c0mrade 82958801b5 fix: harden webhook signature verification across all payment providers ...

- Replace fail-open with fail-closed in CryptoBot, Heleket, Tribute webhooks
  (missing API key now rejects instead of accepting)
- Use hmac.compare_digest for timing-safe comparison in Freekassa, KassaAI,
  Pal24, and Platega webhook verification
- CloudPayments: reject webhooks when signature header is missing but
  API_SECRET is configured (check, pay, fail, universal endpoints)
- CloudPayments: return code 13 (reject) instead of code 0 on parse errors
  and exception handlers to prevent fail-open

2026-03-23 18:45:46 +03:00

..

ban_system_api.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

cryptobot.py

fix: comprehensive security hardening across payment and API layers

2026-03-23 16:44:38 +03:00

heleket_webhook.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

heleket.py

fix: comprehensive security hardening across payment and API layers

2026-03-23 16:44:38 +03:00

pal24_client.py

fix: harden webhook signature verification across all payment providers

2026-03-23 18:45:46 +03:00

remnawave_api.py

fix: add diagnostic payload logging in create_user error path

2026-03-21 04:08:18 +03:00

telegram_stars.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00

tribute.py

fix: harden webhook signature verification across all payment providers

2026-03-23 18:45:46 +03:00

wata_webhook.py

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

webhook_server.py

fix: fix Platega and CryptoBot webhook verification

2026-03-18 20:11:55 +03:00

yookassa_webhook.py

fix: устранение race conditions и атомарность платёжной системы

2026-03-06 04:20:41 +03:00