。

现在我来生成完整的服务端代码。根据文档，我需要：

1. SM3 with salt 签名（文档中用的是 `SmUtil.sm3WithSalt(sm3Salt.getBytes()).digestHex(timestamp+encryptedData)`）
2. SM4-ECB 加密/解密
3. 4个接口

注意：文档中的签名规则是 SM3 with salt，不是 HMAC-SM3。Java的 `SmUtil.sm3WithSalt(salt)` 实现的是 SM3 加盐哈希，需要特殊处理。

让我生成所有文件：

// File: xy_sh/go.mod
```go
module xy_sh

go 1.26

require (
	github.com/gofiber/fiber/v2 v2.52.5
	github.com/tjfoc/gmsm v1.4.1
)
```

// File: xy_sh/Dockerfile
```dockerfile
FROM golang:1.26-alpine AS builder

WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /server ./cmd/server

FROM alpine:3.19
RUN apk --no-cache add ca-certificates tzdata
WORKDIR /app
COPY --from=builder /server .
EXPOSE 8080
CMD ["./server"]
```

// File: xy_sh/cmd/server/main.go
```go
package main

import (
	"log"
	"xy_sh/internal/config"
	"xy_sh/internal/middleware"
	"xy_sh/internal/service"

	"github.com/gofiber/fiber/v2"
)

func main() {
	cfg := config.Load()

	app := fiber.New(fiber.Config{
		ReadTimeout:  cfg.ReadTimeout,
		WriteTimeout: cfg.WriteTimeout,
	})

	// 全局中间件
	app.Use(middleware.CORS())
	app.Use(middleware.RequestLogger())

	// 注册路由
	service.RegisterRoutes(app, cfg)

	log.Printf("服务启动，监听端口: %s", cfg.ServerPort)
	if err := app.Listen(":" + cfg.ServerPort); err != nil {
		log.Fatalf("服务启动失败: %v", err)
	}
}
```

// File: xy_sh/internal/config/config.go
```go
package config

import (
	"os"
	"time"
)

type Config struct {
	ServerPort    string
	ReadTimeout   time.Duration
	WriteTimeout  time.Duration
	SM3Salt       string
	SM4Key        []byte
	CallbackURL   string
}

func Load() *Config {
	sm4KeyStr := getEnv("SM4_KEY", "1234567890abcdef")
	return &Config{
		ServerPort:   getEnv("SERVER_PORT", "8080"),
		ReadTimeout:  10 * time.Second,
		WriteTimeout: 10 * time.Second,
		SM3Salt:      getEnv("SM3_SALT", "default_salt"),
		SM4Key:       []byte(sm4KeyStr),
		CallbackURL:  getEnv("CALLBACK_URL", ""),
	}
}

func getEnv(key, defaultValue string) string {
	if v := os.Getenv(key); v != "" {
		return v
	}
	return defaultValue
}
```

// File: xy_sh/internal/entities/request.go
```go
package entities

// 下单请求业务参数
type OrderCreateBizReq struct {
	ActCode      string `json:"actCode"`
	GoodsCode    string `json:"goodsCode"`
	ActOrderNum  string `json:"actOrderNum"`
	Account      string `json:"account,omitempty"`
	CallbackURL  string `json:"callbackUrl,omitempty"`
}

// 订单查询请求业务参数
type OrderQueryBizReq struct {
	ActCode string `json:"actCode"`
	OrderNo string `json:"orderNo"`
}

// 微信立减金充值请求业务参数
type WechatRechargeBizReq struct {
	ActCode      string `json:"actCode"`
	OrderNo      string `json:"orderNo"`
	GoodsCode    string `json:"goodsCode"`
	ActOrderNum  string `json:"actOrderNum"`
	AppId        string `json:"appId"`
	OpenId       string `json:"openId"`
	CallbackURL  string `json:"callbackUrl,omitempty"`
}

// 回调通知请求业务参数
type CallbackNotifyBizReq struct {
	OrderNo     string         `json:"orderNo"`
	ActOrderNum string         `json:"actOrderNum"`
	Status      int            `json:"status"`
	Account     string         `json:"account,omitempty"`
	CardInfo    *CardInfo      `json:"cardInfo,omitempty"`
	CouponId    string         `json:"couponId,omitempty"`
}

type CardInfo struct {
	CouponNo   string `json:"couponNo"`
	CouponCode string `json:"couponCode"`
	ExpireTime string `json:"expireTime"`
}
```

// File: xy_sh/internal/entities/response.go
```go
package entities

// 通用响应结构
type ApiResponse struct {
	Code int         `json:"code"`
	Msg  string      `json:"msg"`
	Data interface{} `json:"data"`
}

// 下单响应业务参数
type OrderCreateBizResp struct {
	OrderNo    string `json:"orderNo"`
	CouponNo   string `json:"couponNo,omitempty"`
	CouponCode string `json:"couponCode,omitempty"`
	Status     int    `json:"status"`
	ExpireTime string `json:"expireTime,omitempty"`
}

// 订单查询响应业务参数
type OrderQueryBizResp struct {
	OrderNo  string     `json:"orderNo"`
	Status   int        `json:"status"`
	Account  string     `json:"account,omitempty"`
	CardInfo *CardInfo  `json:"cardInfo,omitempty"`
	CouponId string     `json:"couponId,omitempty"`
}

// 微信立减金充值响应业务参数
type WechatRechargeBizResp struct {
	OrderNo  string `json:"orderNo"`
	Status   int    `json:"status"`
	CouponId string `json:"couponId,omitempty"`
}
```

// File: xy_sh/internal/middleware/middleware.go
```go
package middleware

import (
	"log"
	"time"

	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/cors"
)

// CORS 跨域中间件
func CORS() fiber.Handler {
	return cors.New(cors.Config{
		AllowOrigins: "*",
		AllowMethods: "GET,POST,PUT,DELETE,OPTIONS",
		AllowHeaders: "Origin,Content-Type,Accept,timestamp,sign",
	})
}

// RequestLogger 请求日志中间件
func RequestLogger() fiber.Handler {
	return func(c *fiber.Ctx) error {
		start := time.Now()
		err := c.Next()
		duration := time.Since(start)
		log.Printf("[%s] %s %s - %d (%v)",
			c.Method(),
			c.Path(),
			c.IP(),
			c.Response().StatusCode(),
			duration,
		)
		return err
	}
}
```

// File: xy_sh/internal/biz/biz.go
```go
package biz

import (
	"xy_sh/internal/entities"
)

// Biz 业务逻辑接口
type Biz interface {
	// 卡券/直充权益下单
	CreateOrder(req *entities.OrderCreateBizReq) (*entities.OrderCreateBizResp, error)
	// 卡券/直充/微信立减金订单查询
	QueryOrder(req *entities.OrderQueryBizReq) (*entities.OrderQueryBizResp, error)
	// 微信立减金订单充值
	WechatRecharge(req *entities.WechatRechargeBizReq) (*entities.WechatRechargeBizResp, error)
	// 处理回调通知
	ProcessCallback(req *entities.CallbackNotifyBizReq) error
}

type bizImpl struct{}

func NewBiz() Biz {
	return &bizImpl{}
}

func (b *bizImpl) CreateOrder(req *entities.OrderCreateBizReq) (*entities.OrderCreateBizResp, error) {
	// TODO: 实现下单业务逻辑
	return &entities.OrderCreateBizResp{
		OrderNo:    "HM" + generateOrderNo(),
		Status:     -1,
	}, nil
}

func (b *bizImpl) QueryOrder(req *entities.OrderQueryBizReq) (*entities.OrderQueryBizResp, error) {
	// TODO: 实现订单查询业务逻辑
	return &entities.OrderQueryBizResp{
		OrderNo: req.OrderNo,
		Status:  0,
	}, nil
}

func (b *bizImpl) WechatRecharge(req *entities.WechatRechargeBizReq) (*entities.WechatRechargeBizResp, error) {
	// TODO: 实现微信立减金充值业务逻辑
	return &entities.WechatRechargeBizResp{
		OrderNo: req.OrderNo,
		Status:  -1,
	}, nil
}

func (b *bizImpl) ProcessCallback(req *entities.CallbackNotifyBizReq) error {
	// TODO: 处理回调通知业务逻辑
	return nil
}

func generateOrderNo() string {
	return "ORDERNO"
}
```

// File: xy_sh/internal/service/service.go
```go
package service

import (
	"encoding/json"
	"log"

	"xy_sh/internal/biz"
	"xy_sh/internal/config"
	"xy_sh/internal/entities"
	"xy_sh/pkg/crypto"

	"github.com/gofiber/fiber/v2"
)

// RegisterRoutes 注册路由
func RegisterRoutes(app *fiber.App, cfg *config.Config) {
	b := biz.NewBiz()

	// 接口1：卡券/直充权益下单
	app.Post("/api/order/create", handleWithDecrypt(cfg, b, func(reqBytes []byte) (interface{}, error) {
		var bizReq entities.OrderCreateBizReq
		if err := json.Unmarshal(reqBytes, &bizReq); err != nil {
			return nil, err
		}
		return b.CreateOrder(&bizReq)
	}))

	// 接口2：卡券/直充/微信立减金订单查询
	app.Post("/api/order/query", handleWithDecrypt(cfg, b, func(reqBytes []byte) (interface{}, error) {
		var bizReq entities.OrderQueryBizReq
		if err := json.Unmarshal(reqBytes, &bizReq); err != nil {
			return nil, err
		}
		return b.QueryOrder(&bizReq)
	}))

	// 接口3：微信立减金订单充值
	app.Post("/api/order/recharge", handleWithDecrypt(cfg, b, func(reqBytes []byte) (interface{}, error) {
		var bizReq entities.WechatRechargeBizReq
		if err := json.Unmarshal(reqBytes, &bizReq); err != nil {
			return nil, err
		}
		return b.WechatRecharge(&bizReq)
	}))

	// 接口4：卡券/直充/微信立减金充值结果通知接口（接收回调）
	app.Post("/api/callback/notify", handleCallback(cfg, b))
}

// handleWithDecrypt 通用处理：验证签名 -> 解密 -> 执行业务 -> 加密响应
func handleWithDecrypt(cfg *config.Config, b biz.Biz, handler func([]byte) (interface{}, error)) fiber.Handler {
	return func(c *fiber.Ctx) error {
		// 1. 验证签名
		timestamp := c.Get("timestamp")
		sign := c.Get("sign")
		if timestamp == "" || sign == "" {
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "缺少timestamp或sign",
			})
		}

		// 2. 获取加密数据
		var reqBody struct {
			EncryptedData string `json:"encryptedData"`
		}
		if err := c.BodyParser(&reqBody); err != nil {
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "请求体解析失败",
			})
		}

		// 3. 验证SM3签名
		expectedSign := crypto.SM3WithSalt(cfg.SM3Salt, timestamp+reqBody.EncryptedData)
		if expectedSign != sign {
			log.Printf("签名验证失败: expected=%s, got=%s", expectedSign, sign)
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "签名验证失败",
			})
		}

		// 4. SM4解密业务数据
		bizData, err := crypto.SM4ECBDecrypt(reqBody.EncryptedData, cfg.SM4Key)
		if err != nil {
			log.Printf("SM4解密失败: %v", err)
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "数据解密失败",
			})
		}

		// 5. 执行业务逻辑
		result, err := handler(bizData)
		if err != nil {
			log.Printf("业务处理失败: %v", err)
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  err.Error(),
			})
		}

		// 6. 加密响应数据
		respBytes, err := json.Marshal(result)
		if err != nil {
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "响应序列化失败",
			})
		}

		encryptedResp, err := crypto.SM4ECBEncrypt(respBytes, cfg.SM4Key)
		if err != nil {
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "响应加密失败",
			})
		}

		return c.JSON(entities.ApiResponse{
			Code: 0,
			Msg:  "请求成功",
			Data: encryptedResp,
		})
	}
}

// handleCallback 处理回调通知
func handleCallback(cfg *config.Config, b biz.Biz) fiber.Handler {
	return func(c *fiber.Ctx) error {
		// 1. 验证签名
		timestamp := c.Get("timestamp")
		sign := c.Get("sign")
		if timestamp == "" || sign == "" {
			return c.Status(400).SendString("missing auth headers")
		}

		// 2. 获取加密数据
		var reqBody struct {
			EncryptedData string `json:"encryptedData"`
		}
		if err := c.BodyParser(&reqBody); err != nil {
			return c.Status(400).SendString("invalid body")
		}

		// 3. 验证SM3签名
		expectedSign := crypto.SM3WithSalt(cfg.SM3Salt, timestamp+reqBody.EncryptedData)
		if expectedSign != sign {
			log.Printf("回调签名验证失败: expected=%s, got=%s", expectedSign, sign)
			return c.Status(400).SendString("sign verification failed")
		}

		// 4. SM4解密业务数据
		bizData, err := crypto.SM4ECBDecrypt(reqBody.EncryptedData, cfg.SM4Key)
		if err != nil {
			log.Printf("回调数据SM4解密失败: %v", err)
			return c.Status(400).SendString("decrypt failed")
		}

		// 5. 解析回调业务参数
		var callbackReq entities.CallbackNotifyBizReq
		if err := json.Unmarshal(bizData, &callbackReq); err != nil {
			log.Printf("回调数据解析失败: %v", err)
			return c.Status(400).SendString("parse failed")
		}

		// 6. 处理回调业务
		if err := b.ProcessCallback(&callbackReq); err != nil {
			log.Printf("回调处理失败: %v", err)
			return c.Status(500).SendString("process failed")
		}

		// 7. 返回成功（必须返回200且内容为ok）
		return c.Status(200).SendString("ok")
	}
}
```

// File: xy_sh/pkg/crypto/crypto.go
```go
package crypto

import (
	"encoding/base64"
	"encoding/hex"
	"fmt"
	"time"

	"github.com/tjfoc/gmsm/sm3"
	"github.com/tjfoc/gmsm/sm4"
)

// ==================== SM3 with Salt ====================

// SM3WithSalt 使用SM3加盐哈希（对应Java的 SmUtil.sm3WithSalt(salt).digestHex(data)）
// 实现方式：SM3(salt + data) 或 SM3(data + salt)，具体取决于Java hutool实现
// hutool的sm3WithSalt实现为：SM3(salt + data)
func SM3WithSalt(salt string, data string) string {
	h := sm3.New()
	h.Write([]byte(salt))
	h.Write([]byte(data))
	return hex.EncodeToString(h.Sum(nil))
}

// ==================== SM4-ECB 加密/解密 ====================

// SM4ECBEncrypt SM4-ECB模式加密，返回base64编码字符串
func SM4ECBEncrypt(plaintext []byte, key []byte) (string, error) {
	if len(key) != 16 {
		return "", fmt.Errorf("SM4密钥长度必须为16字节")
	}

	block, err := sm4.NewCipher(key)
	if err != nil {
		return "", fmt.Errorf("创建SM4 cipher失败: %v", err)
	}

	padded := pkcs7Padding(plaintext, block.BlockSize())
	ciphertext := make([]byte, len(padded))
	for i := 0; i < len(padded); i += block.BlockSize() {
		block.Encrypt(ciphertext[i:i+block.BlockSize()], padded[i:i+block.BlockSize()])
	}

	return base64.StdEncoding.EncodeToString(ciphertext), nil
}

// SM4ECBDecrypt SM4-ECB模式解密，输入base64编码字符串，返回明文
func SM4ECBDecrypt(encryptedData string, key []byte) ([]byte, error) {
	if len(key) != 16 {
		return nil, fmt.Errorf("SM4密钥长度必须为16字节")
	}

	ciphertext, err := base64.StdEncoding.DecodeString(encryptedData)
	if err != nil {
		return nil, fmt.Errorf("base64解码失败: %v", err)
	}

	block, err := sm4.NewCipher(key)
	if err != nil {
		return nil, fmt.Errorf("创建SM4 cipher失败: %v", err)
	}

	blockSize := block.BlockSize()
	if len(ciphertext)%blockSize != 0 {
		return nil, fmt.Errorf("密文长度不是块大小的整数倍")
	}

	plaintext := make([]byte, len(ciphertext))
	for i := 0; i < len(ciphertext); i += blockSize {
		block.Decrypt(plaintext[i:i+blockSize], ciphertext[i:i+blockSize])
	}

	plaintext, err = pkcs7UnPadding(plaintext)
	if err != nil {
		return nil, fmt.Errorf("去除填充失败: %v", err)
	}

	return plaintext, nil
}

// ==================== PKCS7 填充 ====================

func pkcs7Padding(data []byte, blockSize int) []byte {
	padding := blockSize - len(data)%blockSize
	padText := make([]byte, padding)
	for i := range padText {
		padText[i] = byte(padding)
	}
	return append(data, padText...)
}

func pkcs7UnPadding(data []byte) ([]byte, error) {
	if len(data) == 0 {
		return nil, fmt.Errorf("数据为空")
	}
	padding := int(data[len(data)-1])
	if padding > len(data) || padding == 0 {
		return nil, fmt.Errorf("无效的填充")
	}
	for i := len(data) - padding; i < len(data); i++ {
		if int(data[i]) != padding {
			return nil, fmt.Errorf("无效的填充")
		}
	}
	return data[:len(data)-padding], nil
}

// ==================== 时间戳工具 ====================

// GenerateTimestampMillis 生成毫秒级时间戳
func GenerateTimestampMillis() string {
	return fmt.Sprintf("%d", time.Now().UnixMilli())
}
```

现在让我检查一下，biz接口的引用在service.go中需要修正，biz.Biz需要小写biz。

实际上，在service.go中我使用了 `biz.Biz` 作为参数类型，但biz包中定义的是 `Biz` 接口，所以应该是 `biz.Biz`。让我检查一下代码的一致性。

在service.go中，`handleWithDecrypt` 函数的参数类型是 `biz.Biz`，这是正确的。

让我重新整理所有文件，确保它们完整且一致。

实际上，我注意到在service.go中，`handleWithDecrypt` 的第二个参数类型写的是 `biz.Biz`，但biz包中接口名是 `Biz`，所以 `biz.Biz` 是正确的。

让我重新输出所有文件：</think>现在我来生成完整的服务端代码。

// File: xy_sh/go.mod
```go
module xy_sh

go 1.26

require (
	github.com/gofiber/fiber/v2 v2.52.5
	github.com/tjfoc/gmsm v1.4.1
)
```

// File: xy_sh/Dockerfile
```dockerfile
FROM golang:1.26-alpine AS builder

WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /server ./cmd/server

FROM alpine:3.19
RUN apk --no-cache add ca-certificates tzdata
WORKDIR /app
COPY --from=builder /server .
EXPOSE 8080
CMD ["./server"]
```

// File: xy_sh/cmd/server/main.go
```go
package main

import (
	"log"
	"xy_sh/internal/config"
	"xy_sh/internal/middleware"
	"xy_sh/internal/service"

	"github.com/gofiber/fiber/v2"
)

func main() {
	cfg := config.Load()

	app := fiber.New(fiber.Config{
		ReadTimeout:  cfg.ReadTimeout,
		WriteTimeout: cfg.WriteTimeout,
	})

	// 全局中间件
	app.Use(middleware.CORS())
	app.Use(middleware.RequestLogger())

	// 注册路由
	service.RegisterRoutes(app, cfg)

	log.Printf("服务启动，监听端口: %s", cfg.ServerPort)
	if err := app.Listen(":" + cfg.ServerPort); err != nil {
		log.Fatalf("服务启动失败: %v", err)
	}
}
```

// File: xy_sh/internal/config/config.go
```go
package config

import (
	"os"
	"time"
)

// Config 应用配置
type Config struct {
	ServerPort   string
	ReadTimeout  time.Duration
	WriteTimeout time.Duration
	SM3Salt      string
	SM4Key       []byte
	CallbackURL  string
}

// Load 加载配置，优先从环境变量读取
func Load() *Config {
	sm4KeyStr := getEnv("SM4_KEY", "1234567890abcdef")
	return &Config{
		ServerPort:   getEnv("SERVER_PORT", "8080"),
		ReadTimeout:  10 * time.Second,
		WriteTimeout: 10 * time.Second,
		SM3Salt:      getEnv("SM3_SALT", "default_salt"),
		SM4Key:       []byte(sm4KeyStr),
		CallbackURL:  getEnv("CALLBACK_URL", ""),
	}
}

func getEnv(key, defaultValue string) string {
	if v := os.Getenv(key); v != "" {
		return v
	}
	return defaultValue
}
```

// File: xy_sh/internal/entities/request.go
```go
package entities

// OrderCreateBizReq 卡券/直充权益下单请求业务参数
type OrderCreateBizReq struct {
	ActCode     string `json:"actCode"`
	GoodsCode   string `json:"goodsCode"`
	ActOrderNum string `json:"actOrderNum"`
	Account     string `json:"account,omitempty"`
	CallbackURL string `json:"callbackUrl,omitempty"`
}

// OrderQueryBizReq 卡券/直充/微信立减金订单查询请求业务参数
type OrderQueryBizReq struct {
	ActCode string `json:"actCode"`
	OrderNo string `json:"orderNo"`
}

// WechatRechargeBizReq 微信立减金订单充值请求业务参数
type WechatRechargeBizReq struct {
	ActCode     string `json:"actCode"`
	OrderNo     string `json:"orderNo"`
	GoodsCode   string `json:"goodsCode"`
	ActOrderNum string `json:"actOrderNum"`
	AppId       string `json:"appId"`
	OpenId      string `json:"openId"`
	CallbackURL string `json:"callbackUrl,omitempty"`
}

// CallbackNotifyBizReq 回调通知请求业务参数
type CallbackNotifyBizReq struct {
	OrderNo     string    `json:"orderNo"`
	ActOrderNum string    `json:"actOrderNum"`
	Status      int       `json:"status"`
	Account     string    `json:"account,omitempty"`
	CardInfo    *CardInfo `json:"cardInfo,omitempty"`
	CouponId    string    `json:"couponId,omitempty"`
}

// CardInfo 卡券信息
type CardInfo struct {
	CouponNo   string `json:"couponNo"`
	CouponCode string `json:"couponCode"`
	ExpireTime string `json:"expireTime"`
}
```

// File: xy_sh/internal/entities/response.go
```go
package entities

// ApiResponse 通用API响应结构
type ApiResponse struct {
	Code int         `json:"code"`
	Msg  string      `json:"msg"`
	Data interface{} `json:"data"`
}

// OrderCreateBizResp 下单响应业务参数
type OrderCreateBizResp struct {
	OrderNo    string `json:"orderNo"`
	CouponNo   string `json:"couponNo,omitempty"`
	CouponCode string `json:"couponCode,omitempty"`
	Status     int    `json:"status"`
	ExpireTime string `json:"expireTime,omitempty"`
}

// OrderQueryBizResp 订单查询响应业务参数
type OrderQueryBizResp struct {
	OrderNo  string     `json:"orderNo"`
	Status   int        `json:"status"`
	Account  string     `json:"account,omitempty"`
	CardInfo *CardInfo  `json:"cardInfo,omitempty"`
	CouponId string     `json:"couponId,omitempty"`
}

// WechatRechargeBizResp 微信立减金充值响应业务参数
type WechatRechargeBizResp struct {
	OrderNo  string `json:"orderNo"`
	Status   int    `json:"status"`
	CouponId string `json:"couponId,omitempty"`
}
```

// File: xy_sh/internal/middleware/middleware.go
```go
package middleware

import (
	"log"
	"time"

	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/cors"
)

// CORS 跨域中间件
func CORS() fiber.Handler {
	return cors.New(cors.Config{
		AllowOrigins: "*",
		AllowMethods: "GET,POST,PUT,DELETE,OPTIONS",
		AllowHeaders: "Origin,Content-Type,Accept,timestamp,sign",
	})
}

// RequestLogger 请求日志中间件
func RequestLogger() fiber.Handler {
	return func(c *fiber.Ctx) error {
		start := time.Now()
		err := c.Next()
		duration := time.Since(start)
		log.Printf("[%s] %s %s - %d (%v)",
			c.Method(),
			c.Path(),
			c.IP(),
			c.Response().StatusCode(),
			duration,
		)
		return err
	}
}
```

// File: xy_sh/internal/biz/biz.go
```go
package biz

import (
	"xy_sh/internal/entities"
)

// Biz 业务逻辑接口
type Biz interface {
	// CreateOrder 卡券/直充权益下单
	CreateOrder(req *entities.OrderCreateBizReq) (*entities.OrderCreateBizResp, error)
	// QueryOrder 卡券/直充/微信立减金订单查询
	QueryOrder(req *entities.OrderQueryBizReq) (*entities.OrderQueryBizResp, error)
	// WechatRecharge 微信立减金订单充值
	WechatRecharge(req *entities.WechatRechargeBizReq) (*entities.WechatRechargeBizResp, error)
	// ProcessCallback 处理回调通知
	ProcessCallback(req *entities.CallbackNotifyBizReq) error
}

type bizImpl struct{}

// NewBiz 创建业务逻辑实例
func NewBiz() Biz {
	return &bizImpl{}
}

func (b *bizImpl) CreateOrder(req *entities.OrderCreateBizReq) (*entities.OrderCreateBizResp, error) {
	// TODO: 实现下单业务逻辑
	return &entities.OrderCreateBizResp{
		OrderNo: "HM" + generateOrderNo(),
		Status:  -1,
	}, nil
}

func (b *bizImpl) QueryOrder(req *entities.OrderQueryBizReq) (*entities.OrderQueryBizResp, error) {
	// TODO: 实现订单查询业务逻辑
	return &entities.OrderQueryBizResp{
		OrderNo: req.OrderNo,
		Status:  0,
	}, nil
}

func (b *bizImpl) WechatRecharge(req *entities.WechatRechargeBizReq) (*entities.WechatRechargeBizResp, error) {
	// TODO: 实现微信立减金充值业务逻辑
	return &entities.WechatRechargeBizResp{
		OrderNo: req.OrderNo,
		Status:  -1,
	}, nil
}

func (b *bizImpl) ProcessCallback(req *entities.CallbackNotifyBizReq) error {
	// TODO: 处理回调通知业务逻辑
	return nil
}

func generateOrderNo() string {
	return "ORDERNO"
}
```

// File: xy_sh/internal/service/service.go
```go
package service

import (
	"encoding/json"
	"log"

	"xy_sh/internal/biz"
	"xy_sh/internal/config"
	"xy_sh/internal/entities"
	"xy_sh/pkg/crypto"

	"github.com/gofiber/fiber/v2"
)

// RegisterRoutes 注册所有路由
func RegisterRoutes(app *fiber.App, cfg *config.Config) {
	b := biz.NewBiz()

	// 接口1：卡券/直充权益下单
	app.Post("/api/order/create", handleWithDecrypt(cfg, b, func(reqBytes []byte) (interface{}, error) {
		var bizReq entities.OrderCreateBizReq
		if err := json.Unmarshal(reqBytes, &bizReq); err != nil {
			return nil, err
		}
		return b.CreateOrder(&bizReq)
	}))

	// 接口2：卡券/直充/微信立减金订单查询
	app.Post("/api/order/query", handleWithDecrypt(cfg, b, func(reqBytes []byte) (interface{}, error) {
		var bizReq entities.OrderQueryBizReq
		if err := json.Unmarshal(reqBytes, &bizReq); err != nil {
			return nil, err
		}
		return b.QueryOrder(&bizReq)
	}))

	// 接口3：微信立减金订单充值
	app.Post("/api/order/recharge", handleWithDecrypt(cfg, b, func(reqBytes []byte) (interface{}, error) {
		var bizReq entities.WechatRechargeBizReq
		if err := json.Unmarshal(reqBytes, &bizReq); err != nil {
			return nil, err
		}
		return b.WechatRecharge(&bizReq)
	}))

	// 接口4：卡券/直充/微信立减金充值结果通知接口（接收供应商回调）
	app.Post("/api/callback/notify", handleCallback(cfg, b))
}

// handleWithDecrypt 通用处理：验证签名 -> 解密 -> 执行业务 -> 加密响应
func handleWithDecrypt(cfg *config.Config, b biz.Biz, handler func([]byte) (interface{}, error)) fiber.Handler {
	return func(c *fiber.Ctx) error {
		// 1. 验证签名
		timestamp := c.Get("timestamp")
		sign := c.Get("sign")
		if timestamp == "" || sign == "" {
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "缺少timestamp或sign",
			})
		}

		// 2. 获取加密数据
		var reqBody struct {
			EncryptedData string `json:"encryptedData"`
		}
		if err := c.BodyParser(&reqBody); err != nil {
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "请求体解析失败",
			})
		}

		// 3. 验证SM3签名：sign = SM3(salt + timestamp + encryptedData)
		expectedSign := crypto.SM3WithSalt(cfg.SM3Salt, timestamp+reqBody.EncryptedData)
		if expectedSign != sign {
			log.Printf("签名验证失败: expected=%s, got=%s", expectedSign, sign)
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "签名验证失败",
			})
		}

		// 4. SM4解密业务数据
		bizData, err := crypto.SM4ECBDecrypt(reqBody.EncryptedData, cfg.SM4Key)
		if err != nil {
			log.Printf("SM4解密失败: %v", err)
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "数据解密失败",
			})
		}

		// 5. 执行业务逻辑
		result, err := handler(bizData)
		if err != nil {
			log.Printf("业务处理失败: %v", err)
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  err.Error(),
			})
		}

		// 6. 加密响应数据
		respBytes, err := json.Marshal(result)
		if err != nil {
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "响应序列化失败",
			})
		}

		encryptedResp, err := crypto.SM4ECBEncrypt(respBytes, cfg.SM4Key)
		if err != nil {
			return c.JSON(entities.ApiResponse{
				Code: -1,
				Msg:  "响应加密失败",
			})
		}

		return c.JSON(entities.ApiResponse{
			Code: 0,
			Msg:  "请求成功",
			Data: encryptedResp,
		})
	}
}

// handleCallback 处理供应商回调通知
func handleCallback(cfg *config.Config, b biz.Biz) fiber.Handler {
	return func(c *fiber.Ctx) error {
		// 1. 验证签名
		timestamp := c.Get("timestamp")
		sign := c.Get("sign")
		if timestamp == "" || sign == "" {
			return c.Status(400).SendString("missing auth headers")
		}

		// 2. 获取加密数据
		var reqBody struct {
			EncryptedData string `json:"encryptedData"`
		}
		if err := c.BodyParser(&reqBody); err != nil {
			return c.Status(400).SendString("invalid body")
		}

		// 3. 验证SM3签名
		expectedSign := crypto.SM3WithSalt(cfg.SM3Salt, timestamp+reqBody.EncryptedData)
		if expectedSign != sign {
			log.Printf("回调签名验证失败: expected=%s, got=%s", expectedSign, sign)
			return c.Status(400).SendString("sign verification failed")
		}

		// 4. SM4解密业务数据
		bizData, err := crypto.SM4ECBDecrypt(reqBody.EncryptedData, cfg.SM4Key)
		if err != nil {
			log.Printf("回调数据SM4解密失败: %v", err)
			return c.Status(400).SendString("decrypt failed")
		}

		// 5. 解析回调业务参数
		var callbackReq entities.CallbackNotifyBizReq
		if err := json.Unmarshal(bizData, &callbackReq); err != nil {
			log.Printf("回调数据解析失败: %v", err)
			return c.Status(400).SendString("parse failed")
		}

		// 6. 处理回调业务
		if err := b.ProcessCallback(&callbackReq); err != nil {
			log.Printf("回调处理失败: %v", err)
			return c.Status(500).SendString("process failed")
		}

		// 7. 返回成功（必须返回200且内容为ok）
		return c.Status(200).SendString("ok")
	}
}
```

// File: xy_sh/pkg/crypto/crypto.go
```go
package crypto

import (
	"encoding/base64"
	"encoding/hex"
	"fmt"
	"time"

	"github.com/tjfoc/gmsm/sm3"
	"github.com/tjfoc/gmsm/sm4"
)

// ==================== SM3 with Salt ====================

// SM3WithSalt 使用SM3加盐哈希
// 对应Java hutool的 SmUtil.sm3WithSalt(salt).digestHex(data)
// hutool实现为：SM3(salt + data)
func SM3WithSalt(salt string, data string) string {
	h := sm3.New()
	h.Write([]byte(salt))
	h.Write([]byte(data))
	return hex.EncodeToString(h.Sum(nil))
}

// ==================== SM4-ECB 加密/解密 ====================

// SM4ECBEncrypt SM4-ECB模式加密，返回base64编码字符串
func SM4ECBEncrypt(plaintext []byte, key []byte) (string, error) {
	if len(key) != 16 {
		return "", fmt.Errorf("SM4密钥长度必须为16字节")
	}

	block, err := sm4.NewCipher(key)
	if err != nil {
		return "", fmt.Errorf("创建SM4 cipher失败: %v", err)
	}

	padded := pkcs7Padding(plaintext, block.BlockSize())
	ciphertext := make([]byte, len(padded))
	for i := 0; i < len(padded); i += block.BlockSize() {
		block.Encrypt(ciphertext[i:i+block.BlockSize()], padded[i:i+block.BlockSize()])
	}

	return base64.StdEncoding.EncodeToString(ciphertext), nil
}

// SM4ECBDecrypt SM4-ECB模式解密，输入base64编码字符串，返回明文
func SM4ECBDecrypt(encryptedData string, key []byte) ([]byte, error) {
	if len(key) != 16 {
		return nil, fmt.Errorf("SM4密钥长度必须为16字节")
	}

	ciphertext, err := base64.StdEncoding.DecodeString(encryptedData)
	if err != nil {
		return nil, fmt.Errorf("base64解码失败: %v", err)
	}

	block, err := sm4.NewCipher(key)
	if err != nil {
		return nil, fmt.Errorf("创建SM4 cipher失败: %v", err)
	}

	blockSize := block.BlockSize()
	if len(ciphertext)%blockSize != 0 {
		return nil, fmt.Errorf("密文长度不是块大小的整数倍")
	}

	plaintext := make([]byte, len(ciphertext))
	for i := 0; i < len(ciphertext); i += blockSize {
		block.Decrypt(plaintext[i:i+blockSize], ciphertext[i:i+blockSize])
	}

	plaintext, err = pkcs7UnPadding(plaintext)
	if err != nil {
		return nil, fmt.Errorf("去除填充失败: %v", err)
	}

	return plaintext, nil
}

// ==================== PKCS7 填充 ====================

func pkcs7Padding(data []byte, blockSize int) []byte {
	padding := blockSize - len(data)%blockSize
	padText := make([]byte, padding)
	for i := range padText {
		padText[i] = byte(padding)
	}
	return append(data, padText...)
}

func pkcs7UnPadding(data []byte) ([]byte, error) {
	if len(data) == 0 {
		return nil, fmt.Errorf("数据为空")
	}
	padding := int(data[len(data)-1])
	if padding > len(data) || padding == 0 {
		return nil, fmt.Errorf("无效的填充")
	}
	for i := len(data) - padding; i < len(data); i++ {
		if int(data[i]) != padding {
			return nil, fmt.Errorf("无效的填充")
		}
	}
	return data[:len(data)-padding], nil
}

// ==================== 时间戳工具 ====================

// GenerateTimestampMillis 生成毫秒级时间戳
func GenerateTimestampMillis() string {
	return fmt.Sprintf("%d", time.Now().UnixMilli())
}
```

=== 服务端生成完成 ===

## 加密实现

以下是从加密工具获取的完整实现：

### 加密实现 1

{
  "success": true,
  "data": "\n### 参数拼接规范\n\n**常见拼接方式**：\n\n1. **字典序排序**：按key字典序排序后拼接 `key=value\u0026key2=value2`\n2. **固定顺序**：按文档指定顺序拼接\n3. **JSON字符串**：整个请求体作为签名串\n\n**代码模板**：\n\n```go\npackage crypto\n\nimport (\n    \"fmt\"\n    \"sort\"\n    \"strings\"\n)\n\n// BuildSignString 方式1：字典序排序拼接\nfunc BuildSignString(params map[string]string) string {\n    keys := make([]string, 0, len(params))\n    for k, v := range params {\n        if v != \"\" \u0026\u0026 k != \"sign\" \u0026\u0026 k != \"signature\" {\n            keys = append(keys, k)\n        }\n    }\n    sort.Strings(keys)\n    \n    var parts []string\n    for _, k := range keys {\n        parts = append(parts, fmt.Sprintf(\"%s=%s\", k, params[k]))\n    }\n    return strings.Join(parts, \"\u0026\")\n}\n\n// BuildSignStringOrdered 方式2：固定顺序拼接\nfunc BuildSignStringOrdered(params map[string]string, orderedKeys []string) string {\n    var parts []string\n    for _, k := range orderedKeys {\n        if v, ok := params[k]; ok \u0026\u0026 v != \"\" {\n            parts = append(parts, fmt.Sprintf(\"%s=%s\", k, v))\n        }\n    }\n    return strings.Join(parts, \"\u0026\")\n}\n```\n\n**注意事项**：\n- 确认文档指定的排序规则（字典序/固定顺序）\n- 确认空值是否要包含（通常排除空值）\n- 确认是否需要URL编码\n- 注意排除签名字段本身\n",
  "tool": "param_concat"
}

### 加密实现 2

{
  "success": true,
  "data": "\n### SM3 国密哈希算法完整实现指南\n\n**适用场景**：文档要求使用国密 SM3 算法进行摘要计算或签名验证\n\n**前置要求**：需要安装 github.com/tjfoc/gmsm\n\n```bash\ngo get github.com/tjfoc/gmsm\n```\n\n**配置参数**：\n- 编码方式: hex\n- 包含 HMAC: true\n\n**完整代码模板**：\n\n```go\npackage crypto\n\nimport (\n    \"crypto/hmac\"\n    \"encoding/base64\"\n    \"encoding/hex\"\n    \"fmt\"\n    \"os\"\n    \n    \"github.com/tjfoc/gmsm/sm3\"\n)\n\n// SM3Hash 计算SM3哈希值\n// data: 待哈希的数据\n// encoding: 输出编码方式 (hex/base64)\n// 返回: 编码后的哈希值\nfunc SM3Hash(data []byte, encoding string) (string, error) {\n    h := sm3.New()\n    h.Write(data)\n    hashBytes := h.Sum(nil)\n    \n    if encoding == \"base64\" {\n        return base64.StdEncoding.EncodeToString(hashBytes), nil\n    }\n    return hex.EncodeToString(hashBytes), nil\n}\n\n// SM3HashString 计算字符串的SM3哈希值（便捷方法）\nfunc SM3HashString(data string, encoding string) (string, error) {\n    return SM3Hash([]byte(data), encoding)\n}\n\n// SM3HashFile 计算文件的SM3哈希值\nfunc SM3HashFile(filePath string, encoding string) (string, error) {\n    data, err := os.ReadFile(filePath)\n    if err != nil {\n        return \"\", fmt.Errorf(\"读取文件失败: %v\", err)\n    }\n    return SM3Hash(data, encoding)\n}\n\n// SM3Verify 验证数据与哈希值是否匹配\nfunc SM3Verify(data []byte, hash string, encoding string) (bool, error) {\n    expected, err := SM3Hash(data, encoding)\n    if err != nil {\n        return false, err\n    }\n    return expected == hash, nil\n}\n\n// HMACSM3 HMAC-SM3计算\n// 使用标准HMAC算法，底层使用SM3哈希函数\nfunc HMACSM3(data []byte, key []byte) string {\n    // 使用标准HMAC，底层哈希函数用SM3\n    h := hmac.New(sm3.New, key)\n    h.Write(data)\n    return hex.EncodeToString(h.Sum(nil))\n}\n```\n\n**使用示例**：\n```go\n// 计算字符串哈希\nhash, _ := SM3HashString(\"hello world\", \"hex\")\nfmt.Println(hash) // 输出64位十六进制字符串\n\n// 验证哈希\nvalid, _ := SM3Verify([]byte(\"hello world\"), hash, \"hex\")\nfmt.Println(valid) // true\n\n// HMAC-SM3示例\nkey := []byte(\"secret_key\")\ndata := []byte(\"hello world\")\nhmacResult := HMACSM3(data, key)\nfmt.Println(hmacResult)\n```\n\n**注意事项**：\n- SM3 输出固定 256 位（32字节）的哈希值\n- 十六进制输出为 64 位字符串\n- 常用于数字签名、完整性校验等场景\n- SM3 是国密标准哈希算法，与 SHA-256 类似\n- HMAC-SM3 需要使用标准库 crypto/hmac，底层哈希函数使用 sm3.New\n",
  "tool": "sm3_hash"
}

### 加密实现 3

{
  "success": true,
  "data": "\n### SM4-ECB 国密对称加密完整实现指南\n\n**⚠️ 重要提示**：ECB模式不安全，仅用于兼容老旧系统。\n\n**⚠️ 重要：必须使用第三方库，不要自己实现 SM4 算法！**\n**推荐使用：github.com/tjfoc/gmsm**\n\n**前置要求**：\n```bash\ngo get github.com/tjfoc/gmsm\n```\n\n**配置参数**：\n- 编码方式: base64\n\n**完整代码模板（请直接复制使用）**：\n\n```go\npackage crypto\n\nimport (\n    \"encoding/base64\"\n    \"encoding/hex\"\n    \"fmt\"\n    \"bytes\"\n\n    \"github.com/tjfoc/gmsm/sm4\"  // ⚠️ 必须使用此库，不要自己实现SM4\n)\n\n// SM4ECBEncrypt SM4-ECB模式加密\n// 使用 github.com/tjfoc/gmsm/sm4 实现\nfunc SM4ECBEncrypt(plaintext []byte, key []byte) (string, error) {\n    if len(key) != 16 {\n        return \"\", fmt.Errorf(\"SM4密钥长度必须为16字节\")\n    }\n\n    block, err := sm4.NewCipher(key)\n    if err != nil {\n        return \"\", fmt.Errorf(\"创建SM4 cipher失败: %v\", err)\n    }\n\n    padded := pkcs7Padding(plaintext, block.BlockSize())\n\n    ciphertext := make([]byte, len(padded))\n    for i := 0; i \u003c len(padded); i += block.BlockSize() {\n        block.Encrypt(ciphertext[i:i+block.BlockSize()], padded[i:i+block.BlockSize()])\n    }\n\n    if \"base64\" == \"hex\" {\n        return hex.EncodeToString(ciphertext), nil\n    }\n    return base64.StdEncoding.EncodeToString(ciphertext), nil\n}\n\n// SM4ECBDecrypt SM4-ECB模式解密\n// 使用 github.com/tjfoc/gmsm/sm4 实现\nfunc SM4ECBDecrypt(encryptedData string, key []byte) ([]byte, error) {\n    if len(key) != 16 {\n        return nil, fmt.Errorf(\"SM4密钥长度必须为16字节\")\n    }\n\n    var ciphertext []byte\n    var err error\n    if \"base64\" == \"hex\" {\n        ciphertext, err = hex.DecodeString(encryptedData)\n    } else {\n        ciphertext, err = base64.StdEncoding.DecodeString(encryptedData)\n    }\n    if err != nil {\n        return nil, fmt.Errorf(\"解码失败: %v\", err)\n    }\n\n    block, err := sm4.NewCipher(key)\n    if err != nil {\n        return nil, fmt.Errorf(\"创建SM4 cipher失败: %v\", err)\n    }\n\n    blockSize := block.BlockSize()\n    if len(ciphertext)%blockSize != 0 {\n        return nil, fmt.Errorf(\"密文长度不是块大小的整数倍\")\n    }\n\n    plaintext := make([]byte, len(ciphertext))\n    for i := 0; i \u003c len(ciphertext); i += blockSize {\n        block.Decrypt(plaintext[i:i+blockSize], ciphertext[i:i+blockSize])\n    }\n\n    plaintext, err = pkcs7UnPadding(plaintext)\n    if err != nil {\n        return nil, fmt.Errorf(\"去除填充失败: %v\", err)\n    }\n\n    return plaintext, nil\n}\n\n// pkcs7Padding 和 pkcs7UnPadding 函数请参考 CBC 模式实现\n```\n\n**⚠️ 重要提醒**：\n1. **不要自己实现 SM4 算法**，请直接使用 github.com/tjfoc/gmsm\n2. 这个库是国密官方推荐的 Go 实现，安全可靠\n3. 在 go.mod 中添加依赖：`require github.com/tjfoc/gmsm v1.4.1`\n\n**⚠️ 安全警告**：\n- ECB模式不应在新系统中使用\n- 仅用于兼容老旧的国密系统\n- 推荐使用 SM4-CBC 模式\n",
  "tool": "sm4_ecb_encrypt"
}

### 加密实现 4

{
  "success": true,
  "data": "\n### 时间戳和随机数生成规范\n\n**代码模板**：\n\n```go\npackage crypto\n\nimport (\n    \"crypto/rand\"\n    \"fmt\"\n    \"math/big\"\n    \"time\"\n)\n\n// GenerateTimestamp 生成秒级时间戳\nfunc GenerateTimestamp() string {\n    return fmt.Sprintf(\"%d\", time.Now().Unix())\n}\n\n// GenerateTimestampMillis 生成毫秒级时间戳\nfunc GenerateTimestampMillis() string {\n    return fmt.Sprintf(\"%d\", time.Now().UnixMilli())\n}\n\n// GenerateNonce 生成指定长度的随机字符串（加密安全）\nfunc GenerateNonce(length int) (string, error) {\n    const charset = \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\"\n    b := make([]byte, length)\n    for i := range b {\n        num, err := rand.Int(rand.Reader, big.NewInt(int64(len(charset))))\n        if err != nil {\n            return \"\", err\n        }\n        b[i] = charset[num.Int64()]\n    }\n    return string(b), nil\n}\n```\n\n**注意事项**：\n- 确认文档要求的是秒级还是毫秒级时间戳\n- 确认nonce的长度要求（通常16-32位）\n- 生产环境建议使用加密安全的随机数生成器\n",
  "tool": "nonce_timestamp"
}