Agent Request API

package main

import (
    "crypto/rand"
    "crypto/rsa"
    "crypto/x509"
    "encoding/base64"
    "encoding/json"
    "fmt"
    "io"
    "net/http"
    "os"
    "strconv"
    "strings"
    "time"
)

const (
    appID  = 123457945
    userID = 123457947
)

type Params struct {
    AppID       int   `json:"app_id"`
    RequestTime int64 `json:"request_time"`
    UserID      int   `json:"user_id"`
}

func main() {
    // Save the test key from the documentation as public_key.pem.
    // Its label says "RSA PUBLIC KEY" but its content is SPKI DER.
    text, err := os.ReadFile("public_key.pem")
    check(err)
    var lines []string
    for _, line := range strings.Split(string(text), "\n") {
        line = strings.TrimSpace(line)
        if line != "" && !strings.HasPrefix(line, "-----") {
            lines = append(lines, line)
        }
    }
    der, err := base64.StdEncoding.DecodeString(strings.Join(lines, ""))
    check(err)
    anyKey, err := x509.ParsePKIXPublicKey(der)
    check(err)
    publicKey, ok := anyKey.(*rsa.PublicKey)
    if !ok { panic("not an RSA public key") }

    params := Params{AppID: appID, RequestTime: time.Now().Unix(), UserID: userID}
    // ASSUMPTION: compact JSON bytes are the plaintext for RSA encryption.
    payload, err := json.Marshal(params)
    check(err)
    ciphertext, err := rsa.EncryptPKCS1v15(rand.Reader, publicKey, payload)
    check(err)
    // ASSUMPTION: the server expects standard Base64 in the sign header.
    sign := base64.StdEncoding.EncodeToString(ciphertext)

    baseURL := os.Getenv("AGENT_API_BASE_URL")
    if baseURL == "" { baseURL = "https://test-h5.hzshtech.cn/api" }
    url := strings.TrimRight(baseURL, "/") + "/agent/api/check-user"
    req, err := http.NewRequest(http.MethodPost, url, nil) // No request body.
    check(err)
    req.Header.Set("appid", strconv.Itoa(appID))
    req.Header.Set("sign", sign)
    req.Header.Set("Content-Type", "application/json")
    client := &http.Client{Timeout: 15 * time.Second}
    resp, err := client.Do(req)
    check(err)
    defer resp.Body.Close()
    body, err := io.ReadAll(resp.Body)
    check(err)
    fmt.Printf("HTTP %d\n%s\n", resp.StatusCode, body)
}

func check(err error) {
    if err != nil { panic(err) }
}

import { readFileSync } from 'node:fs';
import { createPublicKey, publicEncrypt, constants } from 'node:crypto';

const APP_ID = 123457945;
const USER_ID = 123457947;

// The documented PEM label is inconsistent with its SPKI DER content.
// Decode the base64 and explicitly import as SPKI (Node.js 18+).
const keyBase64 = readFileSync('public_key.pem', 'utf8')
  .replace(/-----[^-]+-----/g, '')
  .replace(/\s+/g, '');
const publicKey = createPublicKey({
  key: Buffer.from(keyBase64, 'base64'), format: 'der', type: 'spki',
});

const params = {
  app_id: APP_ID,
  request_time: Math.floor(Date.now() / 1000),
  user_id: USER_ID,
};
// ASSUMPTION: compact JSON is encrypted and Base64 is sent in the sign header.
const plaintext = Buffer.from(JSON.stringify(params), 'utf8');
const ciphertext = publicEncrypt(
  { key: publicKey, padding: constants.RSA_PKCS1_PADDING }, plaintext,
);
const sign = ciphertext.toString('base64');

const baseURL = (process.env.AGENT_API_BASE_URL || 'https://test-h5.hzshtech.cn/api')
  .replace(/\/$/, '');
const res = await fetch(`${baseURL}/agent/api/check-user`, {
  method: 'POST',
  headers: {
    appid: String(APP_ID),
    sign,
    'Content-Type': 'application/json',
  },
  // No request body per the source document.
});
console.log(`HTTP ${res.status}`);
console.log(await res.text());

import javax.crypto.Cipher;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.charset.StandardCharsets;
import java.nio.file.Files;
import java.nio.file.Path;
import java.security.KeyFactory;
import java.security.PublicKey;
import java.security.spec.X509EncodedKeySpec;
import java.time.Duration;
import java.time.Instant;
import java.util.Base64;
import java.util.Locale;

public class AgentRequestExample {
    private static final int APP_ID = 123457945;
    private static final int USER_ID = 123457947;

    public static void main(String[] args) throws Exception {
        // The PEM label in the documentation is inconsistent with SPKI DER.
        String pem = Files.readString(Path.of("public_key.pem"));
        String clean = pem.replaceAll("-----[^-]+-----", "").replaceAll("\\s+", "");
        byte[] der = Base64.getDecoder().decode(clean);
        PublicKey key = KeyFactory.getInstance("RSA")
            .generatePublic(new X509EncodedKeySpec(der));

        // ASSUMPTION: encrypt compact JSON as UTF-8 with RSA PKCS#1 v1.5.
        String params = String.format(Locale.ROOT,
            "{\"app_id\":%d,\"request_time\":%d,\"user_id\":%d}",
            APP_ID, Instant.now().getEpochSecond(), USER_ID);
        Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
        cipher.init(Cipher.ENCRYPT_MODE, key);
        byte[] encrypted = cipher.doFinal(params.getBytes(StandardCharsets.UTF_8));
        // ASSUMPTION: standard Base64 is accepted by the sign header.
        String sign = Base64.getEncoder().encodeToString(encrypted);

        String baseURL = System.getenv("AGENT_API_BASE_URL");
        if (baseURL == null || baseURL.isBlank()) {
            baseURL = "https://test-h5.hzshtech.cn/api";
        }
        String endpoint = baseURL.replaceAll("/+$", "") + "/agent/api/check-user";
        HttpRequest request = HttpRequest.newBuilder(URI.create(endpoint))
            .timeout(Duration.ofSeconds(15))
            .header("appid", Integer.toString(APP_ID))
            .header("sign", sign)
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.noBody()) // No body.
            .build();
        HttpClient client = HttpClient.newHttpClient();
        HttpResponse<String> res = client.send(request,
            HttpResponse.BodyHandlers.ofString());
        System.out.println("HTTP " + res.statusCode());
        System.out.println(res.body());
    }
}

import base64
import json
import os
import time
from pathlib import Path
from urllib import request, error
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import padding

APP_ID = 123457945
USER_ID = 123457947

# Save the original test key as public_key.pem. Its label is misleading:
# the DER bytes inside are X.509 SubjectPublicKeyInfo (SPKI).
pem_text = Path('public_key.pem').read_text(encoding='utf-8')
key_b64 = ''.join(
    line.strip() for line in pem_text.splitlines()
    if line.strip() and not line.startswith('-----')
)
public_key = serialization.load_der_public_key(base64.b64decode(key_b64))

params = {
    'app_id': APP_ID,
    'request_time': int(time.time()),
    'user_id': USER_ID,
}
# ASSUMPTION: the server encrypts compact JSON, not a query string.
plaintext = json.dumps(params, separators=(',', ':'), ensure_ascii=False).encode('utf-8')
ciphertext = public_key.encrypt(plaintext, padding.PKCS1v15())
# ASSUMPTION: standard Base64 encoded ciphertext is sent as sign.
sign = base64.b64encode(ciphertext).decode('ascii')

base_url = os.getenv('AGENT_API_BASE_URL', 'https://test-h5.hzshtech.cn/api')
url = base_url.rstrip('/') + '/agent/api/check-user'
req = request.Request(url, method='POST', headers={
    'appid': str(APP_ID),
    'sign': sign,
    'Content-Type': 'application/json',
})  # No request body.
try:
    with request.urlopen(req, timeout=15) as response:
        print(f'HTTP {response.status}')
        print(response.read().decode('utf-8'))
except error.HTTPError as exc:
    print(f'HTTP {exc.code}')
    print(exc.read().decode('utf-8', errors='replace'))