争议订单WEBHOOK回调

{
  "appId": "2",
  "merchantId": "1",
  "notificationItems": [
    {
      "additionalData": {
        "orderType": "chargeback",
        "networkReasonCode": "10.4",
        "providerReference": "du_1UESQM08pryDCbBWNzLD28lZ",
        "fundImpact": "SETTLED_LOST",
        "disputeDueBy": "2026-09-19 00:00:00"
      },
      "amount": { "currency": "USD", "value": 200 },
      "eventCode": "DISPUTE",
      "eventDate": 1789125636000,
      "merchantReference": "35D58738ACA345E3BB380D6003747DD8",
      "originalReference": "2098369735585562624",
      "pspReference": "CB2098370142512742400",
      "resultCode": "FAILED"
    }
  ]
}

{"appId":"2","merchantId":"1","notificationItems":[{"additionalData":{"orderType":"inquiry","networkReasonCode":"10","providerReference":"du_1UESLJ08pryDCbBWiCOIcYBm","fundImpact":"MERCHANT_ACTION","disputeDueBy":"2026-09-19 00:00:00"},"amount":{"currency":"USD","value":200},"eventCode":"INQUIRY","eventDate":1789125013000,"merchantReference":"8739F37B4241400B9A449220579D39FC","originalReference":"2098368390426132480","pspReference":"CB2098368489222963200","resultCode":"INITIALIZED"}]}

public boolean verify(String rawBody, String authorization, String payinSecurityKey) throws Exception {
    ObjectMapper mapper = new ObjectMapper();
    Map<String, Object> body = mapper.readValue(rawBody, new TypeReference<Map<String, Object>>() {});
    String itemsJson = mapper.writeValueAsString(sortDeep(body.get("notificationItems")));
    String expected = sha256Hex("notificationItems=" + itemsJson + payinSecurityKey);
    return expected.equals(authorization);
}

/** 递归按键排序，数组顺序不动 */
@SuppressWarnings("unchecked")
private Object sortDeep(Object node) {
    if (node instanceof Map) {
        Map<String, Object> sorted = new TreeMap<>();
        ((Map<String, Object>) node).forEach((k, v) -> sorted.put(k, sortDeep(v)));
        return sorted;
    }
    if (node instanceof List) {
        List<Object> list = new ArrayList<>();
        ((List<Object>) node).forEach(v -> list.add(sortDeep(v)));
        return list;
    }
    return node;
}

private String sha256Hex(String text) throws Exception {
    byte[] hash = MessageDigest.getInstance("SHA-256").digest(text.getBytes(StandardCharsets.UTF_8));
    StringBuilder sb = new StringBuilder(hash.length * 2);
    for (byte b : hash) {
        sb.append(Character.forDigit((b >> 4) & 0xF, 16)).append(Character.forDigit(b & 0xF, 16));
    }
    return sb.toString();
}