Autorizar con Kledos

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_153":154,"_155":156},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_116":-5,"_20":117,"_22":118,"_119":120,"_121":122,"_25":123,"_24":-5,"_124":-5,"_125":-5,"_126":53,"_127":128,"_129":44,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","obelux8","name","KonstAI","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":37,"_73":44,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","860cf779-c783-4d48-8f05-0214945408a9","new-file-5543.ts","fileId","6097466e-9caa-11f1-80db-1607ee4eb77e","parentId","branchId","fe321492-8f91-4d0d-975c-cb3573f7ce1c","branchVersion",24,"latest",true,"createdAt",["D",1787604128136],20,"fileType","http","content","// ===== Kledos — backend (Val Town, HTTP val) =====\n// Variable de entorno necesaria: KONSTAI_SA = (JSON del service account de Firebase)\n//\n// P2P (ya existente):\n// POST /register { handle, token } -> guarda token del RECEPTOR\n// POST /notify { toHandle, number, payload, sig } -> aviso firmado (EC) al receptor\n// POST /revoke { keyId } -> revoca una clave P2P\n//\n// P2B (nuevo, modelo \"número oculto\"):\n// POST /authorize { number, merchant, label } -> el usuario autoriza a un comercio.\n// Crea una relación con secreto HMAC, la EMPUJA al móvil del usuario (type=grant)\n// y devuelve al comercio un HANDLE opaco (nunca el número).\n// POST /merchant/notify { apiKey, handle } -> el comercio pide llamar al cliente.\n// Kledos firma el aviso con HMAC y lo empuja al móvil. El comercio no ve el número.\n// POST /merchant/revoke { handle } -> corta una relación P2B.\n\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst SA = JSON.parse(Deno.env.get(\"KONSTAI_SA\") || \"{}\");\nconst PROJECT = SA.project_id;\n\n// ---------- empresas (multi-tenant, modelo COMPARTIDO) ----------\n// Empresas SEMBRADAS (demo) + empresas dadas de alta por sí mismas (en blob).\n// Cada empresa tiene su id público, su clave de API secreta y su nº de salida.\nconst SEEDED: Record =\n {\n \"aurora-store\": {\n apiKey: \"demo-key-123\",\n name: \"Aurora Store\",\n caller: \"+34 944 010 010\",\n },\n \"bilbo-clinic\": {\n apiKey: \"sk_bilbo_demo\",\n name: \"Clínica Bilbo\",\n caller: \"+34 944 020 020\",\n },\n };\n\n// getJSON/blob se definen más abajo (las funciones se elevan / hoisting).\nasync function getMerchant(\n id: string,\n): Promise<\n { id: string; name: string; caller: string; apiKey: string } | null\n> {\n if (SEEDED[id]) return { id, ...SEEDED[id] };\n const m = await getJSON(`konstai_merchant_${id}`);\n return m ? m : null;\n}\nasync function merchantByKey(\n apiKey: string,\n): Promise<{ id: string; name: string; caller: string } | null> {\n for (const id in SEEDED) {\n if (SEEDED[id].apiKey === apiKey) {\n return { id, name: SEEDED[id].name, caller: SEEDED[id].caller };\n }\n }\n const id = (await getJSON(`konstai_mkey_${apiKey}`)) as string | null;\n if (!id) return null;\n const m = await getMerchant(id);\n return m ? { id: m.id, name: m.name, caller: m.caller } : null;\n}\nfunction slugify(s: string): string {\n const map: Record = {\n \"á\": \"a\",\n \"à\": \"a\",\n \"ä\": \"a\",\n \"â\": \"a\",\n \"é\": \"e\",\n \"è\": \"e\",\n \"ë\": \"e\",\n \"í\": \"i\",\n \"ì\": \"i\",\n \"ï\": \"i\",\n \"ó\": \"o\",\n \"ò\": \"o\",\n \"ö\": \"o\",\n \"ô\": \"o\",\n \"ú\": \"u\",\n \"ù\": \"u\",\n \"ü\": \"u\",\n \"ñ\": \"n\",\n \"ç\": \"c\",\n };\n return String(s || \"\").toLowerCase().replace(\n /[áàäâéèëíìïóòöôúùüñç]/g,\n (c) => map[c] || c,\n )\n .replace(/[^a-z0-9]+/g, \"-\").replace(/^-+|-+$/g, \"\").slice(0, 24) ||\n \"comercio\";\n}\n\nconst norm = (h: string) => String(h || \"\").replace(/\\D/g, \"\").slice(-9);\n\n// ---------- almacenes (blob) ----------\nasync function getJSON(key: string): Promise {\n try {\n return await blob.getJSON(key);\n } catch {\n return null;\n }\n}\nasync function getTok(k: string): Promise {\n return (await getJSON(`konstai_tok_${k}`)) as string | null;\n}\nasync function setTok(k: string, t: string) {\n await blob.setJSON(`konstai_tok_${k}`, t);\n}\n\nasync function isRevoked(keyId: string): Promise {\n return !!(await getJSON(`konstai_rev_${keyId}`));\n}\nasync function setRevoked(keyId: string) {\n await blob.setJSON(`konstai_rev_${keyId}`, true);\n}\n\nasync function getRel(handle: string): Promise {\n return await getJSON(`konstai_rel_${handle}`);\n}\nasync function setRel(handle: string, obj: any) {\n await blob.setJSON(`konstai_rel_${handle}`, obj);\n}\n\n// Dedup: al quedar ACTIVA una relación nueva de un comercio con un número, jubila\n// (revoca) cualquier relación activa anterior de ese MISMO comercio y número. Así solo\n// hay una relación viva por comercio+número y no se acumulan duplicados al reconectar.\nasync function retirePrev(\n merchantId: string,\n userKey: string,\n exceptHandle: string,\n) {\n const idx =\n ((await getJSON(`konstai_midx_${merchantId}`)) as string[] | null) || [];\n for (const h of idx) {\n if (h === exceptHandle) continue;\n const rel = await getRel(h);\n if (rel && rel.userKey === userKey && !rel.revoked && !rel.pending) {\n rel.revoked = true;\n await setRel(h, rel);\n await setRevoked(rel.keyId);\n }\n }\n}\n\nconst rate: Record = {};\n\n// ---------- portero: límites de uso (best-effort, en memoria) ----------\nconst rl: Record = {};\n/** Devuelve true si \"bucket\" ha superado \"max\" llamadas en \"windowMs\". */\nfunction limited(bucket: string, max: number, windowMs: number): boolean {\n const now = Date.now();\n rl[bucket] = (rl[bucket] || []).filter((t) => now - t < windowMs);\n if (rl[bucket].length >= max) return true;\n rl[bucket].push(now);\n return false;\n}\nfunction clientIp(req: Request): string {\n const xf = req.headers.get(\"x-forwarded-for\") || \"\";\n return (xf.split(\",\")[0] || \"\").trim() || \"ip?\";\n}\n// Validaciones simples de entrada.\nconst validName = (s: string) => s.length >= 1 && s.length <= 60;\nconst validNumber = (s: string) => norm(s).length >= 9; // al menos 9 dígitos\nconst validCaller = (s: string) => {\n const d = s.replace(/\\D/g, \"\");\n return d.length >= 6 && d.length <= 15;\n};\n\n// ---------- utilidades ----------\nconst bytesToB64 = (b: Uint8Array) => btoa(String.fromCharCode(...b)); // base64 estándar\nconst bytesToHex = (b: Uint8Array) =>\n Array.from(b).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\nfunction randBytes(n: number): Uint8Array {\n const a = new Uint8Array(n);\n crypto.getRandomValues(a);\n return a;\n}\n\nasync function hmacSign(\n secretBytes: Uint8Array,\n payload: string,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n secretBytes,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(payload)),\n );\n return bytesToB64(sig);\n}\n\n// ---------- FCM ----------\nfunction pemToArrayBuffer(pem: string): ArrayBuffer {\n const b64 = pem.replace(/-----BEGIN PRIVATE KEY-----/, \"\")\n .replace(/-----END PRIVATE KEY-----/, \"\")\n .replace(/\\\\n/g, \"\")\n .replace(/[^A-Za-z0-9+/=]/g, \"\");\n const bin = atob(b64);\n const buf = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);\n return buf.buffer;\n}\nconst b64url = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\nconst b64urlStr = (s: string) => b64url(new TextEncoder().encode(s));\n\nlet cachedTok: string | null = null;\nlet cachedExp = 0;\nasync function getAccessToken(): Promise {\n const now = Math.floor(Date.now() / 1000);\n if (cachedTok && now < cachedExp - 60) return cachedTok;\n const input = b64urlStr(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" })) + \".\" +\n b64urlStr(JSON.stringify({\n iss: SA.client_email,\n scope: \"https://www.googleapis.com/auth/firebase.messaging\",\n aud: SA.token_uri,\n iat: now,\n exp: now + 3600,\n }));\n const key = await crypto.subtle.importKey(\n \"pkcs8\",\n pemToArrayBuffer(SA.private_key),\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\n \"RSASSA-PKCS1-v1_5\",\n key,\n new TextEncoder().encode(input),\n ),\n );\n const r = await fetch(SA.token_uri, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=\" +\n input + \".\" + b64url(sig),\n });\n const j = await r.json();\n if (!j.access_token) throw new Error(\"no access_token: \" + JSON.stringify(j));\n cachedTok = j.access_token as string;\n cachedExp = now + (j.expires_in || 3600);\n return cachedTok;\n}\n\nasync function sendPush(token: string, data: Record) {\n const access = await getAccessToken();\n const r = await fetch(\n `https://fcm.googleapis.com/v1/projects/${PROJECT}/messages:send`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Bearer \" + access,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: { token, data, android: { priority: \"high\" } },\n }),\n },\n );\n return { status: r.status, body: await r.text() };\n}\n\n// ---------- respuestas + CORS ----------\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n \"Access-Control-Allow-Methods\": \"GET,POST,OPTIONS\",\n};\nconst json = (obj: unknown, status = 200) =>\n new Response(JSON.stringify(obj), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...CORS },\n });\n\n// ---------- SDK embebible + página de autorización alojada ----------\n// Integración de UNA sola línea (el botón se crea solo):\n// \n// Modo avanzado (tu propio botón + capturar el handle):\n// \n// \n// \nconst SDK_JS = [\n \"(function(){\",\n \" var s = document.currentScript;\",\n \" var merchant = (s && s.getAttribute('data-merchant')) || '';\",\n \" var name = (s && s.getAttribute('data-name')) || merchant;\",\n \" var text = (s && s.getAttribute('data-text')) || '\\\\uD83D\\\\uDEE1\\\\uFE0F Recibe nuestras llamadas verificadas';\",\n \" var auto = !!(s && s.getAttribute('data-auto') !== null);\",\n \" var base = (s ? s.src : '').replace(/\\\\/sdk\\\\.js.*$/, '');\",\n \" var injected = null;\",\n \" window.Kledos = {\",\n \" _cb: null,\",\n \" onProtected: function(cb){ this._cb = cb; },\",\n \" open: function(){\",\n \" var u = base + '/connect?merchant=' + encodeURIComponent(merchant) + '&name=' + encodeURIComponent(name) + '&origin=' + encodeURIComponent(location.origin);\",\n \" window.open(u, 'kledos', 'width=430,height=680');\",\n \" }\",\n \" };\",\n \" if (auto && s && s.parentNode) {\",\n \" var b = document.createElement('button'); b.type = 'button'; b.setAttribute('data-konstai','1'); b.textContent = text;\",\n \" b.style.cssText = 'display:inline-flex;align-items:center;justify-content:center;gap:8px;width:100%;max-width:360px;min-height:48px;padding:0 18px;border:none;border-radius:12px;background:#12B76A;color:#fff;font-weight:700;font-size:15px;line-height:1.2;cursor:pointer;font-family:inherit;margin:10px 0;';\",\n \" s.parentNode.insertBefore(b, s.nextSibling); injected = b;\",\n \" }\",\n \" document.addEventListener('click', function(e){\",\n \" var t = e.target.closest && e.target.closest('#konstai-btn,[data-konstai]');\",\n \" if (t) { e.preventDefault(); window.Kledos.open(); }\",\n \" });\",\n \" window.addEventListener('message', function(ev){\",\n \" var d = ev.data;\",\n \" if (d && d.konstai && d.handle) {\",\n \" if (injected) { injected.textContent = '\\\\u2713 Protegido con Kledos'; injected.style.background = '#0E9257'; injected.disabled = true; }\",\n \" if (window.Kledos._cb) window.Kledos._cb(d.handle, d);\",\n \" }\",\n \" });\",\n \"})();\",\n].join(\"\\n\");\n\nconst CONNECT_HTML = [\n \"\",\n \"\",\n \"Autorizar con Kledos\",\n \"

Autorizar con Kledos

Este comercio podrá llamarte de forma verificada.

\",\n \"

Comercio
Comercio verificado

\",\n \"

✓Sus llamadas te llegarán verificadas, no como número desconocido.

\",\n \"

✓Podrás revocar el permiso cuando quieras desde la app Kledos.

\",\n \"\",\n \"

¿no tienes la app aquí? escribe tu número

\",\n \"\",\n \"\",\n \"

\",\n \"

Protegido por Kledos · no compartimos tu número con terceros sin tu permiso

\",\n \"

\",\n \"\",\n].join(\"\\n\");\n\nexport default async function (req: Request): Promise {\n try {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS });\n }\n const url = new URL(req.url);\n const path = url.pathname;\n\n if (req.method === \"GET\" && path === \"/\") {\n return json({ ok: true, service: \"Kledos\" });\n }\n\n if (req.method === \"GET\" && path === \"/sdk.js\") {\n return new Response(SDK_JS, {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n ...CORS,\n },\n });\n }\n\n if (req.method === \"GET\" && path === \"/connect\") {\n return new Response(CONNECT_HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\", ...CORS },\n });\n }\n\n // La web del comercio pregunta si el cliente ya aprobó en su app (flujo \"Conectar\").\n if (req.method === \"GET\" && path === \"/connect/status\") {\n const rq = url.searchParams.get(\"req\") || \"\";\n if (!rq) return json({ ok: false, done: false });\n const r = (await getJSON(`konstai_creq_${rq}`)) as\n | { handle: string }\n | null;\n if (r && r.handle) {\n return json({ ok: true, done: true, handle: r.handle });\n }\n return json({ ok: true, done: false });\n }\n\n // La app del cliente aprueba de un toque una solicitud \"Conectar con Kledos\".\n // El propio acto de aprobar en la app (autenticado por el token del número) es el\n // consentimiento: la relación queda ACTIVA y se guarda el resultado para que la web\n // del comercio lo recoja por /connect/status.\n if (req.method === \"POST\" && path === \"/connect/approve\") {\n const b = await req.json().catch(() => ({}));\n const merchantId = String(b.merchant || \"\");\n const fullNumber = String(b.number || \"\").trim();\n const userKey = norm(fullNumber);\n const token = String(b.token || \"\");\n const rq = String(b.req || \"\");\n if (!userKey || !token) {\n return json({ ok: false, error: \"faltan datos\" }, 400);\n }\n const known = await getTok(userKey);\n if (!known || known !== token) {\n return json({ ok: false, error: \"no autorizado para ese número\" }, 401);\n }\n const m = await getMerchant(merchantId);\n if (!m) return json({ ok: false, error: \"comercio desconocido\" }, 400);\n const label = m.name;\n const keyId = bytesToHex(randBytes(4));\n const secret = randBytes(32);\n const secretB64 = bytesToB64(secret);\n const handle = \"kh_\" + bytesToHex(randBytes(12));\n await setRel(handle, {\n keyId,\n secret: secretB64,\n userKey,\n fullNumber,\n label,\n merchant: m.id,\n revoked: false,\n pending: false,\n ts: Date.now(),\n });\n const midxKey = `konstai_midx_${m.id}`;\n const idx = ((await getJSON(midxKey)) as string[] | null) || [];\n idx.push(handle);\n await blob.setJSON(midxKey, idx.slice(-200));\n const uidxKey = `konstai_uidx_${userKey}`;\n const uidx = ((await getJSON(uidxKey)) as string[] | null) || [];\n if (!uidx.includes(handle)) {\n uidx.push(handle);\n await blob.setJSON(uidxKey, uidx.slice(-300));\n }\n await retirePrev(m.id, userKey, handle);\n if (rq) {\n await blob.setJSON(`konstai_creq_${rq}`, { handle, ts: Date.now() });\n }\n return json({ ok: true, handle, keyId, secret: secretB64, label });\n }\n\n if (req.method === \"GET\" && path === \"/debug\") {\n try {\n await getAccessToken();\n return json({ ok: true, project: PROJECT, tokenOk: true });\n } catch (e) {\n return json({\n ok: false,\n project: PROJECT,\n error: String((e as Error).message || e),\n });\n }\n }\n\n // ---------- P2P ----------\n if (req.method === \"POST\" && path === \"/register\") {\n const b = await req.json().catch(() => ({}));\n const k = norm(b.handle);\n if (!k || !b.token) {\n return json({ ok: false, error: \"handle y token requeridos\" }, 400);\n }\n if (!validNumber(String(b.handle))) {\n return json({ ok: false, error: \"número no válido\" }, 400);\n }\n if (limited(\"reg_\" + clientIp(req), 30, 3600000)) {\n return json({\n ok: false,\n error: \"demasiados registros, prueba más tarde\",\n }, 429);\n }\n await setTok(k, b.token);\n return json({ ok: true, handle: k });\n }\n\n if (req.method === \"POST\" && path === \"/revoke\") {\n const b = await req.json().catch(() => ({}));\n const kid = String(b.keyId || \"\");\n if (!kid) return json({ ok: false, error: \"keyId requerido\" }, 400);\n await setRevoked(kid);\n return json({ ok: true, revoked: kid });\n }\n\n if (req.method === \"POST\" && path === \"/notify\") {\n const b = await req.json().catch(() => ({}));\n const k = norm(b.toHandle);\n const token = await getTok(k);\n if (!token) {\n return json({\n ok: false,\n error: \"destinatario no registrado\",\n handle: k,\n }, 404);\n }\n const kid = String(b.payload || \"\").split(\"~\")[1] || \"\";\n if (kid && await isRevoked(kid)) {\n return json({ ok: false, error: \"clave revocada\" }, 403);\n }\n const now = Date.now();\n rate[k] = (rate[k] || []).filter((t) => now - t < 60000);\n if (rate[k].length >= 5) {\n return json({ ok: false, error: \"demasiados avisos\" }, 429);\n }\n rate[k].push(now);\n const r = await sendPush(token, {\n label: String(b.label || \"\"),\n number: String(b.number || \"\"),\n payload: String(b.payload || \"\"),\n sig: String(b.sig || \"\"),\n });\n return json({ ok: r.status === 200, fcm: r.status }, 200);\n }\n\n // ---------- P2B (modelo COMPARTIDO) ----------\n // CLIENTE: genera un código de emparejamiento de un solo uso para dárselo a un\n // comercio (que enrolará por servidor sin spamear). Autenticado por posesión del\n // token push del número: solo el móvil de ese número conoce su token.\n if (req.method === \"POST\" && path === \"/account/paircode\") {\n const b = await req.json().catch(() => ({}));\n const fullNumber = String(b.number || \"\").trim();\n const userKey = norm(fullNumber);\n const token = String(b.token || \"\");\n if (!userKey || !token) {\n return json({ ok: false, error: \"faltan datos\" }, 400);\n }\n const known = await getTok(userKey);\n if (!known || known !== token) {\n return json({ ok: false, error: \"no autorizado para ese número\" }, 401);\n }\n if (limited(\"pair_\" + userKey, 10, 600000)) {\n return json(\n { ok: false, error: \"demasiados códigos, espera un poco\" },\n 429,\n );\n }\n const rb = randBytes(4);\n const n = (((rb[0] << 24) | (rb[1] << 16) | (rb[2] << 8) | rb[3]) >>> 0) %\n 1000000;\n const code = (\"\" + n).padStart(6, \"0\");\n await blob.setJSON(`konstai_pair_${code}`, { userKey, ts: Date.now() });\n return json({ ok: true, code, expiraSegundos: 1800 });\n }\n\n // COMERCIO (por servidor): enrola a un cliente. Autenticado con la CLAVE SECRETA.\n // - Con 'code' de emparejamiento válido -> se activa al instante (el código prueba\n // el consentimiento del cliente).\n // - Sin 'code' -> queda PENDIENTE y se pide consentimiento al móvil (como el botón,\n // pero atribuible a un comercio real y baneable).\n if (req.method === \"POST\" && path === \"/merchant/enroll\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const fullNumber = String(b.number || \"\").trim();\n const userKey = norm(fullNumber);\n if (!userKey || !validNumber(fullNumber)) {\n return json({ ok: false, error: \"número no válido\" }, 400);\n }\n if (limited(\"enrollnum_\" + userKey, 5, 600000)) {\n return json({\n ok: false,\n error: \"demasiadas solicitudes para ese número\",\n }, 429);\n }\n if (limited(\"enrollmerch_\" + m.id, 200, 3600000)) {\n return json({ ok: false, error: \"límite del comercio superado\" }, 429);\n }\n const token = await getTok(userKey);\n if (!token) {\n return json(\n { ok: false, error: \"usuario no registrado en Kledos\" },\n 409,\n );\n }\n\n const label = m.name; // nombre atado a la cuenta\n const code = String(b.code || \"\").trim();\n let autoAccept = false;\n if (code) {\n const pr = (await getJSON(`konstai_pair_${code}`)) as {\n userKey: string;\n ts: number;\n } | null;\n if (\n !pr || pr.userKey !== userKey || (Date.now() - (pr.ts || 0)) > 1800000\n ) {\n return json({\n ok: false,\n error: \"código de emparejamiento no válido o caducado\",\n }, 403);\n }\n await blob.delete(`konstai_pair_${code}`); // un solo uso\n autoAccept = true;\n }\n\n const keyId = bytesToHex(randBytes(4));\n const secret = randBytes(32);\n const secretB64 = bytesToB64(secret);\n const handle = \"kh_\" + bytesToHex(randBytes(12));\n await setRel(handle, {\n keyId,\n secret: secretB64,\n userKey,\n fullNumber,\n label,\n merchant: m.id,\n revoked: false,\n pending: !autoAccept,\n ts: Date.now(),\n });\n const midxKey = `konstai_midx_${m.id}`;\n const idx = ((await getJSON(midxKey)) as string[] | null) || [];\n idx.push(handle);\n await blob.setJSON(midxKey, idx.slice(-200));\n\n if (autoAccept) {\n const uidxKey = `konstai_uidx_${userKey}`;\n const uidx = ((await getJSON(uidxKey)) as string[] | null) || [];\n if (!uidx.includes(handle)) {\n uidx.push(handle);\n await blob.setJSON(uidxKey, uidx.slice(-300));\n }\n await retirePrev(m.id, userKey, handle);\n const g = await sendPush(token, {\n type: \"grant\",\n keyId,\n secret: secretB64,\n label,\n });\n return json({ ok: true, handle, status: \"active\", fcm: g.status });\n }\n const g = await sendPush(token, {\n type: \"consent\",\n handle,\n keyId,\n label,\n });\n if (g.status !== 200) {\n return json({\n ok: false,\n error: \"no se pudo notificar al móvil\",\n fcm: g.status,\n }, 502);\n }\n return json({ ok: true, handle, status: \"pending\" });\n }\n\n // La TIENDA delega el permiso de ESTE pedido a un REPARTIDOR (se puede llamar varias\n // veces para añadir más de uno). Autenticado con la clave secreta de la tienda, que es\n // la dueña de la relación. Acotado con caducidad (por defecto 7 días).\n if (req.method === \"POST\" && path === \"/order/delegate\") {\n const b = await req.json().catch(() => ({}));\n const store = await merchantByKey(String(b.apiKey || \"\"));\n if (!store) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (rel.merchant !== store.id) {\n return json({ ok: false, error: \"ese pedido no es de tu cuenta\" }, 403);\n }\n const carrierId = String(b.carrier || \"\").trim();\n const carrier = await getMerchant(carrierId);\n if (!carrier) {\n return json({\n ok: false,\n error: \"repartidor desconocido: \" + carrierId,\n }, 400);\n }\n const dias = Math.min(30, Math.max(1, Number(b.dias) || 7));\n const exp = Date.now() + dias * 86400000;\n const delegates: Array<{ id: string; exp: number }> =\n Array.isArray(rel.delegates) ? rel.delegates : [];\n const nuevos = delegates.filter((d) => d.id !== carrierId);\n nuevos.push({ id: carrierId, exp });\n rel.delegates = nuevos;\n await setRel(String(b.handle), rel);\n return json({\n ok: true,\n handle: String(b.handle),\n carrier: carrierId,\n carriersActivos: nuevos.map((d) => d.id),\n expira: exp,\n });\n }\n\n // El usuario autoriza a un comercio con \"Proteger con Kledos\". Kledos:\n // · crea la relación (secreto HMAC) y la empuja al móvil del usuario,\n // · guarda el número completo del usuario (compartido: el comercio podrá marcarlo),\n // · devuelve al comercio un HANDLE con el que pedir avisos y consultar el número.\n if (req.method === \"POST\" && path === \"/authorize\") {\n const b = await req.json().catch(() => ({}));\n const fullNumber = String(b.number || \"\").trim();\n const userKey = norm(fullNumber);\n const merchantId = String(b.merchant || \"comercio\");\n const m = await getMerchant(merchantId);\n if (!userKey) return json({ ok: false, error: \"number requerido\" }, 400);\n if (!validNumber(fullNumber)) {\n return json({ ok: false, error: \"número no válido\" }, 400);\n }\n if (!m) {\n return json(\n { ok: false, error: \"comercio desconocido: \" + merchantId },\n 400,\n );\n }\n // NOMBRE ATADO A LA CUENTA VERIFICADA: ignoramos cualquier 'label' que venga de\n // fuera; el nombre que verá el cliente es SIEMPRE el de la cuenta (anti-suplantación).\n const label = m.name;\n // Anti-spam de autorizaciones: por número y por IP.\n if (limited(\"authnum_\" + userKey, 5, 600000)) {\n return json({\n ok: false,\n error: \"demasiadas autorizaciones para ese número\",\n }, 429);\n }\n if (limited(\"authip_\" + clientIp(req), 30, 3600000)) {\n return json({\n ok: false,\n error: \"demasiadas autorizaciones, prueba más tarde\",\n }, 429);\n }\n const token = await getTok(userKey);\n if (!token) {\n return json({\n ok: false,\n error:\n \"usuario no registrado: abre la app Kledos y pulsa 'registrarme'\",\n }, 409);\n }\n\n const keyId = bytesToHex(randBytes(4));\n const secret = randBytes(32);\n const secretB64 = bytesToB64(secret);\n const handle = \"kh_\" + bytesToHex(randBytes(12));\n\n // La relación nace PENDIENTE: no vale hasta que el dueño acepte en su móvil.\n await setRel(handle, {\n keyId,\n secret: secretB64,\n userKey,\n fullNumber,\n label,\n merchant: merchantId,\n revoked: false,\n pending: true,\n ts: Date.now(),\n });\n const midxKey = `konstai_midx_${merchantId}`;\n const idx = ((await getJSON(midxKey)) as string[] | null) || [];\n idx.push(handle);\n await blob.setJSON(midxKey, idx.slice(-200));\n\n // Pedimos CONSENTIMIENTO al móvil (sin el secreto: ese solo baja al aceptar).\n const g = await sendPush(token, {\n type: \"consent\",\n handle,\n keyId,\n label,\n });\n if (g.status !== 200) {\n return json({\n ok: false,\n error: \"no se pudo notificar al móvil\",\n fcm: g.status,\n }, 502);\n }\n\n return json({ ok: true, handle, status: \"pending\" });\n }\n\n // El móvil del usuario acepta o rechaza la petición de consentimiento.\n // Al ACEPTAR devolvemos el secreto para que el móvil pueda verificar avisos.\n if (req.method === \"POST\" && path === \"/authorize/confirm\") {\n const b = await req.json().catch(() => ({}));\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (String(b.decision) === \"accept\") {\n rel.pending = false;\n await setRel(String(b.handle), rel);\n await retirePrev(rel.merchant, rel.userKey, String(b.handle));\n // Índice por USUARIO (número) para poder restaurar sus permisos en otro móvil.\n const uidxKey = `konstai_uidx_${rel.userKey}`;\n const uidx = ((await getJSON(uidxKey)) as string[] | null) || [];\n if (!uidx.includes(String(b.handle))) {\n uidx.push(String(b.handle));\n await blob.setJSON(uidxKey, uidx.slice(-300));\n }\n return json({\n ok: true,\n keyId: rel.keyId,\n secret: rel.secret,\n label: rel.label,\n });\n } else {\n rel.revoked = true;\n await setRel(String(b.handle), rel);\n await setRevoked(rel.keyId);\n return json({ ok: true, rejected: true });\n }\n }\n\n // Restaurar permisos en un móvil nuevo (cuenta = tu número). Devuelve tus\n // relaciones activas con su secreto para volver a verificar avisos.\n // PRODUCCIÓN: proteger con verificación del número (OTP por SMS).\n if (req.method === \"POST\" && path === \"/account/grants\") {\n const b = await req.json().catch(() => ({}));\n const userKey = norm(String(b.number || \"\"));\n if (!validNumber(String(b.number || \"\"))) {\n return json({ ok: false, error: \"número no válido\" }, 400);\n }\n if (limited(\"acct_\" + clientIp(req), 20, 3600000)) {\n return json({\n ok: false,\n error: \"demasiadas restauraciones, prueba más tarde\",\n }, 429);\n }\n const uidx =\n ((await getJSON(`konstai_uidx_${userKey}`)) as string[] | null) || [];\n const grants = [];\n for (const h of uidx) {\n const rel = await getRel(h);\n if (\n rel && !rel.pending && !rel.revoked && !(await isRevoked(rel.keyId))\n ) {\n grants.push({\n keyId: rel.keyId,\n secret: rel.secret,\n label: rel.label,\n });\n }\n }\n return json({ ok: true, grants });\n }\n\n // Alta de empresa (self-service). Devuelve id público + clave secreta.\n if (req.method === \"POST\" && path === \"/merchant/signup\") {\n const b = await req.json().catch(() => ({}));\n const name = String(b.name || \"\").trim();\n const caller = String(b.caller || \"\").trim();\n if (!validName(name)) {\n return json(\n { ok: false, error: \"nombre no válido (1-60 caracteres)\" },\n 400,\n );\n }\n if (!validCaller(caller)) {\n return json({ ok: false, error: \"número de salida no válido\" }, 400);\n }\n if (limited(\"signup_\" + clientIp(req), 5, 3600000)) {\n return json({\n ok: false,\n error: \"demasiadas altas desde aquí, prueba más tarde\",\n }, 429);\n }\n // id público único\n let id = slugify(name);\n if (await getMerchant(id)) id = id + \"-\" + bytesToHex(randBytes(2));\n const apiKey = \"sk_live_\" + bytesToHex(randBytes(18));\n await blob.setJSON(`konstai_merchant_${id}`, {\n id,\n name,\n caller,\n apiKey,\n ts: Date.now(),\n });\n await blob.setJSON(`konstai_mkey_${apiKey}`, id);\n return json({ ok: true, merchant: id, name, caller, apiKey });\n }\n\n // Cerrar cuenta (self-service). Solo el dueño, que prueba tener la clave secreta,\n // puede darse de baja. Borra el comercio y su índice de clave.\n if (req.method === \"POST\" && path === \"/merchant/close\") {\n const b = await req.json().catch(() => ({}));\n const apiKey = String(b.apiKey || \"\");\n const m = await merchantByKey(apiKey);\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n if (SEEDED[m.id]) {\n return json(\n { ok: false, error: \"cuenta de demo: no se puede cerrar\" },\n 403,\n );\n }\n await blob.delete(`konstai_merchant_${m.id}`);\n await blob.delete(`konstai_mkey_${apiKey}`);\n return json({ ok: true, closed: m.id });\n }\n\n // El comercio pide llamar al cliente (por handle). El aviso lleva el número de\n // salida del comercio, para que la llamada REAL suene verificada en el móvil.\n if (req.method === \"POST\" && path === \"/merchant/notify\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n // Puede avisar el DUEÑO de la relación (la tienda) o un REPARTIDOR al que se le\n // haya delegado el pedido y cuya delegación no haya caducado.\n const isOwner = rel.merchant === m.id;\n const isDelegate = Array.isArray(rel.delegates) &&\n rel.delegates.some((d: any) =>\n d && d.id === m.id && (!d.exp || d.exp > Date.now())\n );\n if (!isOwner && !isDelegate) {\n return json({\n ok: false,\n error: \"ese handle no es de tu comercio ni te ha sido delegado\",\n }, 403);\n }\n if (rel.revoked || await isRevoked(rel.keyId)) {\n return json({ ok: false, error: \"relación revocada\" }, 403);\n }\n if (rel.pending) {\n return json({\n ok: false,\n error: \"pendiente de que el cliente acepte en su móvil\",\n }, 409);\n }\n // Anti-acoso: máximo de avisos por cliente y por comercio.\n if (limited(\"mn_\" + String(b.handle), 6, 600000)) {\n return json(\n { ok: false, error: \"demasiados avisos a ese cliente\" },\n 429,\n );\n }\n if (limited(\"mnmerch_\" + m.id, 120, 60000)) {\n return json({ ok: false, error: \"límite del comercio superado\" }, 429);\n }\n const token = await getTok(rel.userKey);\n if (!token) {\n return json({ ok: false, error: \"usuario sin móvil registrado\" }, 404);\n }\n\n const nonce = bytesToHex(randBytes(6));\n const payload = \"v1~\" + rel.keyId + \"~\" + Date.now() + \"~\" + nonce;\n const secretBytes = new Uint8Array(\n atob(rel.secret).split(\"\").map((c) => c.charCodeAt(0)),\n );\n const sig = await hmacSign(secretBytes, payload);\n // number = caller ID desde el que llama el negocio. La app de negocio puede\n // enviar el suyo real (b.caller); si no, usamos el configurado del comercio.\n const caller = String(b.caller || m.caller);\n const r = await sendPush(token, {\n label: String(rel.label),\n number: caller,\n payload,\n sig,\n });\n return json({ ok: r.status === 200, fcm: r.status, caller }, 200);\n }\n\n // El panel del comercio lista SUS relaciones. En compartido incluye el número\n // (el comercio lo necesita para marcar). Autenticado por su clave.\n if (req.method === \"POST\" && path === \"/merchant/list\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const idx =\n ((await getJSON(`konstai_midx_${m.id}`)) as string[] | null) || [];\n const items = [];\n for (const h of idx.slice(-50).reverse()) {\n const rel = await getRel(h);\n if (rel) {\n items.push({\n handle: h,\n label: rel.label,\n number: rel.fullNumber || \"\",\n revoked: !!rel.revoked || await isRevoked(rel.keyId),\n pending: !!rel.pending,\n ts: rel.ts || 0,\n });\n }\n }\n return json({\n ok: true,\n merchant: m.id,\n name: m.name,\n caller: m.caller,\n items,\n });\n }\n\n if (req.method === \"POST\" && path === \"/merchant/revoke\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (rel.merchant !== m.id) {\n return json(\n { ok: false, error: \"ese handle no es de tu comercio\" },\n 403,\n );\n }\n rel.revoked = true;\n await setRel(String(b.handle), rel);\n await setRevoked(rel.keyId);\n return json({ ok: true });\n }\n\n return json({ ok: false, error: \"not found\" }, 404);\n } catch (e) {\n return json({ ok: false, error: String((e as Error).message || e) }, 200);\n }\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1787604128136],"children",[],[35],"9f22b944-e907-4abc-bcea-f71b3515daaf",["D",1787238273342],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","f438816c-0bcb-436e-89fa-0a25876ac3ba","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a01faf-dd13-7316-b4da-9b1cb1edc8d6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_115":111},"org",{"_11":12,"_108":109,"_110":111,"_70":71,"_112":113,"_114":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Obelux8","avatar","https://avatars.githubusercontent.com/u/260928148?v=4","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":149,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":37,"_73":44,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":150,"_95":151,"_97":152,"_99":53},[146],"files",[146],"counts",{"_136":77,"_137":138,"_139":77,"_31":140,"_141":142},[134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":135},[35],"pulls","branches",1,"forks",{"_143":138,"_145":77},"connections",{"_143":77,"_144":77},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":147,"_18":148},[],[35],["D",1787238273342],{"_11":12,"_115":111},{"_11":12,"_108":109,"_110":111,"_70":71,"_112":113,"_114":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_131":186,"_187":188,"_189":190,"_191":53,"_192":53,"_193":53,"_194":44,"_195":-5,"_196":-7,"_197":-7,"_198":77,"_199":53,"_200":53,"_201":-5,"_202":53,"_203":53,"_204":53,"_205":-5},"ENV",{"_157":158,"_159":160,"_161":16,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]