fix: vpay mode 改为 short_series_coin + signData 按字母序 + offerId 字符串化

server/src/routes/vpay.js

@@ -34,25 +34,28 @@ function hmacSha256Hex(key, data) {
  *   signature = hmac_sha256(sessionKey, signData)
  */
 function buildPayParams(user, pack, outTradeNo) {
-  const signData = JSON.stringify({
-    mode: 'coin',
-    offerId: OFFER_ID,
-    buyQuantity: pack.coins,
-    outTradeNo,
-    custom: '',
+  // signData 字段按字母序排列（微信 Midas 验签对字段顺序敏感，不可乱序）
+  const sd = {
     attach: JSON.stringify({ uid: String(user._id), pack: pack.id }),
-    ts: Math.floor(Date.now() / 1000),
-  })
-  return {
-    mode: 'coin',
+    buyQuantity: pack.coins,
     env: ENV,
-    offerId: OFFER_ID,
+    mode: 'short_series_coin',
+    offerId: String(OFFER_ID),
+    outTradeNo,
+    platform: 'android',
+    ts: Math.floor(Date.now() / 1000),
+  }
+  const signData = JSON.stringify(sd)
+  return {
+    mode: 'short_series_coin',
+    env: ENV,
+    offerId: String(OFFER_ID),
     buyQuantity: pack.coins,
     outTradeNo,
     currencyType: 'CNY',
     platform: 'android',
     signData,
-    paySig: hmacSha256Hex(APPKEY, `requestVirtualPayment&${signData}`),
+    paySig: hmacSha256Hex(APPKEY, 'requestVirtualPayment&' + signData),
     signature: hmacSha256Hex(user.sessionKey || '', signData),
   }
 }