回调排障

// 回调接收端最小实现：先验签，再按 eventId 幂等，再快速 ACK
import { createServer } from 'node:http';
import { createHmac, timingSafeEqual } from 'node:crypto';

const SECRET = process.env.IM_CALLBACK_SECRET;
const handled = new Set(); // 生产用数据库唯一键替代

createServer(async (req, res) => {
  const chunks = [];
  for await (const chunk of req) chunks.push(chunk);
  const raw = Buffer.concat(chunks).toString('utf8');
  const ts = req.headers['x-im-timestamp'];
  const nonce = req.headers['x-im-nonce'];
  const sig = req.headers['x-im-signature'];
  const expected = createHmac('sha256', SECRET).update(`${ts}.${nonce}.${raw}`).digest('hex');
  if (!sig || sig.length !== expected.length || !timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    res.writeHead(401).end('bad signature');
    return;
  }
  if (Math.abs(Date.now() - Number(ts)) > 300000) { res.writeHead(401).end('stale'); return; }

  const event = JSON.parse(raw);
  if (handled.has(event.eventId)) { res.writeHead(200).end('duplicate'); return; }
  handled.add(event.eventId);

  // 业务处理要快：重活丢队列，避免超过 5 秒超时
  await enqueue(event.eventType, event.data);
  res.writeHead(200, { 'content-type': 'application/json' }).end('{"code":0}');
}).listen(9090);

// 管理端：查失败投递并重试
const failed = await admin.request('GET', '/apps/demo/callbacks/deliveries?status=failed&limit=20');
const delivery = failed.items[0];
console.log(delivery.eventType, delivery.responseCode, delivery.error);

await admin.request('POST', `/apps/demo/callbacks/deliveries/${delivery.deliveryId}/retry`);

// 发送测试事件（eventType=test.ping，不计入契约事件）
await admin.request('POST', '/apps/demo/callbacks/test');