Testando seu App

# Sandbox test credentials (from your developer dashboard)
export VENDDOR_API_URL="https://sandbox.api.io.venddor.com.br"
export CLIENT_ID="your_sandbox_client_id"
export CLIENT_SECRET="your_sandbox_client_secret"
export TEST_TENANT_ID="sandbox-demo-tenant"

# Quick test: list products from sandbox
curl -H "Authorization: Bearer $TEST_TOKEN" \
     -H "X-Tenant-ID: $TEST_TENANT_ID" \
     "$VENDDOR_API_URL/api/storefront/products"

# Test token exchange
curl -X POST "$VENDDOR_API_URL/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "client_id": "'$CLIENT_ID'",
    "client_secret": "'$CLIENT_SECRET'",
    "code": "AUTH_CODE_FROM_CALLBACK",
    "redirect_uri": "https://localhost:3000/auth/callback"
  }'

# Test token refresh
curl -X POST "$VENDDOR_API_URL/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "refresh_token",
    "client_id": "'$CLIENT_ID'",
    "client_secret": "'$CLIENT_SECRET'",
    "refresh_token": "YOUR_REFRESH_TOKEN"
  }'

# Set up test environment
API="https://sandbox.api.io.venddor.com.br"
AUTH="Authorization: Bearer $TOKEN"
TENANT="X-Tenant-ID: $TENANT_ID"

# Test: List products (should return 200)
curl -s -w "\nHTTP Status: %{http_code}\n" \
  -H "$AUTH" -H "$TENANT" "$API/api/storefront/products"

# Test: Get non-existent product (should return 404)
curl -s -w "\nHTTP Status: %{http_code}\n" \
  -H "$AUTH" -H "$TENANT" "$API/api/storefront/products/nonexistent-id"

# Test: Create product without required field (should return 400)
curl -s -w "\nHTTP Status: %{http_code}\n" -X POST \
  -H "$AUTH" -H "$TENANT" -H "Content-Type: application/json" \
  -d '{"description": "no name field"}' \
  "$API/api/admin/products"

# Test: Access without token (should return 401)
curl -s -w "\nHTTP Status: %{http_code}\n" \
  -H "$TENANT" "$API/api/admin/products"

# Test: Access scope you don't have (should return 403)
curl -s -w "\nHTTP Status: %{http_code}\n" \
  -H "$AUTH" -H "$TENANT" "$API/api/admin/settings"

# Option 1: Use ngrok to expose your local server
ngrok http 3000
# Copy the ngrok URL (e.g., https://abc123.ngrok.io)
# Register it as webhook URL in your developer dashboard

# Option 2: Use webhook.site for quick testing
# Go to https://webhook.site and copy your unique URL
# Register it as webhook URL in your developer dashboard

# Option 3: Trigger a test webhook from the API
curl -X POST "$API/api/developers/apps/YOUR_APP_ID/webhooks/test" \
  -H "$AUTH" \
  -H "Content-Type: application/json" \
  -d '{
    "event": "order.created",
    "webhook_url": "https://your-ngrok-url.ngrok.io/webhooks/venddor"
  }'

// Webhook signature verification (Node.js)
const crypto = require('crypto');

function verifyWebhookSignature(payload, signature, secret) {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// In your webhook handler:
app.post('/webhooks/venddor', express.raw({ type: 'application/json' }), (req, res) => {
  const signature = req.headers['x-venddor-signature'];

  if (!verifyWebhookSignature(req.body, signature, CLIENT_SECRET)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  // Process the event...
  res.status(200).send('OK');
});