feat: enforce signature-scoped drainage authorization before SMS submission

api/src/common/drainage-target.ts

@@ -1,8 +1,22 @@
-export const DRAINAGE_TARGET_PATTERN = /^(?:(?:https?:\/\/)?(?:(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:[a-z]{2,63}|xn--[a-z0-9-]{2,59})|(?:\d{1,3}\.){3}\d{1,3})(?::\d{1,5})?(?:[/?#]\S*)?|(?:\+?86[\s-]?)?1(?:[\s-]?\d){10}|(?:\+?86[\s-]?)?(?:\(?0\d{2,3}\)?[\s-]?)?\d{7,8}(?:[\s-]?(?:转|ext\.?)?[\s-]?\d{1,6})?)$/i;
+import { parse } from 'tldts';
+import { isIP } from 'node:net';
+
+export const DRAINAGE_TARGET_PATTERN =
+  /^(?:(?:https?:\/\/)?(?:(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:[a-z]{2,63}|xn--[a-z0-9-]{2,59})|(?:\d{1,3}\.){3}\d{1,3})(?::\d{1,5})?(?:[/?#]\S*)?|(?:\+?86[\s-]?)?1(?:[\s-]?\d){10}|(?:\+?86[\s-]?)?(?:\(?0\d{2,3}\)?[\s-]?)?\d{7,8}(?:[\s-]?(?:转|ext\.?)?[\s-]?\d{1,6})?)$/i;
 
 export const DRAINAGE_TARGET_ERROR = '引流信息必须是 URL（可不带协议）、手机号码或固定电话号码';
 
 export function normalizeDrainageTarget(value?: string) {
   const target = value?.trim() ?? '';
-  return target && DRAINAGE_TARGET_PATTERN.test(target) ? target : undefined;
+  const normalized = target.normalize('NFKC');
+  if (!target || !DRAINAGE_TARGET_PATTERN.test(normalized)) return undefined;
+  if (/[a-z]/i.test(normalized) && !/ext\.?/i.test(normalized)) {
+    try {
+      const host = new URL(/^https?:\/\//i.test(normalized) ? normalized : `https://${normalized}`).hostname;
+      if (!isIP(host) && !parse(host, { allowPrivateDomains: true }).domain) return undefined;
+    } catch {
+      return undefined;
+    }
+  }
+  return target;
 }