{
  "event": "PAYMENT_STATUS_UPDATED",
  "timestamp": "2026-05-31T10:01:30Z",
  "data": {
    "paymentInitiationId": "ZVjnvOXJSlgth9MVDS4HmdvyhBlHt_s1MPhMNMBhGSU",
    "paymentId": "pix-abc123def456",
    "endToEndId": "E1234567820260531000012345ABCDE",
    "previousStatus": "PDNG",
    "currentStatus": "ACSC",
    "amount": "1.15",
    "currency": "BRL",
    "date": "2026-05-31",
    "updatedAt": "2026-05-31T10:01:28Z",
    "rejectionReason": null
  }
}

{
  "event": "CONSENT_STATUS_UPDATED",
  "timestamp": "2026-05-31T10:05:00Z",
  "data": {
    "paymentInitiationId": "ZVjnvOXJSlgth9MVDS4HmdvyhBlHt_s1MPhMNMBhGSU",
    "consentId": "urn:celcoin:ZVjnvOXJ...",
    "previousStatus": "AWAITING_AUTHORISATION",
    "currentStatus": "AUTHORISED",
    "updatedAt": "2026-05-31T10:04:58Z",
    "brandId": "6900de69dfdf118e980e10ec"
  }
}

// Node.js / Express
app.post('/webhooks/itp-pix', async (req, res) => {
  // 1. Responder 200 imediatamente
  res.status(200).json({ received: true });

  const { event, data } = req.body;

  // 2. Processar de forma assíncrona
  try {
    switch (event) {
      case 'PAYMENT_STATUS_UPDATED':
        if (data.currentStatus === 'ACSC') {
          await confirmPaymentSuccess(data.paymentInitiationId, data.endToEndId);
        } else if (data.currentStatus === 'RJCT') {
          await handlePaymentRejection(data.paymentInitiationId, data.rejectionReason);
        }
        break;

      case 'CONSENT_STATUS_UPDATED':
        await updateConsentStatus(data.paymentInitiationId, data.currentStatus);
        break;

      case 'CONSENT_REJECTED':
        await notifyUserConsentDenied(data.paymentInitiationId);
        break;
    }
  } catch (error) {
    // Log interno — não retornar erro HTTP (webhook já foi confirmado)
    console.error('Erro ao processar webhook:', error);
  }
});

const crypto = require('crypto');

function isValidWebhookSignature(rawBody, signature, secret) {
  const expected = 'sha256=' +
    crypto.createHmac('sha256', secret)
          .update(rawBody)   // usar o body bruto (string), não o objeto
          .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// No middleware Express:
app.post('/webhooks/itp-pix', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['x-celcoin-signature'];
  if (!isValidWebhookSignature(req.body, sig, process.env.WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Assinatura inválida' });
  }
  // ... processar
});

const redis = require('redis');
const client = redis.createClient();

async function isEventAlreadyProcessed(eventId) {
  const result = await client.set(`event:${eventId}`, '1', {
    NX: true,     // somente se não existir
    EX: 86400     // expirar em 24h
  });
  return result === null; // null = já existia
}

app.post('/webhooks/itp-pix', async (req, res) => {
  res.status(200).json({ received: true });

  const eventId = req.headers['x-celcoin-event-id'];
  if (await isEventAlreadyProcessed(eventId)) return;

  processEvent(req.body);
});