audit full project flows and harden backend

backend/api/internal/logic/payment/close.go

@@ -2,6 +2,7 @@ package payment
 
 import (
 	"context"
+	"crypto/subtle"
 	"fmt"
 	"net/http"
 	"time"
@@ -55,7 +56,9 @@ func closeChannelOrder(ctx context.Context, order models.PaymentOrder) error {
 
 // CloseExpiredHandler 只接受 Worker 共享凭证，不暴露为平台用户动作。
 func CloseExpiredHandler(ctx *gin.Context) {
-	if config.Spec.Payment.InternalServiceToken == "" || ctx.GetHeader("X-Heqi-Worker-Token") != config.Spec.Payment.InternalServiceToken {
+	expected := config.Spec.Payment.InternalServiceToken
+	actual := ctx.GetHeader("X-Heqi-Worker-Token")
+	if expected == "" || len(actual) != len(expected) || subtle.ConstantTimeCompare([]byte(actual), []byte(expected)) != 1 {
 		ctx.AbortWithStatus(http.StatusUnauthorized)
 		return
 	}