Fix/payment security issue 4353

[inoutcode]

修复 Issue

Fixes #4353

漏洞描述

攻击者可以通过伪造 Stripe webhook 回调处理非 Stripe 支付方式的订单，导致用户获得异常高额的充值额度。

修复内容

文件	修改
model/topup.go	Recharge 函数添加 payment_method 验证
controller/topup_stripe.go	StripeWebhook 函数检查 secret 配置

测试方法

1. 创建 epay 订单（不实际支付）
2. 尝试通过 Stripe webhook 端点处理该订单
3. 验证系统拒绝处理（返回支付方式不匹配错误）

安全影响

阻止跨渠道攻击，确保每个充值回调只处理对应支付方式的订单。

Summary by CodeRabbit

Release Notes

• New Features

  • Added Skills management system with full CRUD operations, search, tagging, and download tracking capabilities.
  • Introduced health check endpoint for application monitoring.
  • Implemented comprehensive multi-environment deployment infrastructure (development, staging, production).

• Bug Fixes

  • Improved payment method validation to prevent processing errors.
  • Enhanced webhook configuration handling for payment providers.
  • Optimized logging to reduce noise from infrastructure health checks.

• Documentation

  • Added extensive deployment, operations, and architecture documentation.
  • Introduced development guides covering frameworks and best practices.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a4464ea4-6bb9-43c1-a38d-87a375ef450c

📥 Commits

Reviewing files that changed from the base of the PR and between f995a86 and 3252fd2.

📒 Files selected for processing (32)

• .github/workflows/ci-cd.yml
• .gitlab-ci.yml
• DEVELOPMENT_OPS_GUIDE.md
• controller/skill.go
• controller/topup.go
• controller/topup_stripe.go
• deploy/docs/ACK_SETUP_GUIDE.md
• deploy/kubernetes/base/configmap.yaml
• deploy/kubernetes/base/hpa.yaml
• deploy/kubernetes/base/ingress.yaml
• deploy/kubernetes/base/namespace.yaml
• deploy/kubernetes/base/service.yaml
• deploy/kubernetes/overlays/prod/deployment.yaml
• deploy/kubernetes/overlays/prod/kustomization.yaml
• deploy/kubernetes/overlays/prod/secret.yaml
• deploy/kubernetes/overlays/test/deployment.yaml
• deploy/kubernetes/overlays/test/kustomization.yaml
• deploy/kubernetes/overlays/test/secret.yaml
• deploy/scripts/build_and_push_image.sh
• deploy/scripts/deploy_to_ack.sh
• docs/architecture-deep-dive.md
• docs/go-gin-tutorial.md
• docs/relay-architecture-deep-dive.md
• middleware/logger.go
• model/main.go
• model/skill.go
• model/topup.go
• router/main.go
• router/skill-router.go
• skills/README.md
• skills/downloads/.gitkeep
• test_api_refactored.py

---

Walkthrough

Adds comprehensive CI/CD pipelines for GitHub Actions and GitLab, Kubernetes deployment manifests with overlays for test/prod environments, a new Skills feature module with CRUD operations, security fixes for Stripe webhook validation, deployment scripts, and extensive project documentation covering architecture, deployment, and development practices.

Changes

Cohort / File(s)	Summary
CI/CD Pipelines .github/workflows/ci-cd.yml, .gitlab-ci.yml	Implements end-to-end CI/CD workflows with lint, test, build, security scan, and environment-specific deployments (dev/staging/prod) to Kubernetes. Includes Docker image building, Trivy security scanning, Slack notifications, and rollout verification.
Kubernetes Deployment Infrastructure deploy/kubernetes/base/..., deploy/kubernetes/overlays/test/..., deploy/kubernetes/overlays/prod/...	Defines Kubernetes manifests including Namespace, Deployment, Service, Ingress, HPA, ConfigMap, and environment-specific Secrets and Kustomize overlays for test and production deployments with resource constraints and pod anti-affinity policies.
Deployment Scripts & Setup Guides deploy/scripts/build_and_push_image.sh, deploy/scripts/deploy_to_ack.sh, deploy/docs/ACK_SETUP_GUIDE.md	Provides automated deployment scripts for building/pushing Docker images to ACR and deploying to ACK (Kubernetes), along with comprehensive setup and initialization guide for Alibaba Cloud infrastructure, kustomize configuration structure, and placeholder configuration requirements.
Skills Feature Implementation controller/skill.go, model/skill.go, router/skill-router.go, skills/README.md, skills/downloads/.gitkeep	Introduces complete Skills management module with REST endpoints for CRUD operations, search, tagging, and file downloads; includes paginated querying, soft deletes, atomic counters for downloads/stars, and static file serving for skill artifacts.
Payment System Security Fixes controller/topup_stripe.go, model/topup.go, controller/topup.go	Adds Stripe webhook secret validation guard (returns 503 if secret missing), validates payment method consistency in Recharge function, and migrates error responses to standardized ApiError helpers to prevent cross-provider payment spoofing attacks.
Core Infrastructure Updates model/main.go, middleware/logger.go, router/main.go	Adds Skill table to database auto-migration, suppresses health check logs from logger, registers health endpoint (/health), and integrates Skill router into main routing setup.
Comprehensive Documentation DEVELOPMENT_OPS_GUIDE.md, docs/architecture-deep-dive.md, docs/go-gin-tutorial.md, docs/relay-architecture-deep-dive.md	Provides extensive guides covering end-to-end development/ops practices, Alibaba Cloud architecture decisions, detailed Go/Gin framework tutorial, Relay component architecture with multi-channel adapters, and CI/CD pipeline integration steps.
API Testing & Validation test_api_refactored.py	Adds Python test script for validating OpenAI-compatible endpoints, image generation, Anthropic/Gemini APIs, with request helpers, error handling, and per-model result aggregation.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

The changes span multiple dimensions—security-critical payment system fixes requiring careful validation logic review, a complete new feature module with controller/model/router integration, substantial infrastructure-as-code (CI/CD and Kubernetes manifests), and extensive documentation. While many files contain boilerplate configuration with repetitive patterns (reducing individual file review complexity), the heterogeneity across security fixes, feature implementation, infrastructure, and docs demands separate reasoning for different cohorts. The Stripe webhook vulnerability mitigation requires careful attention to ensure completeness and correctness of validation logic.

Possibly related PRs

• fix: correct topUp link #2124 — Modifies Stripe webhook and checkout-related code in controller/topup_stripe.go, directly overlapping with this PR's payment system security enhancements.
• ✨ fix: Improve subscription payment handling and card layout consistency #2838 — Updates Epay subscription response handling in controller/topup.go, related to the payment request/response refactoring in this PR.

Suggested reviewers

• seefs001

Poem

🐰 A rabbit hops through clouds of change,
Skills bloom where once was blank and strange,
Stripe guards now watch with secret keys,
While K8s flows through clouds with ease,
From docs to pipes, the project's whole—
A warren of code, reaching its goal! 🌿

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch fix/payment-security-issue-4353

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Warning

⚠️ This pull request might be slop. It has been flagged by CodeRabbit slop detection and should be reviewed carefully.