SMS verification API на PHP и Node.js: подтверждение телефона в форме

<?php
session_start();
header('Content-Type: application/json; charset=utf-8');

$in    = json_decode(file_get_contents('php://input'), true) ?: [];
$phone = preg_replace('/\D/', '', $in['phone'] ?? '');

function reply(int $status, array $body) {
    http_response_code($status);
    exit(json_encode($body));
}

if (($in['action'] ?? '') === 'send') {
    if (!preg_match('/^7\d{10}$/', $phone)) reply(400, ['success' => false]);
    if (time() - ($_SESSION['otp']['sent_at'] ?? 0) < 60) reply(429, ['success' => false]);

    $code = (string) random_int(1000, 9999);          // криптостойкий ГСЧ
    $_SESSION['otp'] = [
        'phone'   => $phone,
        'hash'    => password_hash($code, PASSWORD_DEFAULT),
        'exp'     => time() + 300,                    // 5 минут
        'tries'   => 0,
        'sent_at' => time(),
    ];
    reply(200, ['success' => send_sms($phone, "Ваш код: $code")]);
}

if (($in['action'] ?? '') === 'check') {
    $otp = $_SESSION['otp'] ?? null;
    if (!$otp || $otp['phone'] !== $phone || time() > $otp['exp']) reply(410, ['success' => false]);
    if (++$_SESSION['otp']['tries'] > 5) { unset($_SESSION['otp']); reply(429, ['success' => false]); }
    if (!password_verify((string) ($in['code'] ?? ''), $otp['hash'])) reply(400, ['success' => false]);

    unset($_SESSION['otp']);
    $_SESSION['verified_phone'] = $phone;              // дальше форма/регистрация читает только это
    reply(200, ['success' => true]);
}

function send_sms(string $phone, string $text): bool {
    $ch = curl_init('http://api.sms-prosto.ru/');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => [
            'method' => 'push_msg', 'api_v' => '2.0', 'format' => 'json',
            'key'    => getenv('SMS_API_KEY'),
            'phone'  => $phone, 'text' => $text,
            'sender_name' => getenv('SMS_SENDER'),
        ],
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 10,
    ]);
    $r = json_decode((string) curl_exec($ch), true);
    return (int) ($r['response']['msg']['err_code'] ?? -1) === 0;
}

import express from 'express';
import crypto from 'node:crypto';

const app = express();
app.use(express.json());

const store = new Map();   // phone → { hash, exp, tries, sentAt }; в проде — Redis с TTL
const sha = (s) => crypto.createHash('sha256').update(s).digest();
const clean = (p) => String(p || '').replace(/\D/g, '');

app.post('/otp/send', async (req, res) => {
  const phone = clean(req.body.phone);
  if (!/^7\d{10}$/.test(phone)) return res.status(400).json({ success: false });
  const prev = store.get(phone);
  if (prev && Date.now() - prev.sentAt < 60_000) return res.status(429).json({ success: false });

  const code = String(crypto.randomInt(1000, 10000));
  store.set(phone, { hash: sha(phone + code), exp: Date.now() + 300_000, tries: 0, sentAt: Date.now() });

  const qs = new URLSearchParams({ number: phone, text: `Ваш код: ${code}`, sign: process.env.SMS_SIGN });
  const auth = Buffer.from(`${process.env.SMSAERO_EMAIL}:${process.env.SMSAERO_KEY}`).toString('base64');
  const r = await fetch('https://gate.smsaero.ru/v2/sms/send?' + qs, { headers: { Authorization: 'Basic ' + auth } });
  const data = await r.json();
  res.json({ success: Boolean(data.success) });
});

app.post('/otp/check', (req, res) => {
  const phone = clean(req.body.phone);
  const otp = store.get(phone);
  if (!otp || Date.now() > otp.exp) return res.status(410).json({ success: false });
  if (++otp.tries > 5) { store.delete(phone); return res.status(429).json({ success: false }); }
  const ok = crypto.timingSafeEqual(otp.hash, sha(phone + String(req.body.code || '')));
  if (ok) store.delete(phone);
  res.status(ok ? 200 : 400).json({ success: ok });
});

app.listen(3000);

TS=$(date +%s%N)
curl -X POST "https://cp.redsms.ru/api/message" \
  -H "login: $REDSMS_LOGIN" \
  -H "ts: $TS" \
  -H "secret: $(echo -n "$TS$REDSMS_API_KEY" | md5sum | awk '{print $1}')" \
  -H "Content-type: application/json" \
  -d '{"route":"fcall","to":"+79993332211","text":"1234"}'

curl -X POST "http://api.sms-prosto.ru/" \
  -d method=push_msg -d api_v=2.0 -d format=json \
  -d key="$SMS_API_KEY" -d sender_name="$SMS_SENDER" \
  -d phone=79991234567 --data-urlencode text="Ваш код: 4827"

<?php
// Отвечаем быстро: тяжёлую обработку — в очередь
if (isset($_GET['id_sms'])) {
    // SMS Просто: значения state — по таблице в документации
    save_status('sms-prosto', $_GET['id_sms'], $_GET['state'] ?? '');
} elseif (isset($_POST['uuid'])) {
    // RedSMS: например status = delivered
    save_status('redsms', $_POST['uuid'], $_POST['status'] ?? '');
}
http_response_code(200);

function save_status(string $gw, string $id, string $status): void {
    // UPDATE otp_messages SET status = ? WHERE gateway = ? AND message_id = ?
    // message_id — это sms_id / uuid из ответа на отправку
}