From 3777f67af656d1c1b127ceab83c406b799af670e Mon Sep 17 00:00:00 2001
From: txai-dev <txai-dev@yzrcloud.cn>
Date: Mon, 14 Sep 2026 11:04:57 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20vpay=20mode=20=E6=94=B9=E4=B8=BA=20short?=
 =?UTF-8?q?=5Fseries=5Fcoin=20+=20signData=20=E6=8C=89=E5=AD=97=E6=AF=8D?=
 =?UTF-8?q?=E5=BA=8F=20+=20offerId=20=E5=AD=97=E7=AC=A6=E4=B8=B2=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/src/routes/vpay.js | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/server/src/routes/vpay.js b/server/src/routes/vpay.js
index 17c7ce2..cfe65b8 100644
--- a/server/src/routes/vpay.js
+++ b/server/src/routes/vpay.js
@@ -34,25 +34,28 @@ function hmacSha256Hex(key, data) {
  *   signature = hmac_sha256(sessionKey, signData)
  */
 function buildPayParams(user, pack, outTradeNo) {
-  const signData = JSON.stringify({
-    mode: 'coin',
-    offerId: OFFER_ID,
-    buyQuantity: pack.coins,
-    outTradeNo,
-    custom: '',
+  // signData 字段按字母序排列（微信 Midas 验签对字段顺序敏感，不可乱序）
+  const sd = {
     attach: JSON.stringify({ uid: String(user._id), pack: pack.id }),
-    ts: Math.floor(Date.now() / 1000),
-  })
-  return {
-    mode: 'coin',
+    buyQuantity: pack.coins,
     env: ENV,
-    offerId: OFFER_ID,
+    mode: 'short_series_coin',
+    offerId: String(OFFER_ID),
+    outTradeNo,
+    platform: 'android',
+    ts: Math.floor(Date.now() / 1000),
+  }
+  const signData = JSON.stringify(sd)
+  return {
+    mode: 'short_series_coin',
+    env: ENV,
+    offerId: String(OFFER_ID),
     buyQuantity: pack.coins,
     outTradeNo,
     currencyType: 'CNY',
     platform: 'android',
     signData,
-    paySig: hmacSha256Hex(APPKEY, `requestVirtualPayment&${signData}`),
+    paySig: hmacSha256Hex(APPKEY, 'requestVirtualPayment&' + signData),
     signature: hmacSha256Hex(user.sessionKey || '', signData),
   }
 }