security: remove callback URL from user input — read from FrontOfficeBaseUrl config

- PackageService: build callback URL from FrontOfficeBaseUrl config instead of request.CallbackUrl
- TransactionsService: same fix — callback URL from config
- Prevents potential open redirect vulnerability (user could send arbitrary URL)

All callback URLs now come from appsettings FrontOfficeBaseUrl or CmsBaseUrl.

src/CMSMicroservice.WebApi/Services/PackageService.cs

@@ -182,9 +182,9 @@ public class PackageService : PackageContract.PackageContractBase
             .Select(u => new { u.Mobile })
             .FirstOrDefaultAsync(context.CancellationToken);
         
-        // Embed orderId in callback URL so FrontOffice can pass it back for verification
-        var separator = request.CallbackUrl.Contains('?') ? "&" : "?";
-        var callbackWithOrder = $"{request.CallbackUrl}{separator}orderId={purchase.Id}";
+        // Callback URL از config — نه از ورودی کاربر (امنیت)
+        var frontOfficeBaseUrl = _configuration["FrontOfficeBaseUrl"] ?? "https://localhost:5268";
+        var callbackUrl = $"{frontOfficeBaseUrl}/profile/payment-callback?orderId={purchase.Id}";
         
         var paymentResult = await _paymentGateway.InitiatePaymentAsync(new PaymentRequest
         {
@@ -192,7 +192,7 @@ public class PackageService : PackageContract.PackageContractBase
             UserId = userId,
             Mobile = user?.Mobile ?? string.Empty,
             Description = $"خرید پکیج {package.Title}",
-            CallbackUrl = callbackWithOrder
+            CallbackUrl = callbackUrl
         }, context.CancellationToken);
         
         if (!paymentResult.IsSuccess)
@@ -216,7 +216,7 @@ public class PackageService : PackageContract.PackageContractBase
             GatewayProvider = _configuration["PaymentProvider"] ?? "zarinpal",
             MerchantId = _configuration["ZarinPal:MerchantId"] ?? "",
             Amount = package.Price,
-            CallbackUrl = request.CallbackUrl,
+            CallbackUrl = callbackUrl,
             Description = $"خرید پکیج {package.Title}",
             Mobile = user?.Mobile,
             UserId = userId,

src/CMSMicroservice.WebApi/Services/TransactionsService.cs

@@ -162,6 +162,10 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
         _context.Transactions.Add(transaction);
         await _context.SaveChangesAsync(context.CancellationToken);
         
+        // Callback URL از config — نه از ورودی کاربر (امنیت)
+        var frontOfficeBaseUrl = _configuration["FrontOfficeBaseUrl"] ?? "https://localhost:5268";
+        var callbackUrl = $"{frontOfficeBaseUrl}/profile/payment-callback";
+
         // Initiate payment with gateway
         var paymentResult = await _paymentGateway.InitiatePaymentAsync(new PaymentRequest
         {
@@ -169,7 +173,7 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
             UserId = userId,
             Mobile = request.Mobile ?? user?.Mobile ?? string.Empty,
             Description = request.Description ?? "پرداخت آنلاین",
-            CallbackUrl = request.CallbackUrl
+            CallbackUrl = callbackUrl
         }, context.CancellationToken);
         
         if (!paymentResult.IsSuccess)
@@ -191,7 +195,7 @@ public class TransactionsService : TransactionsContract.TransactionsContractBase
             GatewayProvider = _configuration["PaymentProvider"] ?? "zarinpal",
             MerchantId = _configuration["ZarinPal:MerchantId"] ?? "",
             Amount = request.Amount,
-            CallbackUrl = request.CallbackUrl,
+            CallbackUrl = callbackUrl,
             Description = request.Description ?? "پرداخت آنلاین",
             Mobile = request.Mobile ?? user?.Mobile,
             UserId = userId,