使用Google Apps Script更新NetSuite：TBA签名匹配问题求助

问题描述 #

我正在将可正常运行的Python脚本转换为Google Apps Script（GAS）以便分发。脚本能生成签名，但使用与Python脚本完全相同的nonce和timestamp时，生成的签名不一致，无法定位原因。我清楚请求会失败，当前仅需先匹配签名再推进。此外，求问在GAS中不使用OAuth2、仅通过TBA连接NetSuite的有效方法，感谢任何帮助或指导。

代码对比 #

Google Apps Script代码 #

function main() {
  var REALM = 'XXXXX';
  var CONSUMER_KEY = 'XXXXXXx';
  var CONSUMER_SECRET = 'XXXXXXXX';
  var RESOURCE_OWNER_KEY = 'XXXXXXXXX';
  var RESOURCE_OWNER_SECRET = 'XXXXXXXX';
  
  var method = "PATCH";
  var url = 'https://' + REALM + '.suitetalk.api.netsuite.com/services/rest/record/v1/vendor/1846';
  
  var params = {
    'oauth_consumer_key': CONSUMER_KEY,
    'oauth_nonce': '38751934124598253091697458273',
    'oauth_signature_method': 'HMAC-SHA256',
    'oauth_timestamp': '1697458273',
    'oauth_token': RESOURCE_OWNER_KEY,
    'oauth_version': '1.0',
    'realm': REALM
  };
  
  // Sorting and encoding the parameters
  var paramKeys = Object.keys(params);
  paramKeys.sort();
  var paramStr = paramKeys.map(function(key) {
  return encodeURIComponent(key) + "=" + encodeURIComponent(params[key]);
  }).join('&');
  
  // Create base string
  var baseString = method + '&' + encodeURIComponent(url) + '&' + encodeURIComponent(paramStr);
  
  // Create signature key
  var signatureKey = encodeURIComponent(CONSUMER_SECRET) + '&' + encodeURIComponent(RESOURCE_OWNER_SECRET);
  
  // Generate HMAC-SHA256 signature
  var signature = Utilities.computeHmacSha256Signature(baseString, signatureKey);
  signature = Utilities.base64Encode(signature);
  
  Logger.log('Base String: ' + baseString);
  Logger.log('Signature Key: ' + signatureKey);
  Logger.log('Signature: ' + signature);
  
  // Prepare OAuth1.0 headers
  params['oauth_signature'] = signature;
  var authHeader = 'OAuth ' + Object.keys(params).map(function(key) {
    return encodeURIComponent(key) + '="' + encodeURIComponent(params[key]) + '"';
  }).join(', ');
  Logger.log("Params are:   "+JSON.stringify(params))
  
  // Prepare HTTP options
  var options = {
    'method': method,
    'headers': {
      'Authorization': authHeader,
      'Content-Type': 'application/json'
    },
    'payload': JSON.stringify({"custentity_id": "2"})
  };
  
  // Send HTTP request and log the response
  try {
    var response = UrlFetchApp.fetch(url, options);
    Logger.log('Response: ' + response.getContentText());
  } catch (e) {
    Logger.log('Error: ' + e);
  }
}

Python脚本代码 #

import requests
import oauthlib.oauth1
import json
import hmac
import hashlib
import base64
from urllib.parse import quote_plus
from pprint import pprint

# Constants and configurations
REALM = 'XXXXXXX'
CONSUMER_KEY = 'XXXXXXXXXXX'
CONSUMER_SECRET = 'XXXXXXXX'
RESOURCE_OWNER_KEY = 'XXXXXXXX'
RESOURCE_OWNER_SECRET = 'XXXXXXXX'

# Create a session object
session = requests.Session()


def generate_signature(base_string, signature_key):
    hmac_obj = hmac.new(signature_key.encode('utf-8'), base_string.encode('utf-8'), hashlib.sha256)
    return base64.b64encode(hmac_obj.digest()).decode('utf-8')


def create_netsuite_client():
    client = oauthlib.oauth1.Client(
        CONSUMER_KEY,
        client_secret=CONSUMER_SECRET,
        resource_owner_key=RESOURCE_OWNER_KEY,
        resource_owner_secret=RESOURCE_OWNER_SECRET,
        realm=REALM,
        signature_method="HMAC-SHA256",
        timestamp='1697458273',
        nonce='38751934124598253091697458273'
    )
    return client


def process_vendor(netsuite, id, netsuite_id):
    data = {"custentity_id": id}
    hdr = {"Content-Type": "application/json"}
    url = f'https://{REALM}.suitetalk.api.netsuite.com/services/rest/record/v1/vendor/{netsuite_id}'
    url, headers, body = netsuite.sign(url, headers=hdr, body=json.dumps(data), http_method="PATCH")
    pprint(headers)
    try:
        response = session.request("PATCH", url, headers=headers, data=body)
        response.raise_for_status()
        print(f"{id},{netsuite_id},Successful")
    except requests.RequestException as err:
        print(f"{id},{netsuite_id},{str(err)},{json.dumps(response.json()).replace(',', ' ')}")


def main():
    netsuite = create_netsuite_client()
    process_vendor(netsuite, '2', '1846')


if __name__ == '__main__':
    main()

签名不匹配的修复方案 #

1. 移除Realm参数的签名参与 #

OAuth1规范中，Realm仅在Authorization头中出现，不参与base字符串的参数排序与签名计算。GAS代码中需将realm从params中移除，仅在构造Authorization头时添加：

// 修改params，去掉realm
var params = {
  'oauth_consumer_key': CONSUMER_KEY,
  'oauth_nonce': '38751934124598253091697458273',
  'oauth_signature_method': 'HMAC-SHA256',
  'oauth_timestamp': '1697458273',
  'oauth_token': RESOURCE_OWNER_KEY,
  'oauth_version': '1.0'
};

// 构造Authorization头时单独加入realm
var authHeaderParts = Object.keys(params).map(function(key) {
  return encodeURIComponent(key) + '="' + encodeURIComponent(params[key]) + '"';
});
authHeaderParts.unshift('realm="' + encodeURIComponent(REALM) + '"');
var authHeader = 'OAuth ' + authHeaderParts.join(', ');

2. 添加OAuth Body Hash参数 #

对于PATCH/PUT/POST等带请求体的方法，OAuth1要求计算请求体的SHA256哈希并作为oauth_body_hash参数加入签名流程，oauthlib会自动处理这一步，GAS需手动添加：

var payload = JSON.stringify({"custentity_id": "2"});
// 计算请求体哈希
var bodyHash = Utilities.computeDigest(Utilities.DigestAlgorithm.SHA_256, payload);
bodyHash = Utilities.base64Encode(bodyHash);
// 将哈希加入参数列表
params['oauth_body_hash'] = bodyHash;

添加后再执行参数排序与base字符串构造。

3. 统一编码规则 #

Python的quote_plus与GAS的encodeURIComponent对部分字符（如! ' ( ) *）的编码逻辑不同，OAuth1要求按RFC 3986编码所有特殊字符，需修改GAS的参数编码逻辑：

var paramStr = paramKeys.map(function(key) {
  // 补全encodeURIComponent未编码的特殊字符
  var encodedKey = encodeURIComponent(key)
    .replace(/!/g, '%21')
    .replace(/'/g, '%27')
    .replace(/\(/g, '%28')
    .replace(/\)/g, '%29')
    .replace(/\*/g, '%2A');
  var encodedValue = encodeURIComponent(params[key])
    .replace(/!/g, '%21')
    .replace(/'/g, '%27')
    .replace(/\(/g, '%28')
    .replace(/\)/g, '%29')
    .replace(/\*/g, '%2A');
  return encodedKey + "=" + encodedValue;
}).join('&');

GAS中使用TBA连接NetSuite的有效方法 #

TBA本质是OAuth1.0a协议的实现，核心是正确完成签名流程，步骤如下：

1. 获取TBA凭证：在NetSuite后台创建集成记录，获取Consumer Key、Consumer Secret，生成Token ID（对应OAuth1的Resource Owner Key）和Token Secret（对应Resource Owner Secret），记录账户Realm（NetSuite账户ID）。
2. 动态生成Nonce与Timestamp：每次请求需生成唯一的nonce（随机字符串）和当前Unix时间戳（调试时可固定）。
3. 构造签名参数：包含oauth_consumer_key、oauth_nonce、oauth_signature_method、oauth_timestamp、oauth_token、oauth_version，以及带请求体时的oauth_body_hash。
4. 生成签名：按规则构造base字符串，用Consumer Secret&Resource Owner Secret作为密钥计算HMAC-SHA256签名，base64编码后加入参数。
5. 构造请求头：将所有OAuth参数与Realm拼接成Authorization头，指定正确的Content-Type，发送请求。

完整的修复后GAS代码可参考上述修改点整合，确保每一步符合OAuth1.0a规范。

内容的提问来源于stack exchange，提问作者PaulyboyUK