钉钉 Webhook 集成实战：机器人推送、Outgoing 回调与事件订阅（2025 完整指南）

package main

import (
    "bytes"
    "crypto/hmac"
    "crypto/sha256"
    "encoding/base64"
    "encoding/json"
    "fmt"
    "net/http"
    "time"
)

type DingTalkRobot struct {
    WebhookURL string
    Secret     string // 加签密钥
}

func (r *DingTalkRobot) SendText(content string) error {
    timestamp := time.Now().UnixMilli()
    sign := r.sign(timestamp)

    url := fmt.Sprintf("%s&timestamp=%d&sign=%s", r.WebhookURL, timestamp, sign)

    payload := map[string]interface{}{
        "msgtype": "text",
        "text": map[string]string{
            "content": content,
        },
    }

    body, _ := json.Marshal(payload)
    resp, err := http.Post(url, "application/json", bytes.NewReader(body))
    if err != nil {
        return err
    }
    defer resp.Body.Close()

    if resp.StatusCode != 200 {
        return fmt.Errorf("dingtalk robot send failed: %d", resp.StatusCode)
    }
    return nil
}

func (r *DingTalkRobot) sign(timestamp int64) string {
    // 签名字串：timestamp + "\n" + secret
    strToSign := fmt.Sprintf("%d\n%s", timestamp, r.Secret)
    mac := hmac.New(sha256.New, []byte(r.Secret))
    mac.Write([]byte(strToSign))
    return base64.StdEncoding.EncodeToString(mac.Sum(nil))
}

// 使用示例
func main() {
    robot := &DingTalkRobot{
        WebhookURL: "https://oapi.dingtalk.com/robot/send?access_token=xxx",
        Secret:     "SECxxx",
    }
    robot.SendText("🚀 部署成功通知：服务 v1.2.3 已上线")
}

func (r *DingTalkRobot) SendMarkdown(title, text string) error {
    payload := map[string]interface{}{
        "msgtype": "markdown",
        "markdown": map[string]string{
            "title": title,
            "text":  text,
        },
    }
    // ... 同上发送逻辑
    return nil
}

## 订单支付通知
- **订单号**：202501150001
- **金额**：¥299.00
- **状态**：✅ 支付成功
- **时间**：2025-01-15 10:30:00

[查看详情](https://admin.example.com/orders/202501150001)

{
  "conversationType": "1",
  "atUsers": [{"dingtalkId": "$:LWCP_v1:$xxx"}],
  "chatbotCorpId": "dingxxx",
  "chatbotUserId": "$:LWCP_v1:$xxx",
  "msgId": "msgxxx",
  "senderStaffId": "userxxx",
  "senderNick": "张三",
  "senderCorpId": "dingxxx",
  "sessionWebhook": "https://oapi.dingtalk.com/robot/sendBySession?session=xxx",
  "text": {"content": " @机器人 查询订单"},
  "msgtype": "text",
  "createAt": 1705302000000
}

func verifyDingTalkCallback(body []byte, timestamp, signature, secret string) error {
    strToSign := timestamp + "\n" + secret
    mac := hmac.New(sha256.New, []byte(secret))
    mac.Write([]byte(strToSign))
    expectedSign := base64.StdEncoding.EncodeToString(mac.Sum(nil))

    if signature != expectedSign {
        return fmt.Errorf("sign mismatch")
    }

    // 防重放：时间戳必须在 1 小时内
    ts, _ := strconv.ParseInt(timestamp, 10, 64)
    if time.Since(time.UnixMilli(ts)) > time.Hour {
        return fmt.Errorf("timestamp too old")
    }

    return nil
}

func handleDingTalkOutgoing(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)

    timestamp := r.Header.Get("timestamp")
    sign := r.Header.Get("sign")

    if err := verifyDingTalkCallback(body, timestamp, sign, os.Getenv("DINGTALK_SECRET")); err != nil {
        http.Error(w, err.Error(), http.StatusUnauthorized)
        return
    }

    var msg struct {
        MsgType string `json:"msgtype"`
        Text    struct {
            Content string `json:"content"`
        } `json:"text"`
        SessionWebhook string `json:"sessionWebhook"`
    }
    json.Unmarshal(body, &msg)

    // 处理用户指令
    reply := processCommand(strings.TrimSpace(msg.Text.Content))

    // 通过 sessionWebhook 回复（无需 access_token）
    sendReply(msg.SessionWebhook, reply)

    w.WriteHeader(http.StatusOK)
}

func processCommand(cmd string) string {
    switch {
    case strings.Contains(cmd, "订单"):
        return "📦 今日订单：15 笔，总金额 ¥4,230"
    case strings.Contains(cmd, "用户"):
        return "👥 今日新增：23 人，活跃用户 1,024"
    default:
        return "🤖 可用指令：查询订单 / 查询用户 / 系统状态"
    }
}

func sendReply(sessionWebhook, text string) {
    payload := map[string]interface{}{
        "msgtype": "text",
        "text":    map[string]string{"content": text},
    }
    body, _ := json.Marshal(payload)
    http.Post(sessionWebhook, "application/json", bytes.NewReader(body))
}

import (
    "crypto/aes"
    "crypto/cipher"
    "encoding/base64"
)

func decryptDingTalkEvent(encrypt string, aesKey string) ([]byte, error) {
    // 钉钉加密流程：Base64 → AES-256-CBC 解密 → PKCS#7 去填充 → 去掉随机串
    key, _ := base64.StdEncoding.DecodeString(aesKey)
    data, _ := base64.StdEncoding.DecodeString(encrypt)

    block, err := aes.NewCipher(key)
    if err != nil {
        return nil, err
    }

    iv := key[:16]
    mode := cipher.NewCBCDecrypter(block, iv)
    mode.CryptBlocks(data, data)

    // PKCS#7 去填充
    padLen := int(data[len(data)-1])
    return data[16 : len(data)-padLen], nil // 去掉 16 字节随机串
}

func handleDingTalkEvent(w http.ResponseWriter, r *http.Request) {
    body, _ := io.ReadAll(r.Body)

    var event struct {
        Encrypt string `json:"encrypt"`
    }
    json.Unmarshal(body, &event)

    // 解密
    decrypted, err := decryptDingTalkEvent(event.Encrypt, os.Getenv("DINGTALK_AES_KEY"))
    if err != nil {
        http.Error(w, "decrypt failed", http.StatusBadRequest)
        return
    }

    var payload struct {
        EventType   string          `json:"EventType"`
        ProcessCode string          `json:"processCode"`
        ProcessInstance struct {
            Title  string `json:"title"`
            Result string `json:"result"` // agree / refuse
            Status string `json:"status"` // RUNNING / COMPLETED
        } `json:"processInstance"`
    }
    json.Unmarshal(decrypted, &payload)

    switch payload.EventType {
    case "bpms_instance_change":
        handleApprovalEvent(payload)
    case "attendance_check_record":
        handleAttendanceEvent(payload)
    }

    // 钉钉要求返回 success 加密串
    response := encryptResponse("success", os.Getenv("DINGTALK_AES_KEY"))
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(map[string]string{"msg_signature": response})
}