diff --git a/.env b/.env
index 56cbb74..823eec0 100644
--- a/.env
+++ b/.env
@@ -13,6 +13,7 @@ mail_server = imap.qq.com
 api_url = https://api.paystation.co.nz
 client_id = 616562
 client_secret = CfMDrllyqBTFKrUkO2XaE7OmWTYqP3yd
+hmac = 8aU8WnITYhwaGTXH
 
 
 [journal]
diff --git a/application/api/controller/Order.php b/application/api/controller/Order.php
index 7427da7..e0e218a 100644
--- a/application/api/controller/Order.php
+++ b/application/api/controller/Order.php
@@ -69,26 +69,63 @@ class Order extends base{
 
 
     public function testPaystationLookup(){
-        $accessToken = createPayStationToken();
-        $curl = curl_init();
-        curl_setopt_array($curl, array(
-            CURLOPT_URL => 'https://api.paystation.co.nz/v1/transactions?paystation_id=616562&gateway_id=PAYSTATION&merchant_session=TMR20250225E4F6EA2F38793055&transaction_id=217661437',
-            CURLOPT_RETURNTRANSFER => true,
-            CURLOPT_ENCODING => '',
-            CURLOPT_MAXREDIRS => 10,
-            CURLOPT_TIMEOUT => 0,
-            CURLOPT_FOLLOWLOCATION => true,
-            CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
-            CURLOPT_CUSTOMREQUEST => 'GET',
-            CURLOPT_HTTPHEADER => array(
-                'Authorization: Bearer '.$accessToken
-            )
-        ));
-        $response = curl_exec($curl);
-        curl_close($curl);
-        return jsonSuccess(object_to_array(json_decode($response)));
+        $data = $this->request->post();
+        $rule = new Validate([
+            "ms"=>"require"
+        ]);
+        if(!$rule->check($data)){
+            return jsonError($rule->getError());
+        }
+        $time = time();
+        $param = "pi=616562&ms=".$data['ms'];
+
+        $hmac = hash_hmac('sha512', $time."paystation".$param, Env::get("paystation.hmac"));
+        $url = "https://payments.paystation.co.nz/lookup?".$param."&pstn_HMAC=".$hmac."&pstn_HMACTimestamp=".$time;
+        $res = myGet($url);
+        return jsonSuccess($res);
+
+    }
+
+    public function testtest(){
+        $data = $this->request->post();
+        $rule = new Validate([
+            "id"=>"require"
+        ]);
+        if(!$rule->check($data)){
+            return jsonError($rule->getError());
+        }
+        $res =  paystationLookup($data['id']);
+        return jsonSuccess(object_to_array(json_decode($res)));
+    }
 
 
+    public function getPreOrderDetail(){
+        $data = $this->request->post();
+        $rule = new Validate([
+            "article_id"=>"require"
+        ]);
+        if(!$rule->check($data)){
+            return jsonError($rule->getError());
+        }
+        $order_info = $this->order_obj->where("article_id",$data['article_id'])->whereIn("state",[0,1])->find();
+        if(!$order_info){
+            return jsonError("order not find");
+        }
+        if($order_info['pay_type']==2){
+            $paystation = $this->paystation_obj->where("ps_id",$order_info['ps_id'])->find();
+            if($order_info['state']==0){
+                $res = object_to_array(json_decode(paystationLookup($paystation['transaction_id'])));
+                if(isset($res['result']['success'])&&$res['result']['success']){
+                    $this->article_obj->where("article_id",$order_info['article_id'])->update(['is_buy'=>1]);
+                    $this->order_obj->where("order_id",$order_info['order_id'])->update(['state'=>1]);
+                }
+            }
+            $order_info['paystation'] = $paystation;
+            $re['detail'] = $order_info;
+            return jsonSuccess($re);
+        }else{
+            return jsonError("Payment type error");
+        }
     }
 
 
@@ -176,6 +213,7 @@ class Order extends base{
                 "merchant_session" => $ca_sn,
                 "merchant_reference"=>$ca_sn,
                 "amount" =>(int)((((int)$journal_info['fee'])*726/416)*100),
+//                "amount" =>100,
 //                "currency"=>"USD",//目前paystation仅支持nzd
                 "return_url"=>"https://submission.tmrjournals.com/success?id=".$article_info['article_id'],
                 "response_url"=>"http://api.tmrjournals.com/public/index.php/api/Order/completePaystation"
diff --git a/application/api/controller/Preaccept.php b/application/api/controller/Preaccept.php
index f8a0197..2b68c77 100644
--- a/application/api/controller/Preaccept.php
+++ b/application/api/controller/Preaccept.php
@@ -690,7 +690,15 @@ class Preaccept extends Base
         }
         $order_info = $this->order_obj->where("article_id",$article_info['article_id'])->find();
         if($order_info['pay_type']==2){
-            $order_info['paystation'] = $this->paystation_obj->where("ps_id",$order_info['ps_id'])->find();
+            $paystation = $this->paystation_obj->where("ps_id",$order_info['ps_id'])->find();
+            if($order_info['state']==0){
+                $res = object_to_array(json_decode(paystationLookup($paystation['transaction_id'])));
+                if(isset($res['result']['success'])&&$res['result']['success']){
+                    $this->article_obj->where("article_id",$order_info['article_id'])->update(['is_buy'=>1]);
+                    $this->order_obj->where("order_id",$order_info['order_id'])->update(['state'=>1]);
+                }
+            }
+            $order_info['paystation'] = $paystation;
         }
         $re['state'] = $order_info?$order_info['state']:0;
         $re['fee'] = $journal_info['fee'];
diff --git a/application/common.php b/application/common.php
index a4249de..ff032c4 100644
--- a/application/common.php
+++ b/application/common.php
@@ -929,6 +929,27 @@ function aliemail($email,$title,$content,$has_hb=1){
     return $res;
 }
 
+function paystationLookup($transactionId){
+    $curl = curl_init();
+    curl_setopt_array($curl, array(
+        CURLOPT_URL => 'https://api.paystation.co.nz/v1/transactions/'.$transactionId,
+        CURLOPT_RETURNTRANSFER => true,
+        CURLOPT_ENCODING => '',
+        CURLOPT_MAXREDIRS => 10,
+        CURLOPT_TIMEOUT => 0,
+        CURLOPT_FOLLOWLOCATION => true,
+        CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
+        CURLOPT_CUSTOMREQUEST => 'GET',
+        CURLOPT_HTTPHEADER => array(
+            'Content-Type: application/json',
+            'Authorization: Bearer '.createPayStationToken()
+        )
+    ));
+    $response = curl_exec($curl);
+    curl_close($curl);
+    return $response;
+}
+
 function createPayStationToken(){
     $bodyParams = [
         'client_id' => Env::get("paystation.client_id"),