mirror of
https://github.com/BEDOLAGA-DEV/remnawave-bedolaga-telegram-bot.git
synced 2026-01-19 19:32:10 +00:00
403 lines
14 KiB
Python
403 lines
14 KiB
Python
from __future__ import annotations
|
||
|
||
import asyncio
|
||
import logging
|
||
import json
|
||
from ipaddress import (
|
||
IPv4Address,
|
||
IPv4Network,
|
||
IPv6Address,
|
||
IPv6Network,
|
||
ip_address,
|
||
ip_network,
|
||
)
|
||
from typing import Iterable, Optional, Dict, Any, List, Union, Tuple, TYPE_CHECKING
|
||
from aiohttp import web
|
||
|
||
from app.config import settings
|
||
from app.database.database import AsyncSessionLocal
|
||
|
||
if TYPE_CHECKING:
|
||
from app.services.payment_service import PaymentService
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
|
||
IPAddress = Union[IPv4Address, IPv6Address]
|
||
IPNetwork = Union[IPv4Network, IPv6Network]
|
||
|
||
YOOKASSA_ALLOWED_IP_NETWORKS: tuple[IPNetwork, ...] = (
|
||
ip_network("185.71.76.0/27"),
|
||
ip_network("185.71.77.0/27"),
|
||
ip_network("77.75.153.0/25"),
|
||
ip_network("77.75.154.128/25"),
|
||
ip_network("77.75.156.11/32"),
|
||
ip_network("77.75.156.35/32"),
|
||
ip_network("2a02:5180::/32"),
|
||
)
|
||
|
||
|
||
CLOUDFLARE_TRUSTED_NETWORKS: tuple[IPNetwork, ...] = (
|
||
ip_network("173.245.48.0/20"),
|
||
ip_network("103.21.244.0/22"),
|
||
ip_network("103.22.200.0/22"),
|
||
ip_network("103.31.4.0/22"),
|
||
ip_network("141.101.64.0/18"),
|
||
ip_network("108.162.192.0/18"),
|
||
ip_network("190.93.240.0/20"),
|
||
ip_network("188.114.96.0/20"),
|
||
ip_network("197.234.240.0/22"),
|
||
ip_network("198.41.128.0/17"),
|
||
ip_network("162.158.0.0/15"),
|
||
ip_network("104.16.0.0/13"),
|
||
ip_network("104.24.0.0/14"),
|
||
ip_network("172.64.0.0/13"),
|
||
ip_network("131.0.72.0/22"),
|
||
ip_network("2400:cb00::/32"),
|
||
ip_network("2606:4700::/32"),
|
||
ip_network("2803:f800::/32"),
|
||
ip_network("2405:b500::/32"),
|
||
ip_network("2405:8100::/32"),
|
||
ip_network("2a06:98c0::/29"),
|
||
ip_network("2c0f:f248::/32"),
|
||
)
|
||
|
||
|
||
YOOKASSA_ALLOWED_EVENTS: tuple[str, ...] = (
|
||
"payment.succeeded",
|
||
"payment.waiting_for_capture",
|
||
"payment.canceled",
|
||
)
|
||
|
||
|
||
def collect_yookassa_ip_candidates(*values: Optional[str]) -> List[str]:
|
||
candidates: List[str] = []
|
||
for value in values:
|
||
if not value:
|
||
continue
|
||
for part in value.split(","):
|
||
normalized = part.strip()
|
||
if normalized:
|
||
candidates.append(normalized)
|
||
return candidates
|
||
|
||
|
||
def _parse_candidate_ip(candidate: str) -> Optional[IPAddress]:
|
||
value = candidate.strip()
|
||
if not value:
|
||
return None
|
||
|
||
if value.startswith("[") and "]" in value:
|
||
value = value[1:value.index("]")]
|
||
|
||
if "%" in value:
|
||
value = value.split("%", 1)[0]
|
||
|
||
if value.count(":") == 1 and "." in value:
|
||
host, _, port = value.rpartition(":")
|
||
if port.isdigit():
|
||
value = host
|
||
|
||
try:
|
||
return ip_address(value)
|
||
except ValueError:
|
||
return None
|
||
|
||
|
||
def _should_trust_forwarded_headers(remote_ip: Optional[IPAddress]) -> bool:
|
||
if remote_ip is None:
|
||
return True
|
||
|
||
if _is_trusted_proxy_ip(remote_ip):
|
||
return True
|
||
|
||
return any(
|
||
getattr(remote_ip, attribute)
|
||
for attribute in ("is_private", "is_loopback", "is_link_local", "is_reserved")
|
||
)
|
||
|
||
|
||
_TRUSTED_PROXY_NETWORKS_CACHE: Tuple[str, Tuple[IPNetwork, ...]] = ("", ())
|
||
|
||
|
||
def _get_trusted_proxy_networks() -> Tuple[IPNetwork, ...]:
|
||
global _TRUSTED_PROXY_NETWORKS_CACHE
|
||
|
||
raw_value = getattr(settings, "YOOKASSA_TRUSTED_PROXY_NETWORKS", "") or ""
|
||
cached_raw, cached_networks = _TRUSTED_PROXY_NETWORKS_CACHE
|
||
|
||
if raw_value == cached_raw:
|
||
return cached_networks
|
||
|
||
networks: List[IPNetwork] = []
|
||
for part in raw_value.split(","):
|
||
candidate = part.strip()
|
||
if not candidate:
|
||
continue
|
||
|
||
try:
|
||
networks.append(ip_network(candidate, strict=False))
|
||
except ValueError:
|
||
logger.warning("Неверная сеть доверенного прокси YooKassa: %s", candidate)
|
||
|
||
cached_networks = tuple(networks)
|
||
_TRUSTED_PROXY_NETWORKS_CACHE = (raw_value, cached_networks)
|
||
return cached_networks
|
||
|
||
|
||
def _is_trusted_proxy_ip(ip_object: IPAddress) -> bool:
|
||
if any(
|
||
getattr(ip_object, attribute)
|
||
for attribute in ("is_private", "is_loopback", "is_link_local", "is_reserved")
|
||
):
|
||
return True
|
||
|
||
if any(ip_object in network for network in CLOUDFLARE_TRUSTED_NETWORKS):
|
||
return True
|
||
|
||
return any(ip_object in network for network in _get_trusted_proxy_networks())
|
||
|
||
|
||
def resolve_yookassa_ip(
|
||
candidates: Iterable[str],
|
||
*,
|
||
remote: Optional[str] = None,
|
||
) -> Optional[IPAddress]:
|
||
remote_ip = _parse_candidate_ip(remote) if remote else None
|
||
|
||
if (
|
||
remote_ip is not None
|
||
and remote_ip.is_global
|
||
and not _is_trusted_proxy_ip(remote_ip)
|
||
):
|
||
return remote_ip
|
||
|
||
candidate_list = list(candidates)
|
||
|
||
if _should_trust_forwarded_headers(remote_ip):
|
||
last_hop = remote_ip
|
||
for candidate in reversed(candidate_list):
|
||
ip_object = _parse_candidate_ip(candidate)
|
||
if ip_object is not None:
|
||
if last_hop is None or _is_trusted_proxy_ip(last_hop):
|
||
if _is_trusted_proxy_ip(ip_object):
|
||
last_hop = ip_object
|
||
continue
|
||
return ip_object
|
||
break
|
||
|
||
if last_hop is not None and not _is_trusted_proxy_ip(last_hop):
|
||
return last_hop
|
||
|
||
return remote_ip if remote_ip is not None else next(
|
||
(ip for ip in (_parse_candidate_ip(value) for value in candidate_list) if ip is not None),
|
||
None,
|
||
)
|
||
|
||
|
||
def is_yookassa_ip_allowed(ip_object: IPAddress) -> bool:
|
||
return any(ip_object in network for network in YOOKASSA_ALLOWED_IP_NETWORKS)
|
||
|
||
|
||
class YooKassaWebhookHandler:
|
||
|
||
def __init__(self, payment_service: PaymentService):
|
||
self.payment_service = payment_service
|
||
|
||
async def handle_webhook(self, request: web.Request) -> web.Response:
|
||
|
||
try:
|
||
logger.info(f"📥 Получен YooKassa webhook: {request.method} {request.path}")
|
||
logger.info(f"📋 Headers: {dict(request.headers)}")
|
||
|
||
header_ip_candidates = collect_yookassa_ip_candidates(
|
||
request.headers.get("X-Forwarded-For"),
|
||
request.headers.get("X-Real-IP"),
|
||
request.headers.get("Cf-Connecting-Ip"),
|
||
)
|
||
client_ip = resolve_yookassa_ip(
|
||
header_ip_candidates,
|
||
remote=request.remote,
|
||
)
|
||
|
||
if client_ip is None:
|
||
logger.warning(
|
||
"🚫 Не удалось определить IP-адрес отправителя YooKassa webhook. Кандидаты: %s",
|
||
header_ip_candidates + ([request.remote] if request.remote else []),
|
||
)
|
||
return web.Response(status=403, text="Forbidden")
|
||
|
||
if not is_yookassa_ip_allowed(client_ip):
|
||
logger.warning(
|
||
"🚫 YooKassa webhook отклонён: IP %s не входит в доверенные диапазоны (%s)",
|
||
client_ip,
|
||
", ".join(str(network) for network in YOOKASSA_ALLOWED_IP_NETWORKS),
|
||
)
|
||
return web.Response(status=403, text="Forbidden")
|
||
|
||
logger.info("🌐 IP-адрес YooKassa подтверждён: %s", client_ip)
|
||
|
||
body = await request.text()
|
||
|
||
if not body:
|
||
logger.warning("⚠️ Получен пустой webhook от YooKassa")
|
||
return web.Response(status=400, text="Empty body")
|
||
|
||
logger.info(f"📄 Body: {body}")
|
||
|
||
signature = request.headers.get('Signature') or request.headers.get('X-YooKassa-Signature')
|
||
if signature:
|
||
logger.info("ℹ️ Получена подпись YooKassa: %s", signature)
|
||
|
||
try:
|
||
webhook_data = json.loads(body)
|
||
except json.JSONDecodeError as e:
|
||
logger.error(f"❌ Ошибка парсинга JSON webhook YooKassa: {e}")
|
||
return web.Response(status=400, text="Invalid JSON")
|
||
|
||
logger.info(f"📊 Обработка webhook YooKassa: {webhook_data.get('event', 'unknown_event')}")
|
||
logger.debug(f"🔍 Полные данные webhook: {webhook_data}")
|
||
|
||
event_type = webhook_data.get("event")
|
||
if not event_type:
|
||
logger.warning("⚠️ Webhook YooKassa без типа события")
|
||
return web.Response(status=400, text="No event type")
|
||
|
||
# Извлекаем ID платежа из вебхука для предотвращения дублирования
|
||
yookassa_payment_id = webhook_data.get("object", {}).get("id")
|
||
if not yookassa_payment_id:
|
||
logger.warning("⚠️ Webhook YooKassa без ID платежа")
|
||
return web.Response(status=400, text="No payment id")
|
||
|
||
if event_type not in YOOKASSA_ALLOWED_EVENTS:
|
||
logger.info(f"ℹ️ Игнорируем событие YooKassa: {event_type}")
|
||
return web.Response(status=200, text="OK")
|
||
|
||
async with AsyncSessionLocal() as db:
|
||
try:
|
||
# Проверяем, не обрабатывается ли этот платеж уже (защита от дублирования)
|
||
from app.database.models import PaymentMethod
|
||
from app.database.crud.transaction import get_transaction_by_external_id
|
||
existing_transaction = None
|
||
if yookassa_payment_id and hasattr(db, "execute"):
|
||
existing_transaction = await get_transaction_by_external_id(db, yookassa_payment_id, PaymentMethod.YOOKASSA)
|
||
|
||
if existing_transaction and event_type == "payment.succeeded":
|
||
logger.info(f"ℹ️ Платеж YooKassa {yookassa_payment_id} уже был обработан. Пропускаем дублирующий вебхук.")
|
||
return web.Response(status=200, text="OK")
|
||
|
||
success = await self.payment_service.process_yookassa_webhook(db, webhook_data)
|
||
|
||
if success:
|
||
await db.commit()
|
||
logger.info(f"✅ Успешно обработан webhook YooKassa: {event_type} для платежа {yookassa_payment_id}")
|
||
return web.Response(status=200, text="OK")
|
||
else:
|
||
await db.rollback()
|
||
logger.error(f"❌ Ошибка обработки webhook YooKassa: {event_type} для платежа {yookassa_payment_id}")
|
||
return web.Response(status=500, text="Processing error")
|
||
|
||
except Exception as e:
|
||
await db.rollback()
|
||
logger.error(f"❌ Ошибка обработки webhook YooKassa: {e}", exc_info=True)
|
||
return web.Response(status=500, text="Processing error")
|
||
|
||
except Exception as e:
|
||
logger.error(f"❌ Критическая ошибка обработки webhook YooKassa: {e}", exc_info=True)
|
||
return web.Response(status=500, text="Internal server error")
|
||
|
||
def setup_routes(self, app: web.Application) -> None:
|
||
|
||
webhook_path = settings.YOOKASSA_WEBHOOK_PATH
|
||
app.router.add_post(webhook_path, self.handle_webhook)
|
||
app.router.add_get(webhook_path, self._get_handler)
|
||
app.router.add_options(webhook_path, self._options_handler)
|
||
|
||
logger.info(f"✅ Настроен YooKassa webhook на пути: POST {webhook_path}")
|
||
|
||
async def _get_handler(self, request: web.Request) -> web.Response:
|
||
return web.json_response({
|
||
"status": "ok",
|
||
"message": "YooKassa webhook endpoint is working",
|
||
"method": "GET",
|
||
"path": request.path,
|
||
"note": "Use POST method for actual webhooks"
|
||
})
|
||
|
||
async def _options_handler(self, request: web.Request) -> web.Response:
|
||
return web.Response(
|
||
status=200,
|
||
headers={
|
||
'Access-Control-Allow-Origin': '*',
|
||
'Access-Control-Allow-Methods': 'POST, GET, OPTIONS',
|
||
'Access-Control-Allow-Headers': 'Content-Type, X-YooKassa-Signature',
|
||
}
|
||
)
|
||
|
||
|
||
def create_yookassa_webhook_app(payment_service: PaymentService) -> web.Application:
|
||
|
||
app = web.Application()
|
||
|
||
webhook_handler = YooKassaWebhookHandler(payment_service)
|
||
webhook_handler.setup_routes(app)
|
||
|
||
async def health_check(request):
|
||
return web.json_response({
|
||
"status": "ok",
|
||
"service": "yookassa_webhook",
|
||
"port": settings.YOOKASSA_WEBHOOK_PORT,
|
||
"path": settings.YOOKASSA_WEBHOOK_PATH,
|
||
"enabled": settings.is_yookassa_enabled()
|
||
})
|
||
|
||
app.router.add_get("/health", health_check)
|
||
|
||
return app
|
||
|
||
|
||
async def start_yookassa_webhook_server(payment_service: PaymentService) -> None:
|
||
|
||
if not settings.is_yookassa_enabled():
|
||
logger.info("ℹ️ YooKassa отключена, webhook сервер не запускается")
|
||
return
|
||
|
||
try:
|
||
app = create_yookassa_webhook_app(payment_service)
|
||
|
||
runner = web.AppRunner(app)
|
||
await runner.setup()
|
||
|
||
site = web.TCPSite(
|
||
runner,
|
||
host=settings.YOOKASSA_WEBHOOK_HOST,
|
||
port=settings.YOOKASSA_WEBHOOK_PORT
|
||
)
|
||
|
||
await site.start()
|
||
|
||
logger.info(
|
||
"✅ YooKassa webhook сервер запущен на %s:%s",
|
||
settings.YOOKASSA_WEBHOOK_HOST,
|
||
settings.YOOKASSA_WEBHOOK_PORT,
|
||
)
|
||
logger.info(
|
||
"🎯 YooKassa webhook URL: http://%s:%s%s",
|
||
settings.YOOKASSA_WEBHOOK_HOST,
|
||
settings.YOOKASSA_WEBHOOK_PORT,
|
||
settings.YOOKASSA_WEBHOOK_PATH,
|
||
)
|
||
|
||
try:
|
||
while True:
|
||
await asyncio.sleep(1)
|
||
except asyncio.CancelledError:
|
||
logger.info("🛑 YooKassa webhook сервер получил сигнал остановки")
|
||
finally:
|
||
await site.stop()
|
||
await runner.cleanup()
|
||
logger.info("✅ YooKassa webhook сервер остановлен")
|
||
|
||
except Exception as e:
|
||
logger.error(f"❌ Ошибка запуска YooKassa webhook сервера: {e}", exc_info=True)
|
||
raise |