fix: harden backend synchronization

exec/lib/DirectAdminVacationApi.php

@@ -5,9 +5,11 @@ class DirectAdminVacationApi
 {
     /** @var callable|null */
     private $request;
+    private string $daBinary = '/usr/local/bin/da';
 
-    public function __construct(private string $daBinary = '/usr/local/bin/da', ?callable $request = null)
+    public function __construct(string $daBinary = '/usr/local/bin/da', ?callable $request = null)
     {
+        $this->daBinary = $daBinary;
         $this->request = $request;
     }
 
@@ -47,6 +49,37 @@ class DirectAdminVacationApi
         $this->requestAsUser($owner, 'CMD_API_EMAIL_VACATION', $this->buildSavePayload($email, $rule, $exists));
     }
 
+    public function vacationExists(string $owner, string $email): bool
+    {
+        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+            throw new InvalidArgumentException('Invalid mailbox email');
+        }
+        [$local, $domain] = explode('@', strtolower($email), 2);
+        return in_array($local, $this->listVacations($owner, $domain), true);
+    }
+
+    /** @return string[] */
+    public function listVacations(string $owner, string $domain): array
+    {
+        if (!preg_match('/^[A-Za-z0-9.-]+$/', $domain)) {
+            throw new InvalidArgumentException('Invalid domain');
+        }
+        $response = $this->requestAsUser($owner, 'CMD_API_EMAIL_VACATION', ['domain' => strtolower($domain)]);
+        $users = [];
+        foreach (explode('&', trim($response)) as $pair) {
+            if ($pair === '' || !str_contains($pair, '=')) {
+                continue;
+            }
+            [$key] = explode('=', $pair, 2);
+            $local = strtolower(urldecode($key));
+            if (preg_match('/^[A-Za-z0-9._+-]+$/', $local)) {
+                $users[] = $local;
+            }
+        }
+        sort($users);
+        return array_values(array_unique($users));
+    }
+
     public function deleteVacation(string $owner, string $email): void
     {
         if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
@@ -70,7 +103,7 @@ class DirectAdminVacationApi
     }
 
     /** @param array<string,string> $payload */
-    private function requestAsUser(string $owner, string $endpoint, array $payload): void
+    private function requestAsUser(string $owner, string $endpoint, array $payload): string
     {
         if (!preg_match('/^[A-Za-z0-9._-]+$/', $owner)) {
             throw new InvalidArgumentException('Invalid DirectAdmin owner');
@@ -80,7 +113,7 @@ class DirectAdminVacationApi
             if ($result === false) {
                 throw new RuntimeException('DirectAdmin API request failed');
             }
-            return;
+            return (string)$result;
         }
         $baseUrl = $this->apiUrl($owner);
         $url = rtrim($baseUrl, '/') . '/' . $endpoint;
@@ -90,7 +123,7 @@ class DirectAdminVacationApi
             $args[] = $key . '=' . $value;
         }
         $args[] = $url;
-        $this->run($args, '');
+        return $this->run($args, '');
     }
 
     private function apiUrl(string $owner): string