@danhachuel/prodmaker 0.1.14 → 0.1.16

package/app/services/fraude.py

@@ -0,0 +1,174 @@
+"""Anti-Fraude do AdsPixel — padrão do redis-datasets/fraud-detection:
+IP blacklisting (Redis Cuckoo Filter) + click spamming (Redis Sorted Set).
+
+- Redis é OPCIONAL: sem Redis, tudo cai em SQLite local (tabelas ips_bloqueados /
+  fraude_eventos) — bloqueio e detecção continuam funcionando.
+- O pixel NUNCA quebra a página do visitante: avaliação em falha = segue normalmente.
+"""
+import json
+import os
+import time
+
+from .database import get_db, now_str, row_to_dict
+from .llm import LLMError
+from .store import get_settings
+
+CUCKOO_KEY = "prodmaker:ip_blacklist_cf"      # Redis Cuckoo Filter (IP_BLOCKED)
+SPAM_KEY = "prodmaker:click_spamming"          # Redis Sorted Set (IP -> timestamp)
+SPAM_JANELA_SEGUNDOS = int(os.environ.get("PRODMAKER_SPAM_JANELA") or "60")
+SPAM_LIMITE = int(os.environ.get("PRODMAKER_SPAM_LIMITE") or "10")
+
+
+def _redis_url() -> str | None:
+    env = (os.environ.get("REDIS_URL") or "").strip()
+    if env:
+        return env
+    keys = (get_settings().get("api_keys") or {}).get("redis") or {}
+    return (keys.get("url") or "").strip() or None
+
+
+def _redis():
+    url = _redis_url()
+    if not url:
+        return None
+    try:
+        import redis
+
+        client = redis.Redis.from_url(url, decode_responses=True, socket_timeout=2)
+        client.ping()
+        return client
+    except Exception:
+        return None  # sem Redis: fallback SQLite
+
+
+def redis_ativo() -> bool:
+    return _redis() is not None
+
+
+# ---------------------------------------------------------------------------
+# Blacklist (Cuckoo Filter quando há Redis; tabela local sempre)
+# ---------------------------------------------------------------------------
+
+
+def _bloqueados_locais() -> dict[str, str]:
+    with get_db() as conn:
+        rows = conn.execute("SELECT ip, motivo FROM ips_bloqueados ORDER BY id DESC").fetchall()
+    return {row["ip"]: row["motivo"] for row in rows}
+
+
+def bloquear_ip(ip: str, motivo: str = "manual") -> dict:
+    ip = (ip or "").strip()
+    if not ip:
+        raise LLMError("Informe o IP a bloquear.")
+    client = _redis()
+    if client:
+        try:
+            client.execute_command("CF.ADDR", CUCKOO_KEY, ip)
+        except Exception:
+            pass  # filtro ausente no servidor: fica só local
+    with get_db() as conn:
+        existe = conn.execute("SELECT id FROM ips_bloqueados WHERE ip = ?", (ip,)).fetchone()
+        if not existe:
+            conn.execute(
+                "INSERT INTO ips_bloqueados (ip, motivo, origem, created_at) VALUES (?, ?, ?, ?)",
+                (ip, motivo, "redis" if client else "sqlite", now_str()),
+            )
+    return {"ok": True, "ip": ip, "engine": "redis" if client else "sqlite"}
+
+
+def desbloquear_ip(ip: str) -> None:
+    with get_db() as conn:
+        cursor = conn.execute("DELETE FROM ips_bloqueados WHERE ip = ?", (ip.strip(),))
+        if cursor.rowcount == 0:
+            raise LLMError("IP não encontrado na lista de bloqueio.")
+
+
+def ip_bloqueado(ip: str) -> bool:
+    if not ip:
+        return False
+    client = _redis()
+    if client:
+        try:
+            resposta = client.execute_command("CF.EXISTS", CUCKOO_KEY, ip)
+            if isinstance(resposta, list):
+                resposta = resposta[0] if resposta else 0
+            if int(resposta):
+                return True
+        except Exception:
+            pass  # redis sem o módulo RedisBloom: cai no local
+    return (ip or "").strip() in _bloqueados_locais()
+
+
+# ---------------------------------------------------------------------------
+# Click spamming (Sorted Set quando há Redis)
+# ---------------------------------------------------------------------------
+
+
+def registrar_clique(ip: str, page: str = "") -> dict:
+    """Registra um clique e devolve {spam: bool, cliques_janela: N}."""
+    ip = (ip or "").strip()
+    if not ip:
+        return {"spam": False, "cliques_janela": 0, "bloqueado": False}
+    agora = time.time()
+    cliques = 0
+    client = _redis()
+    if client:
+        try:
+            member = f"{int(agora * 1000)}:{ip}"
+            pipeline = client.pipeline()
+            pipeline.execute_command("ZADD", SPAM_KEY, agora, member)
+            pipeline.execute_command("ZREMRANGEBYSCORE", SPAM_KEY, 0, agora - SPAM_JANELA_SEGUNDOS)
+            pipeline.execute_command(
+                "ZCOUNT", SPAM_KEY, (int((agora - SPAM_JANELA_SEGUNDOS) * 1000)), int(agora * 1000)
+            )
+            cliques = int(pipeline.execute()[-1])
+        except Exception:
+            cliques = _cliques_local(ip, agora, page)
+    else:
+        cliques = _cliques_local(ip, agora, page)
+    spam = cliques >= SPAM_LIMITE
+    return {"spam": spam, "cliques_janela": cliques, "bloqueado": ip_bloqueado(ip)}
+
+
+def _cliques_local(ip: str, agora: float, page: str = "") -> int:
+    with get_db() as conn:
+        conn.execute("DELETE FROM fraude_eventos WHERE created_epoch < ?", (agora - SPAM_JANELA_SEGUNDOS * 2,))
+        conn.execute("INSERT INTO fraude_eventos (ip, page, created_epoch, created_at) VALUES (?, ?, ?, ?)", (ip, page or "", agora, now_str()))
+        row = conn.execute(
+            "SELECT COUNT(*) AS n FROM fraude_eventos WHERE ip = ? AND created_epoch > ?",
+            (ip, agora - SPAM_JANELA_SEGUNDOS),
+        ).fetchone()
+    return int(row["n"])
+
+
+# ---------------------------------------------------------------------------
+# Painel / API
+# ---------------------------------------------------------------------------
+
+
+def resumo() -> dict:
+    bloqueados = _bloqueados_locais()
+    spam_24h = 0
+    with get_db() as conn:
+        row = conn.execute(
+            "SELECT COUNT(*) AS n FROM fraude_eventos WHERE created_at >= datetime('now', '-1 day') GROUP BY ip HAVING COUNT(*) >= ?",
+            (SPAM_LIMITE,),
+        ).fetchone()
+        spam_24h = row["n"] if row else 0
+    return {
+        "redis_ativo": redis_ativo(),
+        "ips_bloqueados": [
+            {"ip": ip, "motivo": motivo} for ip, motivo in bloqueados.items()
+        ],
+        "total_bloqueados": len(bloqueados),
+        "spam_ultimas_24h": spam_24h,
+        "janela_segundos": SPAM_JANELA_SEGUNDOS,
+        "limite_cliques": SPAM_LIMITE,
+    }
+
+
+def avaliar_visita(ip: str) -> dict:
+    """Chamado pelo /track: decide se a visita entra no tracking."""
+    if ip_bloqueado(ip):
+        return {"bloqueado": True, "motivo": _bloqueados_locais().get((ip or "").strip(), "blacklist")}
+    return {"bloqueado": False}

package/app/services/publish_ads.py

@@ -1,6 +1,7 @@
-"""Engines de publicação de campanhas — Google Ads (REST mutates) e Meta Ads (Marketing API).
+"""Engines de publicação de campanhas — Google Ads (REST mutates), Meta Ads
+(Marketing API) e TikTok Ads (Marketing API OAuth).
 
-Best-effort com erros atribuídos por etapa. TikTok permanece manual (guia no plano).
+Best-effort com erros atribuídos por etapa. Tudo é criado PAUSADO para revisão.
 """
 import httpx
 

package/app/services/publish_tiktok.py

@@ -0,0 +1,155 @@
+"""TikTok Ads — publicação automática via Marketing API (OAuth + campaign/adgroup).
+
+Fluxo: auth_code (do portal TikTok) -> access_token (24h) -> refresh_token ->
+campanha PAUSADA -> grupo de anúncios. O criativo (vídeo/imagem) exige upload de
+arquivo local: sem vídeo informado, a campanha e o grupo são criados e o passo
+final (anúncio) fica como instrução honesta — nenhum hack é inventado.
+"""
+import time
+
+import httpx
+
+from .llm import LLMError
+from .store import get_settings, save_settings
+
+TIKTOK_API = "https://business-api.tiktok.com/open_api/v1.3"
+
+
+def _keys() -> dict:
+    keys = (get_settings().get("api_keys") or {}).get("tiktok") or {}
+    return {
+        "app_id": (keys.get("app_id") or "").strip(),
+        "app_secret": (keys.get("app_secret") or "").strip(),
+        "auth_code": (keys.get("auth_code") or "").strip(),
+        "access_token": (keys.get("access_token") or "").strip(),
+        "refresh_token": (keys.get("refresh_token") or "").strip(),
+        "advertiser_id": (keys.get("advertiser_id") or "").strip(),
+    }
+
+
+def _check(required: list[str]) -> None:
+    config = _keys()
+    missing = [field for field in required if not config[field]]
+    if missing:
+        raise LLMError(
+            "TikTok Ads requer em Chaves de API: " + ", ".join(missing) + ".",
+            provider="tiktok",
+        )
+
+
+def trocar_auth_code() -> dict:
+    """Troca o auth_code (portal TikTok) por access_token + refresh_token."""
+    config = _keys()
+    _check(["app_id", "app_secret", "auth_code"])
+    try:
+        response = httpx.post(
+            f"{TIKTOK_API}/oauth2/access_token/",
+            json={"app_id": config["app_id"], "secret": config["app_secret"], "auth_code": config["auth_code"]},
+            timeout=30.0,
+        )
+    except httpx.HTTPError as exc:
+        raise LLMError(f"Falha de conexão com o TikTok: {exc}", provider="tiktok", transient=True) from exc
+    payload = response.json() or {}
+    if payload.get("code") != 0:
+        raise LLMError(
+            f"TikTok rejeitou o auth_code ({payload.get('code')}): {payload.get('message')} — gere um novo código no portal.",
+            provider="tiktok",
+        )
+    data = payload.get("data") or {}
+    access_token = data.get("access_token")
+    refresh_token = data.get("refresh_token")
+    advertiser_ids = data.get("advertiser_ids") or []
+    if not access_token:
+        raise LLMError("TikTok não devolveu access_token.", provider="tiktok")
+
+    settings = get_settings()
+    tiktok = settings.setdefault("api_keys", {}).setdefault("tiktok", {})
+    tiktok["access_token"] = access_token
+    tiktok["refresh_token"] = refresh_token
+    tiktok["connected_at"] = time.strftime("%Y-%m-%dT%H:%M:%S")
+    if advertiser_ids and not (tiktok.get("advertiser_id") or "").strip():
+        tiktok["advertiser_id"] = str(advertiser_ids[0])
+    save_settings(settings)
+    return {
+        "ok": True,
+        "connected_at": tiktok["connected_at"],
+        "advertiser_ids": advertiser_ids,
+        "advertiser_id": tiktok.get("advertiser_id"),
+    }
+
+
+def _post(path: str, body: dict, token: str) -> dict:
+    try:
+        response = httpx.post(
+            f"{TIKTOK_API}{path}",
+            headers={"Access-Token": token, "Content-Type": "application/json"},
+            json=body,
+            timeout=60.0,
+        )
+    except httpx.HTTPError as exc:
+        raise LLMError(f"Falha de conexão com o TikTok: {exc}", provider="tiktok", transient=True) from exc
+    payload = response.json() or {}
+    if payload.get("code") != 0:
+        raise LLMError(
+            f"TikTok API ({path}) {payload.get('code')}: {payload.get('message')}",
+            provider="tiktok",
+        )
+    return payload.get("data") or {}
+
+
+def publicar_campanha(campanha: dict) -> dict:
+    """Cria campanha (PAUSADA) + grupo de anúncios. Criativo final = instrução honesta."""
+    config = _keys()
+    _check(["app_id", "app_secret", "advertiser_id", "access_token"])
+    plano = campanha.get("plano") or {}
+    nome = campanha["nome"]
+    orcamento_dia = float(campanha.get("orcamento_diario") or 0)
+    if orcamento_dia <= 0:
+        orcamento_dia = 15.0
+    budget_cents = int(orcamento_dia * 100)
+
+    etapas = []
+    campaign = _post(
+        "/campaign/create/",
+        {
+            "advertiser_id": config["advertiser_id"],
+            "campaign_name": nome,
+            "objective_type": "CONVERSIONS",
+            "budget_mode": "BUDGET_MODE_DAY",
+            "budget": budget_cents,
+            "operation_status": "DISABLE",
+        },
+        config["access_token"],
+    )
+    campaign_id = campaign.get("campaign_id")
+    etapas.append({"etapa": "campanha", "id": campaign_id, "status": "PAUSED"})
+
+    adgroup = _post(
+        "/adgroup/create/",
+        {
+            "advertiser_id": config["advertiser_id"],
+            "campaign_id": campaign_id,
+            "adgroup_name": f"{nome} — Grupo 1",
+            "placement_type": "PLACEMENT_TYPE_AUTOMATIC",
+            "budget_mode": "BUDGET_MODE_DAY",
+            "budget": budget_cents,
+            "schedule_type": "SCHEDULE_START_END",
+            "optimization_goal": "CONVERT",
+            "billing_event": "OCPM",
+            "operation_status": "DISABLE",
+        },
+        config["access_token"],
+    )
+    adgroup_id = adgroup.get("adgroup_id")
+    etapas.append({"etapa": "grupo", "id": adgroup_id, "status": "PAUSED"})
+
+    return {
+        "plataforma": "tiktok",
+        "etapas": etapas,
+        "campaign": campaign_id,
+        "adgroup": adgroup_id,
+        "observacao": (
+            "Campanha e grupo criados PAUSADOS. Passo final (anúncio): suba o vídeo vertical 9:16 "
+            "em TikTok Ads Manager ou use o upload de criativo — o ProdMaker avisa quando não há mídia informada."
+        ),
+    }

package/app/services/stripe_billing.py

@@ -0,0 +1,147 @@
+"""Stripe — planos, checkout sessions e webhooks de assinatura (infraestrutura pronta).
+
+Modo local primeiro: sem chaves Stripe, o app segue 100% liberado (nenhuma trava).
+Com stripe_secret_key + stripe_price_id configurados, o checkout e os webhooks
+passam a operar. Verificação de assinatura do webhook (t=...,v1=...) via HMAC-SHA256.
+"""
+import hashlib
+import hmac
+import json
+import time
+from pathlib import Path
+
+import httpx
+
+from .database import get_db, now_str, row_to_dict
+from .llm import LLMError
+from .store import get_settings, save_settings
+
+STRIPE_API = "https://api.stripe.com/v1"
+SEED_DIR = Path(__file__).resolve().parent.parent.parent / "seed"
+
+
+def _keys() -> dict:
+    keys = (get_settings().get("api_keys") or {}).get("stripe") or {}
+    return {
+        "secret_key": (keys.get("secret_key") or "").strip(),
+        "webhook_secret": (keys.get("webhook_secret") or "").strip(),
+    }
+
+
+def planos_local() -> dict:
+    path = SEED_DIR / "planos.json"
+    if path.exists():
+        return json.loads(path.read_text(encoding="utf-8"))
+    return {"planos": [], "nota": "seed/planos.json ausente."}
+
+
+def _plano(plano_id: str) -> dict | None:
+    for plano in planos_local().get("planos") or []:
+        if plano.get("id") == plano_id:
+            return plano
+    return None
+
+
+def criar_checkout(plano_id: str, email: str, sucesso_url: str, cancelamento_url: str) -> dict:
+    config = _keys()
+    plano = _plano(plano_id)
+    if not plano:
+        raise LLMError(f"Plano '{plano_id}' não encontrado em seed/planos.json.")
+    price_id = (plano.get("stripe_price_id") or "").strip()
+    if not config["secret_key"] or not price_id:
+        raise LLMError(
+            "Assinatura requer Stripe configurado: stripe_secret_key e o stripe_price_id do plano "
+            "(em seed/planos.json / Chaves de API). Sem isso, o app segue liberado em modo local."
+        )
+    try:
+        response = httpx.post(
+            f"{STRIPE_API}/checkout/sessions",
+            headers={"Authorization": f"Bearer {config['secret_key']}"},
+            data={
+                "mode": "subscription",
+                "customer_email": email,
+                "client_reference_id": plano_id,
+                "line_items[0][price]": price_id,
+                "line_items[0][quantity]": "1",
+                "success_url": sucesso_url,
+                "cancel_url": cancelamento_url,
+            },
+            timeout=30.0,
+        )
+    except httpx.HTTPError as exc:
+        raise LLMError(f"Falha de conexão com o Stripe: {exc}", provider="stripe", transient=True) from exc
+    payload = response.json() or {}
+    if response.status_code >= 400:
+        raise LLMError(
+            f"Stripe rejeitou o checkout ({response.status_code}): {(payload.get('error') or {}).get('message', payload)}",
+            provider="stripe",
+        )
+    _registrar(plano_id, email, "checkout_criado", payload.get("id", ""), payload)
+    return {"ok": True, "checkout_url": payload.get("url"), "session_id": payload.get("id")}
+
+
+def verificar_assinatura(payload_body: bytes, cabecalho: str) -> bool:
+    """Stripe-Signature: t=<ts>,v1=<hmac_sha256(secret, ts.body)>"""
+    secret = _keys()["webhook_secret"]
+    if not secret:
+        return True  # sem segredo configurado não há como verificar localmente
+    partes = {}
+    for item in cabecalho.split(","):
+        key, _, valor = item.strip().partition("=")
+        partes[key] = valor
+    timestamp = partes.get("t", "")
+    assinatura = partes.get("v1", "")
+    if not timestamp or not assinatura:
+        return False
+    esperado = hmac.new(secret.encode(), f"{timestamp}.".encode() + payload_body, hashlib.sha256).hexdigest()
+    return hmac.compare_digest(esperado, assinatura)
+
+
+def processar_webhook(evento: dict) -> dict:
+    tipo = evento.get("type", "")
+    objeto = (evento.get("data") or {}).get("object") or {}
+    if tipo == "checkout.session.completed":
+        plano_id = objeto.get("client_reference_id") or ""
+        email = (objeto.get("customer_details") or {}).get("email") or objeto.get("customer_email") or ""
+        _registrar(plano_id, email, "assinatura_ativa", objeto.get("subscription") or objeto.get("id", ""), objeto)
+    elif tipo in ("customer.subscription.deleted", "customer.subscription.paused"):
+        _registrar("", "", "assinatura_cancelada", objeto.get("id", ""), objeto)
+    elif tipo == "invoice.paid":
+        _registrar("", "", "pagamento_aprovado", objeto.get("id", ""), objeto)
+    return {"ok": True, "tipo": tipo}
+
+
+def _registrar(plano_id: str, email: str, status: str, stripe_ref: str, payload: dict) -> None:
+    with get_db() as conn:
+        if status == "assinatura_ativa":
+            conn.execute(
+                "INSERT INTO assinaturas (plano, email, stripe_ref, status, current_period_end, created_at) VALUES (?, ?, ?, 'ativa', ?, ?)",
+                (plano_id, email, stripe_ref, time.strftime("%Y-%m-%dT%H:%M:%S", time.gmtime(time.time() + 30 * 86400)), now_str()),
+            )
+        elif status == "assinatura_cancelada":
+            conn.execute("UPDATE assinaturas SET status = 'cancelada' WHERE stripe_ref = ?", (stripe_ref,))
+        elif status == "checkout_criado":
+            conn.execute(
+                "INSERT INTO assinaturas (plano, email, stripe_ref, status, current_period_end, created_at) VALUES (?, ?, ?, 'checkout', '', ?)",
+                (plano_id, email, stripe_ref, now_str()),
+            )
+
+
+def assinatura_atual() -> dict:
+    with get_db() as conn:
+        row = conn.execute("SELECT * FROM assinaturas WHERE status IN ('ativa','checkout') ORDER BY id DESC LIMIT 1").fetchone()
+    config = _keys()
+    base = {
+        "stripe_configurado": bool(config["secret_key"]),
+        "modo": "local" if not config["secret_key"] else "cloud",
+        "recursos_liberados": True,  # regra: nenhuma trava de pré-registo no app local
+    }
+    if row:
+        base["assinatura"] = row_to_dict(row)
+    return base
+
+
+def historico(limit: int = 30) -> list[dict]:
+    with get_db() as conn:
+        rows = conn.execute("SELECT * FROM assinaturas ORDER BY id DESC LIMIT ?", (limit,)).fetchall()
+    return [row_to_dict(row) for row in rows]

package/app/services/vendas.py

@@ -224,6 +224,20 @@ def registrar_venda(data: dict) -> dict:
         f"{record.get('produto_nome') or 'Produto'} — R$ {record.get('valor')} ({record.get('fonte')})"
         + (f" · GCLID {record['gclid'][:20]}" if record.get("gclid") else ""),
     )
+
+    try:
+        from . import email_mkt
+
+        email_mkt.aplicar_gatilho(
+            "venda_recebida",
+            {
+                "nome": (record.get("comprador_email") or "cliente").split("@")[0],
+                "produto": record.get("produto_nome") or "seu produto",
+                "valor": record.get("valor") or "",
+            },
+        )
+    except Exception:
+        pass  # e-mail nunca quebra o registro da venda
     return record