상품 지급

const response = await fetch(
  "https://api.quartz-vend.com/v1/open/stores/202603290001/orders/202607190001/fulfillments",
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.QUARTZ_API_KEY}`,
      "Content-Type": "application/json",
      "Idempotency-Key": "fulfillment:202607190001:0:0"
    },
    body: JSON.stringify({
      deliveries: [{ index: 0, generation: 0, message: "LICENSE-KEY-001" }]
    })
  }
);
const result = await response.json();
if (!response.ok) throw new Error(result.error?.code ?? "REQUEST_FAILED");
console.log(result.data);

import express from "express";
import { createHmac, timingSafeEqual } from "node:crypto";

const app = express();
const credential = process.env.QUARTZ_PROVIDER_CREDENTIAL;
if (!credential) throw new Error("QUARTZ_PROVIDER_CREDENTIAL is required");

app.post("/fulfill/quartz", express.raw({ type: "application/json" }), async (req, res) => {
  const rawBody = req.body.toString("utf8");
  const idempotencyKey = req.header("Idempotency-Key") ?? "";
  const received = req.header("X-Quartz-Provider-Signature") ?? "";
  const expected = `v1=${createHmac("sha256", credential)
    .update(`${idempotencyKey}.${rawBody}`)
    .digest("hex")}`;

  const actualBuffer = Buffer.from(received);
  const expectedBuffer = Buffer.from(expected);
  if (actualBuffer.length !== expectedBuffer.length ||
      !timingSafeEqual(actualBuffer, expectedBuffer)) {
    return res.status(401).json({
      success: false,
      error: { code: "provider.invalid_signature", message: "Invalid signature" }
    });
  }

  const request = JSON.parse(rawBody);
  // idempotencyKey를 unique key로 저장한 뒤 재고를 한 번만 차감합니다.
  const result = await reserveInventoryOnce(request);
  return res.status(200).json(result);
});

import { createHmac, randomBytes } from "node:crypto";

const callbackSecret = process.env.QUARTZ_CALLBACK_SECRET;
const providerId = "202607190050";
const body = {
  providerEventId: "event-202607190001-completed",
  providerReferenceId: "fulfillment-202607190001",
  success: true,
  deliveries: [
    { index: 0, message: "LICENSE-KEY-001" },
    { index: 1, message: "LICENSE-KEY-002" }
  ],
  remainingStock: 125
};

const rawBody = JSON.stringify(body);
const timestamp = new Date().toISOString();
const nonce = randomBytes(24).toString("base64url");
const signature = createHmac("sha256", callbackSecret)
  .update(`${timestamp}.${nonce}.${rawBody}`)
  .digest("hex");

const response = await fetch(
  `https://api.quartz-vend.com/v1/providers/${providerId}/callback`,
  {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-Quartz-Provider-Timestamp": timestamp,
      "X-Quartz-Provider-Nonce": nonce,
      "X-Quartz-Provider-Signature": `v1=${signature}`
    },
    body: rawBody
  }
);

if (!response.ok) throw new Error(await response.text());