Receba seu primeiro pedido via Open Delivery

import crypto from 'node:crypto'
import http from 'node:http'

const OD = 'https://od.deliveryvip.com.br'
const STORE_SECRET = process.env.OD_STORE_SECRET // ods_... da loja
const PORT = Number(process.env.PORT ?? 3000)
const handled = new Map() // eventId -> Promise; em produção, guarde os eventIds no banco
let token = null

async function getToken() {
  const response = await fetch(`${OD}/oauth/token`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'client_credentials',
      client_id: process.env.OD_CLIENT_ID,
      client_secret: STORE_SECRET,
      scope: 'od.all',
    }),
  })
  if (!response.ok) throw new Error(`token: HTTP ${response.status}`)
  return (await response.json()).access_token
}

async function api(url, options = {}, retry = true) {
  token ??= await getToken()
  const response = await fetch(url.startsWith('http') ? url : `${OD}${url}`, {
    ...options,
    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
  })
  if (response.status === 401 && retry) {
    token = null // expirou: pede outro e repete uma vez
    return api(url, options, false)
  }
  if (!response.ok) throw new Error(`${options.method ?? 'GET'} ${url}: HTTP ${response.status}`)
  return response.status === 204 ? null : response.json()
}

async function processEvent(event) {
  if (event.eventType !== 'CREATED') return // outros tipos: só confirmamos o recebimento

  const order = await api(event.orderURL)
  console.log(`Pedido ${order.displayId} (${order.type}) de ${order.customer?.name}: R$ ${order.total?.orderAmount?.value}`)
  await api(`/v1/orders/${event.orderId}/confirm`, { method: 'POST' })
}

// Webhook e polling podem trazer o mesmo evento ao mesmo tempo: os dois aguardam a mesma Promise
function handle(event) {
  if (!handled.has(event.eventId)) {
    const work = processEvent(event).catch((error) => {
      handled.delete(event.eventId) // falhou: o polling tenta de novo
      throw error
    })
    handled.set(event.eventId, work)
  }
  return handled.get(event.eventId)
}

function acknowledge(events) {
  return api('/v1/events/acknowledgment', {
    method: 'POST',
    body: JSON.stringify(events.map(({ eventId }) => ({ id: eventId }))),
  })
}

function validSignature(rawBody, received = '') {
  const expected = crypto.createHmac('sha256', STORE_SECRET).update(rawBody).digest('hex')
  return received.length === expected.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received))
}

http
  .createServer((req, res) => {
    if (req.method !== 'POST' || req.url !== '/webhooks/deliveryvip') return res.writeHead(404).end()

    const chunks = []
    req.on('data', (chunk) => chunks.push(chunk))
    req.on('end', async () => {
      const rawBody = Buffer.concat(chunks)
      if (!validSignature(rawBody, req.headers['x-app-signature'])) return res.writeHead(401).end()

      res.writeHead(200).end() // responde já; a DeliveryVip espera no máximo 5 s

      try {
        const event = JSON.parse(rawBody) // parse só depois de validar
        await handle(event)
        await acknowledge([event])
      } catch (error) {
        console.error(`webhook: ${error.message}`)
      }
    })
  })
  .listen(PORT, () => console.log(`Webhook em http://localhost:${PORT}/webhooks/deliveryvip`))

while (true) {
  let batchSize = 0
  try {
    const events = (await api('/v1/events:polling')) ?? []
    batchSize = events.length
    const done = []
    for (const event of events) {
      try {
        await handle(event)
        done.push(event)
      } catch (error) {
        console.error(`evento ${event.eventId}: ${error.message}`)
      }
    }
    if (done.length > 0) await acknowledge(done)
    if (batchSize === 100 && done.length === 100) continue // fila acumulada: busca o próximo lote já
  } catch (error) {
    console.error(`polling: ${error.message}`)
  }
  await new Promise((resolve) => setTimeout(resolve, 30_000))
}

import hashlib
import hmac
import os
import threading
import time

import requests
from flask import Flask, request

OD = "https://od.deliveryvip.com.br"
STORE_SECRET = os.environ["OD_STORE_SECRET"]  # ods_... da loja
PORT = int(os.environ.get("PORT", "3000"))

lock = threading.Lock()  # webhook e polling podem trazer o mesmo evento ao mesmo tempo
done = set()  # em produção, guarde os eventIds no banco
token = None

app = Flask(__name__)


def get_token():
    response = requests.post(
        f"{OD}/oauth/token",
        data={
            "grant_type": "client_credentials",
            "client_id": os.environ["OD_CLIENT_ID"],
            "client_secret": STORE_SECRET,
            "scope": "od.all",
        },
        timeout=10,
    )
    response.raise_for_status()
    return response.json()["access_token"]


def api(url, method="GET", json=None, retry=True):
    global token
    if token is None:
        token = get_token()
    response = requests.request(
        method,
        url if url.startswith("http") else f"{OD}{url}",
        headers={"Authorization": f"Bearer {token}"},
        json=json,
        timeout=10,
    )
    if response.status_code == 401 and retry:
        token = None  # expirou: pede outro e repete uma vez
        return api(url, method, json, retry=False)
    response.raise_for_status()
    return None if response.status_code == 204 else response.json()


def handle(event):
    with lock:
        if event["eventId"] in done:
            return
        if event["eventType"] == "CREATED":  # outros tipos: só confirmamos o recebimento
            order = api(event["orderURL"])
            customer = (order.get("customer") or {}).get("name")
            amount = order.get("total", {}).get("orderAmount", {}).get("value")
            print(f"Pedido {order['displayId']} ({order['type']}) de {customer}: R$ {amount}")
            api(f"/v1/orders/{event['orderId']}/confirm", method="POST")
        done.add(event["eventId"])


def acknowledge(events):
    api("/v1/events/acknowledgment", method="POST", json=[{"id": event["eventId"]} for event in events])


def process_in_background(event):
    try:
        handle(event)
        acknowledge([event])
    except Exception as error:  # o polling recupera o evento
        print(f"webhook: {error}")


@app.post("/webhooks/deliveryvip")
def webhook():
    raw_body = request.get_data()  # bytes exatamente como chegaram
    expected = hmac.new(STORE_SECRET.encode(), raw_body, hashlib.sha256).hexdigest()
    if not hmac.compare_digest(expected, request.headers.get("X-App-Signature", "")):
        return "", 401

    event = request.get_json()  # parse só depois de validar
    threading.Thread(target=process_in_background, args=(event,)).start()
    return "", 200  # responde já; a DeliveryVip espera no máximo 5 s


def reconcile():
    while True:
        full_batch = False
        try:
            events = api("/v1/events:polling") or []
            processed = []
            for event in events:
                try:
                    handle(event)
                    processed.append(event)
                except Exception as error:
                    print(f"evento {event['eventId']}: {error}")
            if processed:
                acknowledge(processed)
            full_batch = len(events) == 100 and len(processed) == 100
        except Exception as error:
            print(f"polling: {error}")
        if not full_batch:  # fila acumulada: busca o próximo lote já
            time.sleep(30)


if __name__ == "__main__":
    threading.Thread(target=reconcile, daemon=True).start()
    app.run(port=PORT)

node primeiro-pedido-od.mjs

pip install flask requests
python primeiro_pedido_od.py