feat(支付): 新增Apple IAP支付支持

实现Apple应用内购支付功能，包括：
1. 新增AppleIAP和ApplePay支付平台枚举
2. 添加IAP验证接口/v1/public/iap/verify处理初购验证
3. 实现Apple服务器通知处理逻辑/v1/iap/notifications
4. 新增JWS验签和JWKS公钥缓存功能
5. 复用现有订单系统处理IAP支付订单

相关文档已更新，包含接入方案和实现细节

pkg/appleiap/jwks.go

@@ -0,0 +1,87 @@
+package appleiap
+
+import (
+    "crypto/ecdsa"
+    "crypto/elliptic"
+    "encoding/base64"
+    "encoding/json"
+    "errors"
+    "math/big"
+    "net/http"
+    "sync"
+    "time"
+)
+
+type jwk struct {
+    Kty string `json:"kty"`
+    Kid string `json:"kid"`
+    Crv string `json:"crv"`
+    X   string `json:"x"`
+    Y   string `json:"y"`
+}
+
+type jwks struct {
+    Keys []jwk `json:"keys"`
+}
+
+type cacheEntry struct {
+    keys map[string]*ecdsa.PublicKey
+    exp  time.Time
+}
+
+var (
+    mu    sync.Mutex
+    cache = map[string]*cacheEntry{}
+)
+
+func endpoint(env string) string {
+    if env == "sandbox" {
+        return "https://api.storekit-sandbox.itunes.apple.com/inApps/v1/keys"
+    }
+    return "https://api.storekit.itunes.apple.com/inApps/v1/keys"
+}
+
+func fetch(env string) (map[string]*ecdsa.PublicKey, error) {
+    resp, err := http.Get(endpoint(env))
+    if err != nil {
+        return nil, err
+    }
+    defer resp.Body.Close()
+    var set jwks
+    if err := json.NewDecoder(resp.Body).Decode(&set); err != nil {
+        return nil, err
+    }
+    m := make(map[string]*ecdsa.PublicKey)
+    for _, k := range set.Keys {
+        if k.Kty != "EC" || k.Crv != "P-256" || k.X == "" || k.Y == "" || k.Kid == "" {
+            continue
+        }
+        xb, err := base64.RawURLEncoding.DecodeString(k.X)
+        if err != nil { continue }
+        yb, err := base64.RawURLEncoding.DecodeString(k.Y)
+        if err != nil { continue }
+        var x, y big.Int
+        x.SetBytes(xb)
+        y.SetBytes(yb)
+        m[k.Kid] = &ecdsa.PublicKey{Curve: elliptic.P256(), X: &x, Y: &y}
+    }
+    if len(m) == 0 {
+        return nil, errors.New("empty jwks")
+    }
+    return m, nil
+}
+
+func GetKey(env, kid string) (*ecdsa.PublicKey, error) {
+    mu.Lock()
+    defer mu.Unlock()
+    c := cache[env]
+    if c == nil || time.Now().After(c.exp) {
+        keys, err := fetch(env)
+        if err != nil { return nil, err }
+        cache[env] = &cacheEntry{ keys: keys, exp: time.Now().Add(10 * time.Minute) }
+        c = cache[env]
+    }
+    k := c.keys[kid]
+    if k == nil { return nil, errors.New("key not found") }
+    return k, nil
+}

pkg/appleiap/jws.go

@@ -0,0 +1,29 @@
+package appleiap
+
+import (
+    "errors"
+    "github.com/golang-jwt/jwt/v5"
+)
+
+func verifyWithEnv(env, token string) (jwt.MapClaims, error) {
+    parsed, err := jwt.Parse(token, func(t *jwt.Token) (interface{}, error) {
+        h, ok := t.Header["kid"].(string)
+        if !ok { return nil, errors.New("kid missing") }
+        return GetKey(env, h)
+    })
+    if err != nil { return nil, err }
+    if !parsed.Valid { return nil, errors.New("invalid jws") }
+    c, ok := parsed.Claims.(jwt.MapClaims)
+    if !ok { return nil, errors.New("claims invalid") }
+    return c, nil
+}
+
+func VerifyWithEnv(env, token string) (jwt.MapClaims, error) { return verifyWithEnv(env, token) }
+
+func VerifyAutoEnv(token string) (jwt.MapClaims, string, error) {
+    c, err := verifyWithEnv("production", token)
+    if err == nil { return c, "production", nil }
+    c2, err2 := verifyWithEnv("sandbox", token)
+    if err2 == nil { return c2, "sandbox", nil }
+    return nil, "", err
+}

pkg/payment/platform.go

@@ -10,6 +10,8 @@ const (
 	EPay
 	Balance
 	CryptoSaaS
+	AppleIAP
+	ApplePay
 	UNSUPPORTED Platform = -1
 )
 
@@ -19,6 +21,8 @@ var platformNames = map[string]Platform{
 	"AlipayF2F":   AlipayF2F,
 	"EPay":        EPay,
 	"balance":     Balance,
+	"AppleIAP":    AppleIAP,
+	"ApplePay":    ApplePay,
 	"unsupported": UNSUPPORTED,
 }
 
@@ -80,5 +84,24 @@ func GetSupportedPlatforms() []types.PlatformInfo {
 				"secret_key": "Secret Key",
 			},
 		},
+		{
+			Platform:    AppleIAP.String(),
+			PlatformUrl: "https://developer.apple.com/help/app-store-connect/",
+			PlatformFieldDescription: map[string]string{
+				"issuer_id":   "App Store Connect Issuer ID",
+				"key_id":      "App Store Connect Key ID",
+				"private_key": "Private Key (ES256)",
+				"environment": "Environment: Sandbox/Production",
+			},
+		},
+		{
+			Platform:    ApplePay.String(),
+			PlatformUrl: "https://stripe.com",
+			PlatformFieldDescription: map[string]string{
+				"public_key":     "Publishable key",
+				"secret_key":     "Secret key",
+				"webhook_secret": "Webhook secret",
+			},
+		},
 	}
 }