audit full project flows and harden backend

backend/worker/cmd/main/main.go

@@ -31,6 +31,7 @@ func main() {
 func closeExpiredPayments(ctx context.Context) {
 	ticker := time.NewTicker(time.Duration(config.Spec.PaymentAPI.IntervalSeconds) * time.Second)
 	defer ticker.Stop()
+	client := &http.Client{Timeout: 15 * time.Second}
 	for {
 		select {
 		case <-ctx.Done():
@@ -41,7 +42,7 @@ func closeExpiredPayments(ctx context.Context) {
 				continue
 			}
 			request.Header.Set("X-Heqi-Worker-Token", config.Spec.PaymentAPI.Token)
-			response, err := http.DefaultClient.Do(request)
+			response, err := client.Do(request)
 			if err == nil {
 				_ = response.Body.Close()
 			}

backend/worker/internal/config/config.go

@@ -4,6 +4,8 @@ package config
 import (
 	"git.apinb.com/bsm-sdk/core/conf"
 	"net"
+	"os"
+	"strings"
 )
 
 var Spec SrvConfig
@@ -30,10 +32,28 @@ type IoTAPIConfig struct {
 
 func New(srvKey string) {
 	conf.New(srvKey, &Spec)
+	if databaseDSN := strings.TrimSpace(os.Getenv("HEQI_DATABASE_DSN")); databaseDSN != "" {
+		if Spec.Databases == nil {
+			panic("Databases configuration is required")
+		}
+		Spec.Databases.Source = []string{databaseDSN}
+	}
+	if redisURL := strings.TrimSpace(os.Getenv("HEQI_REDIS_URL")); redisURL != "" {
+		Spec.Cache = redisURL
+	}
+	if token := strings.TrimSpace(os.Getenv("HEQI_PAYMENT_INTERNAL_TOKEN")); token != "" {
+		Spec.PaymentAPI.Token = token
+	}
+	if token := strings.TrimSpace(os.Getenv("HEQI_IOT_INTERNAL_TOKEN")); token != "" {
+		Spec.IoTAPI.Token = token
+	}
 	Spec.Port = conf.CheckPort(Spec.Port)
 	Spec.BindIP = conf.CheckIP(Spec.BindIP)
 	Spec.Addr = net.JoinHostPort(Spec.BindIP, Spec.Port)
 	conf.NotNil(Spec.Service, Spec.Cache)
+	if Spec.Databases == nil || len(Spec.Databases.Source) == 0 {
+		panic("Databases configuration is required")
+	}
 	if Spec.PaymentAPI.BaseURL == "" || Spec.PaymentAPI.Token == "" || Spec.PaymentAPI.IntervalSeconds <= 0 {
 		panic("PaymentAPI configuration is required")
 	}