回调业务系统

第三方业务需要实现 passUrl: https://{domain}/xxx/xxx 对应接口，完成批量审批处理逻辑。

• 请求方法：POST
• 内容类型：Content-Type: application/json

{
    "param": {
        "appId": "1",
        "sourceId": "500408114",
        "batchId": "5de50017e4b0b2767b870423",
        "param": "5dc0d35866b6746a7a5e5bb2",
        "receptionId": "0082222",
        "status": 20   //20.通过，21.已阅，32.撤销
    },
    "sign": "Eg0HrAkbJxxxxxxx"
}

响应

{
    "error": null,
    "errorCode": 0,
    "success": true
}

{
    "error":"失败原因",
    "errorCode":1,
    "success":false
}

生成sign值得算法(java版)

/**
 * 回调接口加密
 *
 * @param secret       应用的秘钥
 * @param appId        应用的id
 * @param sourceId     业务记录ID-业务的唯一编号
 * @param receptionIds 处理人id
 * @return
 * @throws Exception
 */
public static String genSign(String secret, String appId, String sourceId, String receptionId) throws Exception {
    List<String> vals = new ArrayList<>();
    vals.add(sourceId);
    vals.add(appId);
    vals.add(receptionId);
    Collections.sort(vals, new Comparator<String>() {
        @Override
        public int compare(String o1, String o2) {
            return o1.compareTo(o2);
        }
    });
    String sortedVal = StringUtils.join(vals, "&");

    return genHmacSHA1(sortedVal, secret);
}

private static final String HMAC_SHA1_ALGORITHM = "HmacSHA1";

/**
 * 使用 HMAC-SHA1 签名方法对data进行签名
 *
 * @param data 被签名的字符串
 * @param key  密钥
 * @return 加密后的字符串
 */
public static String genHmacSHA1(String data, String key) throws Exception {
    SecretKeySpec signKey = new SecretKeySpec(key.getBytes(), HMAC_SHA1_ALGORITHM);
    Mac mac = Mac.getInstance(HMAC_SHA1_ALGORITHM);
    mac.init(signKey);
    byte[] rawHmac = mac.doFinal(data.getBytes());
    byte[] result = Base64.encodeBase64(rawHmac);

    if (null != result) {
        return new String(result);
    } else {
        return null;
    }
}

passUrl对应的接口的伪代码

@RestController("/xxx")
public class DealTodoRest {
    @RequestMapping(value = "/batchDealTodo", produces = "application/json;charset=utf-8", method = RequestMethod.POST)
    public String batchDealTodo(@RequestBody String jsonParam){
        //sign值校验是否合法（第三方业务用请求报文生成一个sign值【genSign()】，与报文中的sign值进行对比）
        boolean succ = checkSign(jsonParam);
        if (!succ){
            return "{\"error\":\"check sign error.\",\"errorCode\":5001,\"success\":false}";
        }        
        //完成待办逻辑
        return dealTodos();
    }
    private boolean checkSign(String jsonParam){
        String origSign = getBy(jsonParam);
        String currSign = genSign(secret, appId, sourceId, receptionId);
        return StringUtils.equals(origSign, currSign);
    }
}