Manejo de MFA

async function startRefresh(linkId: string) {
  const r = await fetch('https://api.rail.cl/v1/refresh_intents', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.RAIL_SECRET_KEY}`,
      'Content-Type': 'application/json',
      'Idempotency-Key': crypto.randomUUID(),
    },
    body: JSON.stringify({ link_id: linkId, refresh_type: 'full' }),
  });
  return r.json();
}

// /webhooks/rail
export async function POST(req: Request) {
  const body = await req.text();
  // ... verificar firma (ver guía Webhooks)
  const event = JSON.parse(body);

  if (event.type === 'refresh_intent.requires_mfa') {
    const intent = event.data;
    // Guarda el widget_token asociado al user
    await db.from('pending_mfa').insert({
      user_id: getUserIdFromLink(intent.link_id),
      intent_id: intent.id,
      widget_token: intent.requires_mfa.widget_token,
      expires_at: intent.requires_mfa.expires_at,
    });
    // Notifica al frontend (WebSocket, push, etc)
    await notifyUser(intent.link_id, 'mfa_required');
  }

  if (event.type === 'refresh_intent.succeeded') {
    await db.from('pending_mfa').delete().eq('intent_id', event.data.id);
    await notifyUser(event.data.link_id, 'sync_complete');
  }

  if (event.type === 'refresh_intent.failed') {
    await db.from('pending_mfa').delete().eq('intent_id', event.data.id);
    await notifyUser(event.data.link_id, 'sync_failed', event.data.error_code);
  }

  return new Response('ok');
}

'use client';
import { useEffect } from 'react';

export function LinkSyncStatus({ linkId }: { linkId: string }) {
  useEffect(() => {
    // WebSocket / SSE / polling — el patrón que uses para notificaciones
    const sub = supabase
      .channel(`link:${linkId}`)
      .on('broadcast', { event: 'mfa_required' }, async ({ payload }) => {
        // Backend envió el widget_token vía notificación
        window.Rail.openWidget({
          token: payload.widget_token,
          publishableKey: process.env.NEXT_PUBLIC_RAIL_KEY!,
          onSuccess: () => {
            // El MFA fue resuelto. El sync continúa server-side.
            // Muestra un loader hasta que el webhook succeeded llegue.
            setSyncing(true);
          },
          onExit: (reason) => {
            if (reason === 'timeout') {
              alert('El código expiró. Inténtalo de nuevo.');
            }
          },
        });
      })
      .subscribe();

    return () => sub.unsubscribe();
  }, [linkId]);
}

async function pollIntent(intentId: string): Promise<RefreshIntent> {
  while (true) {
    const r = await fetch(`https://api.rail.cl/v1/refresh_intents/${intentId}`, {
      headers: { Authorization: `Bearer ${process.env.RAIL_SECRET_KEY}` },
    });
    const intent = await r.json();
    if (['succeeded', 'failed', 'requires_mfa'].includes(intent.status)) {
      return intent;
    }
    await new Promise((r) => setTimeout(r, 5000)); // 5s entre polls
  }
}

await fetch(`https://api.rail.cl/v1/refresh_intents/${intentId}`, {
  method: 'DELETE',
  headers: { Authorization: `Bearer ${process.env.RAIL_SECRET_KEY}` },
});