Reconciliação e robustez

app.post("/webhooks/malvo", async (req, res) => {
  // 1. valida o IP de egresso e o header de auth configurado
  if (req.ip !== MALVO_EGRESS_IP) return res.sendStatus(403);
  if (req.headers.authorization !== `Bearer ${SECRET}`) return res.sendStatus(401);

  const evt = req.body;

  // 2. idempotência: no-op se já visto
  if (await alreadySeen(evt.eventId)) return res.sendStatus(200);
  await markSeen(evt.eventId);

  // 3. enfileira e responde rápido (ack first, work later)
  await queue.add("malvo", evt, { jobId: evt.eventId }); // jobId reforça o dedupe
  return res.sendStatus(200);
});

// worker — re-busca o recurso canônico
queue.process("malvo", async (job) => {
  const evt = job.data;
  switch (evt.event) {
    case "item/created":
    case "item/updated":
      return syncItem(evt.itemId); // GET /items/{id} + GET /accounts?itemId=...
    case "transactions/created":
    case "transactions/updated":
      return importTransactions(evt.itemId); // lista contas e faz upsert por id
    case "transactions/deleted":
      return deleteTransactions(evt.transactionIds); // delete por id
    case "item/error":
    case "item/waiting_user_input":
      return markItemBlocked(evt.itemId, evt.error); // mande o usuário ao update mode
    case "item/deleted":
      return softDeleteItem(evt.itemId);
  }
});

async function nightlyReconcile() {
  const items = await listActiveItems(); // do seu registro local

  for (const item of items) {
    // 1. itens defasados → dispara novo sync
    if (isStale(item.lastUpdatedAt)) {
      await patchWithRetry(`https://api.malvo.io/items/${item.id}`); // PATCH /items/{id}
    }

    // 2. refetch dos últimos N dias por conta, para cobrir buracos de webhook
    const from = isoDate(daysAgo(N)); // ex.: N = 7
    for (const account of item.accounts) {
      await refetchTransactions(account.id, from); // GET /v2/transactions?...&dateFrom=
    }
  }
}

async function patchWithRetry(url, attempt = 0) {
  const res = await fetch(url, {
    method: "PATCH",
    headers: { "X-API-KEY": apiKey },
  });
  if (res.status === 429 && attempt < 5) {
    const retryAfter = Number(res.headers.get("Retry-After")) || 0;
    const backoff = retryAfter * 1000 || 2 ** attempt * 1000;
    const jitter = Math.random() * 1000;
    await sleep(backoff + jitter);
    return patchWithRetry(url, attempt + 1);
  }
  return res;
}