AI盒绘开放平台开发者中心

const axios = require('axios');
const crypto = require('crypto');

// ========================================================
// 1. 服务端 HMAC-SHA256 加签并申请 Ticket (完整可直接运行)
// ========================================================
async function getOpenEditorTicket(externalUserId, nickname = '设计体验官') {
  const API_BASE_URL = 'https://test-open.1packify.com/api';
  const APP_KEY = 'partner_demo_key';
  const APP_SECRET = 'partner_demo_secret_2026';

  const timestamp = Math.floor(Date.now() / 1000);
  const nonce = crypto.randomBytes(8).toString('hex');

  // 1.1 参数字典序排序并拼接待签名串
  const params = { appKey: APP_KEY, timestamp, nonce, externalUserId, nickname };
  const stringToSign = Object.keys(params)
    .sort()
    .filter(k => params[k] !== undefined && params[k] !== '')
    .map(k => `${k}=${params[k]}`)
    .join('&');

  // 1.2 计算 HMAC-SHA256 签名 (Hex 小写)
  const signature = crypto.createHmac('sha256', APP_SECRET)
    .update(stringToSign, 'utf8')
    .digest('hex');

  // 1.3 携带请求头发送 POST 获取 Ticket
  const resp = await axios.post(`${API_BASE_URL}/open/auth/ticket`, {
    externalUserId,
    nickname
  }, {
    headers: {
      'Content-Type': 'application/json',
      'X-Open-App-Key': APP_KEY,
      'X-Open-Timestamp': timestamp,
      'X-Open-Nonce': nonce,
      'X-Open-Signature': signature
    }
  });
  return resp.data.data.ticket;
}

// ========================================================
// 2. 接收完成编辑 Webhook 文件流 (Express + Multer)
// ========================================================
const express = require('express');
const cors    = require('cors');
const multer  = require('multer');
const upload  = multer({ dest: '/data/designs/' });
const app     = express();

// 必须启用 CORS 放行前端浏览器直推与 OPTIONS 预检
app.use(cors());

app.post('/api/webhook/aidesign/handleSave', upload.single('file'), (req, res) => {
  const { externalProjectId, externalUserId, extra, title } = req.body;
  console.log(`[Webhook] 项目 ${externalProjectId} 保存成功，文件保存在: ${req.file.path}`);
  res.json({ code: 200, message: 'success' });
});

import time
import uuid
import hmac
import hashlib
import requests

# ========================================================
# 1. 服务端 HMAC-SHA256 加签并申请 Ticket (完整可直接运行)
# ========================================================
def get_open_editor_ticket(external_user_id: str, nickname: str = "设计体验官") -> str:
    API_BASE_URL = "https://test-open.1packify.com/api"
    APP_KEY = "partner_demo_key"
    APP_SECRET = "partner_demo_secret_2026"
    
    timestamp = int(time.time())
    nonce = uuid.uuid4().hex[:16]

    # 1.1 参数字典序排序组装待签名串
    params = {
        "appKey": APP_KEY,
        "timestamp": str(timestamp),
        "nonce": nonce,
        "externalUserId": external_user_id,
        "nickname": nickname
    }
    string_to_sign = "&".join(f"{k}={v}" for k, v in sorted(params.items()) if v)

    # 1.2 计算 HMAC-SHA256 签名 (Hex 小写)
    signature = hmac.new(
        APP_SECRET.encode("utf-8"),
        string_to_sign.encode("utf-8"),
        hashlib.sha256
    ).hexdigest()

    # 1.3 携带请求头发送 POST 获取 Ticket
    headers = {
        "Content-Type": "application/json",
        "X-Open-App-Key": APP_KEY,
        "X-Open-Timestamp": str(timestamp),
        "X-Open-Nonce": nonce,
        "X-Open-Signature": signature
    }
    payload = {"externalUserId": external_user_id, "nickname": nickname}
    resp = requests.post(f"{API_BASE_URL}/open/auth/ticket", json=payload, headers=headers)
    return resp.json()["data"]["ticket"]

# ========================================================
# 2. 接收完成编辑 Webhook 文件流 (FastAPI)
# ========================================================
from fastapi import FastAPI, UploadFile, File, Form
from fastapi.middleware.cors import CORSMiddleware
app = FastAPI()

# 必须配置 CORS 中间件放行前端浏览器直推
app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

@app.post("/api/webhook/aidesign/handleSave")
async def handle_save(
    file: UploadFile = File(...),
    externalProjectId: str = Form(...),
    externalUserId: str = Form(None),
    extra: str = Form(None),
    title: str = Form(None)
):
    content = await file.read()
    with open(f"/data/designs/{externalProjectId}_{file.filename}", "wb") as f:
        f.write(content)
    return {"code": 200, "message": "success"}

package main

import (
    "bytes"
    "crypto/hmac"
    "crypto/sha256"
    "encoding/hex"
    "encoding/json"
    "fmt"
    "net/http"
    "sort"
    "strconv"
    "time"
    "github.com/gin-gonic/gin"
)

// ========================================================
// 1. 服务端 HMAC-SHA256 加签并申请 Ticket (完整可直接运行)
// ========================================================
func GetOpenEditorTicket(externalUserId, nickname string) (string, error) {
    const apiBaseUrl = "https://test-open.1packify.com/api"
    const appKey = "partner_demo_key"
    const appSecret = "partner_demo_secret_2026"

    timestamp := time.Now().Unix()
    nonce := fmt.Sprintf("%x", time.Now().UnixNano())[:16]

    // 1.1 参数按 Key 升序字典序拼接待签名串
    params := map[string]string{
        "appKey":         appKey,
        "timestamp":      strconv.FormatInt(timestamp, 10),
        "nonce":          nonce,
        "externalUserId": externalUserId,
        "nickname":       nickname,
    }

    var keys []string
    for k := range params {
        keys = append(keys, k)
    }
    sort.Strings(keys)

    var parts []string
    for _, k := range keys {
        if params[k] != "" {
            parts = append(parts, fmt.Sprintf("%s=%s", k, params[k]))
        }
    }
    stringToSign := strings.Join(parts, "&")

    // 1.2 计算 HMAC-SHA256 签名 (Hex 小写)
    mac := hmac.New(sha256.New, []byte(appSecret))
    mac.Write([]byte(stringToSign))
    signature := hex.EncodeToString(mac.Sum(nil))

    // 1.3 携带请求头发送 POST 请求获取 Ticket
    reqBody, _ := json.Marshal(map[string]string{
        "externalUserId": externalUserId,
        "nickname":       nickname,
    })
    req, _ := http.NewRequest("POST", apiBaseUrl+"/open/auth/ticket", bytes.NewBuffer(reqBody))
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("X-Open-App-Key", appKey)
    req.Header.Set("X-Open-Timestamp", strconv.FormatInt(timestamp, 10))
    req.Header.Set("X-Open-Nonce", nonce)
    req.Header.Set("X-Open-Signature", signature)

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        return "", err
    }
    defer resp.Body.Close()
    
    var res struct {
        Code int `json:"code"`
        Data struct {
            Ticket string `json:"ticket"`
        } `json:"data"`
    }
    json.NewDecoder(resp.Body).Decode(&res)
    return res.Data.Ticket, nil
}

// ========================================================
// 2. 接收完成编辑 Webhook 文件流 (Gin 框架)
// ========================================================
func setupWebhook(r *gin.Engine) {
    // 必须设置 CORS 响应头与放行 OPTIONS 预检
    r.Use(func(c *gin.Context) {
        c.Writer.Header().Set("Access-Control-Allow-Origin", "*")
        c.Writer.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS")
        c.Writer.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Requested-With, Accept")
        if c.Request.Method == "OPTIONS" {
            c.AbortWithStatus(http.StatusNoContent)
            return
        }
        c.Next()
    })

    r.POST("/api/webhook/aidesign/handleSave", func(c *gin.Context) {
        file, _ := c.FormFile("file")
        externalProjectId := c.PostForm("externalProjectId")
        extra := c.PostForm("extra")
        _ = extra // 自定义透传业务数据
        c.SaveUploadedFile(file, "/data/designs/"+externalProjectId+"_"+file.Filename)
        c.JSON(http.StatusOK, gin.H{"code": 200, "message": "success"})
    })
}

<?php
// ========================================================
// 1. 服务端 HMAC-SHA256 加签并申请 Ticket (完整可直接运行)
// ========================================================
function getOpenEditorTicket($externalUserId, $nickname = '设计体验官') {
    $apiBaseUrl = 'https://test-open.1packify.com/api';
    $appKey = 'partner_demo_key';
    $appSecret = 'partner_demo_secret_2026';

    $timestamp = time();
    $nonce = bin2hex(random_bytes(8));

    // 1.1 参数字典序升序拼接待签名串
    $params = [
        'appKey' => $appKey,
        'timestamp' => (string)$timestamp,
        'nonce' => $nonce,
        'externalUserId' => $externalUserId,
        'nickname' => $nickname
    ];
    ksort($params);

    $parts = [];
    foreach ($params as $k => $v) {
        if ($v !== null && $v !== '') {
            $parts[] = "{$k}={$v}";
        }
    }
    $stringToSign = implode('&', $parts);

    // 1.2 计算 HMAC-SHA256 签名 (Hex 小写)
    $signature = hash_hmac('sha256', $stringToSign, $appSecret);

    // 1.3 发送 POST 请求获取 Ticket
    $payload = json_encode(['externalUserId' => $externalUserId, 'nickname' => $nickname]);
    $ch = curl_init("{$apiBaseUrl}/open/auth/ticket");
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => $payload,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => [
            'Content-Type: application/json',
            "X-Open-App-Key: {$appKey}",
            "X-Open-Timestamp: {$timestamp}",
            "X-Open-Nonce: {$nonce}",
            "X-Open-Signature: {$signature}"
        ]
    ]);
    $response = curl_exec($ch);
    curl_close($ch);

    $result = json_decode($response, true);
    return $result['data']['ticket'] ?? null;
}

// ========================================================
// 2. 接收完成编辑 Webhook 文件流 (PHP 原生脚本)
// ========================================================
// 必须配置 CORS 响应头并处理 OPTIONS 预检
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: POST, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With, Accept");
header("Access-Control-Max-Age: 86400");

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(204);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $externalProjectId = $_POST['externalProjectId'] ?? '';
    $extra = $_POST['extra'] ?? '';
    if (isset($_FILES['file']) && $_FILES['file']['error'] === UPLOAD_ERR_OK) {
        $dest = "/data/designs/{$externalProjectId}_" . basename($_FILES['file']['name']);
        move_uploaded_file($_FILES['file']['tmp_name'], $dest);
    }
    header('Content-Type: application/json');
    echo json_encode(['code' => 200, 'message' => 'success']);
    exit;
}
?>