From 2e63213e60acacb2f44c09f5f59df3c2eff0e547 Mon Sep 17 00:00:00 2001
From: Guoguo <i@qwq.trade>
Date: Mon, 18 May 2026 05:32:22 -0700
Subject: [PATCH] fix: handle literal \n in WX_MCH_PRIVATE_KEY env var

- Replace literal '\n' with real newlines when reading private key from env
- Add PEM header validation to catch format errors early
- File-based key (privateKeyPath) unaffected
---
 server/src/lib/wxpay.js | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/server/src/lib/wxpay.js b/server/src/lib/wxpay.js
index a96ad03..1a9779c 100644
--- a/server/src/lib/wxpay.js
+++ b/server/src/lib/wxpay.js
@@ -11,9 +11,17 @@ function isConfigured() {
 let _cachedPrivateKey = null
 function getPrivateKey() {
   if (_cachedPrivateKey) return _cachedPrivateKey
-  if (config.wxpay.privateKey) { _cachedPrivateKey = config.wxpay.privateKey; return _cachedPrivateKey }
-  if (config.wxpay.privateKeyPath) { _cachedPrivateKey = fs.readFileSync(config.wxpay.privateKeyPath, 'utf8'); return _cachedPrivateKey }
-  throw new Error('WeChat Pay private key not configured')
+  let key = ''
+  if (config.wxpay.privateKey) {
+    key = config.wxpay.privateKey.replace(/\\n/g, '\n')
+  } else if (config.wxpay.privateKeyPath) {
+    key = fs.readFileSync(config.wxpay.privateKeyPath, 'utf8')
+  } else {
+    throw new Error('WeChat Pay private key not configured')
+  }
+  if (!key.includes('-----BEGIN')) throw new Error('Invalid private key format (missing PEM header)')
+  _cachedPrivateKey = key
+  return _cachedPrivateKey
 }
 
 function generateNonce() {