bKash集成完整指南

graph TD
    A[提交申请材料] --> B[bKash初审]
    B --> C[补充材料]
    C --> D[实地核查]
    D --> E[风控评估]
    E --> F[签署协议]
    F --> G[获得API凭证]
    G --> H[技术集成测试]
    H --> I[正式上线]

┌─────────────────────────────────────────────────────────────┐
│                    bKash Payment Gateway                    │
├─────────────────────────────────────────────────────────────┤
│  Web API Layer  │  Mobile API  │  USSD Gateway │  Agent API │
├─────────────────────────────────────────────────────────────┤
│              Core Payment Processing Engine                 │
├─────────────────────────────────────────────────────────────┤
│   Risk Engine   │   KYC System   │   Notification Service  │
├─────────────────────────────────────────────────────────────┤
│              Database Cluster (MySQL/Redis)               │
├─────────────────────────────────────────────────────────────┤
│          BRAC Bank Core Banking System Integration         │
└─────────────────────────────────────────────────────────────┘

// 获取访问令牌 POST /tokenized/checkout/token/grant
Headers: { "Content-Type": "application/json", "Accept": "application/json", "username": "YOUR_USERNAME", "password": "YOUR_PASSWORD" } Body: { "app_key": "YOUR_APP_KEY", "app_secret": "YOUR_APP_SECRET" } // 响应示例 { "statusCode": "0000", "statusMessage": "Successful", "id_token": "eyJ0eXAiOiJKV1QiLCJhbGc...", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "eyJ0eXAiOiJKV1QiLCJhbGc..." }

POST /tokenized/checkout/create
Headers: { "Content-Type": "application/json", "Accept": "application/json", "authorization": "Bearer " + id_token, "x-app-key": "YOUR_APP_KEY" } Body: { "mode": "0011", // Payment mode "payerReference": "CUSTOMER_ID_123", "callbackURL": "https://yoursite.com/callback", "amount": "100.50", "currency": "BDT", "intent": "sale", "merchantInvoiceNumber": "INV_001" } // 响应示例 { "statusCode": "0000", "statusMessage": "Successful", "paymentID": "TR0011234567890", "bkashURL": "https://tokenized.pay.bka.sh/checkout?paymentID=TR0011234567890", "callbackURL": "https://yoursite.com/callback", "successCallbackURL": "https://yoursite.com/success", "failureCallbackURL": "https://yoursite.com/failure", "cancelledCallbackURL": "https://yoursite.com/cancel" }

POST /tokenized/checkout/execute
Headers: { "Content-Type": "application/json", "Accept": "application/json", "authorization": "Bearer " + id_token, "x-app-key": "YOUR_APP_KEY" } Body: { "paymentID": "TR0011234567890" } // 成功响应 { "statusCode": "0000", "statusMessage": "Successful", "paymentID": "TR0011234567890", "trxID": "8M2A59MID7", "transactionStatus": "Completed", "amount": "100.50", "currency": "BDT", "paymentExecuteTime": "2024-01-15T10:30:45", "merchantInvoiceNumber": "INV_001" }

POST /tokenized/checkout/payment/status
Headers: { "Content-Type": "application/json", "Accept": "application/json", "authorization": "Bearer " + id_token, "x-app-key": "YOUR_APP_KEY" } Body: { "paymentID": "TR0011234567890" }

<?php class BkashPayment { private $app_key; private $app_secret; private $username; private $password; private $base_url; public function __construct($config) { $this->app_key = $config['app_key']; $this->app_secret = $config['app_secret']; $this->username = $config['username']; $this->password = $config['password']; $this->base_url = $config['sandbox'] ? 'https://tokenized.sandbox.bka.sh/v1.2.0-beta' : 'https://tokenized.pay.bka.sh/v1.2.0-beta'; } // 获取Token public function getToken() { $url = $this->base_url . '/tokenized/checkout/token/grant'; $headers = [ 'Content-Type: application/json', 'Accept: application/json', 'username: ' . $this->username, 'password: ' . $this->password ]; $data = [ 'app_key' => $this->app_key, 'app_secret' => $this->app_secret ]; $response = $this->makeRequest($url, $headers, $data); return json_decode($response, true); } // 创建支付 public function createPayment($amount, $invoice_number, $customer_id = '') { $token_response = $this->getToken(); if ($token_response['statusCode'] !== '0000') { throw new Exception('Token获取失败: ' . $token_response['statusMessage']); } $url = $this->base_url . '/tokenized/checkout/create'; $headers = [ 'Content-Type: application/json', 'Accept: application/json', 'authorization: Bearer ' . $token_response['id_token'], 'x-app-key: ' . $this->app_key ]; $data = [ 'mode' => '0011', 'payerReference' => $customer_id, 'callbackURL' => 'https://yoursite.com/bkash/callback', 'amount' => strval($amount), 'currency' => 'BDT', 'intent' => 'sale', 'merchantInvoiceNumber' => $invoice_number ]; $response = $this->makeRequest($url, $headers, $data); return json_decode($response, true); } // 执行支付 public function executePayment($payment_id) { $token_response = $this->getToken(); $url = $this->base_url . '/tokenized/checkout/execute'; $headers = [ 'Content-Type: application/json', 'Accept: application/json', 'authorization: Bearer ' . $token_response['id_token'], 'x-app-key: ' . $this->app_key ]; $data = ['paymentID' => $payment_id]; $response = $this->makeRequest($url, $headers, $data); return json_decode($response, true); } // HTTP请求方法 private function makeRequest($url, $headers, $data) { $ch = curl_init(); curl_setopt_array($ch, [ CURLOPT_URL => $url, CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => json_encode($data), CURLOPT_HTTPHEADER => $headers, CURLOPT_TIMEOUT => 30, CURLOPT_SSL_VERIFYPEER => false ]); $response = curl_exec($ch); $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE); if (curl_errno($ch)) { throw new Exception('cURL错误: ' . curl_error($ch)); } curl_close($ch); if ($http_code !== 200) { throw new Exception('HTTP错误: ' . $http_code); } return $response; } } // 使用示例 $config = [ 'app_key' => 'your_app_key', 'app_secret' => 'your_app_secret', 'username' => 'your_username', 'password' => 'your_password', 'sandbox' => true // 生产环境设为false ]; $bkash = new BkashPayment($config); try { // 创建支付 $payment = $bkash->createPayment(100.00, 'INV_001', 'CUSTOMER_123'); if ($payment['statusCode'] === '0000') { // 重定向到bKash支付页面 header('Location: ' . $payment['bkashURL']); exit; } else { echo '支付创建失败: ' . $payment['statusMessage']; } } catch (Exception $e) { echo '错误: ' . $e->getMessage(); } ?>

const axios = require('axios'); class BkashPayment { constructor(config) { this.appKey = config.appKey; this.appSecret = config.appSecret; this.username = config.username; this.password = config.password; this.baseUrl = config.sandbox ? 'https://tokenized.sandbox.bka.sh/v1.2.0-beta' : 'https://tokenized.pay.bka.sh/v1.2.0-beta'; } async getToken() { try { const response = await axios.post( `${this.baseUrl}/tokenized/checkout/token/grant`, { app_key: this.appKey, app_secret: this.appSecret }, { headers: { 'Content-Type': 'application/json', 'Accept': 'application/json', 'username': this.username, 'password': this.password } } ); return response.data; } catch (error) { throw new Error(`Token获取失败: ${error.response?.data?.statusMessage || error.message}`); } } async createPayment(amount, invoiceNumber, customerId = '') { const tokenResponse = await this.getToken(); if (tokenResponse.statusCode !== '0000') { throw new Error(`Token获取失败: ${tokenResponse.statusMessage}`); } try { const response = await axios.post( `${this.baseUrl}/tokenized/checkout/create`, { mode: '0011', payerReference: customerId, callbackURL: 'https://yoursite.com/bkash/callback', amount: amount.toString(), currency: 'BDT', intent: 'sale', merchantInvoiceNumber: invoiceNumber
                }, { headers: { 'Content-Type': 'application/json', 'Accept': 'application/json', 'authorization': `Bearer ${tokenResponse.id_token}`, 'x-app-key': this.appKey } } ); return response.data; } catch (error) { throw new Error(`支付创建失败: ${error.response?.data?.statusMessage || error.message}`); } } async executePayment(paymentId) { const tokenResponse = await this.getToken(); try { const response = await axios.post( `${this.baseUrl}/tokenized/checkout/execute`, { paymentID: paymentId }, { headers: { 'Content-Type': 'application/json', 'Accept': 'application/json', 'authorization': `Bearer ${tokenResponse.id_token}`, 'x-app-key': this.appKey } } ); return response.data; } catch (error) { throw new Error(`支付执行失败: ${error.response?.data?.statusMessage || error.message}`); } } } // 使用示例 const config = { appKey: 'your_app_key', appSecret: 'your_app_secret', username: 'your_username', password: 'your_password', sandbox: true }; const bkash = new BkashPayment(config); // Express.js路由示例
app.post('/create-payment', async (req, res) => { try { const { amount, invoiceNumber, customerId } = req.body; const payment = await bkash.createPayment(amount, invoiceNumber, customerId); if (payment.statusCode === '0000') {
            res.json({ success: true, paymentUrl: payment.bkashURL, paymentId: payment.paymentID }); } else {
            res.status(400).json({ success: false, message: payment.statusMessage }); } } catch (error) {
        res.status(500).json({ success: false, message: error.message }); } });

// Token有效期管理 class TokenManager { constructor() { this.token = null; this.tokenExpiry = null; this.refreshToken = null; } isTokenValid() { return this.token && this.tokenExpiry && new Date() < new Date(this.tokenExpiry); } async getValidToken() { if (!this.isTokenValid()) { await this.refreshAccessToken(); } return this.token; } async refreshAccessToken() { // 刷新token的逻辑 if (this.refreshToken) { // 使用refresh token获取新的access token } else { // 重新获取token const tokenResponse = await this.getToken(); this.token = tokenResponse.id_token; this.tokenExpiry = new Date(Date.now() + tokenResponse.expires_in * 1000); this.refreshToken = tokenResponse.refresh_token; } } }

// HTTPS配置示例（Node.js） const https = require('https'); const fs = require('fs'); const options = { key: fs.readFileSync('private-key.pem'), cert: fs.readFileSync('certificate.pem'), // 强制使用TLS 1.2或更高版本 secureProtocol: 'TLSv1_2_method', // 禁用不安全的密码套件 ciphers: [ 'ECDHE-RSA-AES128-GCM-SHA256', 'ECDHE-RSA-AES256-GCM-SHA384', 'ECDHE-RSA-AES128-SHA256', 'ECDHE-RSA-AES256-SHA384' ].join(':'), honorCipherOrder: true };

https.createServer(options, app).listen(443, () => { console.log('HTTPS服务器运行在443端口'); });

<?php // 回调验证示例 function verifyBkashCallback($postData, $secretKey) { // 1. 验证IP白名单 $allowedIPs = ['103.106.118.10', '103.106.118.11']; // bKash服务器IP $clientIP = $_SERVER['REMOTE_ADDR']; if (!in_array($clientIP, $allowedIPs)) { return false; } // 2. 验证时间戳（防重放攻击） $timestamp = $postData['timestamp'] ?? 0; $currentTime = time(); if (abs($currentTime - $timestamp) > 300) { // 5分钟有效期 return false; } // 3. 验证签名 $expectedSignature = hash_hmac('sha256', json_encode($postData), $secretKey); $receivedSignature = $_SERVER['HTTP_X_BKASH_SIGNATURE'] ?? ''; return hash_equals($expectedSignature, $receivedSignature); } // 处理回调 if ($_SERVER['REQUEST_METHOD'] === 'POST') { $postData = json_decode(file_get_contents('php://input'), true); if (verifyBkashCallback($postData, 'your_secret_key')) { // 回调验证成功，处理业务逻辑 $paymentId = $postData['paymentID']; $trxId = $postData['trxID']; $status = $postData['transactionStatus']; // 更新订单状态 updateOrderStatus($paymentId, $status, $trxId); // 返回成功响应 http_response_code(200); echo json_encode(['status' => 'success']); } else { // 回调验证失败 http_response_code(400); echo json_encode(['status' => 'invalid']); } } ?>

// 防重放攻击实现 class ReplayProtection { constructor() { this.usedNonces = new Set(); this.cleanupInterval = setInterval(() => { this.cleanup(); }, 300000); // 每5分钟清理一次 } isValidRequest(nonce, timestamp) { // 检查时间戳 const currentTime = Math.floor(Date.now() / 1000); if (Math.abs(currentTime - timestamp) > 300) { return false; // 超过5分钟的请求拒绝 } // 检查nonce是否已使用 const nonceKey = `${nonce}_${timestamp}`; if (this.usedNonces.has(nonceKey)) { return false; // 重复请求 } // 记录nonce this.usedNonces.add(nonceKey); return true; } cleanup() { // 清理过期的nonce记录 const currentTime = Math.floor(Date.now() / 1000); const expiredTime = currentTime - 300; for (const nonceKey of this.usedNonces) { const timestamp = parseInt(nonceKey.split('_')[1]); if (timestamp < expiredTime) { this.usedNonces.delete(nonceKey); } } } }

// 自动重试机制 async function makeRequestWithRetry(apiCall, maxRetries = 3) { for (let i = 0; i < maxRetries; i++) { try { return await apiCall(); } catch (error) { if (error.response?.status === 401 && i < maxRetries - 1) { // Token过期，刷新后重试 await tokenManager.refreshAccessToken(); continue; } throw error; } } }

// 超时和重试配置 const axiosConfig = { timeout: 30000, // 30秒超时 retry: 3, retryDelay: 1000, retryCondition: (error) => { return error.code === 'ECONNABORTED' || (error.response && error.response.status >= 500); } }; // 指数退避重试 async function exponentialBackoffRetry(fn, maxRetries = 3) { for (let i = 0; i < maxRetries; i++) { try { return await fn(); } catch (error) { if (i === maxRetries - 1) throw error; const delay = Math.pow(2, i) * 1000; // 1s, 2s, 4s await new Promise(resolve => setTimeout(resolve, delay)); } } }

<?php // 定时对账任务 function reconcilePayments() { $pendingPayments = getPendingPayments(); // 获取待确认支付 foreach ($pendingPayments as $payment) { $paymentId = $payment['payment_id']; // 查询bKash支付状态 $bkashStatus = queryBkashPaymentStatus($paymentId); if ($bkashStatus['statusCode'] === '0000') { $transactionStatus = $bkashStatus['transactionStatus']; // 更新本地状态 updateLocalPaymentStatus($paymentId, $transactionStatus); // 记录对账日志 logReconciliation($paymentId, $transactionStatus); } // 避免API频率限制 sleep(1); } } // 每30分钟执行一次对账 // 在crontab中添加: */30 * * * * php /path/to/reconcile.php ?>

// 金额处理工具类 class AmountUtils { static formatAmount(amount) { // 确保金额为两位小数 return parseFloat(amount).toFixed(2); } static validateAmount(amount) { const numAmount = parseFloat(amount); // 检查是否为有效数字 if (isNaN(numAmount) || numAmount <= 0) { throw new Error('无效金额'); } // 检查最小金额限制（bKash最小支付1塔卡） if (numAmount < 1) { throw new Error('金额不能少于1塔卡'); } // 检查最大金额限制 if (numAmount > 25000) { throw new Error('单笔支付不能超过25000塔卡'); } return this.formatAmount(numAmount); } static convertToPaisa(amount) { // 将塔卡转换为派沙（1塔卡=100派沙） return Math.round(parseFloat(amount) * 100); } }

// 统一错误处理 class BkashErrorHandler { static handleError(error, context = '') { const errorInfo = { timestamp: new Date().toISOString(), context: context, error: { message: error.message, code: error.code || 'UNKNOWN', statusCode: error.response?.status, responseData: error.response?.data
            } }; // 记录错误日志 console.error('bKash API Error:', JSON.stringify(errorInfo, null, 2)); // 根据错误类型返回用户友好的错误信息 switch (error.response?.status) { case 400: return '请求参数错误，请检查支付信息'; case 401: return '认证失败，请稍后重试'; case 403: return '权限不足，请联系客服'; case 429: return '请求过于频繁，请稍后重试'; case 500: return 'bKash服务暂时不可用，请稍后重试'; default: return '支付处理失败，请稍后重试或联系客服'; } } static isRetryableError(error) { const retryableStatuses = [408, 429, 500, 502, 503, 504]; return retryableStatuses.includes(error.response?.status) ||
               error.code === 'ECONNABORTED' ||
               error.code === 'ENOTFOUND'; } }

// 支付日志记录 class PaymentLogger { static logPaymentStart(invoiceNumber, amount, customerId) { const logData = { level: 'INFO', action: 'PAYMENT_START', timestamp: new Date().toISOString(), data: {
                invoiceNumber,
                amount,
                customerId, sessionId: this.generateSessionId() } }; this.writeLog(logData); return logData.data.sessionId; } static logPaymentCreated(sessionId, paymentId, bkashUrl) { const logData = { level: 'INFO', action: 'PAYMENT_CREATED', timestamp: new Date().toISOString(),
            sessionId, data: {
                paymentId,
                bkashUrl
            } }; this.writeLog(logData); } static logPaymentCompleted(sessionId, paymentId, trxId, amount) { const logData = { level: 'INFO', action: 'PAYMENT_COMPLETED', timestamp: new Date().toISOString(),
            sessionId, data: {
                paymentId,
                trxId,
                amount, completedAt: new Date().toISOString() } }; this.writeLog(logData); } static logPaymentError(sessionId, error, context) { const logData = { level: 'ERROR', action: 'PAYMENT_ERROR', timestamp: new Date().toISOString(),
            sessionId, data: { error: error.message,
                context, stack: error.stack } }; this.writeLog(logData); } static writeLog(logData) { // 写入日志文件或发送到日志服务 console.log(JSON.stringify(logData)); // 生产环境中建议使用专业的日志服务 // 如 Winston, Bunyan 或云端日志服务 } static generateSessionId() { return 'PAY_' + Date.now() + '_' + Math.random().toString(36).substr(2, 9); } }

// 连接池管理 const https = require('https'); const agent = new https.Agent({ keepAlive: true, keepAliveMsecs: 30000, maxSockets: 50, maxFreeSockets: 10, timeout: 30000 }); // API请求优化 class OptimizedBkashClient { constructor(config) { this.config = config; this.tokenCache = null; this.tokenExpiry = null; // 创建优化的axios实例 this.httpClient = axios.create({ httpsAgent: agent, timeout: 30000, headers: { 'Connection': 'keep-alive', 'Accept-Encoding': 'gzip, deflate' } }); // 添加请求拦截器 this.httpClient.interceptors.request.use(this.requestInterceptor.bind(this)); this.httpClient.interceptors.response.use( this.responseInterceptor.bind(this), this.errorInterceptor.bind(this) ); } requestInterceptor(config) { // 添加请求追踪ID
        config.headers['X-Request-ID'] = this.generateRequestId(); // 记录请求开始时间
        config.metadata = { startTime: Date.now() }; return config; } responseInterceptor(response) { // 计算响应时间 const duration = Date.now() - response.config.metadata.startTime; console.log(`API请求耗时: ${duration}ms`); return response; } errorInterceptor(error) { if (error.config) { const duration = Date.now() - error.config.metadata.startTime; console.error(`API请求失败，耗时: ${duration}ms`); } return Promise.reject(error); } generateRequestId() { return 'req_' + Date.now() + '_' + Math.random().toString(36).substr(2, 8); } }

// Redis缓存实现 const redis = require('redis'); const client = redis.createClient({ host: 'localhost', port: 6379, db: 0 }); class BkashCache { static async cacheToken(token, expiresIn) { const key = 'bkash:token'; const ttl = expiresIn - 60; // 提前1分钟过期，确保安全 await client.setex(key, ttl, JSON.stringify(token)); } static async getToken() { const key = 'bkash:token'; const cached = await client.get(key); return cached ? JSON.parse(cached) : null; } static async cachePaymentStatus(paymentId, status, ttl = 300) { const key = `bkash:payment:${paymentId}`; await client.setex(key, ttl, JSON.stringify(status)); } static async getPaymentStatus(paymentId) { const key = `bkash:payment:${paymentId}`; const cached = await client.get(key); return cached ? JSON.parse(cached) : null; } static async invalidatePaymentCache(paymentId) { const key = `bkash:payment:${paymentId}`; await client.del(key); } }

// 监控指标收集 class PaymentMetrics { constructor() { this.metrics = { totalPayments: 0, successfulPayments: 0, failedPayments: 0, averageResponseTime: 0, errorRates: {}, lastReset: Date.now() }; } recordPaymentAttempt() { this.metrics.totalPayments++; } recordPaymentSuccess(responseTime) { this.metrics.successfulPayments++; this.updateAverageResponseTime(responseTime); } recordPaymentFailure(errorCode) { this.metrics.failedPayments++; this.metrics.errorRates[errorCode] = (this.metrics.errorRates[errorCode] || 0) + 1; // 检查是否需要发送告警 this.checkAlerts(); } updateAverageResponseTime(responseTime) { const total = this.metrics.successfulPayments; const current = this.metrics.averageResponseTime; this.metrics.averageResponseTime = ((current * (total - 1)) + responseTime) / total; } checkAlerts() { const failureRate = this.getFailureRate(); // 失败率超过10%时发送告警 if (failureRate > 0.1) { this.sendAlert({ type: 'HIGH_FAILURE_RATE', rate: failureRate, message: `bKash支付失败率过高: ${(failureRate * 100).toFixed(2)}%` }); } // 响应时间超过5秒时发送告警 if (this.metrics.averageResponseTime > 5000) { this.sendAlert({ type: 'SLOW_RESPONSE', responseTime: this.metrics.averageResponseTime, message: `bKash API响应时间过慢: ${this.metrics.averageResponseTime}ms` }); } } getFailureRate() { const total = this.metrics.totalPayments; return total > 0 ? this.metrics.failedPayments / total : 0; } getSuccessRate() { const total = this.metrics.totalPayments; return total > 0 ? this.metrics.successfulPayments / total : 0; } sendAlert(alert) { // 发送告警到监控系统或通知渠道 console.error('🚨 bKash支付告警:', alert); // 可以集成钉钉、微信、邮件等通知方式 // this.sendDingTalkAlert(alert); // this.sendEmailAlert(alert); } getMetrics() { return { ...this.metrics, successRate: this.getSuccessRate(), failureRate: this.getFailureRate(), uptime: Date.now() - this.metrics.lastReset }; } reset() { this.metrics = { totalPayments: 0, successfulPayments: 0, failedPayments: 0, averageResponseTime: 0, errorRates: {}, lastReset: Date.now() }; } } // 全局监控实例 const paymentMetrics = new PaymentMetrics(); // 定期重置统计（每小时） setInterval(() => { console.log('当前支付指标:', paymentMetrics.getMetrics());
    paymentMetrics.reset(); }, 3600000);

-- 支付记录表 CREATE TABLE bkash_payments (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    invoice_number VARCHAR(50) NOT NULL UNIQUE,
    payment_id VARCHAR(50) UNIQUE,
    trx_id VARCHAR(20),
    customer_id VARCHAR(50),
    amount DECIMAL(10,2) NOT NULL,
    currency VARCHAR(3) DEFAULT 'BDT', status ENUM('PENDING', 'CREATED', 'COMPLETED', 'FAILED', 'CANCELLED') DEFAULT 'PENDING',
    bkash_url TEXT,
    callback_data JSON,
    error_message TEXT,
    session_id VARCHAR(50),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    completed_at TIMESTAMP NULL, INDEX idx_invoice_number (invoice_number), INDEX idx_payment_id (payment_id), INDEX idx_trx_id (trx_id), INDEX idx_customer_id (customer_id), INDEX idx_status (status), INDEX idx_created_at (created_at) ); -- 支付日志表 CREATE TABLE bkash_payment_logs (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    payment_id VARCHAR(50),
    session_id VARCHAR(50), action VARCHAR(50) NOT NULL, level ENUM('INFO', 'WARN', 'ERROR') DEFAULT 'INFO',
    message TEXT,
    request_data JSON,
    response_data JSON,
    error_data JSON,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP, INDEX idx_payment_id (payment_id), INDEX idx_session_id (session_id), INDEX idx_action (action), INDEX idx_level (level), INDEX idx_created_at (created_at) ); -- 对账记录表 CREATE TABLE bkash_reconciliation (
    id BIGINT PRIMARY KEY AUTO_INCREMENT,
    payment_id VARCHAR(50),
    local_status VARCHAR(20),
    bkash_status VARCHAR(20),
    is_matched BOOLEAN DEFAULT FALSE,
    discrepancy_reason TEXT,
    reconciled_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP, INDEX idx_payment_id (payment_id), INDEX idx_is_matched (is_matched), INDEX idx_reconciled_at (reconciled_at) );

# Dockerfile FROM node:16-alpine WORKDIR /app # 复制package文件 COPY package*.json ./ # 安装依赖 RUN npm ci --only=production # 复制源码 COPY . . # 创建非root用户 RUN addgroup -g 1001 -S nodejs && \     adduser -S nextjs -u 1001 # 设置权限 RUN chown -R nextjs:nodejs /app USER nextjs # 暴露端口 EXPOSE 3000 # 健康检查 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ CMD curl -f http://localhost:3000/health || exit 1 # 启动应用 CMD ["npm", "start"]

version: '3.8' services: bkash-payment-api: build: .
    ports: - "3000:3000" environment: - NODE_ENV=production
      - BKASH_APP_KEY=${BKASH_APP_KEY} - BKASH_APP_SECRET=${BKASH_APP_SECRET} - BKASH_USERNAME=${BKASH_USERNAME} - BKASH_PASSWORD=${BKASH_PASSWORD} - REDIS_URL=redis://redis:6379 - DB_HOST=mysql
      - DB_USER=${DB_USER} - DB_PASSWORD=${DB_PASSWORD} - DB_NAME=${DB_NAME} depends_on: - redis
      - mysql
    restart: unless-stopped
    
  redis: image: redis:7-alpine
    ports: - "6379:6379" volumes: - redis_data:/data
    restart: unless-stopped
    
  mysql: image: mysql:8.0 ports: - "3306:3306" environment: - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD} - MYSQL_DATABASE=${DB_NAME} - MYSQL_USER=${DB_USER} - MYSQL_PASSWORD=${DB_PASSWORD} volumes: - mysql_data:/var/lib/mysql
    restart: unless-stopped

volumes: redis_data:
  mysql_data:

# /etc/nginx/sites-available/bkash-payment server { listen 80; server_name your-domain.com; # 重定向到HTTPS return 301 https://$server_name$request_uri; } server { listen 443 ssl http2; server_name your-domain.com; # SSL配置 ssl_certificate /path/to/certificate.crt; ssl_certificate_key /path/to/private.key; ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; # 安全头 add_header X-Frame-Options DENY; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; # API路由 location /api/ { proxy_pass http://localhost:3000/; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_cache_bypass $http_upgrade; # 超时设置 proxy_connect_timeout 30s; proxy_send_timeout 30s; proxy_read_timeout 30s; } # 健康检查 location /health { proxy_pass http://localhost:3000/health; access_log off; } # 限流配置 location /api/payment/ { limit_req zone=payment burst=10 nodelay; proxy_pass http://localhost:3000/api/payment/; } } # 限流配置 http { limit_req_zone $binary_remote_addr zone=payment:10m rate=30r/m; }