fix(payments): reject HTML-special chars in product titles (VK payment guard)

A product title containing & < > " ' silently breaks VK purchases: VK HTML-escapes the character in its order_status_change payment-callback echo (e.g. " -> ") but signs the notification over a different form, so the gateway's signature check no longer matches ("vk callback: bad signature") and the purchase never confirms — while get_item (whose request carries no title) still passes. validateProduct now rejects those characters at the admin catalog editor — the single write path for CreateProduct/UpdateProduct/SetProductActive — so a title can't reintroduce the break. Reject, not transform: the operator retypes a clean title (« » guillemets, not straight quotes), so the stored value stays identical everywhere (storefront, wallet, VK box). Docs: docs/PAYMENTS.md §7 + agent field notes; Go Doc on validateProduct. Test: validateProduct HTML-special-char cases. No wire/schema change.
2026-07-16 20:57:04 +02:00
parent 69246eb0c0
commit f60327c1ce
4 changed files with 34 additions and 6 deletions
@@ -229,6 +229,12 @@ The native Android app is a Capacitor 8 wrapper of the `ui` SPA, scaffolded unde

 - **Monetization** — «Фишка» currency, per-platform wallets, ads. Agreements in
  `docs/PAYMENTS_DECISIONS_ru.md`; a phased plan (E0–E9). go-jet money rule above applies.
+  - **VK payment title trap:** a product title with an HTML-special char (`& < > " '`) silently kills
+    VK purchases. VK HTML-escapes it in the `order_status_change` callback echo (`"`→`&quot;`) but
+    signs a different form → the gateway logs `vk callback: bad signature` and rejects it (get_item
+    passes — its request carries no title). `validateProduct` now forbids those chars; keep titles on
+    « » guillemets. Diagnose a raw VK callback body by tcpdumping the plaintext caddy→gateway hop
+    (`tcp port 8081`, the h2c DATA frame is unencrypted); VK retries `order_status_change` for ~30 min.
 - **PITR** — pgBackRest → Selectel S3 (encrypted, 30-day), currently **gated off**; runbook in
  `deploy/README.md`. Gotcha: run pgBackRest via docker-exec **as the `postgres` user** with
  `--pg1-user=scrabble`.