Início rápido

import express from 'express';

let cachedToken = null; // cache em memória até ~60s antes de expirar

async function getAccessToken() {
  if (cachedToken && cachedToken.exp > Date.now()) return cachedToken.value;
  const basic = Buffer.from(
    `${process.env.FACIPAY_CLIENT_ID}:${process.env.FACIPAY_CLIENT_SECRET}`
  ).toString('base64');

  const res = await fetch(`${process.env.FACIPAY_API_URL}/token`, {
    method: 'POST',
    headers: {
      Authorization: `Basic ${basic}`,
      'Content-Type': 'application/x-www-form-urlencoded',
    },
    body: 'grant_type=client_credentials&validity_period=3600',
  });
  const json = await res.json();
  cachedToken = { value: json.access_token, exp: Date.now() + 3540 * 1000 };
  return cachedToken.value;
}

app.post('/api/facipay/create-order', express.json(), async (req, res) => {
  const amount = recalcTotalFromItems(req.body.items); // inteiro AOA, no servidor
  const externalTransactionId = 'order_' + crypto.randomUUID();
  await db.orders.insert({ externalTransactionId, amount, status: 'PEN' });

  const token = await getAccessToken();
  const applicationUUID = process.env.FACIPAY_PUBLISHABLE_KEY.replace(/^pk_(test|live)_/, '');

  const fp = await fetch(`${process.env.FACIPAY_API_URL}/facipaypartner/createPaymentOrder`, {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${token}`,
      'Accept-Language': 'pt',
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      externalTransactionId,
      clientId: req.user?.id ?? 'guest',
      applicationUUID,
      name: 'Compra',
      amount,
      quantity: 1,
    }),
  });

  const { data } = await fp.json();
  await db.orders.update(externalTransactionId, { referenceNumber: data.referenceNumber });
  res.json({ referenceNumber: data.referenceNumber }); // string não-vazia
});

import crypto from 'node:crypto';

// Registe o parser raw SÓ nesta rota
app.post('/api/facipay/webhook',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const raw = req.body; // Buffer
    const token = req.headers['x-facipay-content-token'];
    const expected = crypto
      .createHmac('sha256', process.env.FACIPAY_WEBHOOK_SECRET)
      .update(raw)
      .digest('hex');

    const a = Buffer.from(String(token));
    const b = Buffer.from(expected);
    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
      return res.status(401).end(); // assinatura inválida
    }

    const payload = JSON.parse(raw.toString('utf8'));
    const { externalTransactionId, paymentStatus } = payload.data;

    // Idempotência: se já está em estado final, responde 200 e sai
    // Atualiza a ordem: CON = pago, CAN = cancelado, PEN = pendente
    updateOrder(externalTransactionId, paymentStatus);

    res.status(200).json({ received: true });
  }
);