Autorizar con Kledos

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_105":86,"_27":53,"_13":14,"_106":-5,"_11":107,"_108":109,"_110":111,"_112":113,"_114":115,"_20":-5,"_116":-5,"_117":-5,"_118":25,"_119":120,"_121":58,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",21,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","new-file-5543.ts","latestPath","fileId","6097466e-9caa-11f1-80db-1607ee4eb77e","name","fileType","http","content","// ===== Kledos — backend (Val Town, HTTP val) =====\n// Variable de entorno necesaria: KONSTAI_SA = (JSON del service account de Firebase)\n//\n// P2P (ya existente):\n// POST /register { handle, token } -> guarda token del RECEPTOR\n// POST /notify { toHandle, number, payload, sig } -> aviso firmado (EC) al receptor\n// POST /revoke { keyId } -> revoca una clave P2P\n//\n// P2B (nuevo, modelo \"número oculto\"):\n// POST /authorize { number, merchant, label } -> el usuario autoriza a un comercio.\n// Crea una relación con secreto HMAC, la EMPUJA al móvil del usuario (type=grant)\n// y devuelve al comercio un HANDLE opaco (nunca el número).\n// POST /merchant/notify { apiKey, handle } -> el comercio pide llamar al cliente.\n// Kledos firma el aviso con HMAC y lo empuja al móvil. El comercio no ve el número.\n// POST /merchant/revoke { handle } -> corta una relación P2B.\n\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst SA = JSON.parse(Deno.env.get(\"KONSTAI_SA\") || \"{}\");\nconst PROJECT = SA.project_id;\n\n// ---------- empresas (multi-tenant, modelo COMPARTIDO) ----------\n// Empresas SEMBRADAS (demo) + empresas dadas de alta por sí mismas (en blob).\n// Cada empresa tiene su id público, su clave de API secreta y su nº de salida.\nconst SEEDED: Record = {\n \"aurora-store\": { apiKey: \"demo-key-123\", name: \"Aurora Store\", caller: \"+34 944 010 010\" },\n \"bilbo-clinic\": { apiKey: \"sk_bilbo_demo\", name: \"Clínica Bilbo\", caller: \"+34 944 020 020\" },\n};\n\n// getJSON/blob se definen más abajo (las funciones se elevan / hoisting).\nasync function getMerchant(id: string): Promise<{ id: string; name: string; caller: string; apiKey: string } | null> {\n if (SEEDED[id]) return { id, ...SEEDED[id] };\n const m = await getJSON(`konstai_merchant_${id}`);\n return m ? m : null;\n}\nasync function merchantByKey(apiKey: string): Promise<{ id: string; name: string; caller: string } | null> {\n for (const id in SEEDED) if (SEEDED[id].apiKey === apiKey) return { id, name: SEEDED[id].name, caller: SEEDED[id].caller };\n const id = (await getJSON(`konstai_mkey_${apiKey}`)) as string | null;\n if (!id) return null;\n const m = await getMerchant(id);\n return m ? { id: m.id, name: m.name, caller: m.caller } : null;\n}\nfunction slugify(s: string): string {\n const map: Record = { \"á\":\"a\",\"à\":\"a\",\"ä\":\"a\",\"â\":\"a\",\"é\":\"e\",\"è\":\"e\",\"ë\":\"e\",\"í\":\"i\",\"ì\":\"i\",\"ï\":\"i\",\"ó\":\"o\",\"ò\":\"o\",\"ö\":\"o\",\"ô\":\"o\",\"ú\":\"u\",\"ù\":\"u\",\"ü\":\"u\",\"ñ\":\"n\",\"ç\":\"c\" };\n return String(s || \"\").toLowerCase().replace(/[áàäâéèëíìïóòöôúùüñç]/g, (c) => map[c] || c)\n .replace(/[^a-z0-9]+/g, \"-\").replace(/^-+|-+$/g, \"\").slice(0, 24) || \"comercio\";\n}\n\nconst norm = (h: string) => String(h || \"\").replace(/\\D/g, \"\").slice(-9);\n\n// ---------- almacenes (blob) ----------\nasync function getJSON(key: string): Promise {\n try { return await blob.getJSON(key); } catch { return null; }\n}\nasync function getTok(k: string): Promise { return (await getJSON(`konstai_tok_${k}`)) as string | null; }\nasync function setTok(k: string, t: string) { await blob.setJSON(`konstai_tok_${k}`, t); }\n\nasync function isRevoked(keyId: string): Promise { return !!(await getJSON(`konstai_rev_${keyId}`)); }\nasync function setRevoked(keyId: string) { await blob.setJSON(`konstai_rev_${keyId}`, true); }\n\nasync function getRel(handle: string): Promise { return await getJSON(`konstai_rel_${handle}`); }\nasync function setRel(handle: string, obj: any) { await blob.setJSON(`konstai_rel_${handle}`, obj); }\n\nconst rate: Record = {};\n\n// ---------- portero: límites de uso (best-effort, en memoria) ----------\nconst rl: Record = {};\n/** Devuelve true si \"bucket\" ha superado \"max\" llamadas en \"windowMs\". */\nfunction limited(bucket: string, max: number, windowMs: number): boolean {\n const now = Date.now();\n rl[bucket] = (rl[bucket] || []).filter((t) => now - t < windowMs);\n if (rl[bucket].length >= max) return true;\n rl[bucket].push(now);\n return false;\n}\nfunction clientIp(req: Request): string {\n const xf = req.headers.get(\"x-forwarded-for\") || \"\";\n return (xf.split(\",\")[0] || \"\").trim() || \"ip?\";\n}\n// Validaciones simples de entrada.\nconst validName = (s: string) => s.length >= 1 && s.length <= 60;\nconst validNumber = (s: string) => norm(s).length >= 9; // al menos 9 dígitos\nconst validCaller = (s: string) => { const d = s.replace(/\\D/g, \"\"); return d.length >= 6 && d.length <= 15; };\n\n// ---------- utilidades ----------\nconst bytesToB64 = (b: Uint8Array) => btoa(String.fromCharCode(...b)); // base64 estándar\nconst bytesToHex = (b: Uint8Array) => Array.from(b).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\nfunction randBytes(n: number): Uint8Array { const a = new Uint8Array(n); crypto.getRandomValues(a); return a; }\n\nasync function hmacSign(secretBytes: Uint8Array, payload: string): Promise {\n const key = await crypto.subtle.importKey(\"raw\", secretBytes, { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"]);\n const sig = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(payload)));\n return bytesToB64(sig);\n}\n\n// ---------- FCM ----------\nfunction pemToArrayBuffer(pem: string): ArrayBuffer {\n const b64 = pem.replace(/-----BEGIN PRIVATE KEY-----/, \"\")\n .replace(/-----END PRIVATE KEY-----/, \"\")\n .replace(/\\\\n/g, \"\")\n .replace(/[^A-Za-z0-9+/=]/g, \"\");\n const bin = atob(b64);\n const buf = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);\n return buf.buffer;\n}\nconst b64url = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\nconst b64urlStr = (s: string) => b64url(new TextEncoder().encode(s));\n\nlet cachedTok: string | null = null;\nlet cachedExp = 0;\nasync function getAccessToken(): Promise {\n const now = Math.floor(Date.now() / 1000);\n if (cachedTok && now < cachedExp - 60) return cachedTok;\n const input = b64urlStr(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" })) + \".\" + b64urlStr(JSON.stringify({\n iss: SA.client_email, scope: \"https://www.googleapis.com/auth/firebase.messaging\",\n aud: SA.token_uri, iat: now, exp: now + 3600,\n }));\n const key = await crypto.subtle.importKey(\"pkcs8\", pemToArrayBuffer(SA.private_key),\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" }, false, [\"sign\"]);\n const sig = new Uint8Array(await crypto.subtle.sign(\"RSASSA-PKCS1-v1_5\", key, new TextEncoder().encode(input)));\n const r = await fetch(SA.token_uri, {\n method: \"POST\", headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=\" + input + \".\" + b64url(sig),\n });\n const j = await r.json();\n if (!j.access_token) throw new Error(\"no access_token: \" + JSON.stringify(j));\n cachedTok = j.access_token as string; cachedExp = now + (j.expires_in || 3600);\n return cachedTok;\n}\n\nasync function sendPush(token: string, data: Record) {\n const access = await getAccessToken();\n const r = await fetch(`https://fcm.googleapis.com/v1/projects/${PROJECT}/messages:send`, {\n method: \"POST\",\n headers: { \"Authorization\": \"Bearer \" + access, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ message: { token, data, android: { priority: \"high\" } } }),\n });\n return { status: r.status, body: await r.text() };\n}\n\n// ---------- respuestas + CORS ----------\nconst CORS = { \"Access-Control-Allow-Origin\": \"*\", \"Access-Control-Allow-Headers\": \"Content-Type\", \"Access-Control-Allow-Methods\": \"GET,POST,OPTIONS\" };\nconst json = (obj: unknown, status = 200) =>\n new Response(JSON.stringify(obj), { status, headers: { \"Content-Type\": \"application/json\", ...CORS } });\n\n// ---------- SDK embebible + página de autorización alojada ----------\n// Integración de UNA sola línea (el botón se crea solo):\n// \n// Modo avanzado (tu propio botón + capturar el handle):\n// \n// \n// \nconst SDK_JS = [\n\"(function(){\",\n\" var s = document.currentScript;\",\n\" var merchant = (s && s.getAttribute('data-merchant')) || '';\",\n\" var name = (s && s.getAttribute('data-name')) || merchant;\",\n\" var text = (s && s.getAttribute('data-text')) || '\\\\uD83D\\\\uDEE1\\\\uFE0F Recibe nuestras llamadas verificadas';\",\n\" var auto = !!(s && s.getAttribute('data-auto') !== null);\",\n\" var base = (s ? s.src : '').replace(/\\\\/sdk\\\\.js.*$/, '');\",\n\" var injected = null;\",\n\" window.Kledos = {\",\n\" _cb: null,\",\n\" onProtected: function(cb){ this._cb = cb; },\",\n\" open: function(){\",\n\" var u = base + '/connect?merchant=' + encodeURIComponent(merchant) + '&name=' + encodeURIComponent(name) + '&origin=' + encodeURIComponent(location.origin);\",\n\" window.open(u, 'kledos', 'width=430,height=680');\",\n\" }\",\n\" };\",\n\" if (auto && s && s.parentNode) {\",\n\" var b = document.createElement('button'); b.type = 'button'; b.setAttribute('data-konstai','1'); b.textContent = text;\",\n\" b.style.cssText = 'display:inline-flex;align-items:center;justify-content:center;gap:8px;width:100%;max-width:360px;min-height:48px;padding:0 18px;border:none;border-radius:12px;background:#12B76A;color:#fff;font-weight:700;font-size:15px;line-height:1.2;cursor:pointer;font-family:inherit;margin:10px 0;';\",\n\" s.parentNode.insertBefore(b, s.nextSibling); injected = b;\",\n\" }\",\n\" document.addEventListener('click', function(e){\",\n\" var t = e.target.closest && e.target.closest('#konstai-btn,[data-konstai]');\",\n\" if (t) { e.preventDefault(); window.Kledos.open(); }\",\n\" });\",\n\" window.addEventListener('message', function(ev){\",\n\" var d = ev.data;\",\n\" if (d && d.konstai && d.handle) {\",\n\" if (injected) { injected.textContent = '\\\\u2713 Protegido con Kledos'; injected.style.background = '#0E9257'; injected.disabled = true; }\",\n\" if (window.Kledos._cb) window.Kledos._cb(d.handle, d);\",\n\" }\",\n\" });\",\n\"})();\",\n].join(\"\\n\");\n\nconst CONNECT_HTML = [\n\"\",\n\"\",\n\"Autorizar con Kledos\",\n\"

Autorizar con Kledos

Este comercio podrá llamarte de forma verificada.

\",\n\"

Comercio
Comercio verificado

\",\n\"

✓Sus llamadas te llegarán verificadas, no como número desconocido.

\",\n\"

✓Podrás revocar el permiso cuando quieras desde la app Kledos.

\",\n\"Tu número de teléfono\",\n\"\",\n\"\",\n\"

\",\n\"

Protegido por Kledos · no compartimos tu número con terceros sin tu permiso

\",\n\"

\",\n\"\",\n].join(\"\\n\");\n\nexport default async function (req: Request): Promise {\n try {\n if (req.method === \"OPTIONS\") return new Response(null, { status: 204, headers: CORS });\n const url = new URL(req.url);\n const path = url.pathname;\n\n if (req.method === \"GET\" && path === \"/\") return json({ ok: true, service: \"Kledos\" });\n\n if (req.method === \"GET\" && path === \"/sdk.js\")\n return new Response(SDK_JS, { headers: { \"Content-Type\": \"application/javascript; charset=utf-8\", ...CORS } });\n\n if (req.method === \"GET\" && path === \"/connect\")\n return new Response(CONNECT_HTML, { headers: { \"Content-Type\": \"text/html; charset=utf-8\", ...CORS } });\n\n if (req.method === \"GET\" && path === \"/debug\") {\n try { await getAccessToken(); return json({ ok: true, project: PROJECT, tokenOk: true }); }\n catch (e) { return json({ ok: false, project: PROJECT, error: String((e as Error).message || e) }); }\n }\n\n // ---------- P2P ----------\n if (req.method === \"POST\" && path === \"/register\") {\n const b = await req.json().catch(() => ({}));\n const k = norm(b.handle);\n if (!k || !b.token) return json({ ok: false, error: \"handle y token requeridos\" }, 400);\n if (!validNumber(String(b.handle))) return json({ ok: false, error: \"número no válido\" }, 400);\n if (limited(\"reg_\" + clientIp(req), 30, 3600000)) return json({ ok: false, error: \"demasiados registros, prueba más tarde\" }, 429);\n await setTok(k, b.token);\n return json({ ok: true, handle: k });\n }\n\n if (req.method === \"POST\" && path === \"/revoke\") {\n const b = await req.json().catch(() => ({}));\n const kid = String(b.keyId || \"\");\n if (!kid) return json({ ok: false, error: \"keyId requerido\" }, 400);\n await setRevoked(kid);\n return json({ ok: true, revoked: kid });\n }\n\n if (req.method === \"POST\" && path === \"/notify\") {\n const b = await req.json().catch(() => ({}));\n const k = norm(b.toHandle);\n const token = await getTok(k);\n if (!token) return json({ ok: false, error: \"destinatario no registrado\", handle: k }, 404);\n const kid = String(b.payload || \"\").split(\"~\")[1] || \"\";\n if (kid && await isRevoked(kid)) return json({ ok: false, error: \"clave revocada\" }, 403);\n const now = Date.now();\n rate[k] = (rate[k] || []).filter((t) => now - t < 60000);\n if (rate[k].length >= 5) return json({ ok: false, error: \"demasiados avisos\" }, 429);\n rate[k].push(now);\n const r = await sendPush(token, {\n label: String(b.label || \"\"), number: String(b.number || \"\"),\n payload: String(b.payload || \"\"), sig: String(b.sig || \"\"),\n });\n return json({ ok: r.status === 200, fcm: r.status }, 200);\n }\n\n // ---------- P2B (modelo COMPARTIDO) ----------\n // El usuario autoriza a un comercio con \"Proteger con Kledos\". Kledos:\n // · crea la relación (secreto HMAC) y la empuja al móvil del usuario,\n // · guarda el número completo del usuario (compartido: el comercio podrá marcarlo),\n // · devuelve al comercio un HANDLE con el que pedir avisos y consultar el número.\n if (req.method === \"POST\" && path === \"/authorize\") {\n const b = await req.json().catch(() => ({}));\n const fullNumber = String(b.number || \"\").trim();\n const userKey = norm(fullNumber);\n const merchantId = String(b.merchant || \"comercio\");\n const m = await getMerchant(merchantId);\n const label = String(b.label || (m ? m.name : \"Comercio\"));\n if (!userKey) return json({ ok: false, error: \"number requerido\" }, 400);\n if (!validNumber(fullNumber)) return json({ ok: false, error: \"número no válido\" }, 400);\n if (!validName(label)) return json({ ok: false, error: \"etiqueta no válida\" }, 400);\n if (!m) return json({ ok: false, error: \"comercio desconocido: \" + merchantId }, 400);\n // Anti-spam de autorizaciones: por número y por IP.\n if (limited(\"authnum_\" + userKey, 5, 600000)) return json({ ok: false, error: \"demasiadas autorizaciones para ese número\" }, 429);\n if (limited(\"authip_\" + clientIp(req), 30, 3600000)) return json({ ok: false, error: \"demasiadas autorizaciones, prueba más tarde\" }, 429);\n const token = await getTok(userKey);\n if (!token) return json({ ok: false, error: \"usuario no registrado: abre la app Kledos y pulsa 'registrarme'\" }, 409);\n\n const keyId = bytesToHex(randBytes(4));\n const secret = randBytes(32);\n const secretB64 = bytesToB64(secret);\n const handle = \"kh_\" + bytesToHex(randBytes(12));\n\n // La relación nace PENDIENTE: no vale hasta que el dueño acepte en su móvil.\n await setRel(handle, { keyId, secret: secretB64, userKey, fullNumber, label, merchant: merchantId, revoked: false, pending: true, ts: Date.now() });\n const midxKey = `konstai_midx_${merchantId}`;\n const idx = ((await getJSON(midxKey)) as string[] | null) || [];\n idx.push(handle);\n await blob.setJSON(midxKey, idx.slice(-200));\n\n // Pedimos CONSENTIMIENTO al móvil (sin el secreto: ese solo baja al aceptar).\n const g = await sendPush(token, { type: \"consent\", handle, keyId, label });\n if (g.status !== 200) return json({ ok: false, error: \"no se pudo notificar al móvil\", fcm: g.status }, 502);\n\n return json({ ok: true, handle, status: \"pending\" });\n }\n\n // El móvil del usuario acepta o rechaza la petición de consentimiento.\n // Al ACEPTAR devolvemos el secreto para que el móvil pueda verificar avisos.\n if (req.method === \"POST\" && path === \"/authorize/confirm\") {\n const b = await req.json().catch(() => ({}));\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (String(b.decision) === \"accept\") {\n rel.pending = false;\n await setRel(String(b.handle), rel);\n // Índice por USUARIO (número) para poder restaurar sus permisos en otro móvil.\n const uidxKey = `konstai_uidx_${rel.userKey}`;\n const uidx = ((await getJSON(uidxKey)) as string[] | null) || [];\n if (!uidx.includes(String(b.handle))) { uidx.push(String(b.handle)); await blob.setJSON(uidxKey, uidx.slice(-300)); }\n return json({ ok: true, keyId: rel.keyId, secret: rel.secret, label: rel.label });\n } else {\n rel.revoked = true;\n await setRel(String(b.handle), rel);\n await setRevoked(rel.keyId);\n return json({ ok: true, rejected: true });\n }\n }\n\n // Restaurar permisos en un móvil nuevo (cuenta = tu número). Devuelve tus\n // relaciones activas con su secreto para volver a verificar avisos.\n // PRODUCCIÓN: proteger con verificación del número (OTP por SMS).\n if (req.method === \"POST\" && path === \"/account/grants\") {\n const b = await req.json().catch(() => ({}));\n const userKey = norm(String(b.number || \"\"));\n if (!validNumber(String(b.number || \"\"))) return json({ ok: false, error: \"número no válido\" }, 400);\n if (limited(\"acct_\" + clientIp(req), 20, 3600000)) return json({ ok: false, error: \"demasiadas restauraciones, prueba más tarde\" }, 429);\n const uidx = ((await getJSON(`konstai_uidx_${userKey}`)) as string[] | null) || [];\n const grants = [];\n for (const h of uidx) {\n const rel = await getRel(h);\n if (rel && !rel.pending && !rel.revoked && !(await isRevoked(rel.keyId))) {\n grants.push({ keyId: rel.keyId, secret: rel.secret, label: rel.label });\n }\n }\n return json({ ok: true, grants });\n }\n\n // Alta de empresa (self-service). Devuelve id público + clave secreta.\n if (req.method === \"POST\" && path === \"/merchant/signup\") {\n const b = await req.json().catch(() => ({}));\n const name = String(b.name || \"\").trim();\n const caller = String(b.caller || \"\").trim();\n if (!validName(name)) return json({ ok: false, error: \"nombre no válido (1-60 caracteres)\" }, 400);\n if (!validCaller(caller)) return json({ ok: false, error: \"número de salida no válido\" }, 400);\n if (limited(\"signup_\" + clientIp(req), 5, 3600000)) return json({ ok: false, error: \"demasiadas altas desde aquí, prueba más tarde\" }, 429);\n // id público único\n let id = slugify(name);\n if (await getMerchant(id)) id = id + \"-\" + bytesToHex(randBytes(2));\n const apiKey = \"sk_live_\" + bytesToHex(randBytes(18));\n await blob.setJSON(`konstai_merchant_${id}`, { id, name, caller, apiKey, ts: Date.now() });\n await blob.setJSON(`konstai_mkey_${apiKey}`, id);\n return json({ ok: true, merchant: id, name, caller, apiKey });\n }\n\n // Cerrar cuenta (self-service). Solo el dueño, que prueba tener la clave secreta,\n // puede darse de baja. Borra el comercio y su índice de clave.\n if (req.method === \"POST\" && path === \"/merchant/close\") {\n const b = await req.json().catch(() => ({}));\n const apiKey = String(b.apiKey || \"\");\n const m = await merchantByKey(apiKey);\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n if (SEEDED[m.id]) return json({ ok: false, error: \"cuenta de demo: no se puede cerrar\" }, 403);\n await blob.delete(`konstai_merchant_${m.id}`);\n await blob.delete(`konstai_mkey_${apiKey}`);\n return json({ ok: true, closed: m.id });\n }\n\n // El comercio pide llamar al cliente (por handle). El aviso lleva el número de\n // salida del comercio, para que la llamada REAL suene verificada en el móvil.\n if (req.method === \"POST\" && path === \"/merchant/notify\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (rel.merchant !== m.id) return json({ ok: false, error: \"ese handle no es de tu comercio\" }, 403);\n if (rel.revoked || await isRevoked(rel.keyId)) return json({ ok: false, error: \"relación revocada\" }, 403);\n if (rel.pending) return json({ ok: false, error: \"pendiente de que el cliente acepte en su móvil\" }, 409);\n // Anti-acoso: máximo de avisos por cliente y por comercio.\n if (limited(\"mn_\" + String(b.handle), 6, 600000)) return json({ ok: false, error: \"demasiados avisos a ese cliente\" }, 429);\n if (limited(\"mnmerch_\" + m.id, 120, 60000)) return json({ ok: false, error: \"límite del comercio superado\" }, 429);\n const token = await getTok(rel.userKey);\n if (!token) return json({ ok: false, error: \"usuario sin móvil registrado\" }, 404);\n\n const nonce = bytesToHex(randBytes(6));\n const payload = \"v1~\" + rel.keyId + \"~\" + Date.now() + \"~\" + nonce;\n const secretBytes = new Uint8Array(atob(rel.secret).split(\"\").map((c) => c.charCodeAt(0)));\n const sig = await hmacSign(secretBytes, payload);\n // number = caller ID desde el que llama el negocio. La app de negocio puede\n // enviar el suyo real (b.caller); si no, usamos el configurado del comercio.\n const caller = String(b.caller || m.caller);\n const r = await sendPush(token, { label: String(rel.label), number: caller, payload, sig });\n return json({ ok: r.status === 200, fcm: r.status, caller }, 200);\n }\n\n // El panel del comercio lista SUS relaciones. En compartido incluye el número\n // (el comercio lo necesita para marcar). Autenticado por su clave.\n if (req.method === \"POST\" && path === \"/merchant/list\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const idx = ((await getJSON(`konstai_midx_${m.id}`)) as string[] | null) || [];\n const items = [];\n for (const h of idx.slice(-50).reverse()) {\n const rel = await getRel(h);\n if (rel) items.push({\n handle: h, label: rel.label, number: rel.fullNumber || \"\",\n revoked: !!rel.revoked || await isRevoked(rel.keyId), pending: !!rel.pending, ts: rel.ts || 0,\n });\n }\n return json({ ok: true, merchant: m.id, name: m.name, caller: m.caller, items });\n }\n\n if (req.method === \"POST\" && path === \"/merchant/revoke\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (rel.merchant !== m.id) return json({ ok: false, error: \"ese handle no es de tu comercio\" }, 403);\n rel.revoked = true;\n await setRel(String(b.handle), rel);\n await setRevoked(rel.keyId);\n return json({ ok: true });\n }\n\n return json({ ok: false, error: \"not found\" }, 404);\n } catch (e) {\n return json({ ok: false, error: String((e as Error).message || e) }, 200);\n }\n}","// ===== Kledos — backend (Val Town, HTTP val) =====\n// Variable de entorno necesaria: KONSTAI_SA = (JSON del service account de Firebase)\n//\n// P2P (ya existente):\n// POST /register { handle, token } -> guarda token del RECEPTOR\n// POST /notify { toHandle, number, payload, sig } -> aviso firmado (EC) al receptor\n// POST /revoke { keyId } -> revoca una clave P2P\n//\n// P2B (nuevo, modelo \"número oculto\"):\n// POST /authorize { number, merchant, label } -> el usuario autoriza a un comercio.\n// Crea una relación con secreto HMAC, la EMPUJA al móvil del usuario (type=grant)\n// y devuelve al comercio un HANDLE opaco (nunca el número).\n// POST /merchant/notify { apiKey, handle } -> el comercio pide llamar al cliente.\n// Kledos firma el aviso con HMAC y lo empuja al móvil. El comercio no ve el número.\n// POST /merchant/revoke { handle } -> corta una relación P2B.\n\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst SA = JSON.parse(Deno.env.get(\"KONSTAI_SA\") || \"{}\");\nconst PROJECT = SA.project_id;\n\n// ---------- empresas (multi-tenant, modelo COMPARTIDO) ----------\n// Empresas SEMBRADAS (demo) + empresas dadas de alta por sí mismas (en blob).\n// Cada empresa tiene su id público, su clave de API secreta y su nº de salida.\nconst SEEDED: Record =\n {\n \"aurora-store\": {\n apiKey: \"demo-key-123\",\n name: \"Aurora Store\",\n caller: \"+34 944 010 010\",\n },\n \"bilbo-clinic\": {\n apiKey: \"sk_bilbo_demo\",\n name: \"Clínica Bilbo\",\n caller: \"+34 944 020 020\",\n },\n };\n\n// getJSON/blob se definen más abajo (las funciones se elevan / hoisting).\nasync function getMerchant(\n id: string,\n): Promise<\n { id: string; name: string; caller: string; apiKey: string } | null\n> {\n if (SEEDED[id]) return { id, ...SEEDED[id] };\n const m = await getJSON(`konstai_merchant_${id}`);\n return m ? m : null;\n}\nasync function merchantByKey(\n apiKey: string,\n): Promise<{ id: string; name: string; caller: string } | null> {\n for (const id in SEEDED) {\n if (SEEDED[id].apiKey === apiKey) {\n return { id, name: SEEDED[id].name, caller: SEEDED[id].caller };\n }\n }\n const id = (await getJSON(`konstai_mkey_${apiKey}`)) as string | null;\n if (!id) return null;\n const m = await getMerchant(id);\n return m ? { id: m.id, name: m.name, caller: m.caller } : null;\n}\nfunction slugify(s: string): string {\n const map: Record = {\n \"á\": \"a\",\n \"à\": \"a\",\n \"ä\": \"a\",\n \"â\": \"a\",\n \"é\": \"e\",\n \"è\": \"e\",\n \"ë\": \"e\",\n \"í\": \"i\",\n \"ì\": \"i\",\n \"ï\": \"i\",\n \"ó\": \"o\",\n \"ò\": \"o\",\n \"ö\": \"o\",\n \"ô\": \"o\",\n \"ú\": \"u\",\n \"ù\": \"u\",\n \"ü\": \"u\",\n \"ñ\": \"n\",\n \"ç\": \"c\",\n };\n return String(s || \"\").toLowerCase().replace(\n /[áàäâéèëíìïóòöôúùüñç]/g,\n (c) => map[c] || c,\n )\n .replace(/[^a-z0-9]+/g, \"-\").replace(/^-+|-+$/g, \"\").slice(0, 24) ||\n \"comercio\";\n}\n\nconst norm = (h: string) => String(h || \"\").replace(/\\D/g, \"\").slice(-9);\n\n// ---------- almacenes (blob) ----------\nasync function getJSON(key: string): Promise {\n try {\n return await blob.getJSON(key);\n } catch {\n return null;\n }\n}\nasync function getTok(k: string): Promise {\n return (await getJSON(`konstai_tok_${k}`)) as string | null;\n}\nasync function setTok(k: string, t: string) {\n await blob.setJSON(`konstai_tok_${k}`, t);\n}\n\nasync function isRevoked(keyId: string): Promise {\n return !!(await getJSON(`konstai_rev_${keyId}`));\n}\nasync function setRevoked(keyId: string) {\n await blob.setJSON(`konstai_rev_${keyId}`, true);\n}\n\nasync function getRel(handle: string): Promise {\n return await getJSON(`konstai_rel_${handle}`);\n}\nasync function setRel(handle: string, obj: any) {\n await blob.setJSON(`konstai_rel_${handle}`, obj);\n}\n\nconst rate: Record = {};\n\n// ---------- portero: límites de uso (best-effort, en memoria) ----------\nconst rl: Record = {};\n/** Devuelve true si \"bucket\" ha superado \"max\" llamadas en \"windowMs\". */\nfunction limited(bucket: string, max: number, windowMs: number): boolean {\n const now = Date.now();\n rl[bucket] = (rl[bucket] || []).filter((t) => now - t < windowMs);\n if (rl[bucket].length >= max) return true;\n rl[bucket].push(now);\n return false;\n}\nfunction clientIp(req: Request): string {\n const xf = req.headers.get(\"x-forwarded-for\") || \"\";\n return (xf.split(\",\")[0] || \"\").trim() || \"ip?\";\n}\n// Validaciones simples de entrada.\nconst validName = (s: string) => s.length >= 1 && s.length <= 60;\nconst validNumber = (s: string) => norm(s).length >= 9; // al menos 9 dígitos\nconst validCaller = (s: string) => {\n const d = s.replace(/\\D/g, \"\");\n return d.length >= 6 && d.length <= 15;\n};\n\n// ---------- utilidades ----------\nconst bytesToB64 = (b: Uint8Array) => btoa(String.fromCharCode(...b)); // base64 estándar\nconst bytesToHex = (b: Uint8Array) =>\n Array.from(b).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\nfunction randBytes(n: number): Uint8Array {\n const a = new Uint8Array(n);\n crypto.getRandomValues(a);\n return a;\n}\n\nasync function hmacSign(\n secretBytes: Uint8Array,\n payload: string,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n secretBytes,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(payload)),\n );\n return bytesToB64(sig);\n}\n\n// ---------- FCM ----------\nfunction pemToArrayBuffer(pem: string): ArrayBuffer {\n const b64 = pem.replace(/-----BEGIN PRIVATE KEY-----/, \"\")\n .replace(/-----END PRIVATE KEY-----/, \"\")\n .replace(/\\\\n/g, \"\")\n .replace(/[^A-Za-z0-9+/=]/g, \"\");\n const bin = atob(b64);\n const buf = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) buf[i] = bin.charCodeAt(i);\n return buf.buffer;\n}\nconst b64url = (bytes: Uint8Array) =>\n btoa(String.fromCharCode(...bytes)).replace(/\\+/g, \"-\").replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\nconst b64urlStr = (s: string) => b64url(new TextEncoder().encode(s));\n\nlet cachedTok: string | null = null;\nlet cachedExp = 0;\nasync function getAccessToken(): Promise {\n const now = Math.floor(Date.now() / 1000);\n if (cachedTok && now < cachedExp - 60) return cachedTok;\n const input = b64urlStr(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" })) + \".\" +\n b64urlStr(JSON.stringify({\n iss: SA.client_email,\n scope: \"https://www.googleapis.com/auth/firebase.messaging\",\n aud: SA.token_uri,\n iat: now,\n exp: now + 3600,\n }));\n const key = await crypto.subtle.importKey(\n \"pkcs8\",\n pemToArrayBuffer(SA.private_key),\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const sig = new Uint8Array(\n await crypto.subtle.sign(\n \"RSASSA-PKCS1-v1_5\",\n key,\n new TextEncoder().encode(input),\n ),\n );\n const r = await fetch(SA.token_uri, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: \"grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=\" +\n input + \".\" + b64url(sig),\n });\n const j = await r.json();\n if (!j.access_token) throw new Error(\"no access_token: \" + JSON.stringify(j));\n cachedTok = j.access_token as string;\n cachedExp = now + (j.expires_in || 3600);\n return cachedTok;\n}\n\nasync function sendPush(token: string, data: Record) {\n const access = await getAccessToken();\n const r = await fetch(\n `https://fcm.googleapis.com/v1/projects/${PROJECT}/messages:send`,\n {\n method: \"POST\",\n headers: {\n \"Authorization\": \"Bearer \" + access,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: { token, data, android: { priority: \"high\" } },\n }),\n },\n );\n return { status: r.status, body: await r.text() };\n}\n\n// ---------- respuestas + CORS ----------\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n \"Access-Control-Allow-Methods\": \"GET,POST,OPTIONS\",\n};\nconst json = (obj: unknown, status = 200) =>\n new Response(JSON.stringify(obj), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...CORS },\n });\n\n// ---------- SDK embebible + página de autorización alojada ----------\n// Integración de UNA sola línea (el botón se crea solo):\n// \n// Modo avanzado (tu propio botón + capturar el handle):\n// \n// \n// \nconst SDK_JS = [\n \"(function(){\",\n \" var s = document.currentScript;\",\n \" var merchant = (s && s.getAttribute('data-merchant')) || '';\",\n \" var name = (s && s.getAttribute('data-name')) || merchant;\",\n \" var text = (s && s.getAttribute('data-text')) || '\\\\uD83D\\\\uDEE1\\\\uFE0F Recibe nuestras llamadas verificadas';\",\n \" var auto = !!(s && s.getAttribute('data-auto') !== null);\",\n \" var base = (s ? s.src : '').replace(/\\\\/sdk\\\\.js.*$/, '');\",\n \" var injected = null;\",\n \" window.Kledos = {\",\n \" _cb: null,\",\n \" onProtected: function(cb){ this._cb = cb; },\",\n \" open: function(){\",\n \" var u = base + '/connect?merchant=' + encodeURIComponent(merchant) + '&name=' + encodeURIComponent(name) + '&origin=' + encodeURIComponent(location.origin);\",\n \" window.open(u, 'kledos', 'width=430,height=680');\",\n \" }\",\n \" };\",\n \" if (auto && s && s.parentNode) {\",\n \" var b = document.createElement('button'); b.type = 'button'; b.setAttribute('data-konstai','1'); b.textContent = text;\",\n \" b.style.cssText = 'display:inline-flex;align-items:center;justify-content:center;gap:8px;width:100%;max-width:360px;min-height:48px;padding:0 18px;border:none;border-radius:12px;background:#12B76A;color:#fff;font-weight:700;font-size:15px;line-height:1.2;cursor:pointer;font-family:inherit;margin:10px 0;';\",\n \" s.parentNode.insertBefore(b, s.nextSibling); injected = b;\",\n \" }\",\n \" document.addEventListener('click', function(e){\",\n \" var t = e.target.closest && e.target.closest('#konstai-btn,[data-konstai]');\",\n \" if (t) { e.preventDefault(); window.Kledos.open(); }\",\n \" });\",\n \" window.addEventListener('message', function(ev){\",\n \" var d = ev.data;\",\n \" if (d && d.konstai && d.handle) {\",\n \" if (injected) { injected.textContent = '\\\\u2713 Protegido con Kledos'; injected.style.background = '#0E9257'; injected.disabled = true; }\",\n \" if (window.Kledos._cb) window.Kledos._cb(d.handle, d);\",\n \" }\",\n \" });\",\n \"})();\",\n].join(\"\\n\");\n\nconst CONNECT_HTML = [\n \"\",\n \"\",\n \"Autorizar con Kledos\",\n \"

Autorizar con Kledos

Este comercio podrá llamarte de forma verificada.

\",\n \"

Comercio
Comercio verificado

\",\n \"

✓Sus llamadas te llegarán verificadas, no como número desconocido.

\",\n \"

✓Podrás revocar el permiso cuando quieras desde la app Kledos.

\",\n \"Tu número de teléfono\",\n \"\",\n \"\",\n \"

\",\n \"

Protegido por Kledos · no compartimos tu número con terceros sin tu permiso

\",\n \"

\",\n \"\",\n].join(\"\\n\");\n\nexport default async function (req: Request): Promise {\n try {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS });\n }\n const url = new URL(req.url);\n const path = url.pathname;\n\n if (req.method === \"GET\" && path === \"/\") {\n return json({ ok: true, service: \"Kledos\" });\n }\n\n if (req.method === \"GET\" && path === \"/sdk.js\") {\n return new Response(SDK_JS, {\n headers: {\n \"Content-Type\": \"application/javascript; charset=utf-8\",\n ...CORS,\n },\n });\n }\n\n if (req.method === \"GET\" && path === \"/connect\") {\n return new Response(CONNECT_HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\", ...CORS },\n });\n }\n\n if (req.method === \"GET\" && path === \"/debug\") {\n try {\n await getAccessToken();\n return json({ ok: true, project: PROJECT, tokenOk: true });\n } catch (e) {\n return json({\n ok: false,\n project: PROJECT,\n error: String((e as Error).message || e),\n });\n }\n }\n\n // ---------- P2P ----------\n if (req.method === \"POST\" && path === \"/register\") {\n const b = await req.json().catch(() => ({}));\n const k = norm(b.handle);\n if (!k || !b.token) {\n return json({ ok: false, error: \"handle y token requeridos\" }, 400);\n }\n if (!validNumber(String(b.handle))) {\n return json({ ok: false, error: \"número no válido\" }, 400);\n }\n if (limited(\"reg_\" + clientIp(req), 30, 3600000)) {\n return json({\n ok: false,\n error: \"demasiados registros, prueba más tarde\",\n }, 429);\n }\n await setTok(k, b.token);\n return json({ ok: true, handle: k });\n }\n\n if (req.method === \"POST\" && path === \"/revoke\") {\n const b = await req.json().catch(() => ({}));\n const kid = String(b.keyId || \"\");\n if (!kid) return json({ ok: false, error: \"keyId requerido\" }, 400);\n await setRevoked(kid);\n return json({ ok: true, revoked: kid });\n }\n\n if (req.method === \"POST\" && path === \"/notify\") {\n const b = await req.json().catch(() => ({}));\n const k = norm(b.toHandle);\n const token = await getTok(k);\n if (!token) {\n return json({\n ok: false,\n error: \"destinatario no registrado\",\n handle: k,\n }, 404);\n }\n const kid = String(b.payload || \"\").split(\"~\")[1] || \"\";\n if (kid && await isRevoked(kid)) {\n return json({ ok: false, error: \"clave revocada\" }, 403);\n }\n const now = Date.now();\n rate[k] = (rate[k] || []).filter((t) => now - t < 60000);\n if (rate[k].length >= 5) {\n return json({ ok: false, error: \"demasiados avisos\" }, 429);\n }\n rate[k].push(now);\n const r = await sendPush(token, {\n label: String(b.label || \"\"),\n number: String(b.number || \"\"),\n payload: String(b.payload || \"\"),\n sig: String(b.sig || \"\"),\n });\n return json({ ok: r.status === 200, fcm: r.status }, 200);\n }\n\n // ---------- P2B (modelo COMPARTIDO) ----------\n // CLIENTE: genera un código de emparejamiento de un solo uso para dárselo a un\n // comercio (que enrolará por servidor sin spamear). Autenticado por posesión del\n // token push del número: solo el móvil de ese número conoce su token.\n if (req.method === \"POST\" && path === \"/account/paircode\") {\n const b = await req.json().catch(() => ({}));\n const fullNumber = String(b.number || \"\").trim();\n const userKey = norm(fullNumber);\n const token = String(b.token || \"\");\n if (!userKey || !token) {\n return json({ ok: false, error: \"faltan datos\" }, 400);\n }\n const known = await getTok(userKey);\n if (!known || known !== token) {\n return json({ ok: false, error: \"no autorizado para ese número\" }, 401);\n }\n if (limited(\"pair_\" + userKey, 10, 600000)) {\n return json(\n { ok: false, error: \"demasiados códigos, espera un poco\" },\n 429,\n );\n }\n const rb = randBytes(4);\n const n = (((rb[0] << 24) | (rb[1] << 16) | (rb[2] << 8) | rb[3]) >>> 0) %\n 1000000;\n const code = (\"\" + n).padStart(6, \"0\");\n await blob.setJSON(`konstai_pair_${code}`, { userKey, ts: Date.now() });\n return json({ ok: true, code, expiraSegundos: 1800 });\n }\n\n // COMERCIO (por servidor): enrola a un cliente. Autenticado con la CLAVE SECRETA.\n // - Con 'code' de emparejamiento válido -> se activa al instante (el código prueba\n // el consentimiento del cliente).\n // - Sin 'code' -> queda PENDIENTE y se pide consentimiento al móvil (como el botón,\n // pero atribuible a un comercio real y baneable).\n if (req.method === \"POST\" && path === \"/merchant/enroll\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const fullNumber = String(b.number || \"\").trim();\n const userKey = norm(fullNumber);\n if (!userKey || !validNumber(fullNumber)) {\n return json({ ok: false, error: \"número no válido\" }, 400);\n }\n if (limited(\"enrollnum_\" + userKey, 5, 600000)) {\n return json({\n ok: false,\n error: \"demasiadas solicitudes para ese número\",\n }, 429);\n }\n if (limited(\"enrollmerch_\" + m.id, 200, 3600000)) {\n return json({ ok: false, error: \"límite del comercio superado\" }, 429);\n }\n const token = await getTok(userKey);\n if (!token) {\n return json(\n { ok: false, error: \"usuario no registrado en Kledos\" },\n 409,\n );\n }\n\n const label = m.name; // nombre atado a la cuenta\n const code = String(b.code || \"\").trim();\n let autoAccept = false;\n if (code) {\n const pr = (await getJSON(`konstai_pair_${code}`)) as {\n userKey: string;\n ts: number;\n } | null;\n if (\n !pr || pr.userKey !== userKey || (Date.now() - (pr.ts || 0)) > 1800000\n ) {\n return json({\n ok: false,\n error: \"código de emparejamiento no válido o caducado\",\n }, 403);\n }\n await blob.delete(`konstai_pair_${code}`); // un solo uso\n autoAccept = true;\n }\n\n const keyId = bytesToHex(randBytes(4));\n const secret = randBytes(32);\n const secretB64 = bytesToB64(secret);\n const handle = \"kh_\" + bytesToHex(randBytes(12));\n await setRel(handle, {\n keyId,\n secret: secretB64,\n userKey,\n fullNumber,\n label,\n merchant: m.id,\n revoked: false,\n pending: !autoAccept,\n ts: Date.now(),\n });\n const midxKey = `konstai_midx_${m.id}`;\n const idx = ((await getJSON(midxKey)) as string[] | null) || [];\n idx.push(handle);\n await blob.setJSON(midxKey, idx.slice(-200));\n\n if (autoAccept) {\n const uidxKey = `konstai_uidx_${userKey}`;\n const uidx = ((await getJSON(uidxKey)) as string[] | null) || [];\n if (!uidx.includes(handle)) {\n uidx.push(handle);\n await blob.setJSON(uidxKey, uidx.slice(-300));\n }\n const g = await sendPush(token, {\n type: \"grant\",\n keyId,\n secret: secretB64,\n label,\n });\n return json({ ok: true, handle, status: \"active\", fcm: g.status });\n }\n const g = await sendPush(token, {\n type: \"consent\",\n handle,\n keyId,\n label,\n });\n if (g.status !== 200) {\n return json({\n ok: false,\n error: \"no se pudo notificar al móvil\",\n fcm: g.status,\n }, 502);\n }\n return json({ ok: true, handle, status: \"pending\" });\n }\n\n // El usuario autoriza a un comercio con \"Proteger con Kledos\". Kledos:\n // · crea la relación (secreto HMAC) y la empuja al móvil del usuario,\n // · guarda el número completo del usuario (compartido: el comercio podrá marcarlo),\n // · devuelve al comercio un HANDLE con el que pedir avisos y consultar el número.\n if (req.method === \"POST\" && path === \"/authorize\") {\n const b = await req.json().catch(() => ({}));\n const fullNumber = String(b.number || \"\").trim();\n const userKey = norm(fullNumber);\n const merchantId = String(b.merchant || \"comercio\");\n const m = await getMerchant(merchantId);\n if (!userKey) return json({ ok: false, error: \"number requerido\" }, 400);\n if (!validNumber(fullNumber)) {\n return json({ ok: false, error: \"número no válido\" }, 400);\n }\n if (!m) {\n return json(\n { ok: false, error: \"comercio desconocido: \" + merchantId },\n 400,\n );\n }\n // NOMBRE ATADO A LA CUENTA VERIFICADA: ignoramos cualquier 'label' que venga de\n // fuera; el nombre que verá el cliente es SIEMPRE el de la cuenta (anti-suplantación).\n const label = m.name;\n // Anti-spam de autorizaciones: por número y por IP.\n if (limited(\"authnum_\" + userKey, 5, 600000)) {\n return json({\n ok: false,\n error: \"demasiadas autorizaciones para ese número\",\n }, 429);\n }\n if (limited(\"authip_\" + clientIp(req), 30, 3600000)) {\n return json({\n ok: false,\n error: \"demasiadas autorizaciones, prueba más tarde\",\n }, 429);\n }\n const token = await getTok(userKey);\n if (!token) {\n return json({\n ok: false,\n error:\n \"usuario no registrado: abre la app Kledos y pulsa 'registrarme'\",\n }, 409);\n }\n\n const keyId = bytesToHex(randBytes(4));\n const secret = randBytes(32);\n const secretB64 = bytesToB64(secret);\n const handle = \"kh_\" + bytesToHex(randBytes(12));\n\n // La relación nace PENDIENTE: no vale hasta que el dueño acepte en su móvil.\n await setRel(handle, {\n keyId,\n secret: secretB64,\n userKey,\n fullNumber,\n label,\n merchant: merchantId,\n revoked: false,\n pending: true,\n ts: Date.now(),\n });\n const midxKey = `konstai_midx_${merchantId}`;\n const idx = ((await getJSON(midxKey)) as string[] | null) || [];\n idx.push(handle);\n await blob.setJSON(midxKey, idx.slice(-200));\n\n // Pedimos CONSENTIMIENTO al móvil (sin el secreto: ese solo baja al aceptar).\n const g = await sendPush(token, {\n type: \"consent\",\n handle,\n keyId,\n label,\n });\n if (g.status !== 200) {\n return json({\n ok: false,\n error: \"no se pudo notificar al móvil\",\n fcm: g.status,\n }, 502);\n }\n\n return json({ ok: true, handle, status: \"pending\" });\n }\n\n // El móvil del usuario acepta o rechaza la petición de consentimiento.\n // Al ACEPTAR devolvemos el secreto para que el móvil pueda verificar avisos.\n if (req.method === \"POST\" && path === \"/authorize/confirm\") {\n const b = await req.json().catch(() => ({}));\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (String(b.decision) === \"accept\") {\n rel.pending = false;\n await setRel(String(b.handle), rel);\n // Índice por USUARIO (número) para poder restaurar sus permisos en otro móvil.\n const uidxKey = `konstai_uidx_${rel.userKey}`;\n const uidx = ((await getJSON(uidxKey)) as string[] | null) || [];\n if (!uidx.includes(String(b.handle))) {\n uidx.push(String(b.handle));\n await blob.setJSON(uidxKey, uidx.slice(-300));\n }\n return json({\n ok: true,\n keyId: rel.keyId,\n secret: rel.secret,\n label: rel.label,\n });\n } else {\n rel.revoked = true;\n await setRel(String(b.handle), rel);\n await setRevoked(rel.keyId);\n return json({ ok: true, rejected: true });\n }\n }\n\n // Restaurar permisos en un móvil nuevo (cuenta = tu número). Devuelve tus\n // relaciones activas con su secreto para volver a verificar avisos.\n // PRODUCCIÓN: proteger con verificación del número (OTP por SMS).\n if (req.method === \"POST\" && path === \"/account/grants\") {\n const b = await req.json().catch(() => ({}));\n const userKey = norm(String(b.number || \"\"));\n if (!validNumber(String(b.number || \"\"))) {\n return json({ ok: false, error: \"número no válido\" }, 400);\n }\n if (limited(\"acct_\" + clientIp(req), 20, 3600000)) {\n return json({\n ok: false,\n error: \"demasiadas restauraciones, prueba más tarde\",\n }, 429);\n }\n const uidx =\n ((await getJSON(`konstai_uidx_${userKey}`)) as string[] | null) || [];\n const grants = [];\n for (const h of uidx) {\n const rel = await getRel(h);\n if (\n rel && !rel.pending && !rel.revoked && !(await isRevoked(rel.keyId))\n ) {\n grants.push({\n keyId: rel.keyId,\n secret: rel.secret,\n label: rel.label,\n });\n }\n }\n return json({ ok: true, grants });\n }\n\n // Alta de empresa (self-service). Devuelve id público + clave secreta.\n if (req.method === \"POST\" && path === \"/merchant/signup\") {\n const b = await req.json().catch(() => ({}));\n const name = String(b.name || \"\").trim();\n const caller = String(b.caller || \"\").trim();\n if (!validName(name)) {\n return json(\n { ok: false, error: \"nombre no válido (1-60 caracteres)\" },\n 400,\n );\n }\n if (!validCaller(caller)) {\n return json({ ok: false, error: \"número de salida no válido\" }, 400);\n }\n if (limited(\"signup_\" + clientIp(req), 5, 3600000)) {\n return json({\n ok: false,\n error: \"demasiadas altas desde aquí, prueba más tarde\",\n }, 429);\n }\n // id público único\n let id = slugify(name);\n if (await getMerchant(id)) id = id + \"-\" + bytesToHex(randBytes(2));\n const apiKey = \"sk_live_\" + bytesToHex(randBytes(18));\n await blob.setJSON(`konstai_merchant_${id}`, {\n id,\n name,\n caller,\n apiKey,\n ts: Date.now(),\n });\n await blob.setJSON(`konstai_mkey_${apiKey}`, id);\n return json({ ok: true, merchant: id, name, caller, apiKey });\n }\n\n // Cerrar cuenta (self-service). Solo el dueño, que prueba tener la clave secreta,\n // puede darse de baja. Borra el comercio y su índice de clave.\n if (req.method === \"POST\" && path === \"/merchant/close\") {\n const b = await req.json().catch(() => ({}));\n const apiKey = String(b.apiKey || \"\");\n const m = await merchantByKey(apiKey);\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n if (SEEDED[m.id]) {\n return json(\n { ok: false, error: \"cuenta de demo: no se puede cerrar\" },\n 403,\n );\n }\n await blob.delete(`konstai_merchant_${m.id}`);\n await blob.delete(`konstai_mkey_${apiKey}`);\n return json({ ok: true, closed: m.id });\n }\n\n // El comercio pide llamar al cliente (por handle). El aviso lleva el número de\n // salida del comercio, para que la llamada REAL suene verificada en el móvil.\n if (req.method === \"POST\" && path === \"/merchant/notify\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (rel.merchant !== m.id) {\n return json(\n { ok: false, error: \"ese handle no es de tu comercio\" },\n 403,\n );\n }\n if (rel.revoked || await isRevoked(rel.keyId)) {\n return json({ ok: false, error: \"relación revocada\" }, 403);\n }\n if (rel.pending) {\n return json({\n ok: false,\n error: \"pendiente de que el cliente acepte en su móvil\",\n }, 409);\n }\n // Anti-acoso: máximo de avisos por cliente y por comercio.\n if (limited(\"mn_\" + String(b.handle), 6, 600000)) {\n return json(\n { ok: false, error: \"demasiados avisos a ese cliente\" },\n 429,\n );\n }\n if (limited(\"mnmerch_\" + m.id, 120, 60000)) {\n return json({ ok: false, error: \"límite del comercio superado\" }, 429);\n }\n const token = await getTok(rel.userKey);\n if (!token) {\n return json({ ok: false, error: \"usuario sin móvil registrado\" }, 404);\n }\n\n const nonce = bytesToHex(randBytes(6));\n const payload = \"v1~\" + rel.keyId + \"~\" + Date.now() + \"~\" + nonce;\n const secretBytes = new Uint8Array(\n atob(rel.secret).split(\"\").map((c) => c.charCodeAt(0)),\n );\n const sig = await hmacSign(secretBytes, payload);\n // number = caller ID desde el que llama el negocio. La app de negocio puede\n // enviar el suyo real (b.caller); si no, usamos el configurado del comercio.\n const caller = String(b.caller || m.caller);\n const r = await sendPush(token, {\n label: String(rel.label),\n number: caller,\n payload,\n sig,\n });\n return json({ ok: r.status === 200, fcm: r.status, caller }, 200);\n }\n\n // El panel del comercio lista SUS relaciones. En compartido incluye el número\n // (el comercio lo necesita para marcar). Autenticado por su clave.\n if (req.method === \"POST\" && path === \"/merchant/list\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const idx =\n ((await getJSON(`konstai_midx_${m.id}`)) as string[] | null) || [];\n const items = [];\n for (const h of idx.slice(-50).reverse()) {\n const rel = await getRel(h);\n if (rel) {\n items.push({\n handle: h,\n label: rel.label,\n number: rel.fullNumber || \"\",\n revoked: !!rel.revoked || await isRevoked(rel.keyId),\n pending: !!rel.pending,\n ts: rel.ts || 0,\n });\n }\n }\n return json({\n ok: true,\n merchant: m.id,\n name: m.name,\n caller: m.caller,\n items,\n });\n }\n\n if (req.method === \"POST\" && path === \"/merchant/revoke\") {\n const b = await req.json().catch(() => ({}));\n const m = await merchantByKey(String(b.apiKey || \"\"));\n if (!m) return json({ ok: false, error: \"apiKey no válida\" }, 401);\n const rel = await getRel(String(b.handle || \"\"));\n if (!rel) return json({ ok: false, error: \"handle desconocido\" }, 404);\n if (rel.merchant !== m.id) {\n return json(\n { ok: false, error: \"ese handle no es de tu comercio\" },\n 403,\n );\n }\n rel.revoked = true;\n await setRel(String(b.handle), rel);\n await setRevoked(rel.keyId);\n return json({ ok: true });\n }\n\n return json({ ok: false, error: \"not found\" }, 404);\n } catch (e) {\n return json({ ok: false, error: String((e as Error).message || e) }, 200);\n }\n}","createdAt",["D",1787513302361],"branchVersion","branchId","fe321492-8f91-4d0d-975c-cb3573f7ce1c","id","9f22b944-e907-4abc-bcea-f71b3515daaf","KonstAI",["D",1787238273342],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","f438816c-0bcb-436e-89fa-0a25876ac3ba","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a01faf-dd13-7316-b4da-9b1cb1edc8d6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_104":100},"org",{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},"branch",{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned",24,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","obelux8","handle","displayName","Obelux8","avatar","https://avatars.githubusercontent.com/u/260928148?v=4","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":150,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":151,"_80":152,"_82":153,"_84":25},"tree",[145],"files",[145],"counts",{"_134":62,"_135":136,"_137":62,"_138":139,"_140":141},"contents",[126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":130,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_27":133},"2cfe0cbf-a8c7-4f9c-9e16-328b89eaedf4","parentId","latest",["D",1787513302361],17,"label",[28],"pulls","branches",1,"forks","envVars",{"_142":136,"_144":62},"connections",{"_142":62,"_143":62},"count","unfilledCount","emptyCount",{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":146,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_147":148,"_27":149},["D",1787513302361],"children",[],[28],["D",1787238273342],{"_96":95,"_104":100},{"_96":95,"_97":98,"_99":100,"_18":55,"_101":102,"_103":25},{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_78":-5,"_123":187,"_188":189,"_190":191,"_192":25,"_193":25,"_194":25,"_195":58,"_196":-5,"_197":-7,"_198":-7,"_199":62,"_200":25,"_201":25,"_202":-5,"_203":25,"_204":25,"_205":25,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":86,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v21