From a9f468c51b3a06674d8cfb1d3a4aad1b70d474ec Mon Sep 17 00:00:00 2001
From: adonis <mseddighi99.ms@gmail.com>
Date: Thu, 4 Jun 2026 17:39:06 +0330
Subject: [PATCH] zarbox added 7

---
 app/Http/Middleware/ValidateRequests.php      | 16 ++++++------
 app/Services/ConfigService.php                | 16 ++++++++++++
 config/price_providers.php                    |  2 ++
 config/services.php                           |  6 +++++
 database/sql/goldali_database_settings.sql    | 13 ++++++++++
 .../sql/goldali_settings_full_catalog.sql     | 25 ++++++++++++++++++-
 database/sql/khaneghi_settings_catalog.sql    | 18 ++++++++++++-
 7 files changed, 87 insertions(+), 9 deletions(-)

diff --git a/app/Http/Middleware/ValidateRequests.php b/app/Http/Middleware/ValidateRequests.php
index 5f31d97..a342469 100644
--- a/app/Http/Middleware/ValidateRequests.php
+++ b/app/Http/Middleware/ValidateRequests.php
@@ -2,10 +2,10 @@
 
 namespace App\Http\Middleware;
 
+use App\Services\ConfigService;
 use Closure;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
-use Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException;
 
 class ValidateRequests
 {
@@ -21,14 +21,16 @@ class ValidateRequests
             abort(401, 'Missing HMAC headers');
         }
 
-        if ($clientId !== config('services.node.client_id')) {
-            abort(401, 'Invalid client id');
+        $config = app(ConfigService::class);
+        $expectedClientId = $config->nodeClientId();
+        $secret = $config->nodeSharedSecret();
+
+        if ($expectedClientId === '' || $secret === '') {
+            abort(500, 'Node API credentials not configured (settings: node_client_id, node_shared_secret)');
         }
 
-        /** ✅ اینجا SECRET واقعاً استفاده می‌شود */
-        $secret = config('services.node.secret');
-        if (!$secret) {
-            abort(500, 'Node shared secret not configured');
+        if ($clientId !== $expectedClientId) {
+            abort(401, 'Invalid client id');
         }
 
 
diff --git a/app/Services/ConfigService.php b/app/Services/ConfigService.php
index 04e2ace..9a9103c 100644
--- a/app/Services/ConfigService.php
+++ b/app/Services/ConfigService.php
@@ -56,6 +56,22 @@ class ConfigService
         return (int) ($value === false || $value === null || $value === '' ? $default : $value);
     }
 
+    /** X-Client-Id برای API خارجی (HMAC) — اول settings، بعد .env NODE_CLIENT_ID */
+    public function nodeClientId(): string
+    {
+        $fromDb = $this->getString('node_client_id', '');
+
+        return $fromDb !== '' ? $fromDb : (string) env('NODE_CLIENT_ID', '');
+    }
+
+    /** کلید امضای HMAC — اول settings، بعد .env NODE_SHARED_SECRET */
+    public function nodeSharedSecret(): string
+    {
+        $fromDb = $this->getString('node_shared_secret', '');
+
+        return $fromDb !== '' ? $fromDb : (string) env('NODE_SHARED_SECRET', '');
+    }
+
     /** اختلاف خرید نمایش (/api/price/last) — fee_single / buy_fee */
     public function displayBuySpreadRial(): float
     {
diff --git a/config/price_providers.php b/config/price_providers.php
index 7fc0b06..7fbf1aa 100644
--- a/config/price_providers.php
+++ b/config/price_providers.php
@@ -23,6 +23,8 @@ return [
     'register_referral_sms_to_referrer' => false,
     'register_referral_bonus_message' => false,
     'external_order_api_enabled' => false,
+    'node_client_id' => '',
+    'node_shared_secret' => '',
     'profit_gold_api_enabled' => false,
     'open_register' => true,
     'auto_active_customer' => false,
diff --git a/config/services.php b/config/services.php
index 2f89270..aa52f9b 100644
--- a/config/services.php
+++ b/config/services.php
@@ -30,6 +30,12 @@ return [
         'region' => env('AWS_DEFAULT_REGION', 'us-east-1'),
     ],
 
+    /*
+     * API خارجی (get_wallet / order) — مقدار واقعی از settings خوانده می‌شود:
+     *   node_client_id      (یا fallback NODE_CLIENT_ID)
+     *   node_shared_secret  (یا fallback NODE_SHARED_SECRET)
+     * ValidateRequests از ConfigService استفاده می‌کند.
+     */
     'node' => [
         'client_id' => env('NODE_CLIENT_ID'),
         'secret' => env('NODE_SHARED_SECRET'),
diff --git a/database/sql/goldali_database_settings.sql b/database/sql/goldali_database_settings.sql
index ed13469..c3ada39 100644
--- a/database/sql/goldali_database_settings.sql
+++ b/database/sql/goldali_database_settings.sql
@@ -62,6 +62,19 @@ SELECT 'profit_gold_api_enabled', 'true', 'API سود طلا', 0, 1, NULL
 WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'profit_gold_api_enabled' LIMIT 1);
 UPDATE `settings` SET `value` = 'true' WHERE `key` = 'profit_gold_api_enabled';
 
+-- API خارجی HMAC (قبلاً فقط در .env: NODE_CLIENT_ID / NODE_SHARED_SECRET)
+INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
+SELECT 'node_client_id', '', 'شناسه کلاینت API خارجی', 1, 1, 'از .env کپی کنید'
+WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'node_client_id' LIMIT 1);
+INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
+SELECT 'node_shared_secret', '', 'کلید HMAC API خارجی', 1, 1, 'از .env کپی کنید'
+WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'node_shared_secret' LIMIT 1);
+INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
+SELECT 'external_order_api_enabled', 'true', 'API سفارش خارجی', 1, 1, NULL
+WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'external_order_api_enabled' LIMIT 1);
+UPDATE `settings` SET `value` = 'true' WHERE `key` = 'external_order_api_enabled';
+-- بعد از اجرا در پنل: node_client_id و node_shared_secret را با مقادیر .env پر کنید
+
 INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
 SELECT 'balance_report_exclude_customer_id', '12', 'حذف مشتری از تراز ادمین', 0, 1, NULL
 WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'balance_report_exclude_customer_id' LIMIT 1);
diff --git a/database/sql/goldali_settings_full_catalog.sql b/database/sql/goldali_settings_full_catalog.sql
index 7aaea90..a8c398e 100644
--- a/database/sql/goldali_settings_full_catalog.sql
+++ b/database/sql/goldali_settings_full_catalog.sql
@@ -100,6 +100,19 @@ INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `de
 SELECT 'display_montzar', 'false', 'نمایش بلوک همکار در UI', 1, 1, NULL
 WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'display_montzar' LIMIT 1);
 
+-- API خارجی Node (HMAC) — معادل NODE_CLIENT_ID / NODE_SHARED_SECRET در .env
+INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
+SELECT 'node_client_id', '', 'شناسه کلاینت API خارجی (X-Client-Id)', 1, 1, 'مقدار قبلی .env: NODE_CLIENT_ID'
+WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'node_client_id' LIMIT 1);
+
+INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
+SELECT 'node_shared_secret', '', 'کلید امضای HMAC API خارجی', 1, 1, 'مقدار قبلی .env: NODE_SHARED_SECRET'
+WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'node_shared_secret' LIMIT 1);
+
+INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
+SELECT 'external_order_api_enabled', 'true', 'فعال‌سازی API سفارش خارجی (get_wallet / order)', 1, 1, 'true + node_client_id + node_shared_secret'
+WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'external_order_api_enabled' LIMIT 1);
+
 -- Jibit
 INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
 SELECT 'jibit_verification', 'true', 'تأیید کارت بانکی با جیبیت', 1, 1, 'true/false — BankAccountController'
@@ -267,6 +280,15 @@ WHERE `key` = 'jibit_verification';
 UPDATE `settings` SET `title_fa` = COALESCE(NULLIF(TRIM(`title_fa`), ''), 'تأیید ثبت‌نام جیبیت'), `can_edit` = 1
 WHERE `key` = 'register_jibit_verify';
 
+UPDATE `settings` SET `title_fa` = COALESCE(NULLIF(TRIM(`title_fa`), ''), 'شناسه کلاینت API خارجی'), `can_edit` = 1
+WHERE `key` = 'node_client_id';
+
+UPDATE `settings` SET `title_fa` = COALESCE(NULLIF(TRIM(`title_fa`), ''), 'کلید HMAC API خارجی'), `can_edit` = 1
+WHERE `key` = 'node_shared_secret';
+
+UPDATE `settings` SET `title_fa` = COALESCE(NULLIF(TRIM(`title_fa`), ''), 'API سفارش خارجی'), `can_edit` = 1
+WHERE `key` = 'external_order_api_enabled';
+
 UPDATE `settings` SET `title_fa` = COALESCE(NULLIF(TRIM(`title_fa`), ''), 'بسته بودن همکار'), `can_edit` = 1
 WHERE `key` = 'montzar_closed';
 
@@ -331,7 +353,7 @@ UPDATE `settings` SET `type` = 'switch' WHERE `key` IN (
   'has_page_physical_gold', 'has_chat', 'charge_notif', 'group_sms', 'display_montzar',
   'montzar_closed', 'montzar_open_buy', 'montzar_open_sell', 'is_requaire_referral',
   'product_update_price_on_list', 'product_auto_close_open_on_list', 'payping_fin_sync_enabled',
-  'fee_free'
+  'fee_free', 'external_order_api_enabled'
 );
 
 -- number
@@ -351,6 +373,7 @@ UPDATE `settings` SET `type` = 'text' WHERE `key` IN (
   'montzar_truly_buy_mazaneh', 'montzar_truly_sell_mazaneh', 'startDay', 'endDay',
   'payping_start_url', 'payping_verify_url', 'payping_gateway_items', 'payping_fin_url',
   'payping_fin_token', 'payping_gateway_item', 'tahesab_token', 'tahesab_db',
+  'node_client_id', 'node_shared_secret',
   'tahesab_bank_account', 'telegram_bot_token', 'bale_bot_token', 'referral_limit',
   'referral_bonus_amount', 'metal_type', 'montify_name', 'price_extreme_date',
   'liman_token'
diff --git a/database/sql/khaneghi_settings_catalog.sql b/database/sql/khaneghi_settings_catalog.sql
index 8369333..3ac58d6 100644
--- a/database/sql/khaneghi_settings_catalog.sql
+++ b/database/sql/khaneghi_settings_catalog.sql
@@ -187,6 +187,21 @@ INSERT INTO `const` (`key`, `value`, `title_fa`)
 SELECT 'limited_price', '0', 'سقف واریز اولیه'
 WHERE NOT EXISTS (SELECT 1 FROM `const` WHERE `key` = 'limited_price' LIMIT 1);
 
+-- -----------------------------------------------------------------------------
+-- API خارجی Node (HMAC) — NODE_CLIENT_ID / NODE_SHARED_SECRET
+-- -----------------------------------------------------------------------------
+INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
+SELECT 'node_client_id', '', 'شناسه کلاینت API خارجی (X-Client-Id)', 1, 1, 'fallback: .env NODE_CLIENT_ID'
+WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'node_client_id' LIMIT 1);
+
+INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
+SELECT 'node_shared_secret', '', 'کلید امضای HMAC API خارجی', 1, 1, 'fallback: .env NODE_SHARED_SECRET'
+WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'node_shared_secret' LIMIT 1);
+
+INSERT INTO `settings` (`key`, `value`, `title_fa`, `can_edit`, `is_active`, `description`)
+SELECT 'external_order_api_enabled', 'false', 'API سفارش خارجی (get_wallet / order)', 1, 1, NULL
+WHERE NOT EXISTS (SELECT 1 FROM `settings` WHERE `key` = 'external_order_api_enabled' LIMIT 1);
+
 -- -----------------------------------------------------------------------------
 -- عنوان فارسی + can_edit برای کلیدهای موجود
 -- -----------------------------------------------------------------------------
@@ -217,7 +232,8 @@ UPDATE `settings` SET `type` = 'longtext' WHERE `key` IN ('text_rule', 'text_abo
 UPDATE `settings` SET `type` = 'select', `description` = 'montzar,zaarbox,main_product,etehadie,taban_gohar' WHERE `key` = 'price_provider';
 UPDATE `settings` SET `type` = 'switch' WHERE `key` IN (
   'jibit_verification', 'register_jibit_verify', 'montzar_price', 'main_product_price',
-  'tabanGohar_price', 'show_last_price', 'close_price', 'montzar_closed', 'montzar_open_buy', 'montzar_open_sell', 'display_montzar'
+  'tabanGohar_price', 'show_last_price', 'close_price', 'montzar_closed', 'montzar_open_buy', 'montzar_open_sell', 'display_montzar',
+  'external_order_api_enabled'
 );
 UPDATE `settings` SET `type` = 'number' WHERE `key` IN ('fee_single', 'buy_fee', 'sell_fee', 'fee_cash', 'fee_service_charge_percentage', 'montzar_product_id');
 UPDATE `settings` SET `type` = 'text' WHERE `type` IS NULL OR TRIM(`type`) = '';