Go语言与GAE集成PayPal IPN：确保参数顺序的正确处理方法

package myapp

import (
    "bytes"
    "io"
    "log"
    "net/http"

    "google.golang.org/appengine"
    "google.golang.org/appengine/urlfetch"
)

// handlePaypalIPN 是处理PayPal IPN消息的HTTP处理器
func handlePaypalIPN(w http.ResponseWriter, r *http.Request) {
    // 确保请求方法是POST
    if r.Method != http.MethodPost {
        http.Error(w, "Method Not Allowed", http.StatusMethodNotAllowed)
        return
    }

    // 创建App Engine上下文
    ctx := appengine.NewContext(r)
    client := urlfetch.Client(ctx)

    // 构建用于回传给PayPal的请求体
    var buf bytes.Buffer
    // 1. 添加PayPal要求的验证参数
    _, err := buf.WriteString("cmd=_notify-validate&")
    if err != nil {
        log.Errorf(ctx, "Failed to write cmd parameter: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }

    // 2. 将原始IPN请求体复制到缓冲区，确保参数顺序不变
    // 注意：r.Body只能读取一次，如果后续还需要读取原始请求体，需要先将其复制到另一个缓冲区。
    _, err = io.Copy(&buf, r.Body)
    if err != nil {
        log.Errorf(ctx, "Failed to copy original request body: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }

    // PayPal IPN验证URL（沙盒环境为例）
    // 在生产环境中，请替换为 "https://www.paypal.com/cgi-bin/webscr"
    paypalVerifyURL := "https://www.sandbox.paypal.com/cgi-bin/webscr"

    // 使用 client.Post 发送请求，Content-Type 必须与原始IPN请求一致
    // 通常是 "application/x-www-form-urlencoded"
    resp, err := client.Post(paypalVerifyURL, "application/x-www-form-urlencoded", &buf)
    if err != nil {
        log.Errorf(ctx, "Failed to post back to PayPal for verification: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }
    defer resp.Body.Close()

    // 读取PayPal的响应
    paypalResponse, err := io.ReadAll(resp.Body)
    if err != nil {
        log.Errorf(ctx, "Failed to read PayPal verification response: %v", err)
        http.Error(w, "Internal Server Error", http.StatusInternalServerError)
        return
    }

    // 根据PayPal的响应进行处理
    // 如果响应是 "VERIFIED"，则IPN有效
    // 如果响应是 "INVALID"，则IPN无效
    responseString := string(paypalResponse)
    if responseString == "VERIFIED" {
        log.Infof(ctx, "PayPal IPN Verified successfully.")
        // 在这里处理您的业务逻辑，例如更新订单状态、发货等
        // ...
        w.WriteHeader(http.StatusOK)
        w.Write([]byte("IPN Processed"))
    } else if responseString == "INVALID" {
        log.Warningf(ctx, "PayPal IPN Invalid: %s", responseString)
        // 记录无效IPN，可能需要人工审查或进一步调查
        http.Error(w, "IPN Invalid", http.StatusBadRequest)
    } else {
        log.Errorf(ctx, "Unexpected PayPal IPN verification response: %s", responseString)
        http.Error(w, "Unexpected Response", http.StatusInternalServerError)
    }
}

// 在GAE应用的init函数中注册处理器
func init() {
    http.HandleFunc("/paypal-ipn-listener", handlePaypalIPN)
}