Fix Business Logic Errors in Spiral

Business logic flaws in the Spiral framework often arise from a failure to decouple request data from domain state within persistent worker processes. Since Spiral runs on RoadRunner, improper handling of stateful services can lead to 'Insecure State Transitions' and 'Parameter Tampering'. Attackers exploit these by manipulating variables that the developer assumed were immutable or server-controlled, bypassing standard middleware filters.

The Vulnerable Pattern

public function checkout(CheckoutRequest $request, OrderRepository $orders): void {
    $order = $orders->findByPK($request->order_id);
// VULNERABLE: Trusting the total price provided by the client
// An attacker can modify the 'total' parameter in the POST request to 0.01
$order->total = $request->input('total');
$order->status = 'paid';

$orders->save($order);
}

The Secure Implementation

The exploit involves 'Parameter Tampering'. In the vulnerable snippet, the application trusts the 'total' field sent via the request, allowing an attacker to intercept the HTTP call and set an arbitrary price. The secure implementation follows the 'Server-as-Source-of-Truth' principle. It ignores client-provided pricing, re-calculates the total using a dedicated PriceCalculator service based on the items stored in the database, and adds a state check to prevent 'Double Spending' or replay attacks. In Spiral, always use Domain Services to encapsulate these rules rather than placing them directly in Controllers or Request objects.

public function checkout(CheckoutRequest $request, OrderRepository $orders, PriceCalculator $calculator): void {
    $order = $orders->findByPK($request->order_id);
if ($order->status !== 'pending') {
    throw new BusinessLogicException('Order already processed');
}

// SECURE: Recalculate the total server-side based on DB state
// Never trust client-side calculations for financial or authorization logic
$expectedTotal = $calculator->calculate($order->items);

$order->total = $expectedTotal;
$order->status = 'paid';

$orders->save($order);
}