SCRM 系统接管多公众号实战指南

1. 发起授权：用户在平台点击【一键接入公众号】 -> 前端请求后端获取授权链接
2. 生成凭据：后端用 component_access_token 向微信换取 pre_auth_code，拼接 auth_url 下发
3. 扫码确认：前端展示二维码 -> 管理员微信扫码 -> 勾选权限并点击【同意授权】
4. 换证入库：微信带 auth_code 回跳 -> 后端换取永久凭证 authorizer_refresh_token 并落库
5. 业务接管：微信向平台推送代管公众号的粉丝消息与事件 -> 平台解密并分发处理

[微信开放平台后台详情页 - 关键配置一览]
   ├── 1. 记下凭据：开发者ID (AppId) & 开发者密码 (AppSecret)
   ├── 2. 配置白名单：把本地电脑的公网出口 IP 加入【IP白名单】
   ├── 3. 基础安全配置：消息校验Token & 消息加解密Key (EncodingAESKey)
   ├── 4. 核心回调配置：授权事件接收URL & 公众号消息接收URL
   └── 5. 开发沙箱配置：在【测试公众号列表】中绑定你的测试公众号

cpolar http 4307

Forwarding          https://scrm-dev.r10.cpolar.top -> http://localhost:4307

open_platform:
  app_id: "wx58xxxxxxxxxxxxxx"                   # 开发者ID (AppId)
  app_secret: "22a91933f4664a4119118bfd2dacd489" # 开发者密码 (AppSecret)
  token: "my_scrm_token_2026"                    # 消息校验 Token
  encoding_aes_key: "xxx"                        # 消息加解密 Key (EncodingAESKey)

// ReceiveAuthEvent 处理微信推送的 component_verify_ticket 及授权变更事件
func (h *OpenPlatformHandler) ReceiveAuthEvent(ctx *gin.Context) {
	msgSignature := ctx.Query("msg_signature")
	timestamp := ctx.Query("timestamp")
	nonce := ctx.Query("nonce")

	body, err := io.ReadAll(ctx.Request.Body)
	if err != nil {
		h.l.Error("读取授权事件请求体失败", zap.Error(err))
		ctx.String(http.StatusBadRequest, "fail")
		return
	}

	event, err := h.svc.ReceiveVerifyTicket(ctx, msgSignature, timestamp, nonce, body)
	if err != nil {
		h.l.Warn("解析授权事件失败", zap.Error(err))
		ctx.String(http.StatusOK, "success") // 无论成功失败均回复 success，避免微信重发风暴
		return
	}

	h.l.Info("处理微信开放平台授权事件成功", zap.String("infoType", event.InfoType))
	ctx.String(http.StatusOK, "success")
}

// TicketXML 微信开放平台推送事件报文结构
type TicketXML struct {
	XMLName               xml.Name `xml:"xml"`
	AppId                 string   `xml:"AppId"`
	CreateTime            int64    `xml:"CreateTime"`
	InfoType              string   `xml:"InfoType"`
	ComponentVerifyTicket string   `xml:"ComponentVerifyTicket"`
	AuthorizerAppid       string   `xml:"AuthorizerAppid"`
	AuthorizationCode     string   `xml:"AuthorizationCode"`
}

func (s *openPlatformService) ReceiveVerifyTicket(ctx context.Context, msgSignature, timestamp, nonce string, encryptedXML []byte) (*TicketXML, error) {
	appID := s.cfg.OpenPlatform.AppId
	token := s.cfg.OpenPlatform.Token
	aesKey := s.cfg.OpenPlatform.EncodingAESKey

	// 1. 初始化微信加解密工具包
	crypt, err := crypto.NewWXBizMsgCrypt(token, aesKey, appID)
	if err != nil {
		return nil, fmt.Errorf("create wxbizmsgcrypt failed: %w", err)
	}

	// 2. 验签并解密 XML 载荷
	decrypted, err := crypt.DecryptMsg(msgSignature, timestamp, nonce, encryptedXML)
	if err != nil {
		return nil, fmt.Errorf("decrypt msg failed: %w", err)
	}

	var event TicketXML
	if err := xml.Unmarshal(decrypted, &event); err != nil {
		return nil, fmt.Errorf("unmarshal decrypted ticket xml failed: %w", err)
	}

	// 3. 提取 component_verify_ticket 并持久化至 Redis（缓存 12 小时滚动更新）
	if event.InfoType == "component_verify_ticket" && event.ComponentVerifyTicket != "" {
		s.l.Info("成功接收并解析微信 component_verify_ticket", zap.String("appId", event.AppId))
		if err := s.repo.SetVerifyTicket(ctx, event.AppId, event.ComponentVerifyTicket, 12*time.Hour); err != nil {
			s.l.Error("保存 component_verify_ticket 至缓存失败", zap.Error(err))
			return &event, err
		}
	}

	return &event, nil
}

package crypto

import (
	"bytes"
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"crypto/sha1"
	"encoding/base64"
	"encoding/binary"
	"encoding/hex"
	"encoding/xml"
	"errors"
	"fmt"
	"io"
	"sort"
)

// CDATA 结构
type CDATA struct {
	Value string `xml:",cdata"`
}

// EncryptedXMLMsg 微信加密 XML 消息通用外层结构
type EncryptedXMLMsg struct {
	XMLName    xml.Name `xml:"xml"`
	ToUserName string   `xml:"ToUserName"`
	AppId      string   `xml:"AppId"`
	Encrypt    string   `xml:"Encrypt"`
}

// ResponseXMLMsg 被动回复加密 XML 结构
type ResponseXMLMsg struct {
	XMLName      xml.Name `xml:"xml"`
	Encrypt      CDATA    `xml:"Encrypt"`
	MsgSignature CDATA    `xml:"MsgSignature"`
	TimeStamp    string   `xml:"TimeStamp"`
	Nonce        CDATA    `xml:"Nonce"`
}

// WXBizMsgCrypt 微信消息加解密处理器
type WXBizMsgCrypt struct {
	token          string
	encodingAESKey string
	appID          string
	aesKey         []byte
}

func NewWXBizMsgCrypt(token, encodingAESKey, appID string) (*WXBizMsgCrypt, error) {
	if len(encodingAESKey) != 43 {
		return nil, errors.New("EncodingAESKey 长度必须为 43 位")
	}
	aesKey, err := base64.StdEncoding.DecodeString(encodingAESKey + "=")
	if err != nil {
		return nil, fmt.Errorf("decode aesKey failed: %w", err)
	}
	return &WXBizMsgCrypt{
		token:          token,
		encodingAESKey: encodingAESKey,
		appID:          appID,
		aesKey:         aesKey,
	}, nil
}

// CalcSignature 计算微信签名
func CalcSignature(token, timestamp, nonce, msgEncrypt string) string {
	params := []string{token, timestamp, nonce, msgEncrypt}
	sort.Strings(params)
	h := sha1.New()
	for _, p := range params {
		h.Write([]byte(p))
	}
	return hex.EncodeToString(h.Sum(nil))
}

// VerifySignature 验证签名
func (c *WXBizMsgCrypt) VerifySignature(msgSignature, timestamp, nonce, msgEncrypt string) bool {
	sig := CalcSignature(c.token, timestamp, nonce, msgEncrypt)
	return sig == msgSignature
}

// DecryptMsg 解密微信加密报文，返回明文字节
func (c *WXBizMsgCrypt) DecryptMsg(msgSignature, timestamp, nonce string, postData []byte) ([]byte, error) {
	var encMsg EncryptedXMLMsg
	if err := xml.Unmarshal(postData, &encMsg); err != nil {
		return nil, fmt.Errorf("unmarshal encrypted xml failed: %w", err)
	}

	if !c.VerifySignature(msgSignature, timestamp, nonce, encMsg.Encrypt) {
		return nil, errors.New("signature verification failed")
	}

	cipherBytes, err := base64.StdEncoding.DecodeString(encMsg.Encrypt)
	if err != nil {
		return nil, fmt.Errorf("base64 decode encrypt failed: %w", err)
	}

	block, err := aes.NewCipher(c.aesKey)
	if err != nil {
		return nil, fmt.Errorf("aes new cipher failed: %w", err)
	}

	if len(cipherBytes) < aes.BlockSize || len(cipherBytes)%aes.BlockSize != 0 {
		return nil, errors.New("cipher text length is invalid")
	}

	iv := c.aesKey[:16]
	mode := cipher.NewCBCDecrypter(block, iv)
	plainBytes := make([]byte, len(cipherBytes))
	mode.CryptBlocks(plainBytes, cipherBytes)

	// PKCS#7 unpad
	plainBytes = pkcs7Unpad(plainBytes)
	if len(plainBytes) < 20 {
		return nil, errors.New("plain text length too short")
	}

	// 报文结构: 16B 随机字符串 + 4B msg_len (网络字节序) + msg + appid
	msgLen := binary.BigEndian.Uint32(plainBytes[16:20])
	totalLen := len(plainBytes)
	if totalLen < 20+int(msgLen) {
		return nil, errors.New("invalid msg len in decrypted content")
	}

	xmlContent := plainBytes[20 : 20+msgLen]
	appIDFromMsg := string(plainBytes[20+msgLen:])

	if c.appID != "" && appIDFromMsg != c.appID {
		return nil, fmt.Errorf("appID mismatch: expected %s, got %s", c.appID, appIDFromMsg)
	}

	return xmlContent, nil
}

// EncryptMsg 加密回复明文并组装成加密 XML
func (c *WXBizMsgCrypt) EncryptMsg(replyXML []byte, timestamp, nonce string) ([]byte, error) {
	rand16 := make([]byte, 16)
	if _, err := io.ReadFull(rand.Reader, rand16); err != nil {
		return nil, fmt.Errorf("generate random bytes failed: %w", err)
	}

	msgLenBytes := make([]byte, 4)
	binary.BigEndian.PutUint32(msgLenBytes, uint32(len(replyXML)))

	var rawBuf bytes.Buffer
	rawBuf.Write(rand16)
	rawBuf.Write(msgLenBytes)
	rawBuf.Write(replyXML)
	rawBuf.WriteString(c.appID)

	padded := pkcs7Pad(rawBuf.Bytes(), aes.BlockSize)

	block, err := aes.NewCipher(c.aesKey)
	if err != nil {
		return nil, fmt.Errorf("aes new cipher failed: %w", err)
	}

	iv := c.aesKey[:16]
	mode := cipher.NewCBCEncrypter(block, iv)
	cipherText := make([]byte, len(padded))
	mode.CryptBlocks(cipherText, padded)

	encryptB64 := base64.StdEncoding.EncodeToString(cipherText)
	signature := CalcSignature(c.token, timestamp, nonce, encryptB64)

	res := ResponseXMLMsg{
		Encrypt:      CDATA{Value: encryptB64},
		MsgSignature: CDATA{Value: signature},
		TimeStamp:    timestamp,
		Nonce:        CDATA{Value: nonce},
	}

	return xml.MarshalIndent(res, "", "  ")
}

func pkcs7Pad(data []byte, blockSize int) []byte {
	padding := blockSize - len(data)%blockSize
	padText := bytes.Repeat([]byte{byte(padding)}, padding)
	return append(data, padText...)
}

func pkcs7Unpad(data []byte) []byte {
	length := len(data)
	if length == 0 {
		return nil
	}
	padding := int(data[length-1])
	if padding > length || padding > 32 || padding == 0 {
		return data
	}
	return data[:length-padding]
}

func (r *openPlatformRepository) SetVerifyTicket(ctx context.Context, platformAppID, ticket string, ttl time.Duration) error {
	return r.cache.SetVerifyTicket(ctx, platformAppID, ticket, ttl)
}

func (c *openPlatformCache) SetVerifyTicket(ctx context.Context, platformAppID, ticket string, ttl time.Duration) error {
	key := fmt.Sprintf("scrm:open:ticket:%s", platformAppID)
	return c.redis.Set(ctx, key, ticket, ttl).Err()
}

func (s *openPlatformService) GetComponentAccessToken(ctx context.Context, platformAppID string) (string, error) {
	if platformAppID == "" {
		platformAppID = s.cfg.OpenPlatform.AppId
	}

	// 1. 优先查缓存
	token, err := s.repo.GetComponentAccessToken(ctx, platformAppID)
	if err == nil && token != "" {
		return token, nil
	}

	// 2. singleflight 保护并发请求，避免同一时间打穿微信接口
	val, err, _ := s.sf.Do("component_token:"+platformAppID, func() (any, error) {
		token, err := s.repo.GetComponentAccessToken(ctx, platformAppID)
		if err == nil && token != "" {
			return token, nil
		}

		ticket, err := s.repo.GetVerifyTicket(ctx, platformAppID)
		if err != nil || ticket == "" {
			return "", fmt.Errorf("未获取到 component_verify_ticket，请等待微信推送: %w", err)
		}

		reqBody, _ := json.Marshal(map[string]string{
			"component_appid":         platformAppID,
			"component_appsecret":     s.cfg.OpenPlatform.AppSecret,
			"component_verify_ticket": ticket,
		})

		url := "https://api.weixin.qq.com/cgi-bin/component/api_component_token"
		resp, err := s.httpClient.Post(url, "application/json", bytes.NewReader(reqBody))
		if err != nil {
			return "", fmt.Errorf("request api_component_token failed: %w", err)
		}
		defer resp.Body.Close()

		body, _ := io.ReadAll(resp.Body)
		var res struct {
			ComponentAccessToken string `json:"component_access_token"`
			ExpiresIn            int    `json:"expires_in"`
			ErrCode              int    `json:"errcode"`
			ErrMsg               string `json:"errmsg"`
		}
		_ = json.Unmarshal(body, &res)
		if res.ErrCode != 0 || res.ComponentAccessToken == "" {
			return "", fmt.Errorf("wechat api_component_token error [%d]: %s", res.ErrCode, res.ErrMsg)
		}

		// 提前 200 秒过期以平滑续期
		ttl := time.Duration(res.ExpiresIn-200) * time.Second
		_ = s.repo.SetComponentAccessToken(ctx, platformAppID, res.ComponentAccessToken, ttl)
		return res.ComponentAccessToken, nil
	})

	if err != nil {
		return "", err
	}
	return val.(string), nil
}

// 注册微信消息接收端点，:appid 动态捕获当前触发事件的公众号 AppID
g.POST("/msg-callback/:appid", h.ReceiveMessage)

// ReceiveMessage 接收授权公众号的粉丝消息与事件推送
func (h *OpenPlatformHandler) ReceiveMessage(ctx *gin.Context) {
	authorizerAppID := ctx.Param("appid")
	msgSignature := ctx.Query("msg_signature")
	timestamp := ctx.Query("timestamp")
	nonce := ctx.Query("nonce")

	body, err := io.ReadAll(ctx.Request.Body)
	if err != nil {
		h.l.Error("读取微信公众号消息请求体失败", zap.String("authorizerAppID", authorizerAppID), zap.Error(err))
		ctx.String(http.StatusBadRequest, "fail")
		return
	}

	h.l.Debug("接收到微信公众号消息推送",
		zap.String("authorizerAppID", authorizerAppID),
		zap.String("msgSignature", msgSignature),
		zap.String("timestamp", timestamp),
		zap.String("nonce", nonce),
	)

	// 调用 Service 纯业务逻辑（参数解耦，不传递 gin.Context）
	if err := h.svc.HandleMessage(ctx.Request.Context(), authorizerAppID, msgSignature, timestamp, nonce, body); err != nil {
		h.l.Warn("处理微信公众号粉丝消息异常",
			zap.String("authorizerAppID", authorizerAppID),
			zap.Error(err),
		)
		// 微信官方规范：即便业务处理失败，也应回复 success 避免微信服务器 5 秒超时重发风暴
		ctx.String(http.StatusOK, "success")
		return
	}

	// 微信规定收到消息后必须回复 success 或空字符串
	ctx.String(http.StatusOK, "success")
}

// CommonMsgXML 微信公众号粉丝基础消息/事件 XML 结构
type CommonMsgXML struct {
	XMLName      xml.Name `xml:"xml"`
	ToUserName   string   `xml:"ToUserName"`   // 开发者微信号 / 公众号原始ID
	FromUserName string   `xml:"FromUserName"` // 发送方帐号（粉丝的 OpenID）
	CreateTime   int64    `xml:"CreateTime"`   // 消息创建时间
	MsgType      string   `xml:"MsgType"`      // 消息类型：text / image / event 等
	Event        string   `xml:"Event"`        // 事件类型：subscribe / unsubscribe / CLICK 等
	Content      string   `xml:"Content"`      // 文本消息内容
	EventKey     string   `xml:"EventKey"`     // 事件 KEY 值（如带参二维码参数）
}

// OpenPlatformMessageHandler 消息处理器插件接口
type OpenPlatformMessageHandler interface {
	Process(ctx context.Context, authorizerAppID string, rawXML []byte, msg map[string]string) error
}

// HandleMessage 解密并路由分发公众号消息与事件
func (s *openPlatformService) HandleMessage(
	ctx context.Context,
	authorizerAppID, msgSignature, timestamp, nonce string,
	body []byte,
) error {
	crypt, err := crypto.NewWXBizMsgCrypt(s.cfg.OpenPlatform.Token, s.cfg.OpenPlatform.EncodingAESKey, s.cfg.OpenPlatform.AppId)
	if err != nil {
		s.l.Error("初始化加解密失败", zap.Error(err))
		return err
	}

	decrypted, err := crypt.DecryptMsg(msgSignature, timestamp, nonce, body)
	if err != nil {
		s.l.Warn("解密粉丝消息失败", zap.String("authorizerAppID", authorizerAppID), zap.Error(err))
		return err
	}

	var msg CommonMsgXML
	if err := xml.Unmarshal(decrypted, &msg); err != nil {
		s.l.Error("反序列化消息明文失败", zap.String("authorizerAppID", authorizerAppID), zap.Error(err))
		return err
	}

	s.l.Info("收到授权公众号粉丝消息/事件",
		zap.String("authorizerAppID", authorizerAppID),
		zap.String("fromUser", msg.FromUserName),
		zap.String("msgType", msg.MsgType),
		zap.String("event", msg.Event),
		zap.String("content", msg.Content),
	)

	// 组装路由 Key（如 "text" 或 "event:subscribe"）
	key := msg.MsgType
	if msg.Event != "" {
		key = fmt.Sprintf("%s:%s", msg.MsgType, msg.Event)
	}

	// 命中注册的处理器则异步分发执行，不阻塞当前 HTTP 响应
	if handlerVal, ok := s.handlers.Load(key); ok {
		handler := handlerVal.(OpenPlatformMessageHandler)
		m := map[string]string{
			"ToUserName":   msg.ToUserName,
			"FromUserName": msg.FromUserName,
			"MsgType":      msg.MsgType,
			"Event":        msg.Event,
			"Content":      msg.Content,
			"EventKey":     msg.EventKey,
		}
		go func() {
			if err := handler.Process(context.Background(), authorizerAppID, decrypted, m); err != nil {
				s.l.Error("处理器处理消息失败", zap.String("key", key), zap.Error(err))
			}
		}()
	}

	return nil
}

// RegisterMessageHandler 注册自定义事件监听器
func (s *openPlatformService) RegisterMessageHandler(msgType, eventType string, handler OpenPlatformMessageHandler) {
	key := msgType
	if eventType != "" {
		key = fmt.Sprintf("%s:%s", msgType, eventType)
	}
	s.handlers.Store(key, handler)
}

// 1. 向微信官方换取 pre_auth_code
func (s *openPlatformService) GetPreAuthCode(ctx context.Context, platformAppID string) (string, error) {
	if platformAppID == "" {
		platformAppID = s.cfg.OpenPlatform.AppId
	}
	compToken, err := s.GetComponentAccessToken(ctx, platformAppID)
	if err != nil {
		return "", fmt.Errorf("get component token failed: %w", err)
	}

	reqBody, _ := json.Marshal(map[string]string{
		"component_appid": platformAppID,
	})
	apiURL := fmt.Sprintf("https://api.weixin.qq.com/cgi-bin/component/api_create_preauthcode?component_access_token=%s", compToken)
	resp, err := s.httpClient.Post(apiURL, "application/json", bytes.NewReader(reqBody))
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()

	body, _ := io.ReadAll(resp.Body)
	var res struct {
		PreAuthCode string `json:"pre_auth_code"`
		ErrCode     int    `json:"errcode"`
		ErrMsg      string `json:"errmsg"`
	}
	_ = json.Unmarshal(body, &res)
	if res.ErrCode != 0 || res.PreAuthCode == "" {
		return "", fmt.Errorf("wechat api_create_preauthcode error [%d]: %s", res.ErrCode, res.ErrMsg)
	}
	return res.PreAuthCode, nil
}

// 2. 拼装 PC 端与移动端适用的完整授权链接
func (s *openPlatformService) GenerateAuthURL(ctx context.Context, redirectURI, accountID string) (string, string, string, error) {
	platformAppID := s.cfg.OpenPlatform.AppId
	if redirectURI == "" {
		redirectURI = s.cfg.OpenPlatform.RedirectURI
	}

	// 生成会话追踪 ticket，并拼入 redirect_uri 中传递给微信
	ticket := uuid.NewV4().String()
	if parsed, err := url.Parse(redirectURI); err == nil {
		q := parsed.Query()
		if q.Get("account_id") == "" {
			q.Set("account_id", accountID)
		}
		q.Set("ticket", ticket)
		parsed.RawQuery = q.Encode()
		redirectURI = parsed.String()
	}

	preAuthCode, err := s.GetPreAuthCode(ctx, platformAppID)
	if err != nil {
		return "", "", "", err
	}

	// 电脑端打开的标准授权页面
	authURL := fmt.Sprintf(
		"https://mp.weixin.qq.com/cgi-bin/componentloginpage?component_appid=%s&pre_auth_code=%s&redirect_uri=%s&auth_type=1",
		platformAppID, preAuthCode, url.QueryEscape(redirectURI),
	)
	// 手机微信客户端直接扫码直达授权页
	scanURL := fmt.Sprintf(
		"https://open.weixin.qq.com/wxaopen/safe/bindcomponent?action=bindcomponent&auth_type=1&no_scan=1&component_appid=%s&pre_auth_code=%s&redirect_uri=%s#wechat_redirect",
		platformAppID, preAuthCode, url.QueryEscape(redirectURI),
	)
	return authURL, scanURL, ticket, nil
}

GET http://127.0.0.1:4307/v1/open/auth-url?redirect_uri=https://scrm-dev.r10.cpolar.top/v1/open/auth-success

{
    "code": 0,
    "msg": "OK",
    "data": {
        "auth_url": "https://mp.weixin.qq.com/cgi-bin/componentloginpage?component_appid=wx391b50c00911423a&pre_auth_code=preauthcode@@@j3Ao3zHByB0CAQdbJ9vjsnQaCIbjAUm-UFnFRzl160IniwSiGfeEdemCw6zodAdQocpUMNThxH4lI5ZztIqWGA&redirect_uri=https%3A%2F%2F287a01f1.r1.cpolar.top%2Fv1%2Fopen%2Fauth-success%3Faccount_id%3D42735d9f-47b6-4b8d-82dc-17de9d81cdc1%26ticket%3D415422ef-4fcd-4cdc-b3cc-4020b3953f3f&auth_type=1",
        "scan_url": "https://open.weixin.qq.com/wxaopen/safe/bindcomponent?action=bindcomponent&auth_type=1&no_scan=1&component_appid=wx391b50c00911423a&pre_auth_code=preauthcode@@@j3Ao3zHByB0CAQdbJ9vjsnQaCIbjAUm-UFnFRzl160IniwSiGfeEdemCw6zodAdQocpUMNThxH4lI5ZztIqWGA&redirect_uri=https%3A%2F%2F287a01f1.r1.cpolar.top%2Fv1%2Fopen%2Fauth-success%3Faccount_id%3D42735d9f-47b6-4b8d-82dc-17de9d81cdc1%26ticket%3D415422ef-4fcd-4cdc-b3cc-4020b3953f3f#wechat_redirect",
        "stream_url": "/v1/open/auth-stream?ticket=415422ef-4fcd-4cdc-b3cc-4020b3953f3f",
        "ticket": "415422ef-4fcd-4cdc-b3cc-4020b3953f3f"
    }
}

GET http://127.0.0.1:4307/v1/open/auth-url?redirect_uri=https://scrm-dev.r10.cpolar.top/v1/open/auth-success

// 注册绑定端点
g.POST("/bind", iam.RequireAction("scrm:open:auth:Bind", "绑定授权公众号"), h.BindAuthorizer)

// BindAuthorizerReq 绑定请求体
type BindAuthorizerReq struct {
	AuthCode  string `json:"auth_code" binding:"required"`
	AccountID string `json:"account_id"`
}

// BindAuthorizer 商户扫码授权成功后，使用 auth_code 换取 refresh_token 并绑定入库
func (h *OpenPlatformHandler) BindAuthorizer(ctx *gin.Context) {
	var req BindAuthorizerReq
	if valid, errs := validator.BindAndValid(ctx, &req); !valid {
		h.l.Warn("绑定授权公众号参数校验失败", zap.Any("errs", errs))
		response.Fail(ctx, ecode.InvalidParams.WithDetails(errs))
		return
	}

	accountID := req.AccountID
	if accountID == "" {
		accountID = ctx.GetString("userId")
	}
	if accountID == "" {
		accountID = "dev_admin_test"
	}

	// 调用业务层换证并持久化落库
	authorizer, err := h.svc.FetchAndSaveAuthorizerInfo(ctx, accountID, req.AuthCode)
	if err != nil {
		h.l.Error("换取并绑定授权微信账号信息失败", zap.Error(err))
		response.Fail(ctx, ecode.ServerError.WithDetails(err.Error()))
		return
	}

	h.l.Info("商户成功绑定微信账号",
		zap.String("appid", authorizer.AuthorizerAppID),
		zap.String("nick_name", authorizer.NickName),
		zap.String("user_name", authorizer.UserName),
		zap.String("principal_name", authorizer.PrincipalName),
		zap.Int("account_type", authorizer.AccountType),
		zap.Int("verify_type", authorizer.VerifyType),
	)

	response.Success(ctx, authorizer)
}

// FetchAndSaveAuthorizerInfo 使用 auth_code 换取被授权方的永久刷新令牌与详情并持久化
func (s *openPlatformService) FetchAndSaveAuthorizerInfo(ctx context.Context, accountID, authCode string) (*domain.WxAuthorizer, error) {
	platformAppID := s.cfg.OpenPlatform.AppId
	compToken, err := s.GetComponentAccessToken(ctx, platformAppID)
	if err != nil {
		return nil, fmt.Errorf("get component access token failed: %w", err)
	}

	// 1. 使用一次性 auth_code 换取该公众号的调用凭证与永久 refresh_token
	queryAuthURL := fmt.Sprintf("https://api.weixin.qq.com/cgi-bin/component/api_query_auth?component_access_token=%s", compToken)
	reqBody, _ := json.Marshal(map[string]string{
		"component_appid":    platformAppID,
		"authorization_code": authCode,
	})
	resp, err := s.httpClient.Post(queryAuthURL, "application/json", bytes.NewReader(reqBody))
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()

	var queryAuthRes struct {
		AuthorizationInfo struct {
			AuthorizerAppid        string `json:"authorizer_appid"`
			AuthorizerRefreshToken string `json:"authorizer_refresh_token"`
			FuncInfo               []any  `json:"func_info"`
		} `json:"authorization_info"`
		ErrCode int `json:"errcode"`
	}
	_ = json.NewDecoder(resp.Body).Decode(&queryAuthRes)
	authorizerAppID := queryAuthRes.AuthorizationInfo.AuthorizerAppid
	refreshToken := queryAuthRes.AuthorizationInfo.AuthorizerRefreshToken

	// 2. 调用微信接口拉取该公众号的真实资料（昵称、头像、主体名称、原始ID等）
	getInfoURL := fmt.Sprintf("https://api.weixin.qq.com/cgi-bin/component/api_get_authorizer_info?component_access_token=%s", compToken)
	infoBody, _ := json.Marshal(map[string]string{
		"component_appid":  platformAppID,
		"authorizer_appid": authorizerAppID,
	})
	infoResp, _ := s.httpClient.Post(getInfoURL, "application/json", bytes.NewReader(infoBody))
	var nickName, headImg, userName, principalName string
	if infoResp != nil {
		defer infoResp.Body.Close()
		var infoRes struct {
			AuthorizerInfo struct {
				NickName      string `json:"nick_name"`
				HeadImg       string `json:"head_img"`
				UserName      string `json:"user_name"` // 原始ID (gh_xxx)
				PrincipalName string `json:"principal_name"`
			} `json:"authorizer_info"`
		}
		_ = json.NewDecoder(infoResp.Body).Decode(&infoRes)
		nickName = infoRes.AuthorizerInfo.NickName
		headImg = infoRes.AuthorizerInfo.HeadImg
		userName = infoRes.AuthorizerInfo.UserName
		principalName = infoRes.AuthorizerInfo.PrincipalName
	}

	// 3. 构建 Domain 实体并交由 Repository 落库
	funcInfoBytes, _ := json.Marshal(queryAuthRes.AuthorizationInfo.FuncInfo)
	authorizer := &domain.WxAuthorizer{
		ID:                     uuid.NewV4().String(),
		AccountID:              accountID,
		AuthorizerAppID:        authorizerAppID,
		NickName:               nickName,
		HeadImg:                headImg,
		UserName:               userName,
		PrincipalName:          principalName,
		AuthorizerRefreshToken: refreshToken, // 接管的核心：必须落库的永久令牌
		FuncInfo:               string(funcInfoBytes),
		Status:                 "NORMAL",
		UpdatedAt:              time.Now().UnixMilli(),
	}

	if err := s.repo.SaveAuthorizer(ctx, authorizer); err != nil {
		return nil, fmt.Errorf("持久化公众号失败: %w", err)
	}
	return authorizer, nil
}

// 1. DAO 层持久化实体 (dao/openplatform.go)
type WxAuthorizer struct {
    ID                     string `gorm:"primaryKey;type:char(36)"`
    AccountID              string `gorm:"column:account_id;type:char(36);not null;index"`
    AuthorizerAppID        string `gorm:"column:authorizer_appid;type:varchar(100);not null;uniqueIndex"`
    NickName               string `gorm:"column:nick_name;type:varchar(100)"`
    AuthorizerRefreshToken string `gorm:"column:authorizer_refresh_token;type:varchar(200);not null"`
    Status                 string `gorm:"column:status;type:varchar(32);default:NORMAL"`
    UpdatedAt              int64  `gorm:"column:updated_at;autoUpdateTime:milli"`
}

// 2. Repository 层双向防腐转换 (repository/openplatform.go)
func (r *openPlatformRepository) SaveAuthorizer(ctx context.Context, authorizer *domain.WxAuthorizer) error {
    if authorizer == nil {
        return nil
    }
    return r.dao.SaveOrUpdateAuthorizer(ctx, r.toDaoEntity(authorizer))
}

func (r *openPlatformRepository) toDaoEntity(d *domain.WxAuthorizer) *dao.WxAuthorizer {
    return &dao.WxAuthorizer{
        ID:                     d.ID,
        AccountID:              d.AccountID,
        AuthorizerAppID:        d.AuthorizerAppID,
        NickName:               d.NickName,
        AuthorizerRefreshToken: d.AuthorizerRefreshToken,
        Status:                 d.Status,
        UpdatedAt:              d.UpdatedAt,
    }
}