feat: Support customizing the success and cancel url of Stripe.

[mehunk]

Summary by CodeRabbit

• New Features
  • Support for custom Stripe Checkout Success/Cancel redirect URLs with fallback to defaults.
  • New environment setting to declare trusted redirect domains for callbacks.
• Security / Validation
  • Redirect URLs are now validated against the trusted domains list; invalid URLs are rejected with localized errors.
• Tests
  • Added comprehensive tests for redirect URL validation.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Adds trusted-domain-backed validation for optional SuccessURL and CancelURL in Stripe pay flows; RequestPay now validates URLs and forwards them to genStripeLink, which accepts and applies or defaults these URLs when creating Stripe Checkout sessions.

Changes

Cohort / File(s)	Summary
Stripe payment flow controller/topup_stripe.go	Added SuccessURL and CancelURL fields to StripePayRequest; RequestPay validates those URLs against trusted domains and passes them to genStripeLink; genStripeLink signature and logic expanded to accept, default, and apply success/cancel URLs to Stripe Checkout params.
Trusted redirect configuration .env.example	Added TRUSTED_REDIRECT_DOMAINS env var documentation (comma-separated list supporting subdomains) for redirect validation.
Trusted domains initialization common/init.go, constant/env.go	New exported TrustedRedirectDomains []string and init logic that reads, normalizes, and populates it from TRUSTED_REDIRECT_DOMAINS.
URL validation logic & tests common/url_validator.go, common/url_validator_test.go	New ValidateRedirectURL(rawURL string) error that enforces http/https and checks domain/subdomain against trusted list; comprehensive unit tests covering valid, invalid, scheme, and edge cases.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant Server
    participant Stripe

    Client->>Server: POST /request-pay (amount, email, SuccessURL?, CancelURL?)
    Server->>Server: RequestPay validates payload
    Server->>Server: common.ValidateRedirectURL(SuccessURL / CancelURL)
    alt URLs valid
        Server->>Server: genStripeLink(refId, custId, email, amount, successURL, cancelURL)
    else invalid
        Server-->>Client: 400 Bad Request (localized message)
    end
    Server->>Stripe: Create Checkout Session (uses provided or default success/cancel URLs)
    Stripe-->>Server: Checkout session URL
    Server-->>Client: Respond with Stripe link

Loading

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly Related PRs

• fix: stripe支付成功未正确跳转 #1807: Modifies Stripe Checkout SuccessURL handling in the same area; likely overlaps with the new custom success/cancel URL support and defaults.

Poem

🐰
I twitched my nose and hopped to aid,
Now redirects travel where they're laid,
Success or cancel, near or far,
Trusted domains guide each star,
A joyful hop—link ready to send! 🎉

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 28.57% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately describes the main feature: supporting customization of Stripe success and cancel URLs with a whitelist-based security mechanism.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@controller/topup_stripe.go`:
- Around line 222-228: Validate user-provided successURL and cancelURL before
using them to prevent open redirects: add a helper (e.g., validateRedirectURL)
that parses the raw URL, ensures the scheme is "https" and the host matches or
belongs to an allowlist (or matches system_setting.ServerAddress's host), call
this helper immediately after reading successURL/cancelURL and return an error
(or fall back to the default) if validation fails, and update the logic that
sets successURL/cancelURL so defaults are only used when validation fails or the
parameter is empty.

[seefs001]

不知道Stripe有没有针对success和cancel地址的白名单限制。
让用户直接掺入这个地址是否有点太心大了，生成一个无法确定支付完或者取消后会去哪里的地址再发给别人，万一是一个钓鱼地址呢，转给stripe再回来可看不出来了。

[mehunk]

谢谢你的回复，我的应用场景是这样的：
我在前端又重新定制了一个用户侧的管理平台，调用 new API 的后端接口，可以让用户管理 keys、充值、查询使用记录等功能。其他接口都没问题，就是这个充值这个是个问题，因为会跳转回原来的页面，这样就从我定制的这个用户侧管理平台跑了，逻辑就全乱了，所以我需要能够制定跳转页面。这个接口不是给客户直接用的，我是要在用户侧管理平台用的。

麻烦你基于这个需求再考虑一下，如果有需要我修改的地方我可以随时修改，谢谢。

不知道Stripe有没有针对success和cancel地址的白名单限制。

我在本地已经测试过了，Stripe 没有任何限制。

[mehunk]

如果有安全方面的担心，我也可以在环境变量里面配置一个白名单，接口只能传递白名单里面的 url

[seefs001]

如果有安全方面的担心，我也可以在环境变量里面配置一个白名单，接口只能传递白名单里面的 url

嗯这倒是一个法子

[mehunk]

如果有安全方面的担心，我也可以在环境变量里面配置一个白名单，接口只能传递白名单里面的 url

嗯这倒是一个法子

@seefs001 你好，我已经按照咱们讨论的方案实现了一个可信任域名的环境变量

65fd33e