fix(core): harden settlement and wallet integration

2026-07-22 01:40:37 +08:00
parent 150c3e7ebd
commit 35f6e46958
54 changed files with 2564 additions and 359 deletions
--- a/app/Support/Integration/WalletApiRequestGuard.php
+++ b/app/Support/Integration/WalletApiRequestGuard.php
@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Support\Integration;
+
+use App\Contracts\WalletApiDnsResolver;
+
+final readonly class WalletApiRequestGuard
+{
+    private const MAX_CONNECT_TIMEOUT_SECONDS = 5;
+
+    public function __construct(
+        private WalletApiDnsResolver $dnsResolver,
+    ) {}
+
+    public function guard(?string $rawBaseUrl, int $timeoutSeconds): ?GuardedWalletApiEndpoint
+    {
+        $baseUrl = WalletApiUrlSanitizer::normalizeAndValidate($rawBaseUrl);
+        if ($baseUrl === null) {
+            return null;
+        }
+
+        $parts = parse_url($baseUrl);
+        if (! is_array($parts) || ! is_string($parts['host'] ?? null)) {
+            return null;
+        }
+
+        $hostname = trim((string) $parts['host'], '[]');
+        $port = isset($parts['port']) ? (int) $parts['port'] : 443;
+
+        if (filter_var($hostname, FILTER_VALIDATE_IP) !== false) {
+            $addresses = [$hostname];
+        } else {
+            // Pinning is required for hostnames; without cURL, a second DNS lookup could rebind.
+            if (! extension_loaded('curl')
+                || ! defined('CURLOPT_RESOLVE')
+                || (! function_exists('curl_exec') && ! function_exists('curl_multi_exec'))
+            ) {
+                return null;
+            }
+
+            try {
+                $addresses = $this->dnsResolver->resolveAll($hostname);
+            } catch (\Throwable) {
+                return null;
+            }
+        }
+
+        $addresses = array_values(array_unique(array_filter(
+            $addresses,
+            static fn (mixed $address): bool => is_string($address) && $address !== '',
+        )));
+
+        if ($addresses === []) {
+            return null;
+        }
+
+        foreach ($addresses as $address) {
+            if (! WalletApiUrlSanitizer::isPublicIp($address)) {
+                return null;
+            }
+        }
+
+        $totalTimeoutSeconds = max(1, $timeoutSeconds);
+
+        return new GuardedWalletApiEndpoint(
+            baseUrl: $baseUrl,
+            hostname: $hostname,
+            port: $port,
+            pinnedIp: $addresses[0],
+            totalTimeoutSeconds: $totalTimeoutSeconds,
+            connectTimeoutSeconds: min(self::MAX_CONNECT_TIMEOUT_SECONDS, $totalTimeoutSeconds),
+        );
+    }
+}