Integración PayPal-NEQUI: Análisis Técnico y Arquitectura de Pagos

// Estructura probable de la integración
class PayPalNequiIntegration {
  constructor() {
    this.authEndpoint = 'https://api.paypal.com/v1/oauth2/token';
    this.nequiPayoutEndpoint = 'https://api.nequi.com/payments/v1/payouts';
    this.webhookUrls = {
      payment_completed: '/webhooks/paypal/payment-completed',
      payout_processed: '/webhooks/nequi/payout-processed'
    };
  }

  async initiateTransfer(userData, amount) {
    // 1. Autenticación OAuth2 con PayPal
    const paypalAuth = await this.authenticatePayPal();

    // 2. Validación de fondos en PayPal
    const balanceCheck = await this.checkPayPalBalance(amount);

    // 3. Inicio de transferencia a NEQUI
    const transfer = await this.createNequiPayout(userData, amount);

    return transfer;
  }
}

// Configuración típica de autenticación PayPal
const paypalConfig = {
  clientId: process.env.PAYPAL_CLIENT_ID,
  clientSecret: process.env.PAYPAL_CLIENT_SECRET,
  environment: process.env.PAYPAL_ENVIRONMENT, // 'sandbox' | 'live'
  webhookId: process.env.PAYPAL_WEBHOOK_ID
};

async function getPayPalAccessToken() {
  const auth = Buffer.from(`${paypalConfig.clientId}:${paypalConfig.clientSecret}`).toString('base64');

  const response = await fetch(`${paypalConfig.baseUrl}/v1/oauth2/token`, {
    method: 'POST',
    headers: {
      'Authorization': `Basic ${auth}`,
      'Content-Type': 'application/x-www-form-urlencoded'
    },
    body: 'grant_type=client_credentials'
  });

  const data = await response.json();
  return data.access_token;
}

// Posible estructura de autenticación NEQUI
const nequiConfig = {
  apiKey: process.env.NEQUI_API_KEY,
  apiSecret: process.env.NEQUI_API_SECRET,
  merchantId: process.env.NEQUI_MERCHANT_ID,
  baseUrl: process.env.NEQUI_BASE_URL
};

function generateNequiSignature(timestamp, payload) {
  const message = `${timestamp}${nequiConfig.apiKey}${JSON.stringify(payload)}`;
  return crypto.createHmac('sha256', nequiConfig.apiSecret)
              .update(message)
              .digest('hex');
}

// Posible estructura de autenticación NEQUI
const nequiConfig = {
  apiKey: process.env.NEQUI_API_KEY,
  apiSecret: process.env.NEQUI_API_SECRET,
  merchantId: process.env.NEQUI_MERCHANT_ID,
  baseUrl: process.env.NEQUI_BASE_URL
};

function generateNequiSignature(timestamp, payload) {
  const message = `${timestamp}${nequiConfig.apiKey}${JSON.stringify(payload)}`;
  return crypto.createHmac('sha256', nequiConfig.apiSecret)
              .update(message)
              .digest('hex');
}

# paypal_nequi_limits.yaml
rate_limits:
  paypal:
    requests_per_minute: 500
    payout_frequency: "60/min"
    max_payout_amount: 10000.00
    min_payout_amount: 0.01

  nequi:
    daily_transactions: 2500
    monthly_volume: 2500000
    max_transaction_amount: 5000
    min_transaction_amount: 1

api_constraints:
  payload_size: "1MB"
  timeout: "30s"
  retry_attempts: 3
  webhook_timeout: "10s"

// Endpoints principales utilizados
const criticalEndpoints = {
  paypal: {
    oauth: 'POST /v1/oauth2/token',
    payout: 'POST /v1/payments/payouts',
    webhooks: 'POST /v1/notifications/webhooks',
    balance: 'GET /v1/wallet/balance'
  },
  nequi: {
    account_linking: 'POST /v1/accounts/link',
    payout_init: 'POST /v1/payments/payouts',
    status_check: 'GET /v1/payments/{payout_id}',
    webhooks: 'POST /v1/webhooks/notifications'
  }
};

class RetryStrategy {
  constructor(maxRetries = 3, baseDelay = 1000) {
    this.maxRetries = maxRetries;
    this.baseDelay = baseDelay;
  }

  async executeWithRetry(operation, context = '') {
    let lastError;

    for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
      try {
        console.log(`Attempt ${attempt} for ${context}`);
        return await operation();
      } catch (error) {
        lastError = error;

        // No reintentar para errores del cliente (4xx)
        if (error.status >= 400 && error.status < 500) {
          throw error;
        }

        if (attempt === this.maxRetries) break;

        const delay = this.baseDelay * Math.pow(2, attempt - 1);
        await this.sleep(delay + Math.random() * 1000);
      }
    }

    throw lastError;
  }

  sleep(ms) {
    return new Promise(resolve => setTimeout(resolve, ms));
  }
}

// Uso en la integración
const retryStrategy = new RetryStrategy();

async function processPaymentTransfer(transferData) {
  return await retryStrategy.executeWithRetry(
    async () => {
      const result = await paypalNequiIntegration.initiateTransfer(transferData);
      return result;
    },
    'payment_transfer'
  );
}

class SecurityManager {
  static validateWebhookSignature(payload, signature, timestamp) {
    // Prevenir replay attacks
    if (Date.now() - timestamp > 300000) { // 5 minutos
      throw new Error('Webhook timestamp expired');
    }

    const expectedSignature = this.generateSignature(payload, timestamp);
    if (!crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(expectedSignature)
    )) {
      throw new Error('Invalid webhook signature');
    }
  }

  static sanitizeUserInput(input) {
    const sanitized = {
      ...input,
      // Remover campos sensibles
      cvv: undefined,
      pin: undefined
    };

    // Validar formato de datos
    if (!this.isValidEmail(sanitized.email)) {
      throw new Error('Invalid email format');
    }

    return sanitized;
  }
}

const monitoringMetrics = {
  transaction_metrics: [
    'payout_success_rate',
    'average_processing_time',
    'error_rate_by_type',
    'conversion_rate_usd_cop'
  ],

  system_metrics: [
    'api_response_time_p95',
    'concurrent_connections',
    'queue_backlog_size',
    'database_connection_pool'
  ],

  business_metrics: [
    'daily_transaction_volume',
    'revenue_by_commission',
    'user_acquisition_cost',
    'customer_support_tickets'
  ]
};

// Configuración de alertas
const criticalAlerts = {
  high_error_rate: {
    threshold: 0.05, // 5%
    window: '5m',
    channels: ['slack', 'pagerduty']
  },

  api_latency_spike: {
    threshold: 2000, // 2 segundos
    window: '10m',
    channels: ['slack']
  },

  failed_payouts: {
    threshold: 10,
    window: '1h',
    channels: ['pagerduty', 'email']
  }
};

class CircuitBreaker {
  constructor(failureThreshold = 5, resetTimeout = 60000) {
    this.failureThreshold = failureThreshold;
    this.resetTimeout = resetTimeout;
    this.failureCount = 0;
    this.state = 'CLOSED';
    this.nextAttempt = Date.now();
  }

  async call(service) {
    if (this.state === 'OPEN') {
      if (Date.now() < this.nextAttempt) {
        throw new Error('Circuit breaker is OPEN');
      }
      this.state = 'HALF_OPEN';
    }

    try {
      const result = await service();
      this.onSuccess();
      return result;
    } catch (error) {
      this.onFailure();
      throw error;
    }
  }

  onSuccess() {
    this.failureCount = 0;
    this.state = 'CLOSED';
  }

  onFailure() {
    this.failureCount++;
    if (this.failureCount >= this.failureThreshold) {
      this.state = 'OPEN';
      this.nextAttempt = Date.now() + this.resetTimeout;
    }
  }
}

class PaymentCache {
  constructor(redisClient, defaultTTL = 300) { // 5 minutos
    this.redis = redisClient;
    this.defaultTTL = defaultTTL;
  }

  async cacheExchangeRate(currencyPair, rate) {
    const key = `exchange_rate:${currencyPair}`;
    await this.redis.setex(key, this.defaultTTL, rate.toString());
  }

  async getCachedUserLimits(userId) {
    const key = `user_limits:${userId}`;
    const cached = await this.redis.get(key);
    return cached ? JSON.parse(cached) : null;
  }
}