75 lines
2.2 KiB
PHP
75 lines
2.2 KiB
PHP
<?php
|
|
|
|
namespace App\Support\Integration;
|
|
|
|
use App\Contracts\WalletApiDnsResolver;
|
|
|
|
final readonly class WalletApiRequestGuard
|
|
{
|
|
private const MAX_CONNECT_TIMEOUT_SECONDS = 5;
|
|
|
|
public function __construct(
|
|
private WalletApiDnsResolver $dnsResolver,
|
|
) {}
|
|
|
|
public function guard(?string $rawBaseUrl, int $timeoutSeconds): ?GuardedWalletApiEndpoint
|
|
{
|
|
$baseUrl = WalletApiUrlSanitizer::normalizeAndValidate($rawBaseUrl);
|
|
if ($baseUrl === null) {
|
|
return null;
|
|
}
|
|
|
|
$parts = parse_url($baseUrl);
|
|
if (! is_array($parts) || ! is_string($parts['host'] ?? null)) {
|
|
return null;
|
|
}
|
|
|
|
$hostname = trim((string) $parts['host'], '[]');
|
|
$port = isset($parts['port']) ? (int) $parts['port'] : 443;
|
|
|
|
if (filter_var($hostname, FILTER_VALIDATE_IP) !== false) {
|
|
$addresses = [$hostname];
|
|
} else {
|
|
// Pinning is required for hostnames; without cURL, a second DNS lookup could rebind.
|
|
if (! extension_loaded('curl')
|
|
|| ! defined('CURLOPT_RESOLVE')
|
|
|| (! function_exists('curl_exec') && ! function_exists('curl_multi_exec'))
|
|
) {
|
|
return null;
|
|
}
|
|
|
|
try {
|
|
$addresses = $this->dnsResolver->resolveAll($hostname);
|
|
} catch (\Throwable) {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
$addresses = array_values(array_unique(array_filter(
|
|
$addresses,
|
|
static fn (mixed $address): bool => is_string($address) && $address !== '',
|
|
)));
|
|
|
|
if ($addresses === []) {
|
|
return null;
|
|
}
|
|
|
|
foreach ($addresses as $address) {
|
|
if (! WalletApiUrlSanitizer::isPublicIp($address)) {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
$totalTimeoutSeconds = max(1, $timeoutSeconds);
|
|
|
|
return new GuardedWalletApiEndpoint(
|
|
baseUrl: $baseUrl,
|
|
hostname: $hostname,
|
|
port: $port,
|
|
pinnedIp: $addresses[0],
|
|
totalTimeoutSeconds: $totalTimeoutSeconds,
|
|
connectTimeoutSeconds: min(self::MAX_CONNECT_TIMEOUT_SECONDS, $totalTimeoutSeconds),
|
|
);
|
|
}
|
|
}
|