WeChat Ecosystem & Enterprise WeChat Integration

In enterprise digital workflows across Asian markets, the WeChat ecosystem (Official Accounts, Mini Programs, and Enterprise WeChat / WeCom) represents a primary collaboration channel for employees, clients, and judicial partners.

BitzOrcas.Platform.WeChat.Mp provides native multi-tenant WeChat integration infrastructure, managing per-tenant AppId/Secret isolation, parametric Scene QR code authentication, SHA1 cryptographic webhook validation, and reliable template notification pipelines.

1. Architectural Topology & Multi-Tenant Isolation

Each corporate tenant binds dedicated WeChat credentials, kept strictly isolated by TenantId:

2. Webhook Signature Verification Algorithm

All inbound callbacks from WeChat servers undergo SHA1 lexical sorting and cryptographic comparison to defeat spoofed webhooks:

using System;
using System.Security.Cryptography;
using System.Text;

namespace BitzOrcas.Platform.WeChat.Mp.Infrastructure;

/// <summary>
/// Cryptographic signature validator for WeChat Official Account webhooks
/// </summary>
public static class WeChatSignatureValidator
{
    /// <summary>
    /// Verifies inbound callback signatures against configured tenant tokens
    /// </summary>
    /// <param name="token">Tenant-configured communication token</param>
    /// <param name="timestamp">Inbound request timestamp</param>
    /// <param name="nonce">Inbound random nonce</param>
    /// <param name="signature">Signature header provided by WeChat</param>
    /// <returns>True if signature matches; otherwise false</returns>
    public static bool VerifySignature(string token, string timestamp, string nonce, string signature)
    {
        if (string.IsNullOrWhiteSpace(token) || string.IsNullOrWhiteSpace(signature))
        {
            return false;
        }

        // 1. Sort token, timestamp, and nonce alphabetically
        var array = new[] { token, timestamp, nonce };
        Array.Sort(array, StringComparer.Ordinal);

        // 2. Concatenate and compute SHA1 digest
        var combined = string.Concat(array);
        var hashBytes = SHA1.HashData(Encoding.UTF8.GetBytes(combined));
        var computedSignature = Convert.ToHexString(hashBytes).ToLowerInvariant();

        // 3. Constant-time comparison to prevent timing attacks
        return CryptographicOperations.FixedTimeEquals(
            Encoding.UTF8.GetBytes(computedSignature),
            Encoding.UTF8.GetBytes(signature.ToLowerInvariant()));
    }
}

3. Parametric QR Code Authentication Lifecycle

Enables passwordless authentication on desktop browsers:

1. Ticket Generation: Web frontend requests a temporary QR code ticket containing a cryptographic snowflake session identifier;
2. Mobile Scan & Event Ingestion: The mobile user scans the QR code; Tencent servers dispatch a SCAN or SUBSCRIBE event to the BitzOrcas webhook;
3. Identity Resolution & Session Release:
   • The handler maps OpenId / UnionId to an internal user identity;
   • Redis updates the ticket state to Approved and emits an authentication token;
   • The desktop frontend captures the event via SignalR or SSE, completing login without password entry.

4. Related Architecture Decisions & Deep Dives

• Identity Lifecycle: Identity & Multi-Tenant Lifecycle
• Real-Time Alerts: Multi-Channel Notification Dispatch
• Security Review: Webhook Signing & Replay Attack Defense