feat(tenpayv3): 提供 ICertificateStorer 接口，并基于此重新实现验签的扩展方法

src/SKIT.FlurlHttpClient.Wechat.TenpayV3/Extensions/WechatTenpayClientEventDecryptionExtensions.cs

@@ -3,9 +3,9 @@
 namespace SKIT.FlurlHttpClient.Wechat.TenpayV3
 {
     /// <summary>
-    /// 为 <see cref="WechatTenpayClient"/> 提供回调通知事件的扩展方法。
+    /// 为 <see cref="WechatTenpayClient"/> 提供回调通知事件敏感数据解密的扩展方法。
     /// </summary>
-    public static class WechatTenpayClientEventExtensions
+    public static class WechatTenpayClientEventDecryptionExtensions
     {
         /// <summary>
         /// <para>反序列化得到 <see cref="WechatTenpayEvent"/> 对象。</para>

src/SKIT.FlurlHttpClient.Wechat.TenpayV3/Extensions/WechatTenpayClientEventVerificationExtensions.cs

@@ -0,0 +1,80 @@
+using System;
+using System.Text;
+
+namespace SKIT.FlurlHttpClient.Wechat.TenpayV3
+{
+    /// <summary>
+    /// 为 <see cref="WechatTenpayClient"/> 提供回调通知事件签名验证的扩展方法。
+    /// </summary>
+    public static class WechatTenpayClientEventVerificationExtensions
+    {
+        /// <summary>
+        /// <para>验证回调通知事件签名。</para>
+        /// <para>REF: https://pay.weixin.qq.com/wiki/doc/apiv3/wechatpay/wechatpay4_1.shtml </para>
+        /// <para>REF: https://pay.weixin.qq.com/wiki/doc/apiv3_partner/wechatpay/wechatpay4_1.shtml </para>
+        /// </summary>
+        /// <typeparam name="TResponse"></typeparam>
+        /// <param name="client"></param>
+        /// <param name="callbackTimestamp">微信回调通知中的 Wechatpay-Timestamp 字段。</param>
+        /// <param name="callbackNonce">微信回调通知中的 Wechatpay-Nonce 字段。</param>
+        /// <param name="callbackBody">微信回调通知中请求正文。</param>
+        /// <param name="callbackSignature">微信回调通知中的 Wechatpay-Signature 字段。</param>
+        /// <param name="callbackSerialNumber">微信回调通知中的 Wechatpay-Serial 字段。</param>
+        /// <returns></returns>
+        public static bool VerifyEventSignature<TResponse>(
+            this WechatTenpayClient client, 
+            string callbackTimestamp, 
+            string callbackNonce, 
+            string callbackBody,
+            string callbackSignature,
+            string callbackSerialNumber)
+            where TResponse : WechatTenpayResponse
+        {
+            if (client == null) throw new ArgumentNullException(nameof(client));
+            if (callbackTimestamp == null) throw new ArgumentNullException(nameof(callbackTimestamp));
+            if (callbackNonce == null) throw new ArgumentNullException(nameof(callbackNonce));
+            if (callbackBody == null) throw new ArgumentNullException(nameof(callbackBody));
+            if (callbackSignature == null) throw new ArgumentNullException(nameof(callbackSignature));
+            if (callbackSerialNumber == null) throw new ArgumentNullException(nameof(callbackSerialNumber));
+
+            if (client.WechatCertificateStorer == null)
+            {
+                throw new Exceptions.WechatTenpayResponseVerificationException($"You must set an instance of `{nameof(Settings.ICertificateStorer)}` at first.");
+            }
+            else
+            {
+                string? certificate = client.WechatCertificateStorer.Get(callbackSerialNumber);
+                if (certificate == null)
+                    throw new Exceptions.WechatTenpayResponseVerificationException("Cannot get certificate by the serial number, may not be stored.");
+
+                string? publicKey = null;
+                try
+                {
+                    publicKey = Utilities.RSAUtility.ExportPublicKey(certificate);
+                }
+                catch (Exception ex)
+                {
+                    throw new Exceptions.WechatTenpayResponseVerificationException("Cannot get public key of the certificate, may not be a valid certificate data.", ex);
+                }
+
+                try
+                {
+                    return Utilities.RSAUtility.VerifyWithSHA256(
+                        publicKey: publicKey,
+                        plainText: GetPlainTextForSignature(timestamp: callbackTimestamp, nonce: callbackNonce, body: callbackBody),
+                        signature: callbackSignature
+                    );
+                }
+                catch (Exception ex)
+                {
+                    throw new Exceptions.WechatTenpayResponseVerificationException("Verify event signature failed.", ex);
+                }
+            }
+        }
+
+        private static string GetPlainTextForSignature(string timestamp, string nonce, string body)
+        {
+            return $"{timestamp}\n{nonce}\n{body}\n";
+        }
+    }
+}

src/SKIT.FlurlHttpClient.Wechat.TenpayV3/Extensions/WechatTenpayClientResponseVerificationExtensions.cs

@@ -0,0 +1,72 @@
+using System;
+using System.Text;
+
+namespace SKIT.FlurlHttpClient.Wechat.TenpayV3
+{
+    /// <summary>
+    /// 为 <see cref="WechatTenpayClient"/> 提供响应签名验证的扩展方法。
+    /// </summary>
+    public static class WechatTenpayClientResponseVerificationExtensions
+    {
+        /// <summary>
+        /// <para>验证响应签名。</para>
+        /// <para>REF: https://pay.weixin.qq.com/wiki/doc/apiv3/wechatpay/wechatpay4_1.shtml </para>
+        /// <para>REF: https://pay.weixin.qq.com/wiki/doc/apiv3_partner/wechatpay/wechatpay4_1.shtml </para>
+        /// </summary>
+        /// <typeparam name="TResponse"></typeparam>
+        /// <param name="client"></param>
+        /// <param name="response"></param>
+        /// <returns></returns>
+        public static bool VerifyResponseSignature<TResponse>(this WechatTenpayClient client, TResponse response)
+            where TResponse : WechatTenpayResponse
+        {
+            if (client == null) throw new ArgumentNullException(nameof(client));
+            if (response == null) throw new ArgumentNullException(nameof(response));
+
+            if (client.WechatCertificateStorer == null)
+            {
+                throw new Exceptions.WechatTenpayResponseVerificationException($"You must set an instance of `{nameof(Settings.ICertificateStorer)}` at first.");
+            }
+            else
+            {
+                if (response.WechatpayCertSerialNumber == null)
+                    throw new Exceptions.WechatTenpayResponseVerificationException("Cannot read the serial number in headers of this response.");
+
+                string? certificate = client.WechatCertificateStorer.Get(response.WechatpayCertSerialNumber);
+                if (certificate == null)
+                    throw new Exceptions.WechatTenpayResponseVerificationException("Cannot get certificate by the serial number, may not be stored.");
+
+                string? publicKey = null;
+                try
+                {
+                    publicKey = Utilities.RSAUtility.ExportPublicKey(certificate);
+                }
+                catch (Exception ex)
+                {
+                    throw new Exceptions.WechatTenpayResponseVerificationException("Cannot get public key of the certificate, may not be a valid certificate data.", ex);
+                }
+
+                try
+                {
+                    return Utilities.RSAUtility.VerifyWithSHA256(
+                        publicKey: publicKey,
+                        plainText: GetPlainTextForSignature(response),
+                        signature: response.WechatpaySignature
+                    );
+                }
+                catch (Exception ex)
+                {
+                    throw new Exceptions.WechatTenpayResponseVerificationException("Verify response signature failed.", ex);
+                }
+            }
+        }
+
+        private static string GetPlainTextForSignature(WechatTenpayResponse response)
+        {
+            string timestamp = response.WechatpayTimestamp;
+            string nonce = response.WechatpayNonce;
+            string body = Encoding.UTF8.GetString(response.RawBytes);
+            return $"{timestamp}\n{nonce}\n{body}\n";
+        }
+    }
+}

src/SKIT.FlurlHttpClient.Wechat.TenpayV3/Extensions/WechatTenpayClientResponseVerifyExtensions.cs

@@ -1,81 +0,0 @@
-using System;
-using System.Text;
-
-namespace SKIT.FlurlHttpClient.Wechat.TenpayV3
-{
-    /// <summary>
-    /// 为 <see cref="WechatTenpayClient"/> 提供响应签名验证的扩展方法。
-    /// </summary>
-    public static class WechatTenpayClientResponseVerifyExtensions
-    {
-        /// <summary>
-        /// <para>验证响应签名（使用微信支付平台证书公钥）。</para>
-        /// <para>REF: https://pay.weixin.qq.com/wiki/doc/apiv3/wechatpay/wechatpay4_1.shtml </para>
-        /// <para>REF: https://pay.weixin.qq.com/wiki/doc/apiv3_partner/wechatpay/wechatpay4_1.shtml </para>
-        /// </summary>
-        /// <typeparam name="TResponse"></typeparam>
-        /// <param name="client"></param>
-        /// <param name="response"></param>
-        /// <param name="publicKey"></param>
-        /// <returns></returns>
-        public static bool VerifyResponseSignature<TResponse>(this WechatTenpayClient client, TResponse response, string publicKey)
-            where TResponse : WechatTenpayResponse
-        {
-            if (client == null) throw new ArgumentNullException(nameof(client));
-            if (response == null) throw new ArgumentNullException(nameof(response));
-            if (string.IsNullOrEmpty(publicKey)) throw new ArgumentNullException(publicKey);
-
-            try
-            {
-                return Utilities.RSAUtility.VerifyWithSHA256(
-                    publicKey: publicKey,
-                    plainText: GetPlainTextForSignature(response),
-                    signature: response.WechatpaySignature
-                );
-            }
-            catch (Exception ex)
-            {
-                throw new Exceptions.WechatTenpayResponseVerificationException("Verify response signature failed.", ex);
-            }
-        }
-
-        /// <summary>
-        /// <para>验证响应签名（使用微信支付平台证书）。</para>
-        /// <para>REF: https://pay.weixin.qq.com/wiki/doc/apiv3/wechatpay/wechatpay4_1.shtml </para>
-        /// <para>REF: https://pay.weixin.qq.com/wiki/doc/apiv3_partner/wechatpay/wechatpay4_1.shtml </para>
-        /// </summary>
-        /// <typeparam name="TResponse"></typeparam>
-        /// <param name="client"></param>
-        /// <param name="response"></param>
-        /// <param name="certificate"></param>
-        /// <returns></returns>
-        public static bool VerifyResponseSignatureByCertificate<TResponse>(this WechatTenpayClient client, TResponse response, string certificate)
-            where TResponse : WechatTenpayResponse
-        {
-            if (client == null) throw new ArgumentNullException(nameof(client));
-            if (response == null) throw new ArgumentNullException(nameof(response));
-            if (string.IsNullOrEmpty(certificate)) throw new ArgumentNullException(certificate);
-
-            try
-            {
-                return Utilities.RSAUtility.VerifyWithSHA256ByCertificate(
-                    certificate: certificate,
-                    plainText: GetPlainTextForSignature(response),
-                    signature: response.WechatpaySignature
-                );
-            }
-            catch (Exception ex)
-            {
-                throw new Exceptions.WechatTenpayResponseVerificationException("Verify response signature failed.", ex);
-            }
-        }
-
-        private static string GetPlainTextForSignature(WechatTenpayResponse response)
-        {
-            string timestamp = response.WechatpayTimestamp;
-            string nonce = response.WechatpayNonce;
-            string body = Encoding.UTF8.GetString(response.RawBytes);
-            return $"{timestamp}\n{nonce}\n{body}\n";
-        }
-    }
-}