From 1affc1fc0ed3e66894690e55451863073ef2bedb Mon Sep 17 00:00:00 2001
From: deploy <deploy@athleticmap>
Date: Fri, 25 Sep 2026 22:32:27 +0000
Subject: [PATCH] =?UTF-8?q?feat(plataforma):=20subconta=20Asaas=20dos=20te?=
 =?UTF-8?q?nants=20ligada=20=E2=80=94=20token=20de=20situacao=20selado,=20?=
 =?UTF-8?q?rota=20do=20aviso=20e=20SUBCONTA=5F*?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../09-sealed-plataforma-subconta-token.yaml      | 15 +++++++++++++++
 tenants/plataforma/30-ingress.yaml                |  2 ++
 tenants/plataforma/82-servico-captacao.yaml       |  8 ++++++++
 3 files changed, 25 insertions(+)
 create mode 100644 tenants/plataforma/09-sealed-plataforma-subconta-token.yaml

diff --git a/tenants/plataforma/09-sealed-plataforma-subconta-token.yaml b/tenants/plataforma/09-sealed-plataforma-subconta-token.yaml
new file mode 100644
index 0000000..e773af5
--- /dev/null
+++ b/tenants/plataforma/09-sealed-plataforma-subconta-token.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: plataforma-subconta-token
+  namespace: plataforma-prod
+spec:
+  encryptedData:
+    token: AgBOGJCfk5n3I9gsGBZHzVFGF1idr9rGECRVP4kQ9ejfjrHahcwGWZnWcw8Cq/1zeZELzfQxOIn+09ZdWNkVBc0PhYvhvuO+xEjBpsx2ZZxBBQH1jqnBAG3lxd1+P/DnpYK9Gegs/8ZJsYNEn2yuOXLrPdHmyKSd231mSgAxJurMVo2EMl/dLyoCnQD7pKijTZlJSsDAZMmZZxLL5eRMgweD71ofVu4vhhzs0uD4bKwiVFvCNFLfkiV/Ginpqc9AqWKzaL0MX+Pr/yaefZYt5pT4825Wxmg+x2lhOfksNgPnx7FSwdVqw5O2PJm3h9zC9A+MWOtwHpDEq1Dx3H61K3LWe6k71Lmq/+niegJcW6Mkh63abRGoRZc1qlMw6Wn9m9hDv7LpbmjIrDiDtd1OXrzFtNh/rIWtTYLKyoNMTDl3gFy2Zjp33Ygul183bduur2zHm2rJrWxtoUNkI46tL0pK3V1KDZFrD7KLM5wSWJWgv/1wq47ipJJjy4Q+c1eTDmRKic9wLcQGnAku8hIF13GqKleY78VvC1BNSWx8UX6RcIl32gqlgRzPc2+Se6JmH8W/hxo++U1AQWPsds4q1bPlVAXiRBNycWBMXNAUNPXweC2/TWuQ6yQIRjYXS7dk0T0i+WoqC50lxrf5LHqaNf2onupXGkQo5R9PD38RZrB/etBEBgBkCo4PEwqCBAerh23ODZdJEHgRACJCgQKI7f7mwcramRJG2Jx8s8OzF3pe5VSeu3MtfBikfNap4IMKkgA=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: plataforma-subconta-token
+      namespace: plataforma-prod
diff --git a/tenants/plataforma/30-ingress.yaml b/tenants/plataforma/30-ingress.yaml
index ecad25c..7f1d529 100644
--- a/tenants/plataforma/30-ingress.yaml
+++ b/tenants/plataforma/30-ingress.yaml
@@ -122,6 +122,7 @@ spec:
           # Sem esta linha o Ingress devolvia 404: alguem assinaria, pagaria, e
           # nenhum tenant seria criado — sem erro em lugar nenhum do nosso lado.
           - { path: /api/public/webhooks/assinatura, pathType: Prefix, backend: { service: { name: servico-captacao, port: { number: 80 } } } }
+          - { path: /api/public/webhooks/subconta, pathType: Prefix, backend: { service: { name: servico-captacao, port: { number: 80 } } } }
 
           # PUBLICA — o aviso de pagamento do Asaas, que chega da internet sem
           # token nenhum (P3.3). NAO casa com /api/financeiro: o controlador
@@ -192,6 +193,7 @@ spec:
           # Sem esta linha o Ingress devolvia 404: alguem assinaria, pagaria, e
           # nenhum tenant seria criado — sem erro em lugar nenhum do nosso lado.
           - { path: /api/public/webhooks/assinatura, pathType: Prefix, backend: { service: { name: servico-captacao, port: { number: 80 } } } }
+          - { path: /api/public/webhooks/subconta, pathType: Prefix, backend: { service: { name: servico-captacao, port: { number: 80 } } } }
 
           # PUBLICA — o aviso de pagamento do Asaas, que chega da internet sem
           # token nenhum (P3.3). NAO casa com /api/financeiro: o controlador
diff --git a/tenants/plataforma/82-servico-captacao.yaml b/tenants/plataforma/82-servico-captacao.yaml
index 54596e2..64a3786 100644
--- a/tenants/plataforma/82-servico-captacao.yaml
+++ b/tenants/plataforma/82-servico-captacao.yaml
@@ -116,6 +116,14 @@ spec:
             - name: PLATAFORMA_ADMIN_TOKEN
               valueFrom:
                 secretKeyRef: { name: plataforma-admin-token, key: token }
+            # A subconta Asaas de cada tenant (CobrancaDoTenant). O token autentica
+            # o aviso de situacao que cada subconta manda para a plataforma; ele
+            # nasceu no servidor (scripts/ligar_subconta.py) e vai no webhook de
+            # cada subconta aberta — trocar aqui exige trocar la.
+            - { name: SUBCONTA_LIGADO, value: "true" }
+            - name: SUBCONTA_TOKEN_DE_SITUACAO
+              valueFrom:
+                secretKeyRef: { name: plataforma-subconta-token, key: token }
             # P5.3 — de onde vem o certificado PUBLICO do sealed-secrets.
             #
             # A URL, e nao um arquivo: o controlador ROTACIONA a chave a cada