Serviços externos

{
  "id": "0d4a3b8e-6f1c-4a7e-9b2d-5c8f1e3a7b90",
  "type": "delivery.requested",
  "apiVersion": "2026-10-01",
  "createdAt": "2026-10-12T14:30:00.000Z",
  "projectId": "7c1e9f40-2b3d-4c5a-8e6f-9a0b1c2d3e4f",
  "data": {
    "delivery": {
      "operationId": "5f2b8c1d-3e4a-4b6c-9d7e-8f0a1b2c3d4e",
      "entitlementId": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d",
      "channel": "webhook",
      "kind": "grant",
      "attempt": 1,
      "orderId": "3c4d5e6f-7a8b-4c9d-8e0f-1a2b3c4d5e6f",
      "orderItemId": "6e7f8a9b-0c1d-4e2f-9a3b-4c5d6e7f8a9b",
      "productId": "1b2c3d4e-5f6a-4b7c-8d9e-0f1a2b3c4d5e",
      "benefitId": "2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f",
      "quantity": 1
    },
    "customer": {
      "id": "4d5e6f7a-8b9c-4d0e-8f1a-2b3c4d5e6f7a",
      "email": "cliente@exemplo.com",
      "name": "Ana Souza"
    },
    "benefit": {
      "id": "2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f",
      "type": "external_webhook",
      "config": { "endpointId": "8e9f0a1b-2c3d-4e4f-9a5b-6c7d8e9f0a1b" }
    }
  }
}

POST /api/v1/deliveries/{operationId}/complete
Authorization: Bearer sk_live_…
Content-Type: application/json

{
  "externalReference": "licenca_123",
  "downloadUrl": "https://servico.sualoja.com.br/p/licenca_123",
  "expiresAt": "2026-12-31T23:59:59Z",
  "metadata": { "plano": "anual" }
}

{ "data": { "operationId": "5f2b8c1d-3e4a-4b6c-9d7e-8f0a1b2c3d4e", "status": "succeeded" } }

POST /api/v1/deliveries/{operationId}/resend
Authorization: Bearer sk_live_…
Idempotency-Key: 6f1c2a9e-…

POST /api/v1/deliveries/{operationId}/fail
Authorization: Bearer sk_live_…
Content-Type: application/json

{
  "code": "product_not_configured",
  "message": "Produto sem arquivo vinculado.",
  "retryable": true
}

import { createHmac, timingSafeEqual } from 'node:crypto';
import express from 'express';

const MINEPAG_API = 'https://minepag.com.br/api/v1';
const API_KEY = process.env.MINEPAG_SECRET_KEY; // sk_… com escopo deliveries:write
const WEBHOOK_SECRETS = process.env.MINEPAG_WEBHOOK_SECRETS.split(' '); // whsec_…; dois durante uma rotação

function isSignedByMinePag(headers, body) {
  const id = headers['webhook-id'];
  const timestamp = headers['webhook-timestamp'];
  const signatures = String(headers['webhook-signature'] ?? '').split(' ');
  if (!id || !/^\d{1,12}$/.test(timestamp ?? '')) return false;
  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;

  return WEBHOOK_SECRETS.some(secret => {
    const key = Buffer.from(secret.replace(/^whsec_/, ''), 'base64');
    const expected = createHmac('sha256', key).update(`${id}.${timestamp}.${body}`).digest();
    return signatures.some(entry => {
      if (!entry.startsWith('v1,')) return false;
      const received = Buffer.from(entry.slice(3), 'base64');
      return received.length === expected.length && timingSafeEqual(received, expected);
    });
  });
}

async function callMinePag(path, payload) {
  const response = await fetch(`${MINEPAG_API}${path}`, {
    method: 'POST',
    headers: { Authorization: `Bearer ${API_KEY}`, 'Content-Type': 'application/json' },
    body: JSON.stringify(payload)
  });
  if (response.status === 409) return; // a entrega já tinha sido finalizada
  if (!response.ok) throw new Error(`A MinePag respondeu ${response.status}`);
}

async function handleDeliveryRequested({ delivery, customer }) {
  let license;
  try {
    // Sua lógica. Use delivery.operationId como chave para não emitir duas vezes.
    license = await issueLicense({
      operationId: delivery.operationId,
      entitlementId: delivery.entitlementId,
      productId: delivery.productId,
      quantity: delivery.quantity,
      email: customer.email
    });
  } catch {
    await callMinePag(`/deliveries/${delivery.operationId}/fail`, {
      code: 'license_error',
      message: 'Não foi possível emitir a licença.',
      retryable: true
    });
    return;
  }
  await callMinePag(`/deliveries/${delivery.operationId}/complete`, { externalReference: license.id });
}

const app = express();

app.post('/webhooks/minepag', express.raw({ type: 'application/json' }), (req, res) => {
  const body = req.body.toString('utf8');
  if (!isSignedByMinePag(req.headers, body)) return res.sendStatus(401);
  res.sendStatus(202);

  const event = JSON.parse(body);
  if (event.type === 'delivery.requested') {
    handleDeliveryRequested(event.data).catch(error => console.error('Falha na entrega', error));
  }
  if (event.type === 'entitlement.revoked') {
    revokeLicense(event.data.entitlement.id).catch(error => console.error('Falha na revogação', error));
  }
});

app.listen(3000);