支付中台接入方案

// 1. 前端请求创建订单 POST /payment/charge { "package_id": "pkg_1200", "channel": "paynow" } // 2. 后端 → DBS API：创建 PayNow 订单 POST https://api.dbs.com/sg/paynow/v1/orders Headers: X-DBS-Client-Id, X-DBS-Signature Body: { "amount": 9.99, "currency": "SGD", "description": "Vocalink 1200 coins", "callback_url": "https://api.vocalink.sg/v1/payment/webhook/dbs", "reference_id": "ord_xxx" } // 3. DBS 返回 QR 数据 Response: { "order_id": "dbs_ord_123", "qr_data": "00020101021126490009SG.PAYNOW01...", "qr_image_url": "https://...", "expires_at": "2026-08-15T10:15:00Z" } // 4. 用户扫码支付 → DBS 回调 POST /payment/webhook/dbs { "order_id": "dbs_ord_123", "status": "completed", "amount": 9.99 } // 5. 后端验证签名 → 发放金币 → WebSocket 通知客户端

// 1. 后端创建 PaymentIntent StripePaymentIntent intent = stripe.paymentIntents.create( amount = 999, // 分 currency = "sgd", metadata = mapOf( "order_id" to "ord_xxx", "user_id" to "usr_xxx", "coins" to "1400" ), paymentMethodTypes = listOf("card"), description = "Vocalink 1200+200 bonus coins" ) // 2. 返回 client_secret 给前端 Response: { "client_secret": "pi_xxx_secret_yyy", "order_id": "ord_xxx" } // 3. 前端 Stripe SDK 确认支付 stripe.confirmCardPayment(clientSecret, { paymentMethod: cardElement }) // 4. Stripe Webhook → 后端 POST /payment/webhook/stripe { "type": "payment_intent.succeeded", "data": { "object": { "id": "pi_xxx", "metadata": {...} } } } // 5. 验证 + 幂等 + 发放金币

// 1. iOS 客户端完成购买 → 获取 receipt let receiptData = try! Data(contentsOf: Bundle.main.appStoreReceiptURL!) let receiptString = receiptData.base64EncodedString() // 2. 客户端发送 receipt 到后端验证 POST /payment/subscription { "plan_id": "vip_month", "channel": "apple_iap", "receipt_data": receiptString } // 3. 后端 → Apple VerifyReceipt API POST https://buy.itunes.apple.com/verifyReceipt { "receipt-data": receiptString, "password": "shared_secret" } // 4. Apple 返回验证结果 { "status": 0, "receipt": {...}, "latest_receipt_info": [{ "product_id": "sg.vocalink.vip.month", "expires_date_ms": "1718000000000" }] } // 5. 后端验证 + 发放 VIP + 记录原始交易 ID（用于续订）

// 1. Android 客户端完成购买 → 获取 purchaseToken Purchase purchase = ...; // from BillingClient String purchaseToken = purchase.getPurchaseToken(); // 2. 发送到后端验证 POST /payment/subscription { "plan_id": "vip_month", "channel": "google_play", "purchase_token": "..." } // 3. 后端 → Google Play Developer API 验证 GET https://androidpublisher.googleapis.com/androidpublisher/v3/applications/sg.vocalink/purchases/subscriptions/vip_month/tokens/{token} Headers: Authorization: Bearer {service_account_jwt} // 4. Google 返回 { "kind": "androidpublisher#subscriptionPurchase", "paymentState": 1, "expiryTimeMillis": "1718000000000", "autoRenewing": true } // 5. 后端验证 + 发放 VIP

# 风控引擎（Payment Service 内） class RiskEngine: def evaluate(self, payment_request): risk_score = 0 user = get_user(payment_request.user_id) # 规则 1：高频 if self._count_recent_payments(user.id, hours=1) > 5: risk_score += 30 # 规则 2：大额 if payment_request.amount_sgd > 100: risk_score += 20 # 规则 3：异地 if payment_request.ip_country != user.registered_country: risk_score += 25 # 规则 4：新账号 if (now() - user.created_at) < 24h and payment_request.amount_sgd > 50: risk_score += 35 # 决策 if risk_score >= 70: return "block", "High risk score" elif risk_score >= 40: return "review", "Manual review needed" else: return "allow", "Low risk"