Estoque por API

import crypto from 'node:crypto';
import http from 'node:http';

const SECRET = process.env.PROMISSE_STOCK_SECRET;
if (!SECRET) throw new Error('Defina PROMISSE_STOCK_SECRET');

// Troque por um banco. Cada item tem o texto entregue e a referência de quem reservou.
const stock = {
  licenca: [
    { text: 'AAAA-BBBB-CCCC', reference: null },
    { text: 'DDDD-EEEE-FFFF', reference: null },
  ],
};

function isValid(rawBody, headers) {
  const timestamp = String(headers['x-promisse-timestamp'] ?? '');
  if (!/^\d+$/.test(timestamp) || Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
  const expected = crypto.createHmac('sha256', SECRET).update(`${timestamp}.`).update(rawBody).digest('hex');
  const received = String(headers['x-promisse-signature'] ?? '');
  return expected.length === received.length && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
}

function readBody(req) {
  return new Promise((resolve, reject) => {
    const chunks = [];
    req.on('data', (chunk) => chunks.push(chunk));
    req.on('end', () => resolve(Buffer.concat(chunks)));
    req.on('error', reject);
  });
}

const free = (items) => items.filter((item) => !item.reference);

function handle(call) {
  const items = stock[call.product];
  switch (call.action) {
    case 'ping':
      return [200, { ok: true }];
    case 'stock':
      return [200, { products: call.products.filter((id) => stock[id]).map((id) => ({ id, stock: free(stock[id]).length })) }];
    case 'reserve': {
      if (!items) return [404, { error: 'Produto não existe' }];
      // A mesma referência devolve os mesmos itens: a loja pode repetir a chamada.
      const mine = items.filter((item) => item.reference === call.reference);
      const take = free(items).slice(0, Math.max(0, call.quantity - mine.length));
      if (mine.length + take.length < call.quantity) return [409, { error: 'Sem estoque' }];
      for (const item of take) item.reference = call.reference;
      return [200, { items: [...mine, ...take].slice(0, call.quantity).map((item) => item.text) }];
    }
    case 'release': {
      const mine = (items ?? []).filter((item) => item.reference === call.reference);
      for (const item of mine) item.reference = null;
      return [200, { released: mine.length }];
    }
    case 'confirm':
      // Reservado e pago: marque como vendido e guarde o pedido e o e-mail, se precisar.
      return [200, { ok: true }];
    default:
      return [200, { ok: true }];
  }
}

http.createServer(async (req, res) => {
  if (req.method !== 'POST' || req.url !== '/promisse/estoque') return res.writeHead(404).end();
  const rawBody = await readBody(req);
  if (!isValid(rawBody, req.headers)) return res.writeHead(401, { 'content-type': 'application/json' }).end('{"error":"Assinatura inválida"}');
  const [status, body] = handle(JSON.parse(rawBody));
  res.writeHead(status, { 'content-type': 'application/json' }).end(JSON.stringify(body));
}).listen(3000);

{ "action": "ping" }

{ "action": "stock", "products": ["licenca", "curso"] }

{ "products": [{ "id": "licenca", "stock": 12 }, { "id": "curso", "unlimited": true }] }

{
  "action": "reserve",
  "product": "licenca",
  "quantity": 2,
  "reference": "4a8f0c1e-5b7d-4e8a-9c2f-1d3e5f7a9b0c",
  "order": { "id": "e2b1c4d6-8f0a-4b2c-9d4e-6f8a0b2c4d6e", "number": 100231 }
}

{ "items": ["AAAA-BBBB-CCCC", "DDDD-EEEE-FFFF"] }

BEGIN;
UPDATE itens SET referencia = $1
 WHERE id IN (
   SELECT id FROM itens
    WHERE produto = $2 AND referencia IS NULL
    ORDER BY id LIMIT $3
    FOR UPDATE SKIP LOCKED)
RETURNING texto;
-- Se voltaram menos linhas que $3: ROLLBACK e responda 409. Senão: COMMIT.

{ "action": "release", "product": "licenca", "reference": "4a8f0c1e-5b7d-4e8a-9c2f-1d3e5f7a9b0c" }

{ "released": 2 }

{
  "action": "confirm",
  "product": "licenca",
  "reference": "4a8f0c1e-5b7d-4e8a-9c2f-1d3e5f7a9b0c",
  "quantity": 2,
  "order": { "id": "e2b1c4d6-8f0a-4b2c-9d4e-6f8a0b2c4d6e", "number": 100231, "email": "cliente@email.com", "paid_at": "2026-11-03T18:10:00.000Z" }
}