrivate(new PKCS8EncodedKeySpec(Base64.getDecoder().decode(privateKey)));
	} catch (InvalidKeySpecException e) {
	throw new RuntimeException("Invalid key format");
	}
	}

	private RefundHistResponseVO getRefundHist() throws Exception {
	String token = generateToken();
	HttpHeaders header = new HttpHeaders();
	header.set("Authorization", "Bearer "+ token);
	RequestEntity<Map<String, String>> requestEntity = new RequestEntity<>(header, HttpMethod.GET, URI.create("https://api.storekit-sandbox.itunes.apple.com/inApps/v2/refund/lookup/2000000308586738"));
	ResponseEntity<RefundHistResponseVO> exchange = restTemplate.exchange(requestEntity, RefundHistResponseVO.class);
	return exchange.getBody();
	}

	@Data
	public static class RefundHistResponseVO{
	/**
	* 同一个用户的下的退款订单列表，jws格式
	*/
	private List<String> signedTransactions;

	/**
	* 分页token
	* signedTransactions最大数量是20条，超过20条需要下一次请求带上分页token
	*/
	private String revision;

	/**
	* 是否有下一页
	*/
	private Boolean hasMore;
	}

	{
	"signedTransactions": [
	"eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTURDQ0E3YWdBd0lCQWdJUWFQb1BsZHZwU29FSDBsQnJqRFB2OWpBS0JnZ3Foa2pPUFFRREF6QjFNVVF3UWdZRFZRUURERHRCY0hCc1pTQlhiM0pzWkhkcFpHVWdSR1YyWld4dmNHVnlJRkpsYkdGMGFXOXVjeUJEWlhKMGFXWnBZMkYwYVc5dUlFRjFkR2h2Y21sMGVURUxNQWtHQTFVRUN3d0NSell4RXpBUkJnTlZCQW9NQ2tGd2NHeGxJRWx1WXk0eEN6QUpCZ05WQkFZVEFsVlRNQjRYRFRJeE1EZ3lOVEF5TlRBek5Gb1hEVEl6TURreU5EQXlOVEF6TTFvd2daSXhRREErQmdOVkJBTU1OMUJ5YjJRZ1JVTkRJRTFoWXlCQmNIQWdVM1J2Y21VZ1lXNWtJR2xVZFc1bGN5QlRkRzl5WlNCU1pXTmxhWEIwSUZOcFoyNXBibWN4TERBcUJnTlZCQXNNST...",
	"eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTURDQ0E3YWdBd0lCQWdJUWFQb1BsZHZwU29FSDBsQnJqRFB2OWpBS0JnZ3Foa2pPUFFRREF6QjFNVVF3UWdZRFZRUURERHRCY0hCc1pTQlhiM0pzWkhkcFpHVWdSR1YyWld4dmNHVnlJRkpsYkdGMGFXOXVjeUJEWlhKMGFXWnBZMkYwYVc5dUlFRjFkR2h2Y21sMGVURUxNQWtHQTFVRUN3d0NSell4RXpBUkJnTlZCQW9NQ2tGd2NHeGxJRWx1WXk0eEN6QUpCZ05WQkFZVEFsVlRNQjRYRFRJeE1EZ3lOVEF5TlRBek5Gb1hEVEl6TURreU5EQXlOVEF6TTFvd2daSXhRREErQmdOVkJBTU1OMUJ5YjJRZ1JVTkRJRTFoWXlCQmNIQWdVM1J2Y21VZ1lXNWtJR2xVZFc1bGN5QlRkRzl5WlNCU1pXTmxhWEIwSUZOcFoyNXBibWN4TERBcUJnTlZCQXNNSTBGd2NHeGxJRmR2Y214a2QybGtaU0JFWlhabGJHOXdaWElnVW1Wc1lYUnBiMjV6TVJNd0VRWURWUVFLREFwQmNIQnNaU0JKYm1NdU...",
	"eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTURDQ0E3YWdBd0lCQWdJUWFQb1BsZHZwU29FSDBsQnJqRFB2OWpBS0JnZ3Foa2pPUFFRREF6QjFNVVF3UWdZRFZRUURERHRCY0hCc1pTQlhiM0pzWkhkcFpHVWdSR1YyWld4dmNHVnlJRkpsYkdGMGFXOXVjeUJEWlhKMGFXWnBZMkYwYVc5dUlFRjFkR2h2Y21sMGVURUxNQWtHQTFVRUN3d0NSell4RXpBUkJnTlZCQW9NQ2tGd2NHeGxJRWx1WXk0eEN6QUpCZ05WQkFZVEFsVlRNQjRYRFRJeE1EZ3lOVEF5TlRBek5Gb1hEVEl6TURreU5EQXlOVEF6TTFvd2daSXhRREErQmdOVkJBTU1OMUJ5YjJRZ1JVTkRJRTFoWXlCQmNIQWdVM1J2Y21VZ1lXNWtJR2xVZFc1bGN5QlRkRzl5WlNCU1pXTmxhWEIwSUZOcFoyNXBibWN4TERBcUJnTlZCQXNNSTBGd2NHeGxJRm..."
	],
	"revision": "1680777292000_2000000308641111",
	"hasMore": false
	}

	public void handleRefundOrder() throws Exception {
	RefundHistResponseVO refundHist = getRefundHist();
	for (String signedTransaction : refundHist.getSignedTransactions()) {
	DecodedJWT decode = JWT.decode(signedTransaction);
	TransactionResponseVO responseVO = JSONObject.parseObject(new String(Base64.getDecoder().decode(decode.getPayload())), TransactionResponseVO.class);
	// do something
	}
	}

	@Data
	public static class TransactionResponseVO{
	private String transactionId; // 交易订单号
	private String originalTransactionId; // 原始交易订单号
	private String bundleId; // 包名
	private String productId; // 商品编号
	private Date purchaseDate; // 购买日期
	private Date originalPurchaseDate; // 原始订单购买日期
	private Integer quantity; // 商品数量
	/**
	* <a href="https://developer.apple.com/documentation/appstoreserverapi/type/">消费类型</a>
	* Consumable 消耗品
	*/
	private String type;
	/**
	* <a href="https://developer.apple.com/documentation/appstoreserverapi/type/">所有类型</a>
	* FAMILY_SHARED 交易属于受益于服务的家庭成员。
	* PURCHASED 交易属于买方。
	*/
	private String inAppOwnershipType;
	private Date signedDate; // 签名日期
	private Integer revocationReason; // 退款方 1: apple ；0：客户
	private Date revocationDate; // 退款时间
	private String environment; //环境
	}

	{
	"transactionId": "2000000308611111",
	"originalTransactionId": "2000000308611111",
	"bundleId": "com.******",
	"productId": "a10001",
	"purchaseDate": 1680773327000,
	"originalPurchaseDate": 1680773327000,
	"quantity": 1,
	"type": "Consumable",
	"inAppOwnershipType": "PURCHASED",
	"signedDate": 1681198157817,
	"revocationReason": 0,
	"revocationDate": 1680777292000,
	"environment": "Sandbox"
	}

	/**
	* 验证签名
	* @param decodedJWT
	* @return
	* @throws CertificateException
	*/
	private JSONObject verifyAndGet(String jws) throws CertificateException {
	DecodedJWT decodedJWT = JWT.decode(jws);
	// 拿到 header 中 x5c 数组中第一个
	String header = new String(java.util.Base64.getDecoder().decode(decodedJWT.getHeader()));
	String x5c = JSONObject.parseObject(header).getJSONArray("x5c").getString(0);

	// 获取公钥
	PublicKey publicKey = getPublicKeyByX5c(x5c);

	// 验证 token
	Algorithm algorithm = Algorithm.ECDSA256((ECPublicKey) publicKey, null);

	try {
	algorithm.verify(decodedJWT);
	} catch (SignatureVerificationException e) {
	return throw new RunTimeException();
	}
	// 解析数据
	JSONObject payload = JSONObject.parseObject(new String(java.util.Base64.getDecoder().decode(decodedJWT.getPayload()));

	}


	/**
	* 获取公钥
	* @param x5c
	* @return
	* @throws CertificateException
	*/
	private PublicKey getPublicKeyByX5c(String x5c) throws CertificateException {
	byte[] x5c0Bytes = java.util.Base64.getDecoder().decode(x5c);
	CertificateFactory fact = CertificateFactory.getInstance("X.509");
	X509Certificate cer = (X509Certificate) fact.generateCertificate(new ByteArrayInputStream(x5c0Bytes));
	return cer.getPublicKey();
	}

	{
	"notificationType": "REFUND",
	"notificationUUID": "334d1548-**-4ea9-**-e104731870b9",
	"data": {
	"appAppleId": 1617026651,
	"bundleId": "com.*****",
	"bundleVersion": "1",
	"environment": "Sandbox",
	"signedTransactionInfo": "eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTURDQ0E3YWdBd0lCQWdJUWFQb1BsZHZwU29FSDBsQnJqRFB2OWpBS0JnZ3Foa2pPUFFRREF6QjFNVVF3UWdZRFZRUURERHRCY0hCc1pTQlhiM0pzWkhkcFpHVWdSR1YyWld4dmNHVnlJRkpsYkdGMGFXOXVjeUJEWlhKMGFXWnBZMkYwYVc5dUlFRjFkR2h2Y21sMGVURUxNQWtHQTFVRUN3d0NSell4RXpBUkJnTlZCQW9NQ2tGd2NHeGxJRWx1WXk0eEN6QUpCZ05WQkFZVEFsVlRNQjRYRFRJeE1EZ3lOVEF5TlRBek5Gb1hEVEl6TURreU5EQXlOVEF6TTFvd2daSXhRREErQmdOVkJBTU1OMUJ5YjJRZ1JVTkRJRTFoWXlCQmNIQWdVM1J2Y21VZ1lXNWtJR2xVZFc1bGN5QlRkRzl5WlNCU1pXTmxhWEIwSUZOcFoyNXBibWN4TERBcUJnTlZCQXNNSTBGd2NHeGxJRmR2Y214a2QybGtaU0JFWlhabGJHOXdaWElnVW1Wc1lYUnBi..."
	},
	"version": "2.0",
	"signedDate": 1680778196476
	}

苹果（apple）支付退款通知、api

苹果（apple）支付退款通知、api

背景：

方案选型：

主动请求退款api：

接收服务器通知：

微信扫一扫：分享