gavindiaz/PolyWeather
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: require auth token for manual payments

Browse Source
This commit is contained in:
2569718930@qq.com
2026-05-30 14:09:57 +08:00
parent c26f89f134
commit 57240e02ee
2 changed files with 12 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/components/account/__tests__/paymentShell.test.ts
+9
View File
@@ -58,6 +58,10 @@ export function runTests() {
const hookSource = fs.existsSync(hookPath) const hookSource = fs.existsSync(hookPath)
? fs.readFileSync(hookPath, "utf8") ? fs.readFileSync(hookPath, "utf8")
: ""; : "";
const paymentFlowSource = fs.readFileSync(
path.join(accountDir, "usePaymentFlow.ts"),
"utf8",
);
assert( assert(
(accountCenterSource.includes('import { usePaymentState } from "./usePaymentState";') || (accountCenterSource.includes('import { usePaymentState } from "./usePaymentState";') ||
hookSource.includes('import { usePaymentState } from "./usePaymentState";')) && hookSource.includes('import { usePaymentState } from "./usePaymentState";')) &&
@@ -327,4 +331,9 @@ export function runTests() {
paymentRuntimeRouteSource.includes("includeSupabaseIdentity: false"), paymentRuntimeRouteSource.includes("includeSupabaseIdentity: false"),
"payment runtime proxy must not read Supabase session cookies because backend entitlement token already protects the runtime status payload", "payment runtime proxy must not read Supabase session cookies because backend entitlement token already protects the runtime status payload",
); );
assert(
(paymentFlowSource.match(/await buildAuthedHeaders\(true, true\);/g) || [])
.length >= 3,
"manual payment mutations must require a valid Supabase bearer token instead of forwarding unauthenticated requests that surface raw backend JSON",
);
} }
frontend/components/account/usePaymentFlow.ts
+3 -3
View File
@@ -632,7 +632,7 @@ export function usePaymentFlow(params: UsePaymentFlowParams) {
setPaymentBusy(true); setPaymentBusy(true);
try { try {
const authHeaders = await buildAuthedHeaders(true, false); const authHeaders = await buildAuthedHeaders(true, true);
const createRes = await fetch("/api/payments/intents", { const createRes = await fetch("/api/payments/intents", {
method: "POST", method: "POST",
headers: authHeaders, headers: authHeaders,
@@ -704,7 +704,7 @@ export function usePaymentFlow(params: UsePaymentFlowParams) {
setPaymentBusy(true); setPaymentBusy(true);
setPaymentError(""); setPaymentError("");
try { try {
const authHeaders = await buildAuthedHeaders(true, false); const authHeaders = await buildAuthedHeaders(true, true);
const submitRes = await fetch(`/api/payments/intents/${intentIdVal}/submit`, { const submitRes = await fetch(`/api/payments/intents/${intentIdVal}/submit`, {
method: "POST", headers: authHeaders, body: JSON.stringify({ tx_hash: txHashNorm }), method: "POST", headers: authHeaders, body: JSON.stringify({ tx_hash: txHashNorm }),
}); });
@@ -762,7 +762,7 @@ export function usePaymentFlow(params: UsePaymentFlowParams) {
} }
setTxValidation({ loading: true, checked: false }); setTxValidation({ loading: true, checked: false });
try { try {
const headers = await buildAuthedHeaders(true, false); const headers = await buildAuthedHeaders(true, true);
const res = await fetch(`/api/payments/intents/${intentId}/validate`, { const res = await fetch(`/api/payments/intents/${intentId}/validate`, {
method: "POST", headers, body: JSON.stringify({ tx_hash: hashNorm }), method: "POST", headers, body: JSON.stringify({ tx_hash: hashNorm }),
}); });