Monte um operador de fidelidade mínimo

import crypto from 'node:crypto'
import http from 'node:http'

const CLIENT_SECRET = process.env.DV_CLIENT_SECRET // o client_secret do app
const PROGRAM_ID = process.env.PROGRAM_ID ?? 'clube-teste' // o program.id do config push
const WELCOME_BONUS = 2000 // centavos: R$ 20,00 de saldo inicial, para testar o resgate
const PORT = Number(process.env.PORT ?? 4001)

// Em memória: some quando o processo para. Em produção, o seu banco.
const accounts = new Map() // accountId -> { id, document, name, balance (centavos), consent }
const accountByDocument = new Map() // CPF -> accountId
const redemptions = new Map() // redemptionId -> { id, accountId, relatedOrderId, amount, reversed }
const redemptionByOrder = new Map() // relatedOrderId -> redemptionId

const toCents = (value) => Math.round(Number(value) * 100)

function validSignature(rawBody, received = '') {
  const expected = crypto.createHmac('sha256', CLIENT_SECRET).update(rawBody).digest('hex')
  return received.length === expected.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))
}

function link(body) {
  let accountId = accountByDocument.get(body.customer.document)

  if (!accountId) {
    if (!body.enroll) return [404] // adesão fechada e o CPF não é membro
    accountId = `acc_${crypto.randomUUID()}`
    accounts.set(accountId, {
      id: accountId,
      document: body.customer.document,
      name: body.customer.name,
      balance: WELCOME_BONUS,
      consent: body.consent, // guarde o consentimento (LGPD)
    })
    accountByDocument.set(body.customer.document, accountId)
  }

  return [200, { id: accountId, programId: PROGRAM_ID, balanceType: 'cashback' }]
}

function balance(accountId) {
  const account = accounts.get(accountId)
  if (!account) return [404]
  return [200, { id: account.id, programId: PROGRAM_ID, balanceType: 'cashback', balance: account.balance / 100, currency: 'BRL' }]
}

function redeem(body) {
  const amount = toCents(body.amount)
  const previous = redemptions.get(redemptionByOrder.get(body.relatedOrderId))

  if (previous) {
    // Idempotência por relatedOrderId: mesmo valor, mesma resposta
    if (previous.amount === amount) return [201, { redemptionId: previous.id }]
    return [422, { code: 'idempotency_conflict' }]
  }

  const account = accounts.get(body.accountId)
  if (!account) return [422, { code: 'unknown_account' }]
  if (!(amount > 0)) return [422, { code: 'invalid_amount' }]
  if (account.balance < amount) return [409, { code: 'insufficient_balance' }]

  const redemption = { id: `red_${crypto.randomUUID()}`, accountId: account.id, relatedOrderId: body.relatedOrderId, amount, reversed: false }
  account.balance -= amount
  redemptions.set(redemption.id, redemption)
  redemptionByOrder.set(redemption.relatedOrderId, redemption.id)
  return [201, { redemptionId: redemption.id }]
}

function reverse(redemptionId) {
  const redemption = redemptions.get(redemptionId)
  if (!redemption) return [404] // nunca vimos este id: terminal para a DeliveryVip

  if (!redemption.reversed) {
    accounts.get(redemption.accountId).balance += redemption.amount
    redemption.reversed = true
  }
  return [204] // já estornado também responde 2xx
}

function route(method, path, body) {
  if (method === 'GET' && path === '/v1/loyalty/ping') return [204]
  if (method === 'POST' && path === '/v1/loyalty/accounts:link') return link(body)
  if (method === 'POST' && path === '/v1/loyalty/redemptions') return redeem(body)

  let match = path.match(/^\/v1\/loyalty\/accounts\/([^/]+)$/)
  if (method === 'GET' && match) return balance(decodeURIComponent(match[1]))

  match = path.match(/^\/v1\/loyalty\/redemptions\/([^/]+)\/reversal$/)
  if (method === 'POST' && match) return reverse(decodeURIComponent(match[1]))

  return [404]
}

http
  .createServer((req, res) => {
    const chunks = []
    req.on('data', (chunk) => chunks.push(chunk))
    req.on('end', () => {
      const rawBody = Buffer.concat(chunks) // vazio no ping e no reversal: assinatura da string vazia
      const path = new URL(req.url, 'http://localhost').pathname

      if (!validSignature(rawBody, req.headers['x-app-signature'])) {
        console.log(`${req.method} ${path} -> 401 (assinatura inválida)`)
        return res.writeHead(401).end()
      }

      let status, payload
      try {
        const body = rawBody.length > 0 ? JSON.parse(rawBody) : null // parse só depois de validar
        ;[status, payload] = route(req.method, path, body)
      } catch (error) {
        console.error(error)
        status = 500
      }

      console.log(`${req.method} ${path} -> ${status}`, payload ? JSON.stringify(payload) : '')
      if (payload === undefined) return res.writeHead(status).end()
      res.writeHead(status, { 'Content-Type': 'application/json' }).end(JSON.stringify(payload))
    })
  })
  .listen(PORT, () => console.log(`Operador em http://localhost:${PORT}`))

import hashlib
import hmac
import json
import os
import threading
import uuid
from decimal import Decimal

from flask import Flask, Response, request

CLIENT_SECRET = os.environ["DV_CLIENT_SECRET"].encode()  # o client_secret do app
PROGRAM_ID = os.environ.get("PROGRAM_ID", "clube-teste")  # o program.id do config push
WELCOME_BONUS = 2000  # centavos: R$ 20,00 de saldo inicial, para testar o resgate
PORT = int(os.environ.get("PORT", "4001"))

# Em memória: some quando o processo para. Em produção, o seu banco.
accounts = {}  # account_id -> {id, document, name, balance (centavos), consent}
account_by_document = {}  # CPF -> account_id
redemptions = {}  # redemption_id -> {id, account_id, related_order_id, amount, reversed}
redemption_by_order = {}  # related_order_id -> redemption_id
lock = threading.Lock()  # o Flask atende requisições em paralelo

app = Flask(__name__)


def to_cents(value):
    return int((Decimal(str(value)) * 100).to_integral_value())


def reply(status, payload=None):
    if payload is None:
        return Response(status=status)
    return Response(json.dumps(payload), status=status, mimetype="application/json")


@app.before_request
def verify_signature():
    raw_body = request.get_data()  # bytes como chegaram; b"" no ping e no reversal
    expected = hmac.new(CLIENT_SECRET, raw_body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-App-Signature", "")):
        return reply(401)


@app.get("/v1/loyalty/ping")
def ping():
    return reply(204)


@app.post("/v1/loyalty/accounts:link")
def link():
    body = json.loads(request.get_data())  # parse só depois de validar
    document = body["customer"]["document"]
    with lock:
        account_id = account_by_document.get(document)
        if account_id is None:
            if not body["enroll"]:
                return reply(404)  # adesão fechada e o CPF não é membro
            account_id = f"acc_{uuid.uuid4()}"
            accounts[account_id] = {
                "id": account_id,
                "document": document,
                "name": body["customer"]["name"],
                "balance": WELCOME_BONUS,
                "consent": body["consent"],  # guarde o consentimento (LGPD)
            }
            account_by_document[document] = account_id
    return reply(200, {"id": account_id, "programId": PROGRAM_ID, "balanceType": "cashback"})


@app.get("/v1/loyalty/accounts/<account_id>")
def balance(account_id):
    account = accounts.get(account_id)
    if account is None:
        return reply(404)
    return reply(200, {
        "id": account["id"],
        "programId": PROGRAM_ID,
        "balanceType": "cashback",
        "balance": account["balance"] / 100,
        "currency": "BRL",
    })


@app.post("/v1/loyalty/redemptions")
def redeem():
    body = json.loads(request.get_data())
    amount = to_cents(body["amount"])
    with lock:
        previous = redemptions.get(redemption_by_order.get(body["relatedOrderId"]))
        if previous:
            # Idempotência por relatedOrderId: mesmo valor, mesma resposta
            if previous["amount"] == amount:
                return reply(201, {"redemptionId": previous["id"]})
            return reply(422, {"code": "idempotency_conflict"})

        account = accounts.get(body["accountId"])
        if account is None:
            return reply(422, {"code": "unknown_account"})
        if amount <= 0:
            return reply(422, {"code": "invalid_amount"})
        if account["balance"] < amount:
            return reply(409, {"code": "insufficient_balance"})

        redemption_id = f"red_{uuid.uuid4()}"
        account["balance"] -= amount
        redemptions[redemption_id] = {
            "id": redemption_id,
            "account_id": account["id"],
            "related_order_id": body["relatedOrderId"],
            "amount": amount,
            "reversed": False,
        }
        redemption_by_order[body["relatedOrderId"]] = redemption_id
    return reply(201, {"redemptionId": redemption_id})


@app.post("/v1/loyalty/redemptions/<redemption_id>/reversal")
def reverse(redemption_id):
    with lock:
        redemption = redemptions.get(redemption_id)
        if redemption is None:
            return reply(404)  # nunca vimos este id: terminal para a DeliveryVip
        if not redemption["reversed"]:
            accounts[redemption["account_id"]]["balance"] += redemption["amount"]
            redemption["reversed"] = True
    return reply(204)  # já estornado também responde 2xx


if __name__ == "__main__":
    app.run(port=PORT)