ti2 1.0.102 → 1.0.104

package/api.yml

@@ -451,6 +451,9 @@ components:
         id:
           type: string
           description: a quote Id to make a reservation for
+        shellOnly:
+          type: boolean
+          description: Optional itinerary-assist flag to create/update booking header only without adding a service line
     settingsBody:
       type: object
       required: true

package/controllers/__tests__/bookings.js

@@ -32,6 +32,7 @@ describe('user: bookings controller', () => {
   let userToken;
   let appSetup;
   let createUserToken;
+  let sqldb;
   
   beforeAll(async () => {
     ({
@@ -41,6 +42,7 @@ describe('user: bookings controller', () => {
       plugins,
       appSetup,
       createUserToken,
+      sqldb,
     } = await testUtils({
       plugins: [newApp.name],
     }));
@@ -168,6 +170,56 @@ describe('user: bookings controller', () => {
     expect(plugins[0].createBooking.mock.calls[0][0].payload).toEqual(payload);
     expect(plugins[0].createBooking.mock.calls[0][0].token).toEqual(token);
   });
+  it('should return 422 when stored app token is corrupted on bookings endpoint', async () => {
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const [originalRows] = await sqldb.query(
+      'SELECT id, appKey FROM UserAppKeys WHERE integrationId = :integrationId AND userId = :userId AND hint = :hint',
+      {
+        replacements: {
+          integrationId: appKey,
+          userId,
+          hint: 'testingToken',
+        },
+      },
+    );
+    await sqldb.query(
+      'UPDATE UserAppKeys SET appKey = :appKey WHERE integrationId = :integrationId AND userId = :userId AND hint = :hint',
+      {
+        replacements: {
+          appKey: 'corrupted-token-without-delimiter',
+          integrationId: appKey,
+          userId,
+          hint: 'testingToken',
+        },
+      },
+    );
+    try {
+      const returnValue = await doApiPost({
+        url: `/bookings/${appKey}/${userId}/testingToken/search`,
+        token: userToken,
+        payload: {
+          bookingId: '',
+          supplierBookingId: '',
+          name: '',
+        },
+        expectStatusCode: 422,
+      });
+      expect(returnValue.message).toBe(
+        'Stored integration token is invalid. Please re-save credentials.',
+      );
+    } finally {
+      await Promise.all(originalRows.map(currentRow => sqldb.query(
+        'UPDATE UserAppKeys SET appKey = :appKey WHERE id = :id',
+        {
+          replacements: {
+            id: currentRow.id,
+            appKey: currentRow.appKey,
+          },
+        },
+      )));
+      consoleErrorSpy.mockRestore();
+    }
+  });
 
   describe('product search with empty cache', () => {
     const productSearchCacheKey = hash({

package/controllers/__tests__/user.js

@@ -2,6 +2,7 @@
 
 const R = require('ramda');
 const chance = require('chance').Chance();
+const request = require('supertest');
 const slugify = require('../../test/slugify');
 
 const { env: { adminKey } } = process;
@@ -18,6 +19,8 @@ describe('user', () => {
   };
   let doApiGet; let doApiPost; let
     doApiDelete;
+  let app;
+  let sqldb;
   let appKey;
   const userId = chance.guid();
   let apiKey = chance.guid();
@@ -29,6 +32,8 @@ describe('user', () => {
   let plugins;
   beforeAll(async () => {
     ({
+      app,
+      sqldb,
       doApiDelete,
       doApiGet,
       doApiPost,
@@ -162,6 +167,28 @@ describe('user', () => {
     });
     expect(returnValue.token).toEqual(token2);
   });
+  it('should return a preflight response for token endpoint', async () => {
+    const response = await request(app)
+      .options(`/${appName}/${userId}/token`)
+      .set('Origin', 'https://tcoutlook.tourconnect.dev')
+      .set('Access-Control-Request-Method', 'GET');
+    expect([200, 204]).toContain(response.statusCode);
+    expect(response.headers['access-control-allow-origin']).toBeTruthy();
+  });
+  it('should keep returning 404 for a missing token hint', async () => {
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const missingHint = chance.guid();
+    try {
+      const returnValue = await doApiGet({
+        url: `/${appName}/${userId}/${missingHint}/token`,
+        token: userKey,
+        expectStatusCode: 404,
+      });
+      expect(returnValue.message).toContain('User integration is not found');
+    } finally {
+      consoleErrorSpy.mockRestore();
+    }
+  });
   it('should be able to create an app setting', async () => {
     const returnValue = await doApiPost({
       url: `/settings/${appName}/${userId}`,
@@ -211,4 +238,92 @@ describe('user', () => {
       ]),
     );
   });
+  it('should return 422 when stored app token is corrupted', async () => {
+    const consoleWarnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const [originalRows] = await sqldb.query(
+      'SELECT id, appKey FROM UserAppKeys WHERE integrationId = :integrationId AND userId = :userId',
+      {
+        replacements: {
+          integrationId: appName,
+          userId,
+        },
+      },
+    );
+    await sqldb.query(
+      'UPDATE UserAppKeys SET appKey = :appKey WHERE integrationId = :integrationId AND userId = :userId',
+      {
+        replacements: {
+          appKey: 'corrupted-token-without-delimiter',
+          integrationId: appName,
+          userId,
+        },
+      },
+    );
+    try {
+      const returnValue = await doApiGet({
+        url: `/${appName}/${userId}/token`,
+        token: userKey,
+        expectStatusCode: 422,
+      });
+      expect(returnValue.message).toBe('Stored integration token is invalid. Please re-save credentials.');
+    } finally {
+      await Promise.all(originalRows.map(currentRow => sqldb.query(
+        'UPDATE UserAppKeys SET appKey = :appKey WHERE id = :id',
+        {
+          replacements: {
+            id: currentRow.id,
+            appKey: currentRow.appKey,
+          },
+        },
+      )));
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    }
+  });
+  it('should return 422 when stored app token is corrupted for hinted endpoint', async () => {
+    const consoleWarnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const [originalRows] = await sqldb.query(
+      'SELECT id, appKey FROM UserAppKeys WHERE integrationId = :integrationId AND userId = :userId AND hint = :hint',
+      {
+        replacements: {
+          integrationId: appName,
+          userId,
+          hint: apiKey2.split('-')[1],
+        },
+      },
+    );
+    await sqldb.query(
+      'UPDATE UserAppKeys SET appKey = :appKey WHERE integrationId = :integrationId AND userId = :userId AND hint = :hint',
+      {
+        replacements: {
+          appKey: 'corrupted-token-without-delimiter',
+          integrationId: appName,
+          userId,
+          hint: apiKey2.split('-')[1],
+        },
+      },
+    );
+    try {
+      const returnValue = await doApiGet({
+        url: `/${appName}/${userId}/${apiKey2.split('-')[1]}/token`,
+        token: userKey,
+        expectStatusCode: 422,
+      });
+      expect(returnValue.message).toBe('Stored integration token is invalid. Please re-save credentials.');
+    } finally {
+      await Promise.all(originalRows.map(currentRow => sqldb.query(
+        'UPDATE UserAppKeys SET appKey = :appKey WHERE id = :id',
+        {
+          replacements: {
+            id: currentRow.id,
+            appKey: currentRow.appKey,
+          },
+        },
+      )));
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    }
+  });
 });

package/controllers/app.js

@@ -488,20 +488,24 @@ const getAppToken = async (req, res, next) => {
       hint,
     },
   } = req;
-  // check if the user exists
-  const userRecord = await sqldb.User.findOne({ where: { userId } });
-  if (!userRecord) return next({ status: 404, message: 'User does not exists' });
-  const userAppKey = await sqldb.UserAppKey.findOne({
-    where: {
-      userId,
-      integrationId,
-      ...(hint ? { hint } : {}),
-    },
-  });
-  if (!userAppKey) {
-    return next({ status: 404, message: `User integratio is not found for ${integrationId}:${userId}:${hint}` });
+  try {
+    // check if the user exists
+    const userRecord = await sqldb.User.findOne({ where: { userId } });
+    if (!userRecord) return next({ status: 404, message: 'User does not exists' });
+    const userAppKey = await sqldb.UserAppKey.findOne({
+      where: {
+        userId,
+        integrationId,
+        ...(hint ? { hint } : {}),
+      },
+    });
+    if (!userAppKey) {
+      return next({ status: 404, message: `User integration is not found for ${integrationId}:${userId}:${hint}` });
+    }
+    return res.json({ token: await userAppKey.token });
+  } catch (err) {
+    return next(err);
   }
-  return res.json({ token: await userAppKey.token });
 };
 
 const createCronjob = async (req, res, next) => {

package/index.js

@@ -48,6 +48,7 @@ const rebuild = fn => obj =>
   Object.fromEntries(Object.entries(obj).flatMap(([k, v]) => fn(k, v)));
 
 const isNumber = value => !Number.isNaN(Number(value));
+const isCorruptedTokenError = err => R.pathOr(false, ['code'], err) === 'CORRUPTED_TOKEN';
 
 const axiosSafeRequest = R.pick(['headers', 'method', 'url', 'data']);
 const axiosSafeResponse = response => {
@@ -163,6 +164,7 @@ module.exports = async ({
     if (apiDocs) {
       app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(allSchema));
     }
+    app.options('*', middleware.CORS(), (_req, res) => res.sendStatus(204));
     app.use(
       middleware.metadata(),
       middleware.CORS(),
@@ -373,6 +375,17 @@ module.exports = async ({
     app.use(middleware.mock());
     // global error Handling
     app.use((err, req, res, next) => {
+      if (isCorruptedTokenError(err) && !process.env.JEST_WORKER_ID) {
+        console.warn('Invalid stored integration token', {
+          requestId: req.requestId,
+          integrationId: R.path(['context', 'integrationId'], err),
+          userId: R.path(['context', 'userId'], err),
+          hint: R.path(['context', 'hint'], err),
+          errorCode: R.path(['cause', 'code'], err),
+          errorName: R.path(['cause', 'name'], err),
+          message: R.path(['cause', 'message'], err),
+        });
+      }
       if (process.env.CONSOLE_ERRORS || process.env.JEST_WORKER_ID) {
         console.error(R.pathOr(err, ['response', 'data'], err));
       }

package/lib/corrupted-token-error.js

@@ -0,0 +1,22 @@
+const buildCorruptedTokenError = ({
+  integrationId,
+  userId,
+  hint,
+  cause,
+}) => {
+  const error = new Error(
+    'Stored integration token is invalid. Please re-save credentials.',
+  );
+  error.name = 'CorruptedTokenError';
+  error.code = 'CORRUPTED_TOKEN';
+  error.status = 422;
+  error.context = {
+    integrationId,
+    userId,
+    hint,
+  };
+  error.cause = cause;
+  return error;
+};
+
+module.exports = buildCorruptedTokenError;

package/models/userappkey.js

@@ -1,10 +1,9 @@
-const jwt = require('jsonwebtoken');
 const Sequelize = require('sequelize');
 const R = require('ramda');
 const { encrypt, decrypt } = require('../lib/security');
+const buildCorruptedTokenError = require('../lib/corrupted-token-error');
 const db = require('./db');
 
-const { env: { dbCryptoKey } } = process;
 const removeEmptyAttributes = obj => R.reject(R.anyPass([R.isEmpty, R.isNil]))(obj);
 
 const UserAppKey = db.define('UserAppKey', {
@@ -50,13 +49,27 @@ const UserAppKey = db.define('UserAppKey', {
   token: {
     type: Sequelize.VIRTUAL,
     async get() {
-      if (!this.getDataValue('appKey')) return {};
-      if (!decrypt(this.getDataValue('appKey'))) return {};
+      const encryptedAppKey = this.getDataValue('appKey');
+      if (!encryptedAppKey) return {};
+
+      let appKey;
+      try {
+        const decryptedAppKey = decrypt(encryptedAppKey);
+        if (!decryptedAppKey) return {};
+        appKey = JSON.parse(decryptedAppKey);
+      } catch (err) {
+        throw buildCorruptedTokenError({
+          integrationId: this.getDataValue('integrationId'),
+          userId: this.getDataValue('userId'),
+          hint: this.getDataValue('hint'),
+          cause: err,
+        });
+      }
+
       const sqldb = require('./index');
       const userIntegrationSettings = await sqldb.UserIntegrationSettings.findOne({
         where: { userId: this.getDataValue('userId'), integrationId: this.getDataValue('integrationId') },
       });
-      const appKey = JSON.parse(decrypt(this.getDataValue('appKey')));
       return {
         ...R.pathOr({}, ['settings'], userIntegrationSettings),
         ...removeEmptyAttributes(appKey),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ti2",
-  "version": "1.0.102",
+  "version": "1.0.104",
   "description": "Tourist Industry Exchange (TI2)",
   "main": "index.js",
   "scripts": {

package/test/plugin.js

@@ -718,12 +718,13 @@ class Plugin {
    * @param {string} args.payload.QB - 'Q' for quote, 'B' for booking
    * @param {string} args.payload.quoteName - Name of the booking/quote
    * @param {string} [args.payload.quoteId] - identifier of the booking/quote, if one is provided, we are expecting the service line to be inserted to an existing booking/quote
+   * @param {boolean} [args.payload.shellOnly] - Optional flag to create/update booking header only and skip service-line insertion
    * @param {string} [args.payload.lineId] - identifier of the service line in the booking/quote, if one is provided, we are expecting an existing service line to be updated
    * @param {string} [args.payload.rateId] - Rate identifier, we are sending 'Default' if no rates are provided by the check availability call
-   * @param {string} args.payload.optionId - Option identifier of the service line
-   * @param {string} args.payload.startDate - Start date always in (YYYY-MM-DD) format
+   * @param {string} args.payload.optionId - Option identifier of the service line (required unless shellOnly is true)
+   * @param {string} args.payload.startDate - Start date always in (YYYY-MM-DD) format (required unless shellOnly is true)
    * @param {string} [args.payload.reference] - Reference number from external system
-   * @param {Array<PaxConfig>} args.payload.paxConfigs - Passenger configurations
+   * @param {Array<PaxConfig>} args.payload.paxConfigs - Passenger configurations (required unless shellOnly is true)
    * @param {Array<Object>} [args.payload.extras] - Additional extras
    * @param {Extra} args.payload.extras.selectedExtra - Selected extra
    * @param {number} args.payload.extras.quantity - quantity

package/tutorials/itinerary-assist-plugin-dev.md

@@ -267,8 +267,9 @@ No, we don't have a specific test scenarios, but we recommend you to cover the f
   quoteName: String,
   rateId: String,           // Optional
   quoteId: String,          // Optional
-  optionId: String,
-  startDate: String,        // YYYY-MM-DD
+  shellOnly: Boolean,       // Optional. If true, create/update quote header only and skip service insertion
+  optionId: String,         // Required unless shellOnly is true
+  startDate: String,        // YYYY-MM-DD, required unless shellOnly is true
   reference: String,        // Optional
   paxConfigs: [{
     roomType: String,       // Optional
@@ -280,7 +281,7 @@ No, we don't have a specific test scenarios, but we recommend you to cover the f
       dob: String,            // Optional, YYYY-MM-DD
       personId: String        // Optional
     }]
-  }],
+  }],                       // Required unless shellOnly is true
   extras: [{                // Optional
     selectedExtra: {
       id: String