36b69d300d
Codex 审计发现 124 个问题，修复 59 个 P0-P2 级别问题： P0 (CRITICAL): - TOCTOU 竞态: TransientRateStore/SseConcurrencyGuard 改用 wp_cache_add 原子锁 - REST 路由: __return_true → check_bearer_present 轻量鉴权 - Schema 验证: messages/tools/tool_choice 添加完整 validate_callback - SQL 列名不匹配: upsert 查询对齐 SchemaManager 定义 - SQL 表名插值: 统一使用 %i 占位符 P1 (HIGH): - IP hash 加盐 (HMAC) + IP 解析统一 (context 共享) - Header 注入防护 (X-Request-Id/响应头 \r\n 过滤) - 数值参数范围校验 (temperature/top_p/penalties/max_tokens) - insert_key 错误处理 + revoke_key 审计日志 - Pipeline finally 保护 + RateLimiter rollback 双 store - wp_unslash 补全 + strtotime 返回值检查 - RedisRateStore $rid 冒号验证 - UpstreamStreamClient catch \Throwable P2 (MEDIUM): - AuditLogRepository DRY (提取 build_where_clause) - Token 估算 CJK 优化 (mb_strlen) - ResponseTransformMiddleware null 检查 - 嵌入响应 usage 数据修复 - SchemaManager autoload 优化 25 files changed, ~530 insertions, ~190 deletions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
84 lines
No EOL
1.8 KiB
PHP
84 lines
No EOL
1.8 KiB
PHP
<?php
|
|
/**
|
|
* Budget Middleware
|
|
*
|
|
* Pipeline stage that enforces monthly budget limits per API key.
|
|
*
|
|
* @package WPMind\Modules\ApiGateway\Pipeline
|
|
* @since 1.0.0
|
|
*/
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace WPMind\Modules\ApiGateway\Pipeline;
|
|
|
|
/**
|
|
* Class BudgetMiddleware
|
|
*
|
|
* Checks the current month's spend against the key's monthly budget.
|
|
* Skips for management routes and already-errored contexts.
|
|
*/
|
|
final class BudgetMiddleware implements GatewayStageInterface {
|
|
|
|
/**
|
|
* {@inheritDoc}
|
|
*/
|
|
public function process( GatewayRequestContext $context ): void {
|
|
if ( $context->is_management_route() ) {
|
|
return;
|
|
}
|
|
|
|
if ( $context->has_error() ) {
|
|
return;
|
|
}
|
|
|
|
$auth_result = $context->auth_result();
|
|
|
|
if ( $auth_result === null ) {
|
|
return;
|
|
}
|
|
|
|
$budget = (float) $auth_result->monthly_budget_usd;
|
|
|
|
if ( $budget <= 0.0 ) {
|
|
return;
|
|
}
|
|
|
|
$spent = $this->get_current_month_spend( $auth_result->key_id );
|
|
|
|
if ( $spent >= $budget ) {
|
|
$context->set_error(
|
|
new \WP_Error(
|
|
'insufficient_quota',
|
|
'Monthly budget exceeded.',
|
|
[ 'status' => 429 ]
|
|
)
|
|
);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Query the total spend for the current month from the usage table.
|
|
*
|
|
* @param string $key_id API key identifier.
|
|
* @return float Total cost in USD for the current month.
|
|
*/
|
|
private function get_current_month_spend( string $key_id ): float {
|
|
global $wpdb;
|
|
|
|
$table = $wpdb->prefix . 'wpmind_api_key_usage';
|
|
$window_month = gmdate( 'Y-m' );
|
|
|
|
// phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
|
|
$result = $wpdb->get_var(
|
|
$wpdb->prepare(
|
|
'SELECT total_cost_usd FROM %i WHERE key_id = %s AND window_month = %s LIMIT 1',
|
|
$table,
|
|
$key_id,
|
|
$window_month
|
|
)
|
|
);
|
|
|
|
return $result !== null ? (float) $result : 0.0;
|
|
}
|
|
} |
