Autorizar con KonstAI

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_105":86,"_27":53,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":58,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",15,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","new-file-5543.ts","latestPath","fileId","6097466e-9caa-11f1-80db-1607ee4eb77e","name","fileType","http","content","// ===== KonstAI — backend (Val Town, HTTP val) =====\n// Variable de entorno necesaria: KONSTAI_SA = (JSON del service account de Firebase)\n//\n// P2P (ya existente):\n// POST /register { handle, token } -> guarda token del RECEPTOR\n// POST /notify { toHandle, number, payload, sig } -> aviso firmado (EC) al receptor\n// POST /revoke { keyId } -> revoca una clave P2P\n//\n// P2B (nuevo, modelo \"número oculto\"):\n// POST /authorize { number, merchant, label } -> el usuario autoriza a un comercio.\n// Crea una relación con secreto HMAC, la EMPUJA al móvil del usuario (type=grant)\n// y devuelve al comercio un HANDLE opaco (nunca el número).\n// POST /merchant/notify { apiKey, handle } -> el comercio pide llamar al cliente.\n// KonstAI firma el aviso con HMAC y lo empuja al móvil. El comercio no ve el número.\n// POST /merchant/revoke { handle } -> corta una relación P2B.\n\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst SA = JSON.parse(Deno.env.get(\"KONSTAI_SA\") || \"{}\");\nconst PROJECT = SA.project_id;\n\n// ---------- empresas (multi-tenant, modelo COMPARTIDO) ----------\n// Cada empresa tiene su PROPIA clave de API y su número de salida (caller ID).\n// En un producto real esto vive en una BBDD con alta de empresas; aquí lo\n// dejamos sembrado para la demo, pero ya con estructura por-empresa.\nconst MERCHANTS: Record<\n string,\n { apiKey: string; name: string; caller: string }\n> = {\n \"aurora-store\": {\n apiKey: \"demo-key-123\",\n name: \"Aurora Store\",\n caller: \"+34 944 010 010\",\n },\n \"bilbo-clinic\": {\n apiKey: \"sk_bilbo_demo\",\n name: \"Clínica Bilbo\",\n caller: \"+34 944 020 020\",\n },\n};\nfunction merchantByKey(\n apiKey: string,\n): { id: string; name: string; caller: string } | null {\n for (const id in MERCHANTS) {\n if (MERCHANTS[id].apiKey === apiKey) return { id, ...MERCHANTS[id] };\n }\n return null;\n}\n\nconst norm = (h: string) => String(h || \"\").replace(/\\D/g, \"\").slice(-9);\n\n// ---------- almacenes (blob) ----------\nasync function getJSON(key: string): Promise {\n try {\n return await blob.getJSON(key);\n } catch {\n return null;\n }\n}\nasync function getTok(k: string): Promise {\n return (await getJSON(`konstai_tok_${k}`)) as string | null;\n}\nasync function setTok(k: string, t: string) {\n await blob.setJSON(`konstai_tok_${k}`, t);\n}\n\nasync function isRevoked(keyId: string): Promise {\n return !!(await getJSON(`konstai_rev_${keyId}`));\n}\nasync function setRevoked(keyId: string) {\n await blob.setJSON(`konstai_rev_${keyId}`, true);\n}\n\nasync function getRel(handle: string): Promise {\n return await getJSON(`konstai_rel_${handle}`);\n}\nasync function setRel(handle: string, obj: any) {\n await blob.setJSON(`konstai_rel_${handle}`, obj);\n}\n\nconst rate: Record = {};\n\n// ---------- utilidades ----------\nconst bytesToB64 = (b: Uint8Array) => btoa(String.fromCharCode(...b)); // base64 estándar\nconst bytesToHex = (b: Uint8Array) =>\n Array.from(b).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\nfunction randBytes(n: number): Uint8Array {\n const a = new Uint8Array(n);\n crypto.getRandomValues(a);\n return a;\n}\n\nasync function hmacSign(\n secretBytes: Uint8Array,\n payload: string,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n secretBytes,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(payload)),\n );\n return bytesToB64(sig);\n}\n\n// ---------- FCM ----------\nfunction pemToArrayBuffer(pem: string): ArrayBuffer {\n const b64 = pem.replace(/-----BEGIN PRIVATE KEY-----/, \"\")\n .replace(/-----END PRIVATE KEY-----/, \"\")\n .replace(/\\\\n/g, \"\")\n .replace(/[^A-Za-z0-9+/=]/g, \"\");\n const bin = atob(b64);\n const buf = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);\n return buf.buffer;\n}\nconst b64url = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\nconst b64urlStr = (s: string) => b64url(new TextEncoder().encode(s));\n\nlet cachedTok: string | null = null;\nlet cachedExp = 0;\nasync function getAccessToken(): Promise {\n const now = Math.floor(Date.now() / 1000);\n if (cachedTok && now < cachedExp - 60) return cachedTok;\n const input = b64urlStr(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" })) + \".\" +\n b64urlStr(JSON.stringify({\n iss: SA.client_email,\n scope: \"https://www.googleapis.com/auth/firebase.messaging\",\n aud: SA.token_uri,\n iat: now,\n exp: now + 3600,\n }));\n const key = await crypto.subtle.importKey(\n \"pkcs8\",\n pemToArrayBuffer(SA.private_key),\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\n \"RSASSA-PKCS1-v1_5\",\n key,\n new TextEncoder().encode(input),\n ),\n );\n const r = await fetch(SA.token_uri, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=\" +\n input + \".\" + b64url(sig),\n });\n const j = await r.json();\n if (!j.access_token) throw new Error(\"no access_token: \" + JSON.stringify(j));\n cachedTok = j.access_token as string;\n cachedExp = now + (j.expires_in || 3600);\n return cachedTok;\n}\n\nasync function sendPush(token: string, data: Record) {\n const access = await getAccessToken();\n const r = await fetch(\n `https://fcm.googleapis.com/v1/projects/${PROJECT}/messages:send`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Bearer \" + access,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: { token, data, android: { priority: \"high\" } },\n }),\n },\n );\n return { status: r.status, body: await r.text() };\n}\n\n// ---------- respuestas + CORS ----------\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n \"Access-Control-Allow-Methods\": \"GET,POST,OPTIONS\",\n};\nconst json = (obj: unknown, status = 200) =>\n new Response(JSON.stringify(obj), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...CORS },\n });\n\n// ---------- SDK embebible + página de autorización alojada ----------\n// El comercio pega en su web:\n// \n// \n// \nconst SDK_JS = [\n \"(function(){\",\n \" var s = document.currentScript;\",\n \" var merchant = (s && s.getAttribute('data-merchant')) || '';\",\n \" var name = (s && s.getAttribute('data-name')) || merchant;\",\n \" var base = (s ? s.src : '').replace(/\\\\/sdk\\\\.js.*$/, '');\",\n \" window.KonstAI = {\",\n \" _cb: null,\",\n \" onProtected: function(cb){ this._cb = cb; },\",\n \" open: function(){\",\n \" var u = base + '/connect?merchant=' + encodeURIComponent(merchant) + '&name=' + encodeURIComponent(name) + '&origin=' + encodeURIComponent(location.origin);\",\n \" window.open(u, 'konstai', 'width=430,height=680');\",\n \" }\",\n \" };\",\n \" document.addEventListener('click', function(e){\",\n \" var t = e.target.closest && e.target.closest('#konstai-btn,[data-konstai]');\",\n \" if (t) { e.preventDefault(); window.KonstAI.open(); }\",\n \" });\",\n \" window.addEventListener('message', function(ev){\",\n \" var d = ev.data;\",\n \" if (d && d.konstai && d.handle && window.KonstAI._cb) window.KonstAI._cb(d.handle, d);\",\n \" });\",\n \"})();\",\n].join(\"\\n\");\n\nconst CONNECT_HTML = [\n \"\",\n \"\",\n \"Autorizar con KonstAI\",\n \"

Autorizar con KonstAI

Este comercio podrá llamarte de forma verificada.

\",\n \"

Comercio
Comercio verificado

\",\n \"

✓Sus llamadas te llegarán verificadas, no como número desconocido.

\",\n \"

✓Podrás revocar el permiso cuando quieras desde la app KonstAI.

\",\n \"Tu número de teléfono\",\n \"\",\n \"\",\n \"

\",\n \"

Protegido por KonstAI · no compartimos tu número con terceros sin tu permiso

\",\n \"

\",\n \"\",\n].join(\"\\n\");\n\nexport default async function (req: Request): Promise {\n try {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS });\n }\n const url = new URL(req.url);\n const path = url.pathname;\n\n if (req.method === \"GET\" && path === \"/\") {\n return json({ ok: true, service: \"KonstAI\" });\n }\n\n if (req.method === \"GET\" && path === \"/sdk.js\") {\n return new Response(SDK_JS, {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n ...CORS,\n },\n });\n }\n\n if (req.method === \"GET\" && path === \"/connect\") {\n return new Response(CONNECT_HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\", ...CORS },\n });\n }\n\n if (req.method === \"GET\" && path === \"/debug\") {\n try {\n await getAccessToken();\n return json({ ok: true, project: PROJECT, tokenOk: true });\n } catch (e) {\n return json({\n ok: false,\n project: PROJECT,\n error: String((e as Error).message || e),\n });\n }\n }\n\n // ---------- P2P ----------\n if (req.method === \"POST\" && path === \"/register\") {\n const b = await req.json().catch(() => ({}));\n const k = norm(b.handle);\n if (!k || !b.token) {\n return json({ ok: false, error: \"handle y token requeridos\" }, 400);\n }\n await setTok(k, b.token);\n return json({ ok: true, handle: k });\n }\n\n if (req.method === \"POST\" && path === \"/revoke\") {\n const b = await req.json().catch(() => ({}));\n const kid = String(b.keyId || \"\");\n if (!kid) return json({ ok: false, error: \"keyId requerido\" }, 400);\n await setRevoked(kid);\n return json({ ok: true, revoked: kid });\n }\n\n if (req.method === \"POST\" && path === \"/notify\") {\n const b = await req.json().catch(() => ({}));\n const k = norm(b.toHandle);\n const token = await getTok(k);\n if (!token) {\n return json({\n ok: false,\n error: \"destinatario no registrado\",\n handle: k,\n }, 404);\n }\n const kid = String(b.payload || \"\").split(\"~\")[1] || \"\";\n if (kid && await isRevoked(kid)) {\n return json({ ok: false, error: \"clave revocada\" }, 403);\n }\n const now = Date.now();\n rate[k] = (rate[k] || []).filter((t) => now - t < 60000);\n if (rate[k].length >= 5) {\n return json({ ok: false, error: \"demasiados avisos\" }, 429);\n }\n rate[k].push(now);\n const r = await sendPush(token, {\n label: String(b.label || \"\"),\n number: String(b.number || \"\"),\n payload: String(b.payload || \"\"),\n sig: String(b.sig || \"\"),\n });\n return json({ ok: r.status === 200, fcm: r.status }, 200);\n }\n\n // ---------- P2B (modelo COMPARTIDO) ----------\n // El usuario autoriza a un comercio con \"Proteger con KonstAI\". KonstAI:\n // · crea la relación (secreto HMAC) y la empuja al móvil del usuario,\n // · guarda el número completo del usuario (compartido: el comercio podrá marcarlo),\n // · devuelve al comercio un HANDLE con el que pedir avisos y consultar el número.\n if (req.method === \"POST\" && path === \"/authorize\") {\n const b = await req.json().catch(() => ({}));\n const fullNumber = String(b.number || \"\").trim();\n const userKey = norm(fullNumber);\n const merchantId = String(b.merchant || \"comercio\");\n const m = MERCHANTS[merchantId];\n const label = String(b.label || (m ? m.name : \"Comercio\"));\n if (!userKey) return json({ ok: false, error: \"number requerido\" }, 400);\n if (!m) {\n return json(\n { ok: false, error: \"comercio desconocido: \" + merchantId },\n 400,\n );\n }\n const token = await getTok(userKey);\n if (!token) {\n return json({\n ok: false,\n error:\n \"usuario no registrado: abre la app KonstAI y pulsa 'registrarme'\",\n }, 409);\n }\n\n const keyId = bytesToHex(randBytes(4));\n const secret = randBytes(32);\n const secretB64 = bytesToB64(secret);\n const handle = \"kh_\" + bytesToHex(randBytes(12));\n\n await setRel(handle, {\n keyId,\n secret: secretB64,\n userKey,\n fullNumber,\n label,\n merchant: merchantId,\n revoked: false,\n ts: Date.now(),\n });\n const midxKey = `konstai_midx_${merchantId}`;\n const idx = ((await getJSON(midxKey)) as string[] | null) || [];\n idx.push(handle);\n await blob.setJSON(midxKey, idx.slice(-200));\n\n const g = await sendPush(token, {\n type: \"grant\",\n keyId,\n secret: secretB64,\n label,\n });\n if (g.status !== 200) {\n return json({\n ok: false,\n error: \"no se pudo notificar al móvil\",\n fcm: g.status,\n }, 502);\n }\n\n return json({ ok: true, handle });\n }\n\n // El comercio pide llamar al cliente (por handle). El aviso lleva el número de\n // salida del comercio, para que la llamada REAL suene verificada en el móvil.\n if (req.method === \"POST\" && path === \"/merchant/notify\") {\n const b = await req.json().catch(() => ({}));\n const m = merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (rel.merchant !== m.id) {\n return json(\n { ok: false, error: \"ese handle no es de tu comercio\" },\n 403,\n );\n }\n if (rel.revoked || await isRevoked(rel.keyId)) {\n return json({ ok: false, error: \"relación revocada\" }, 403);\n }\n const token = await getTok(rel.userKey);\n if (!token) {\n return json({ ok: false, error: \"usuario sin móvil registrado\" }, 404);\n }\n\n const nonce = bytesToHex(randBytes(6));\n const payload = \"v1~\" + rel.keyId + \"~\" + Date.now() + \"~\" + nonce;\n const secretBytes = new Uint8Array(\n atob(rel.secret).split(\"\").map((c) => c.charCodeAt(0)),\n );\n const sig = await hmacSign(secretBytes, payload);\n // number = caller ID desde el que llama el negocio. La app de negocio puede\n // enviar el suyo real (b.caller); si no, usamos el configurado del comercio.\n const caller = String(b.caller || m.caller);\n const r = await sendPush(token, {\n label: String(rel.label),\n number: caller,\n payload,\n sig,\n });\n return json({ ok: r.status === 200, fcm: r.status, caller }, 200);\n }\n\n // El panel del comercio lista SUS relaciones. En compartido incluye el número\n // (el comercio lo necesita para marcar). Autenticado por su clave.\n if (req.method === \"POST\" && path === \"/merchant/list\") {\n const b = await req.json().catch(() => ({}));\n const m = merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const idx =\n ((await getJSON(`konstai_midx_${m.id}`)) as string[] | null) || [];\n const items = [];\n for (const h of idx.slice(-50).reverse()) {\n const rel = await getRel(h);\n if (rel) {\n items.push({\n handle: h,\n label: rel.label,\n number: rel.fullNumber || \"\",\n revoked: !!rel.revoked || await isRevoked(rel.keyId),\n ts: rel.ts || 0,\n });\n }\n }\n return json({\n ok: true,\n merchant: m.id,\n name: m.name,\n caller: m.caller,\n items,\n });\n }\n\n if (req.method === \"POST\" && path === \"/merchant/revoke\") {\n const b = await req.json().catch(() => ({}));\n const m = merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (rel.merchant !== m.id) {\n return json(\n { ok: false, error: \"ese handle no es de tu comercio\" },\n 403,\n );\n }\n rel.revoked = true;\n await setRel(String(b.handle), rel);\n await setRevoked(rel.keyId);\n return json({ ok: true });\n }\n\n return json({ ok: false, error: \"not found\" }, 404);\n } catch (e) {\n return json({ ok: false, error: String((e as Error).message || e) }, 200);\n }\n}","// ===== KonstAI — backend (Val Town, HTTP val) =====\n// Variable de entorno necesaria: KONSTAI_SA = (JSON del service account de Firebase)\n//\n// P2P (ya existente):\n// POST /register { handle, token } -> guarda token del RECEPTOR\n// POST /notify { toHandle, number, payload, sig } -> aviso firmado (EC) al receptor\n// POST /revoke { keyId } -> revoca una clave P2P\n//\n// P2B (nuevo, modelo \"número oculto\"):\n// POST /authorize { number, merchant, label } -> el usuario autoriza a un comercio.\n// Crea una relación con secreto HMAC, la EMPUJA al móvil del usuario (type=grant)\n// y devuelve al comercio un HANDLE opaco (nunca el número).\n// POST /merchant/notify { apiKey, handle } -> el comercio pide llamar al cliente.\n// KonstAI firma el aviso con HMAC y lo empuja al móvil. El comercio no ve el número.\n// POST /merchant/revoke { handle } -> corta una relación P2B.\n\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst SA = JSON.parse(Deno.env.get(\"KONSTAI_SA\") || \"{}\");\nconst PROJECT = SA.project_id;\n\n// ---------- empresas (multi-tenant, modelo COMPARTIDO) ----------\n// Empresas SEMBRADAS (demo) + empresas dadas de alta por sí mismas (en blob).\n// Cada empresa tiene su id público, su clave de API secreta y su nº de salida.\nconst SEEDED: Record =\n {\n \"aurora-store\": {\n apiKey: \"demo-key-123\",\n name: \"Aurora Store\",\n caller: \"+34 944 010 010\",\n },\n \"bilbo-clinic\": {\n apiKey: \"sk_bilbo_demo\",\n name: \"Clínica Bilbo\",\n caller: \"+34 944 020 020\",\n },\n };\n\n// getJSON/blob se definen más abajo (las funciones se elevan / hoisting).\nasync function getMerchant(\n id: string,\n): Promise<\n { id: string; name: string; caller: string; apiKey: string } | null\n> {\n if (SEEDED[id]) return { id, ...SEEDED[id] };\n const m = await getJSON(`konstai_merchant_${id}`);\n return m ? m : null;\n}\nasync function merchantByKey(\n apiKey: string,\n): Promise<{ id: string; name: string; caller: string } | null> {\n for (const id in SEEDED) {\n if (SEEDED[id].apiKey === apiKey) {\n return { id, name: SEEDED[id].name, caller: SEEDED[id].caller };\n }\n }\n const id = (await getJSON(`konstai_mkey_${apiKey}`)) as string | null;\n if (!id) return null;\n const m = await getMerchant(id);\n return m ? { id: m.id, name: m.name, caller: m.caller } : null;\n}\nfunction slugify(s: string): string {\n const map: Record = {\n \"á\": \"a\",\n \"à\": \"a\",\n \"ä\": \"a\",\n \"â\": \"a\",\n \"é\": \"e\",\n \"è\": \"e\",\n \"ë\": \"e\",\n \"í\": \"i\",\n \"ì\": \"i\",\n \"ï\": \"i\",\n \"ó\": \"o\",\n \"ò\": \"o\",\n \"ö\": \"o\",\n \"ô\": \"o\",\n \"ú\": \"u\",\n \"ù\": \"u\",\n \"ü\": \"u\",\n \"ñ\": \"n\",\n \"ç\": \"c\",\n };\n return String(s || \"\").toLowerCase().replace(\n /[áàäâéèëíìïóòöôúùüñç]/g,\n (c) => map[c] || c,\n )\n .replace(/[^a-z0-9]+/g, \"-\").replace(/^-+|-+$/g, \"\").slice(0, 24) ||\n \"comercio\";\n}\n\nconst norm = (h: string) => String(h || \"\").replace(/\\D/g, \"\").slice(-9);\n\n// ---------- almacenes (blob) ----------\nasync function getJSON(key: string): Promise {\n try {\n return await blob.getJSON(key);\n } catch {\n return null;\n }\n}\nasync function getTok(k: string): Promise {\n return (await getJSON(`konstai_tok_${k}`)) as string | null;\n}\nasync function setTok(k: string, t: string) {\n await blob.setJSON(`konstai_tok_${k}`, t);\n}\n\nasync function isRevoked(keyId: string): Promise {\n return !!(await getJSON(`konstai_rev_${keyId}`));\n}\nasync function setRevoked(keyId: string) {\n await blob.setJSON(`konstai_rev_${keyId}`, true);\n}\n\nasync function getRel(handle: string): Promise {\n return await getJSON(`konstai_rel_${handle}`);\n}\nasync function setRel(handle: string, obj: any) {\n await blob.setJSON(`konstai_rel_${handle}`, obj);\n}\n\nconst rate: Record = {};\n\n// ---------- utilidades ----------\nconst bytesToB64 = (b: Uint8Array) => btoa(String.fromCharCode(...b)); // base64 estándar\nconst bytesToHex = (b: Uint8Array) =>\n Array.from(b).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\nfunction randBytes(n: number): Uint8Array {\n const a = new Uint8Array(n);\n crypto.getRandomValues(a);\n return a;\n}\n\nasync function hmacSign(\n secretBytes: Uint8Array,\n payload: string,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n secretBytes,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(payload)),\n );\n return bytesToB64(sig);\n}\n\n// ---------- FCM ----------\nfunction pemToArrayBuffer(pem: string): ArrayBuffer {\n const b64 = pem.replace(/-----BEGIN PRIVATE KEY-----/, \"\")\n .replace(/-----END PRIVATE KEY-----/, \"\")\n .replace(/\\\\n/g, \"\")\n .replace(/[^A-Za-z0-9+/=]/g, \"\");\n const bin = atob(b64);\n const buf = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);\n return buf.buffer;\n}\nconst b64url = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\nconst b64urlStr = (s: string) => b64url(new TextEncoder().encode(s));\n\nlet cachedTok: string | null = null;\nlet cachedExp = 0;\nasync function getAccessToken(): Promise {\n const now = Math.floor(Date.now() / 1000);\n if (cachedTok && now < cachedExp - 60) return cachedTok;\n const input = b64urlStr(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" })) + \".\" +\n b64urlStr(JSON.stringify({\n iss: SA.client_email,\n scope: \"https://www.googleapis.com/auth/firebase.messaging\",\n aud: SA.token_uri,\n iat: now,\n exp: now + 3600,\n }));\n const key = await crypto.subtle.importKey(\n \"pkcs8\",\n pemToArrayBuffer(SA.private_key),\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\n \"RSASSA-PKCS1-v1_5\",\n key,\n new TextEncoder().encode(input),\n ),\n );\n const r = await fetch(SA.token_uri, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=\" +\n input + \".\" + b64url(sig),\n });\n const j = await r.json();\n if (!j.access_token) throw new Error(\"no access_token: \" + JSON.stringify(j));\n cachedTok = j.access_token as string;\n cachedExp = now + (j.expires_in || 3600);\n return cachedTok;\n}\n\nasync function sendPush(token: string, data: Record) {\n const access = await getAccessToken();\n const r = await fetch(\n `https://fcm.googleapis.com/v1/projects/${PROJECT}/messages:send`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Bearer \" + access,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: { token, data, android: { priority: \"high\" } },\n }),\n },\n );\n return { status: r.status, body: await r.text() };\n}\n\n// ---------- respuestas + CORS ----------\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n \"Access-Control-Allow-Methods\": \"GET,POST,OPTIONS\",\n};\nconst json = (obj: unknown, status = 200) =>\n new Response(JSON.stringify(obj), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...CORS },\n });\n\n// ---------- SDK embebible + página de autorización alojada ----------\n// El comercio pega en su web:\n// \n// \n// \nconst SDK_JS = [\n \"(function(){\",\n \" var s = document.currentScript;\",\n \" var merchant = (s && s.getAttribute('data-merchant')) || '';\",\n \" var name = (s && s.getAttribute('data-name')) || merchant;\",\n \" var base = (s ? s.src : '').replace(/\\\\/sdk\\\\.js.*$/, '');\",\n \" window.KonstAI = {\",\n \" _cb: null,\",\n \" onProtected: function(cb){ this._cb = cb; },\",\n \" open: function(){\",\n \" var u = base + '/connect?merchant=' + encodeURIComponent(merchant) + '&name=' + encodeURIComponent(name) + '&origin=' + encodeURIComponent(location.origin);\",\n \" window.open(u, 'konstai', 'width=430,height=680');\",\n \" }\",\n \" };\",\n \" document.addEventListener('click', function(e){\",\n \" var t = e.target.closest && e.target.closest('#konstai-btn,[data-konstai]');\",\n \" if (t) { e.preventDefault(); window.KonstAI.open(); }\",\n \" });\",\n \" window.addEventListener('message', function(ev){\",\n \" var d = ev.data;\",\n \" if (d && d.konstai && d.handle && window.KonstAI._cb) window.KonstAI._cb(d.handle, d);\",\n \" });\",\n \"})();\",\n].join(\"\\n\");\n\nconst CONNECT_HTML = [\n \"\",\n \"\",\n \"Autorizar con KonstAI\",\n \"

Autorizar con KonstAI

Este comercio podrá llamarte de forma verificada.

\",\n \"

Comercio
Comercio verificado

\",\n \"

✓Sus llamadas te llegarán verificadas, no como número desconocido.

\",\n \"

✓Podrás revocar el permiso cuando quieras desde la app KonstAI.

\",\n \"Tu número de teléfono\",\n \"\",\n \"\",\n \"

\",\n \"

Protegido por KonstAI · no compartimos tu número con terceros sin tu permiso

\",\n \"

\",\n \"\",\n].join(\"\\n\");\n\nexport default async function (req: Request): Promise {\n try {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS });\n }\n const url = new URL(req.url);\n const path = url.pathname;\n\n if (req.method === \"GET\" && path === \"/\") {\n return json({ ok: true, service: \"KonstAI\" });\n }\n\n if (req.method === \"GET\" && path === \"/sdk.js\") {\n return new Response(SDK_JS, {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n ...CORS,\n },\n });\n }\n\n if (req.method === \"GET\" && path === \"/connect\") {\n return new Response(CONNECT_HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\", ...CORS },\n });\n }\n\n if (req.method === \"GET\" && path === \"/debug\") {\n try {\n await getAccessToken();\n return json({ ok: true, project: PROJECT, tokenOk: true });\n } catch (e) {\n return json({\n ok: false,\n project: PROJECT,\n error: String((e as Error).message || e),\n });\n }\n }\n\n // ---------- P2P ----------\n if (req.method === \"POST\" && path === \"/register\") {\n const b = await req.json().catch(() => ({}));\n const k = norm(b.handle);\n if (!k || !b.token) {\n return json({ ok: false, error: \"handle y token requeridos\" }, 400);\n }\n await setTok(k, b.token);\n return json({ ok: true, handle: k });\n }\n\n if (req.method === \"POST\" && path === \"/revoke\") {\n const b = await req.json().catch(() => ({}));\n const kid = String(b.keyId || \"\");\n if (!kid) return json({ ok: false, error: \"keyId requerido\" }, 400);\n await setRevoked(kid);\n return json({ ok: true, revoked: kid });\n }\n\n if (req.method === \"POST\" && path === \"/notify\") {\n const b = await req.json().catch(() => ({}));\n const k = norm(b.toHandle);\n const token = await getTok(k);\n if (!token) {\n return json({\n ok: false,\n error: \"destinatario no registrado\",\n handle: k,\n }, 404);\n }\n const kid = String(b.payload || \"\").split(\"~\")[1] || \"\";\n if (kid && await isRevoked(kid)) {\n return json({ ok: false, error: \"clave revocada\" }, 403);\n }\n const now = Date.now();\n rate[k] = (rate[k] || []).filter((t) => now - t < 60000);\n if (rate[k].length >= 5) {\n return json({ ok: false, error: \"demasiados avisos\" }, 429);\n }\n rate[k].push(now);\n const r = await sendPush(token, {\n label: String(b.label || \"\"),\n number: String(b.number || \"\"),\n payload: String(b.payload || \"\"),\n sig: String(b.sig || \"\"),\n });\n return json({ ok: r.status === 200, fcm: r.status }, 200);\n }\n\n // ---------- P2B (modelo COMPARTIDO) ----------\n // El usuario autoriza a un comercio con \"Proteger con KonstAI\". KonstAI:\n // · crea la relación (secreto HMAC) y la empuja al móvil del usuario,\n // · guarda el número completo del usuario (compartido: el comercio podrá marcarlo),\n // · devuelve al comercio un HANDLE con el que pedir avisos y consultar el número.\n if (req.method === \"POST\" && path === \"/authorize\") {\n const b = await req.json().catch(() => ({}));\n const fullNumber = String(b.number || \"\").trim();\n const userKey = norm(fullNumber);\n const merchantId = String(b.merchant || \"comercio\");\n const m = await getMerchant(merchantId);\n const label = String(b.label || (m ? m.name : \"Comercio\"));\n if (!userKey) return json({ ok: false, error: \"number requerido\" }, 400);\n if (!m) {\n return json(\n { ok: false, error: \"comercio desconocido: \" + merchantId },\n 400,\n );\n }\n const token = await getTok(userKey);\n if (!token) {\n return json({\n ok: false,\n error:\n \"usuario no registrado: abre la app KonstAI y pulsa 'registrarme'\",\n }, 409);\n }\n\n const keyId = bytesToHex(randBytes(4));\n const secret = randBytes(32);\n const secretB64 = bytesToB64(secret);\n const handle = \"kh_\" + bytesToHex(randBytes(12));\n\n await setRel(handle, {\n keyId,\n secret: secretB64,\n userKey,\n fullNumber,\n label,\n merchant: merchantId,\n revoked: false,\n ts: Date.now(),\n });\n const midxKey = `konstai_midx_${merchantId}`;\n const idx = ((await getJSON(midxKey)) as string[] | null) || [];\n idx.push(handle);\n await blob.setJSON(midxKey, idx.slice(-200));\n\n const g = await sendPush(token, {\n type: \"grant\",\n keyId,\n secret: secretB64,\n label,\n });\n if (g.status !== 200) {\n return json({\n ok: false,\n error: \"no se pudo notificar al móvil\",\n fcm: g.status,\n }, 502);\n }\n\n return json({ ok: true, handle });\n }\n\n // Alta de empresa (self-service). Devuelve id público + clave secreta.\n if (req.method === \"POST\" && path === \"/merchant/signup\") {\n const b = await req.json().catch(() => ({}));\n const name = String(b.name || \"\").trim();\n const caller = String(b.caller || \"\").trim();\n if (!name) return json({ ok: false, error: \"nombre requerido\" }, 400);\n if (!caller) {\n return json({ ok: false, error: \"número de salida requerido\" }, 400);\n }\n // id público único\n let id = slugify(name);\n if (await getMerchant(id)) id = id + \"-\" + bytesToHex(randBytes(2));\n const apiKey = \"sk_live_\" + bytesToHex(randBytes(18));\n await blob.setJSON(`konstai_merchant_${id}`, {\n id,\n name,\n caller,\n apiKey,\n ts: Date.now(),\n });\n await blob.setJSON(`konstai_mkey_${apiKey}`, id);\n return json({ ok: true, merchant: id, name, caller, apiKey });\n }\n\n // El comercio pide llamar al cliente (por handle). El aviso lleva el número de\n // salida del comercio, para que la llamada REAL suene verificada en el móvil.\n if (req.method === \"POST\" && path === \"/merchant/notify\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (rel.merchant !== m.id) {\n return json(\n { ok: false, error: \"ese handle no es de tu comercio\" },\n 403,\n );\n }\n if (rel.revoked || await isRevoked(rel.keyId)) {\n return json({ ok: false, error: \"relación revocada\" }, 403);\n }\n const token = await getTok(rel.userKey);\n if (!token) {\n return json({ ok: false, error: \"usuario sin móvil registrado\" }, 404);\n }\n\n const nonce = bytesToHex(randBytes(6));\n const payload = \"v1~\" + rel.keyId + \"~\" + Date.now() + \"~\" + nonce;\n const secretBytes = new Uint8Array(\n atob(rel.secret).split(\"\").map((c) => c.charCodeAt(0)),\n );\n const sig = await hmacSign(secretBytes, payload);\n // number = caller ID desde el que llama el negocio. La app de negocio puede\n // enviar el suyo real (b.caller); si no, usamos el configurado del comercio.\n const caller = String(b.caller || m.caller);\n const r = await sendPush(token, {\n label: String(rel.label),\n number: caller,\n payload,\n sig,\n });\n return json({ ok: r.status === 200, fcm: r.status, caller }, 200);\n }\n\n // El panel del comercio lista SUS relaciones. En compartido incluye el número\n // (el comercio lo necesita para marcar). Autenticado por su clave.\n if (req.method === \"POST\" && path === \"/merchant/list\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const idx =\n ((await getJSON(`konstai_midx_${m.id}`)) as string[] | null) || [];\n const items = [];\n for (const h of idx.slice(-50).reverse()) {\n const rel = await getRel(h);\n if (rel) {\n items.push({\n handle: h,\n label: rel.label,\n number: rel.fullNumber || \"\",\n revoked: !!rel.revoked || await isRevoked(rel.keyId),\n ts: rel.ts || 0,\n });\n }\n }\n return json({\n ok: true,\n merchant: m.id,\n name: m.name,\n caller: m.caller,\n items,\n });\n }\n\n if (req.method === \"POST\" && path === \"/merchant/revoke\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (rel.merchant !== m.id) {\n return json(\n { ok: false, error: \"ese handle no es de tu comercio\" },\n 403,\n );\n }\n rel.revoked = true;\n await setRel(String(b.handle), rel);\n await setRevoked(rel.keyId);\n return json({ ok: true });\n }\n\n return json({ ok: false, error: \"not found\" }, 404);\n } catch (e) {\n return json({ ok: false, error: String((e as Error).message || e) }, 200);\n }\n}","createdAt",["D",1787312856719],"branchVersion","branchId","fe321492-8f91-4d0d-975c-cb3573f7ce1c","id","9f22b944-e907-4abc-bcea-f71b3515daaf","KonstAI",["D",1787238273342],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","f438816c-0bcb-436e-89fa-0a25876ac3ba","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a01faf-dd13-7316-b4da-9b1cb1edc8d6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},"branch",{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned",24,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","obelux8","handle","displayName","Obelux8","avatar","https://avatars.githubusercontent.com/u/260928148?v=4","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":150,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":151,"_80":152,"_82":153,"_84":25},"tree",[145],"files",[145],"counts",{"_134":62,"_135":136,"_137":62,"_138":139,"_140":141},"contents",[126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":130,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_27":133},"26dd9de7-a648-424f-9784-ed71cb3fdc7f","parentId","latest",["D",1787312856719],11,"label",[28],"pulls","branches",1,"forks","envVars",{"_142":136,"_144":62},"connections",{"_142":62,"_143":62},"count","unfilledCount","emptyCount",{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":146,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_147":148,"_27":149},["D",1787312856719],"children",[],[28],["D",1787238273342],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_78":-5,"_123":187,"_188":189,"_190":191,"_192":25,"_193":25,"_194":25,"_195":58,"_196":-5,"_197":-7,"_198":-7,"_199":62,"_200":25,"_201":25,"_202":-5,"_203":25,"_204":25,"_205":25,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":86,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v15