SMS API w Ruby i Rails: Net::HTTP, ActiveJob, webhooki

export PRZYPOMINAMY_API_KEY=pk_test_...
# Rails: bin/rails credentials:edit
#   przypominamy:
#     api_key: pk_live_...
#     webhook_secret: whsec_...

# frozen_string_literal: true

require "net/http"
require "json"
require "uri"

module Przypominamy
  # Koperta błędu API: { "error": { code, message, param }, "request_id" }
  class Error < StandardError
    attr_reader :status, :code, :param, :request_id, :retry_after

    def initialize(status:, code:, message:, param: nil, request_id: nil, retry_after: nil)
      @status = status
      @code = code
      @param = param
      @request_id = request_id
      @retry_after = retry_after
      super("przypominamy: #{code} (#{status}): #{message} [request_id=#{request_id}]")
    end
  end

  class RequestError < Error; end   # 400, 401, 402 — nie ponawiaj
  class RateLimited < Error; end    # 429 — odczekaj retry_after
  class ProviderError < Error; end  # 502 i inne 5xx — ponów z backoffem

  class Client
    BASE = "https://api.przypominamy.com/v1"

    def initialize(api_key, base: BASE)
      @api_key = api_key
      @base = base
    end

    # to: String lub Array (do 500 numerów). Zwraca hash wiadomości albo tablicę hashy.
    def send_sms(to:, text:, from: nil, send_at: nil, reference: nil, idempotency_key: nil)
      raise ArgumentError, "max 500 odbiorców" if to.is_a?(Array) && to.size > 500

      payload = { to: to, text: text, from: from, send_at: send_at, reference: reference }.compact
      request(:post, "/messages", body: payload, idempotency_key: idempotency_key)
    end

    def get(id)
      request(:get, "/messages/#{id}")
    end

    def list(**query)
      request(:get, "/messages", query: query)
    end

    def account
      request(:get, "/account")
    end

    def set_webhook(url)
      request(:put, "/account/webhook", body: { url: url })
    end

    private

    def request(method, path, body: nil, query: nil, idempotency_key: nil)
      uri = URI("#{@base}#{path}")
      uri.query = URI.encode_www_form(query) if query && !query.empty?

      headers = {
        "Authorization" => "Bearer #{@api_key}",
        "Accept" => "application/json",
        "Content-Type" => "application/json"
      }
      headers["Idempotency-Key"] = idempotency_key if idempotency_key

      req = case method
            when :post then Net::HTTP::Post.new(uri, headers)
            when :put  then Net::HTTP::Put.new(uri, headers)
            else            Net::HTTP::Get.new(uri, headers)
            end
      req.body = payload_json(body) if body

      res = Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: 5, read_timeout: 10) do |http|
        http.request(req)
      end

      data = res.body.to_s.empty? ? {} : JSON.parse(res.body, symbolize_names: true)
      return data if res.is_a?(Net::HTTPSuccess)

      raise error_for(res, data)
    end

    def payload_json(body)
      JSON.generate(body)
    end

    def error_for(res, data)
      err = data[:error] || {}
      status = res.code.to_i
      attrs = {
        status: status,
        code: err[:code] || "http_#{status}",
        message: err[:message] || res.message,
        param: err[:param],
        request_id: data[:request_id],
        retry_after: res["Retry-After"]&.to_i
      }
      klass = if status == 429 then RateLimited
              elsif status >= 500 then ProviderError
              else RequestError
              end
      klass.new(**attrs)
    end
  end
end

require_relative "lib/przypominamy"

sms = Przypominamy::Client.new(ENV.fetch("PRZYPOMINAMY_API_KEY"))

msg = sms.send_sms(
  to: "+48600123456",
  text: "Przypominamy o wizycie jutro o 14:00.",
  reference: "wizyta-4521",
  idempotency_key: "wizyta-4521-przypomnienie"
)

puts [msg[:id], msg[:status], msg[:parts], msg[:cost_grosze]].join(" ") # msg_… queued 1 15

numery = %w[+48600123456 +48600234567 +48600345678]

wyniki = sms.send_sms(
  to: numery,
  text: "Promocja -20% tylko do niedzieli. Kod: SMS20",
  from: "SKLEP",
  reference: "promo-2026-09",
  idempotency_key: "promo-2026-09-batch-1"
)

wyniki.each { |m| puts "#{m[:to]} -> #{m[:status]} #{m[:error]}" }
puts "Koszt: #{wyniki.sum { |m| m[:cost_grosze] } / 100.0} zł"

# Więcej niż 500 numerów: dziel na paczki, jedna paczka = jedno żądanie.
numery.each_slice(500).with_index(1) do |paczka, i|
  sms.send_sms(to: paczka, text: "…", idempotency_key: "promo-2026-09-batch-#{i}")
end

class SendSmsJob < ApplicationJob
  queue_as :sms

  # Rails 7.1: :exponentially_longer zostało przemianowane na :polynomially_longer
  retry_on Przypominamy::RateLimited, Przypominamy::ProviderError,
           wait: :polynomially_longer, attempts: 5
  # 400/401/402 nie ma sensu ponawiać — job trafia do logu, nie do kolejki
  discard_on Przypominamy::RequestError do |job, error|
    Rails.logger.error("SMS #{job.arguments.first} odrzucony: #{error.code} #{error.request_id}")
  end

  def perform(wizyta_id)
    wizyta = Wizyta.find(wizyta_id)
    client = Przypominamy::Client.new(Rails.application.credentials.przypominamy[:api_key])

    msg = client.send_sms(
      to: wizyta.telefon,
      text: "Cześć #{wizyta.imie}, wizyta jutro o #{wizyta.godzina.strftime('%H:%M')}. Potwierdź odpisując TAK.",
      reference: "wizyta-#{wizyta.id}",
      idempotency_key: "wizyta-#{wizyta.id}-przypomnienie"
    )
    wizyta.update!(sms_id: msg[:id], sms_status: msg[:status])
  end
end

# Wywołanie, np. z crona dzień przed wizytą:
# Wizyta.jutro.find_each { |w| SendSmsJob.perform_later(w.id) }

module Przypominamy
  module Retry
    # Ponawia 429, 5xx i błędy sieci (max attempts prób), zawsze z tym samym idempotency_key,
    # więc timeout po stronie klienta nie skończy się podwójnym SMS-em.
    def self.send_sms(client, attempts: 3, **args)
      raise ArgumentError, "idempotency_key jest wymagany przy retry" unless args[:idempotency_key]

      attempt = 0
      begin
        client.send_sms(**args)
      rescue Przypominamy::RateLimited => e
        attempt += 1
        raise if attempt >= attempts
        sleep(e.retry_after || 2**attempt)
        retry
      rescue Przypominamy::ProviderError, Net::OpenTimeout, Net::ReadTimeout, Errno::ECONNRESET => e
        attempt += 1
        raise if attempt >= attempts
        sleep(2**attempt) # 2 s, 4 s, 8 s…
        retry
      end
    end
  end
end

# msg = Przypominamy::Retry.send_sms(sms, to: "+48600123456", text: "…", idempotency_key: "order-1234-confirm")

module Webhooks
  class SmsController < ActionController::API
    TOLERANCE = 300 # sekund

    def create
      raw = request.raw_post # surowe body — podpis liczony jest z bajtów, nie z params
      header = request.headers["X-Przypominamy-Signature"].to_s

      return head :forbidden unless valid_signature?(header, raw)

      event = JSON.parse(raw, symbolize_names: true)
      message = event.dig(:data, :message)

      # Odpowiedz 200 od razu; ciężką pracę oddaj do joba.
      UpdateSmsStatusJob.perform_later(
        event_id: event[:id], type: event[:type],
        message_id: message[:id], status: message[:status], reference: message[:reference]
      )
      head :ok
    rescue JSON::ParserError
      head :bad_request
    end

    private

    def valid_signature?(header, raw)
      parts = header.split(",").to_h { |kv| kv.strip.split("=", 2) }
      t = parts["t"]
      sig = parts["v1"]
      return false if t.nil? || sig.nil? || t !~ /\A\d+\z/
      return false if (Time.now.to_i - t.to_i).abs > TOLERANCE

      secret = Rails.application.credentials.przypominamy[:webhook_secret]
      expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{t}.#{raw}")
      ActiveSupport::SecurityUtils.secure_compare(expected, sig) # porównanie w stałym czasie
    end
  end
end

# config/routes.rb
# post "/webhooks/sms", to: "webhooks/sms#create"