zarbox added 7

app/Http/Middleware/ValidateRequests.php

@@ -2,10 +2,10 @@
 
 namespace App\Http\Middleware;
 
+use App\Services\ConfigService;
 use Closure;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Cache;
-use Symfony\Component\HttpKernel\Exception\UnprocessableEntityHttpException;
 
 class ValidateRequests
 {
@@ -21,14 +21,16 @@ class ValidateRequests
             abort(401, 'Missing HMAC headers');
         }
 
-        if ($clientId !== config('services.node.client_id')) {
-            abort(401, 'Invalid client id');
+        $config = app(ConfigService::class);
+        $expectedClientId = $config->nodeClientId();
+        $secret = $config->nodeSharedSecret();
+
+        if ($expectedClientId === '' || $secret === '') {
+            abort(500, 'Node API credentials not configured (settings: node_client_id, node_shared_secret)');
         }
 
-        /** ✅ اینجا SECRET واقعاً استفاده می‌شود */
-        $secret = config('services.node.secret');
-        if (!$secret) {
-            abort(500, 'Node shared secret not configured');
+        if ($clientId !== $expectedClientId) {
+            abort(401, 'Invalid client id');
         }
 
 

app/Services/ConfigService.php

@@ -56,6 +56,22 @@ class ConfigService
         return (int) ($value === false || $value === null || $value === '' ? $default : $value);
     }
 
+    /** X-Client-Id برای API خارجی (HMAC) — اول settings، بعد .env NODE_CLIENT_ID */
+    public function nodeClientId(): string
+    {
+        $fromDb = $this->getString('node_client_id', '');
+
+        return $fromDb !== '' ? $fromDb : (string) env('NODE_CLIENT_ID', '');
+    }
+
+    /** کلید امضای HMAC — اول settings، بعد .env NODE_SHARED_SECRET */
+    public function nodeSharedSecret(): string
+    {
+        $fromDb = $this->getString('node_shared_secret', '');
+
+        return $fromDb !== '' ? $fromDb : (string) env('NODE_SHARED_SECRET', '');
+    }
+
     /** اختلاف خرید نمایش (/api/price/last) — fee_single / buy_fee */
     public function displayBuySpreadRial(): float
     {