git clone https://github.com/aimacgao-lab/align-plugin-wecom.git
cd align-plugin-wecom
npm install

align-plugin-wecom/
├── src/
│   └── index.ts       ← 插件入口，export default plugin
├── package.json
├── tsconfig.json
└── README.md          ← 功能清单和约束说明

import type { AlignPlugin, PluginContext } from '@aimacgao-lab/align-plugin-sdk';

async function getContacts(ctx: PluginContext): Promise<void> {
  const { userId } = ctx.iam!;
  const binding = await ctx.db.collection('bindings').findOne({ userId });
  if (!binding) {
    ctx.res.status(400).json({ error: '未绑定企微账号' });
    return;
  }
  // 调企微 API 拿外部联系人...
  ctx.res.json({ contacts: [] });
}

const plugin: AlignPlugin = {
  name: 'wecom',
  version: '1.0.0',
  routes: [
    { method: 'get', path: '/contacts', handler: getContacts },
  ],
};

export default plugin;

const ctx = {
  iam: { userId: 'test-user', orgId: 'org-1', role: 'user', email: '', name: '' },
  req: { body: {}, query: {}, params: {}, headers: {} },
  res: {
    json: (d) => console.log(JSON.stringify(d, null, 2)),
    status: () => ctx.res,
    send: console.log,
  },
  db: { collection: () => mockCollection },  // 你的 mock
  align: { getUser: async () => null, /* ... */ },
};

await getContacts(ctx);

const plugin: AlignPlugin = {
  name: 'wecom',        // 英文小写，决定路由前缀
  version: '1.0.0',
  routes: [...],
  onInstall: async (ctx) => { /* 可选，首次加载时执行 */ },
};
export default plugin;

{
  method: 'get' | 'post' | 'put' | 'delete' | 'patch',
  path: '/your-path',         // 相对路径
  handler: async (ctx) => { ... },
  auth: true,               // 默认 true；Webhook 等设 false
}
// 最终挂载: /api/plugins/{pluginName}{path}

const CORP_ID = process.env.WECOM_CORP_ID;
if (!CORP_ID) throw new Error('WECOM_CORP_ID not configured');

Align 前端 → GET /api/plugins/wecom/oauth/redirect
          ← 返回企微 OAuth URL（前端跳转）
             ↓ 用户授权
企微 → GET /api/plugins/wecom/oauth/callback?code=xxx
     → 存绑定关系 plugin_wecom_bindings
     ← 重定向回 Align

async function getAccessToken(ctx: PluginContext): Promise<string> {
  const cache = await ctx.db.collection('token_cache').findOne({ key: 'access_token' });
  if (cache && cache.expiresAt > Date.now() + 60_000) return cache.token;

  const resp = await fetch(
    `https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=${CORP_ID}&corpsecret=${SECRET}`
  );
  const { access_token, expires_in } = await resp.json();

  await ctx.db.collection('token_cache').updateOne(
    { key: 'access_token' },
    { key: 'access_token', token: access_token, expiresAt: Date.now() + expires_in * 1000 },
    { upsert: true }
  );
  return access_token;
}

1. 验签
   msg_signature = sha1(sort([token, timestamp, nonce, encrypt_msg]))

2. AES-CBC 解密
   key = base64_decode(WECOM_AES_KEY + '=')   // 补全 padding
   iv  = key[0..16]
   plaintext = aes_cbc_decrypt(ciphertext, key, iv)
   // plaintext = random(16) + msg_len(4) + xml_content + appid

3. 解析 XML → MsgType / Content / FromUserName

4. 存入 DB + 通知员工

POST /api/plugins/payment/orders/create
{
  "subject": "购买高级会员",
  "amount": 9900,        // 分（9900 = ¥99.00）
  "channel": "wxpay",    // 或 "alipay"
  "notifyUrl": "https://align.xin/api/plugins/payment/notify/wxpay"
}

→ {
  "orderId": "PAY_20240101_abc123",
  "payParams": { /* 前端唤起支付参数 */ }
}

async function handleWxpayNotify(ctx: PluginContext) {
  // 1. 解密验签拿 orderId
  const { orderId, trade_state } = decryptNotify(ctx.req.body, ctx.req.headers);

  // 2. 幂等检查
  const order = await ctx.db.collection('orders').findOne({ orderId });
  if (order?.status === 'paid') {
    ctx.res.json({ code: 'SUCCESS', message: '幂等' });  // 直接返回
    return;
  }

  // 3. 更新状态
  await ctx.db.collection('orders').updateOne(
    { orderId },
    { status: 'paid', paidAt: new Date().toISOString() }
  );

  // 4. 通知用户
  await ctx.align.sendIM(order.userId, `支付成功：${order.subject}`);

  ctx.res.json({ code: 'SUCCESS' });
}

if (!ctx.iam || !['admin', 'super_admin'].includes(ctx.iam.role)) {
  ctx.res.status(403).json({ error: '无权限' });
  return;
}