feat: simplify HTTP request signing and publish revised client guide

api/src/open-api/open-api-auth.guard.ts

@@ -15,7 +15,7 @@ import IORedis from 'ioredis';
 import { PrismaService } from '../prisma/prisma.service';
 import { decryptSecret } from './open-api.crypto';
 import type { OpenApiRequestLike } from './open-api.types';
-import { openApiBodyHash, openApiSignature, publicOpenApiFailure } from './open-api.protocol';
+import { openApiSignature, publicOpenApiFailure } from './open-api.protocol';
 import { ProtocolLogsService } from '../protocol-logs/protocol-logs.service';
 import { SecurityDetectionService } from '../security-detection/security-detection.service';
 
@@ -97,14 +97,13 @@ export class OpenApiAuthGuard implements CanActivate, OnModuleDestroy {
       throw new ForbiddenException({ code: 'IP_NOT_ALLOWED', message: '当前IP不在HTTP接口白名单中' });
     }
     const path = (request.originalUrl ?? request.url ?? '').split('?')[0];
-    const bodyHash = openApiBodyHash(request.rawBody, request.body);
     const expected = openApiSignature(
       decryptSecret(credential.secretEncrypted),
       request.method,
       path,
       timestampText,
       nonce,
-      bodyHash,
+      request.rawBody,
     );
     const expectedBuffer = Buffer.from(expected, 'hex');
     const suppliedBuffer = /^[0-9a-f]{64}$/i.test(suppliedSignature)