Güpp para desarrolladores

curl -s -H "X-API-Key: $GUPP_KEY" https://api-sandbox-3e2d10e3.up.railway.app/api/partner/v1/me

curl -s -X POST https://api-sandbox-3e2d10e3.up.railway.app/api/partner/v1/quotes \
  -H "X-API-Key: $GUPP_KEY" -H "Content-Type: application/json" \
  -d '{
    "service_code": "grua",
    "pickup_lat": 4.6533, "pickup_lng": -74.0836,
    "dropoff_lat": 4.7001, "dropoff_lng": -74.0502,
    "vehicle_kind": "carro"
  }'

curl -s -X POST https://api-sandbox-3e2d10e3.up.railway.app/api/partner/v1/orders \
  -H "X-API-Key: $GUPP_KEY" -H "Content-Type: application/json" \
  -d '{
    "service_code": "grua",
    "pickup_lat": 4.6533, "pickup_lng": -74.0836,
    "pickup_address": "Av. 68 con Cll 26",
    "dropoff_lat": 4.7001, "dropoff_lng": -74.0502,
    "dropoff_address": "Taller aliado Cll 100",
    "vehicle_kind": "carro",
    "vehicle_description": "ABC123 · Kia Picanto gris",
    "contact_name": "Ana Ruiz",
    "contact_phone": "3157778899",
    "external_ref": "SINIESTRO-2026-00123",
    "problem": "choque",
    "notes": "Vehículo en el carril derecho"
  }'

curl -s -H "X-API-Key: $GUPP_KEY" \
  "https://api-sandbox-3e2d10e3.up.railway.app/api/partner/v1/orders?status=active&external_ref=SINIESTRO-2026-00123"

# 1. ¿Cuánto cuesta cancelar ahora?
curl -s -H "X-API-Key: $GUPP_KEY" https://api-sandbox-3e2d10e3.up.railway.app/api/partner/v1/orders/$ORDER_ID/cancel-preview
# → {"fee": 0, "reason": "Cancelación sin costo"}

# 2. Cancelar. Si fee > 0 hay que confirmar con "accept_fee": true (si no, responde 409)
curl -s -X POST https://api-sandbox-3e2d10e3.up.railway.app/api/partner/v1/orders/$ORDER_ID/cancel \
  -H "X-API-Key: $GUPP_KEY" -H "Content-Type: application/json" \
  -d '{"reason": "El cliente consiguió ayuda por su cuenta", "accept_fee": true}'

POST /webhooks/gupp HTTP/1.1
Content-Type: application/json
User-Agent: Gupp-Webhooks/1.0
X-Gupp-Event: order.updated
X-Gupp-Delivery: 5b0c3c1e-8f0a-4d1e-9a51-0b7f2d6a9e44
X-Gupp-Signature: t=1794449005,v1=6f1c0a…e93b

{
  "event": "order.updated",
  "created_at": "2026-11-11T21:27:44.512Z",
  "data": {
    "id": "d0df529f-38be-4b59-87a4-8847bffc7b4c",
    "code": "GP-Q2YRSD",
    "status": "en_route",
    "external_ref": "SINIESTRO-2026-00123",
    "start_pin": "4821",
    "eta_minutes": 7,
    "provider": { "display_name": "Rescate Vial Norte", "vehicle_plate": "TTX902", … },
    …
  }
}

import crypto from "node:crypto";
import express from "express";

const SECRET = process.env.GUPP_WEBHOOK_SECRET;
const TOLERANCE_S = 5 * 60;

function verifyGupp(header, rawBody) {
  const parts = Object.fromEntries(
    (header ?? "").split(",").map((p) => p.split("=", 2)),
  );
  const t = Number(parts.t);
  if (!t || !parts.v1) return false;
  if (Math.abs(Date.now() / 1000 - t) > TOLERANCE_S) return false;

  const expected = crypto
    .createHmac("sha256", SECRET)
    .update(`${t}.`)
    .update(rawBody) // Buffer con el cuerpo tal cual llegó
    .digest("hex");
  const a = Buffer.from(expected, "hex");
  const b = Buffer.from(parts.v1, "hex");
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

const app = express();
// Importante: el cuerpo crudo, no el JSON ya parseado.
app.post("/webhooks/gupp", express.raw({ type: "application/json" }), (req, res) => {
  if (!verifyGupp(req.get("X-Gupp-Signature"), req.body)) {
    return res.status(400).send("firma inválida");
  }
  const event = JSON.parse(req.body.toString("utf8"));
  // Responde rápido y procesa en segundo plano (idempotente por X-Gupp-Delivery).
  res.sendStatus(204);
  queue.push(event);
});

import hashlib
import hmac
import os
import time

from fastapi import FastAPI, Header, HTTPException, Request

SECRET = os.environ["GUPP_WEBHOOK_SECRET"].encode()
TOLERANCE_S = 5 * 60
app = FastAPI()


def verify_gupp(header: str | None, raw_body: bytes) -> bool:
    try:
        parts = dict(p.split("=", 1) for p in (header or "").split(","))
        t = int(parts["t"])
        received = parts["v1"]
    except (KeyError, ValueError):
        return False
    if abs(time.time() - t) > TOLERANCE_S:
        return False
    expected = hmac.new(SECRET, f"{t}.".encode() + raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, received)


@app.post("/webhooks/gupp", status_code=204)
async def gupp_webhook(request: Request, x_gupp_signature: str | None = Header(None)):
    raw = await request.body()  # cuerpo crudo
    if not verify_gupp(x_gupp_signature, raw):
        raise HTTPException(400, "firma inválida")
    event = await request.json()
    # Encola y responde en menos de 10 s; deduplica por X-Gupp-Delivery.
    enqueue(event)