Emite comprobantes del SRI desde tu propio sistema

import crypto from "node:crypto";

// express.raw: la firma se calcula sobre el cuerpo CRUDO, sin parsear.
app.post("/webhooks/facturon", express.raw({ type: "application/json" }), (req, res) => {
  const timestamp = req.get("X-Webhook-Timestamp") ?? "";
  const received = req.get("X-Webhook-Signature") ?? "";
  const expected = crypto
    .createHmac("sha256", process.env.FACTURON_WEBHOOK_SECRET)
    .update(`${timestamp}.${req.body}`)
    .digest("hex");

  const valid = received.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) < 300;
  if (!valid || !fresh) return res.sendStatus(400);

  const event = JSON.parse(req.body);
  // Guarda event.id y responde 2xx de inmediato; procesa en segundo plano.
  res.sendStatus(200);
});

$body = file_get_contents('php://input');           // cuerpo crudo
$timestamp = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '';
$received = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$expected = hash_hmac('sha256', $timestamp . '.' . $body, getenv('FACTURON_WEBHOOK_SECRET'));

if (! hash_equals($expected, $received) || abs(time() - (int) $timestamp) > 300) {
    http_response_code(400);
    exit;
}

$event = json_decode($body, true); // ['id', 'event', 'timestamp', 'test', 'data']
// Descarta duplicados por $event['id'] y responde 200 rápido.
http_response_code(200);

# 1) Verifica la llave
curl https://facturon.ec/api/v1/ext/me \
  -H "Authorization: Bearer fec_TU_LLAVE"

# 2) Emite una factura (idempotente por pedido)
curl -X POST https://facturon.ec/api/v1/ext/documents \
  -H "Authorization: Bearer fec_TU_LLAVE" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: pedido-WEB-1001" \
  -d @factura.json

# 3) Consulta el estado hasta que sea authorized
curl https://facturon.ec/api/v1/ext/documents/812/status \
  -H "Authorization: Bearer fec_TU_LLAVE"

# 4) Descarga el RIDE
curl -o factura.pdf https://facturon.ec/api/v1/ext/documents/812/ride \
  -H "Authorization: Bearer fec_TU_LLAVE"

const BASE = "https://facturon.ec/api/v1/ext";
const headers = {
  Authorization: `Bearer ${process.env.FACTURON_API_KEY}`,
  "Content-Type": "application/json",
};

async function emitirFactura(pedido) {
  const res = await fetch(`${BASE}/documents`, {
    method: "POST",
    headers: { ...headers, "Idempotency-Key": `pedido-${pedido.id}` },
    body: JSON.stringify(pedido.factura),
  });
  const json = await res.json();
  if (!res.ok) throw new Error(`${json.error}: ${json.message}`);
  return json.data.document; // status: "processing"
}

async function esperarAutorizacion(id, intentos = 12) {
  for (let i = 0; i < intentos; i++) {
    const res = await fetch(`${BASE}/documents/${id}/status`, { headers });
    const { data } = await res.json();
    if (data.status === "authorized" || data.status === "rejected") return data;
    await new Promise((r) => setTimeout(r, 5000));
  }
  throw new Error("El SRI aún no responde; reintenta más tarde");
}

$client = new \GuzzleHttp\Client([
    'base_uri' => 'https://facturon.ec/api/v1/ext/',
    'headers' => ['Authorization' => 'Bearer ' . getenv('FACTURON_API_KEY')],
]);

// Cliente: buscar o crear
try {
    $cliente = json_decode($client->get('customers/lookup', ['query' => ['identification' => '1790012345001']])->getBody(), true)['data']['customer'];
} catch (\GuzzleHttp\Exception\ClientException $e) {
    if ($e->getResponse()->getStatusCode() !== 404) throw $e;
    $cliente = json_decode($client->post('customers', ['json' => [
        'identification_type' => '04', 'identification_number' => '1790012345001', 'name' => 'ACME S.A.',
    ]])->getBody(), true)['data']['customer'];
}

// Emitir
$factura = json_decode($client->post('documents', [
    'headers' => ['Idempotency-Key' => 'pedido-WEB-1001'],
    'json' => $payload + ['customer_id' => $cliente['id']],
])->getBody(), true)['data']['document'];

// Estado
$estado = json_decode($client->get("documents/{$factura['id']}/status")->getBody(), true)['data'];