baodev0
2deb4ad74e
- Implemented client access token verification middleware to secure API endpoints. - Updated ServiceController to fetch active hosting services for authenticated users. - Refactored OrderController to ensure order retrieval is customer-specific. - Improved error logging in VmController for unexpected vCenter responses. - Disabled VNPay auto-deposit in TransactionController, switching to manual deposit flow. - Enhanced ServiceClientDetailResource to include Plesk credentials for hosting accounts. - Adjusted VpsServiceResource to dynamically set page type based on product type. - Added logging for PowerShellService to capture errors in RDP port changes. - Provisioning job now resolves service plans and logs relevant information for hosting accounts. - Updated database migrations to add necessary fields for service plans and DNS servers. - Refactored Service and ServicePlan models to establish relationships with hosting accounts and DNS servers.
51 lines
1.4 KiB
PHP
51 lines
1.4 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
|
|
class ClientAccessTokenCheck
|
|
{
|
|
/**
|
|
* Verify the `x-access-token` header contains an AES-256-CBC ciphertext
|
|
* (base64(iv . ciphertext)) of the shared secret, encrypted with the
|
|
* openssl key configured in services.client_api.key. Blocks callers
|
|
* that don't hold the shared key (external scraping/direct API calls).
|
|
*/
|
|
public function handle(Request $request, Closure $next)
|
|
{
|
|
$token = $request->header('x-access-token', '');
|
|
$key = config('services.client_api.key');
|
|
|
|
if (!$key || !$this->isValid($token, $key)) {
|
|
return response()->json([
|
|
'error' => true,
|
|
'message' => 'Invalid access token',
|
|
'code' => 403,
|
|
], 403);
|
|
}
|
|
|
|
return $next($request);
|
|
}
|
|
|
|
private function isValid(string $token, string $key): bool
|
|
{
|
|
$raw = base64_decode($token, true);
|
|
if ($raw === false || strlen($raw) <= 16) {
|
|
return false;
|
|
}
|
|
|
|
$iv = substr($raw, 0, 16);
|
|
$ciphertext = substr($raw, 16);
|
|
|
|
$plaintext = openssl_decrypt($ciphertext, 'aes-256-cbc', hex2bin($key), OPENSSL_RAW_DATA, $iv);
|
|
|
|
if ($plaintext === false) {
|
|
return false;
|
|
}
|
|
|
|
return hash_equals(config('services.client_api.secret'), $plaintext);
|
|
}
|
|
}
|