ti2 1.0.102 → 1.0.106

package/api.yml

@@ -451,6 +451,9 @@ components:
         id:
           type: string
           description: a quote Id to make a reservation for
+        shellOnly:
+          type: boolean
+          description: Optional itinerary-assist flag to create/update booking header only without adding a service line
     settingsBody:
       type: object
       required: true

package/controllers/__tests__/app.js

@@ -47,7 +47,7 @@ describe('app', () => {
     }));
     expect(appKey).toBeTruthy();
   });
-  it('should encode an airbitrary object', async () => {
+  it('should encode an arbitrary object', async () => {
     ({ value: encodedKey } = await doApiPut({
       url: `/app/encode/${appName}`,
       token: appKey,
@@ -96,7 +96,7 @@ describe('app', () => {
           cron: '0 9 * * *',
         });
     });
-    it.todo('if a new version of the plugin has a different set of scheduled tasks, they shoul dbe re-syncjed');
+    it.todo('if a new version of the plugin has a different set of scheduled tasks, they should be re-synced');
     let jobId;
     it('should be able to run a job', async () => {
       let status;
@@ -142,4 +142,49 @@ describe('app', () => {
       ]),
     );
   });
+
+  describe('token and settings merge', () => {
+    const hint = apiKey.split('-')[0];
+    const settingsOverrideEndpoint = 'https://settings-override.example.com';
+
+    it('getAppToken returns token with appKey payload (endpoint, apiKey)', async () => {
+      // No settings created yet – token is purely from appKey.
+      const body = await doApiGet({
+        url: `/${appName}/${userId}/${hint}/token`,
+        token: appKey,
+        payload: {},
+      });
+      expect(body.token).toEqual(expect.objectContaining({
+        endpoint: token.endpoint,
+        apiKey: token.apiKey,
+      }));
+    });
+
+    it('createAppSettings updates user settings for the app', async () => {
+      await doApiPost({
+        url: `/settings/${appName}/${userId}`,
+        token: adminKey,
+        payload: {
+          settings: {
+            endpoint: settingsOverrideEndpoint,
+            onlyInSettings: true,
+          },
+        },
+      });
+    });
+
+    it('getAppToken returns merged token with settings overriding appKey for same keys', async () => {
+      const body = await doApiGet({
+        url: `/${appName}/${userId}/${hint}/token`,
+        token: appKey,
+        payload: {},
+      });
+      // Settings override: endpoint from appKey is overridden by UserIntegrationSettings.settings
+      expect(body.token.endpoint).toBe(settingsOverrideEndpoint);
+      // Settings add new keys
+      expect(body.token.onlyInSettings).toBe(true);
+      // appKey-only keys still present
+      expect(body.token.apiKey).toBe(token.apiKey);
+    });
+  });
 });

package/controllers/__tests__/bookings.js

@@ -32,6 +32,7 @@ describe('user: bookings controller', () => {
   let userToken;
   let appSetup;
   let createUserToken;
+  let sqldb;
   
   beforeAll(async () => {
     ({
@@ -41,6 +42,7 @@ describe('user: bookings controller', () => {
       plugins,
       appSetup,
       createUserToken,
+      sqldb,
     } = await testUtils({
       plugins: [newApp.name],
     }));
@@ -168,6 +170,56 @@ describe('user: bookings controller', () => {
     expect(plugins[0].createBooking.mock.calls[0][0].payload).toEqual(payload);
     expect(plugins[0].createBooking.mock.calls[0][0].token).toEqual(token);
   });
+  it('should return 422 when stored app token is corrupted on bookings endpoint', async () => {
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const [originalRows] = await sqldb.query(
+      'SELECT id, appKey FROM UserAppKeys WHERE integrationId = :integrationId AND userId = :userId AND hint = :hint',
+      {
+        replacements: {
+          integrationId: appKey,
+          userId,
+          hint: 'testingToken',
+        },
+      },
+    );
+    await sqldb.query(
+      'UPDATE UserAppKeys SET appKey = :appKey WHERE integrationId = :integrationId AND userId = :userId AND hint = :hint',
+      {
+        replacements: {
+          appKey: 'corrupted-token-without-delimiter',
+          integrationId: appKey,
+          userId,
+          hint: 'testingToken',
+        },
+      },
+    );
+    try {
+      const returnValue = await doApiPost({
+        url: `/bookings/${appKey}/${userId}/testingToken/search`,
+        token: userToken,
+        payload: {
+          bookingId: '',
+          supplierBookingId: '',
+          name: '',
+        },
+        expectStatusCode: 422,
+      });
+      expect(returnValue.message).toBe(
+        'Stored integration token is invalid. Please re-save credentials.',
+      );
+    } finally {
+      await Promise.all(originalRows.map(currentRow => sqldb.query(
+        'UPDATE UserAppKeys SET appKey = :appKey WHERE id = :id',
+        {
+          replacements: {
+            id: currentRow.id,
+            appKey: currentRow.appKey,
+          },
+        },
+      )));
+      consoleErrorSpy.mockRestore();
+    }
+  });
 
   describe('product search with empty cache', () => {
     const productSearchCacheKey = hash({

package/controllers/__tests__/user.js

@@ -2,6 +2,7 @@
 
 const R = require('ramda');
 const chance = require('chance').Chance();
+const request = require('supertest');
 const slugify = require('../../test/slugify');
 
 const { env: { adminKey } } = process;
@@ -18,6 +19,8 @@ describe('user', () => {
   };
   let doApiGet; let doApiPost; let
     doApiDelete;
+  let app;
+  let sqldb;
   let appKey;
   const userId = chance.guid();
   let apiKey = chance.guid();
@@ -29,6 +32,8 @@ describe('user', () => {
   let plugins;
   beforeAll(async () => {
     ({
+      app,
+      sqldb,
       doApiDelete,
       doApiGet,
       doApiPost,
@@ -162,6 +167,28 @@ describe('user', () => {
     });
     expect(returnValue.token).toEqual(token2);
   });
+  it('should return a preflight response for token endpoint', async () => {
+    const response = await request(app)
+      .options(`/${appName}/${userId}/token`)
+      .set('Origin', 'https://tcoutlook.tourconnect.dev')
+      .set('Access-Control-Request-Method', 'GET');
+    expect([200, 204]).toContain(response.statusCode);
+    expect(response.headers['access-control-allow-origin']).toBeTruthy();
+  });
+  it('should keep returning 404 for a missing token hint', async () => {
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const missingHint = chance.guid();
+    try {
+      const returnValue = await doApiGet({
+        url: `/${appName}/${userId}/${missingHint}/token`,
+        token: userKey,
+        expectStatusCode: 404,
+      });
+      expect(returnValue.message).toContain('User integration is not found');
+    } finally {
+      consoleErrorSpy.mockRestore();
+    }
+  });
   it('should be able to create an app setting', async () => {
     const returnValue = await doApiPost({
       url: `/settings/${appName}/${userId}`,
@@ -211,4 +238,92 @@ describe('user', () => {
       ]),
     );
   });
+  it('should return 422 when stored app token is corrupted', async () => {
+    const consoleWarnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const [originalRows] = await sqldb.query(
+      'SELECT id, appKey FROM UserAppKeys WHERE integrationId = :integrationId AND userId = :userId',
+      {
+        replacements: {
+          integrationId: appName,
+          userId,
+        },
+      },
+    );
+    await sqldb.query(
+      'UPDATE UserAppKeys SET appKey = :appKey WHERE integrationId = :integrationId AND userId = :userId',
+      {
+        replacements: {
+          appKey: 'corrupted-token-without-delimiter',
+          integrationId: appName,
+          userId,
+        },
+      },
+    );
+    try {
+      const returnValue = await doApiGet({
+        url: `/${appName}/${userId}/token`,
+        token: userKey,
+        expectStatusCode: 422,
+      });
+      expect(returnValue.message).toBe('Stored integration token is invalid. Please re-save credentials.');
+    } finally {
+      await Promise.all(originalRows.map(currentRow => sqldb.query(
+        'UPDATE UserAppKeys SET appKey = :appKey WHERE id = :id',
+        {
+          replacements: {
+            id: currentRow.id,
+            appKey: currentRow.appKey,
+          },
+        },
+      )));
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    }
+  });
+  it('should return 422 when stored app token is corrupted for hinted endpoint', async () => {
+    const consoleWarnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
+    const [originalRows] = await sqldb.query(
+      'SELECT id, appKey FROM UserAppKeys WHERE integrationId = :integrationId AND userId = :userId AND hint = :hint',
+      {
+        replacements: {
+          integrationId: appName,
+          userId,
+          hint: apiKey2.split('-')[1],
+        },
+      },
+    );
+    await sqldb.query(
+      'UPDATE UserAppKeys SET appKey = :appKey WHERE integrationId = :integrationId AND userId = :userId AND hint = :hint',
+      {
+        replacements: {
+          appKey: 'corrupted-token-without-delimiter',
+          integrationId: appName,
+          userId,
+          hint: apiKey2.split('-')[1],
+        },
+      },
+    );
+    try {
+      const returnValue = await doApiGet({
+        url: `/${appName}/${userId}/${apiKey2.split('-')[1]}/token`,
+        token: userKey,
+        expectStatusCode: 422,
+      });
+      expect(returnValue.message).toBe('Stored integration token is invalid. Please re-save credentials.');
+    } finally {
+      await Promise.all(originalRows.map(currentRow => sqldb.query(
+        'UPDATE UserAppKeys SET appKey = :appKey WHERE id = :id',
+        {
+          replacements: {
+            id: currentRow.id,
+            appKey: currentRow.appKey,
+          },
+        },
+      )));
+      consoleWarnSpy.mockRestore();
+      consoleErrorSpy.mockRestore();
+    }
+  });
 });

package/controllers/app.js

@@ -488,20 +488,24 @@ const getAppToken = async (req, res, next) => {
       hint,
     },
   } = req;
-  // check if the user exists
-  const userRecord = await sqldb.User.findOne({ where: { userId } });
-  if (!userRecord) return next({ status: 404, message: 'User does not exists' });
-  const userAppKey = await sqldb.UserAppKey.findOne({
-    where: {
-      userId,
-      integrationId,
-      ...(hint ? { hint } : {}),
-    },
-  });
-  if (!userAppKey) {
-    return next({ status: 404, message: `User integratio is not found for ${integrationId}:${userId}:${hint}` });
+  try {
+    // check if the user exists
+    const userRecord = await sqldb.User.findOne({ where: { userId } });
+    if (!userRecord) return next({ status: 404, message: 'User does not exists' });
+    const userAppKey = await sqldb.UserAppKey.findOne({
+      where: {
+        userId,
+        integrationId,
+        ...(hint ? { hint } : {}),
+      },
+    });
+    if (!userAppKey) {
+      return next({ status: 404, message: `User integration is not found for ${integrationId}:${userId}:${hint}` });
+    }
+    return res.json({ token: await userAppKey.token });
+  } catch (err) {
+    return next(err);
   }
-  return res.json({ token: await userAppKey.token });
 };
 
 const createCronjob = async (req, res, next) => {

package/index.js

@@ -48,6 +48,7 @@ const rebuild = fn => obj =>
   Object.fromEntries(Object.entries(obj).flatMap(([k, v]) => fn(k, v)));
 
 const isNumber = value => !Number.isNaN(Number(value));
+const isCorruptedTokenError = err => R.pathOr(false, ['code'], err) === 'CORRUPTED_TOKEN';
 
 const axiosSafeRequest = R.pick(['headers', 'method', 'url', 'data']);
 const axiosSafeResponse = response => {
@@ -163,6 +164,7 @@ module.exports = async ({
     if (apiDocs) {
       app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(allSchema));
     }
+    app.options('*', middleware.CORS(), (_req, res) => res.sendStatus(204));
     app.use(
       middleware.metadata(),
       middleware.CORS(),
@@ -255,7 +257,7 @@ module.exports = async ({
             requestId: req.requestId,
             err: errMsg,
             ...(err.request ? { request: axiosSafeRequest(err.request) } : {}),
-            ...(err.response ? { response: axiosSafeRequest(err.response) } : {}),
+            ...(err.response ? { response: axiosSafeResponse(err.response) } : {}),
           });
         }
         return Promise.reject(errMsg);
@@ -373,6 +375,17 @@ module.exports = async ({
     app.use(middleware.mock());
     // global error Handling
     app.use((err, req, res, next) => {
+      if (isCorruptedTokenError(err) && !process.env.JEST_WORKER_ID) {
+        console.warn('Invalid stored integration token', {
+          requestId: req.requestId,
+          integrationId: R.path(['context', 'integrationId'], err),
+          userId: R.path(['context', 'userId'], err),
+          hint: R.path(['context', 'hint'], err),
+          errorCode: R.path(['cause', 'code'], err),
+          errorName: R.path(['cause', 'name'], err),
+          message: R.path(['cause', 'message'], err),
+        });
+      }
       if (process.env.CONSOLE_ERRORS || process.env.JEST_WORKER_ID) {
         console.error(R.pathOr(err, ['response', 'data'], err));
       }

package/lib/corrupted-token-error.js

@@ -0,0 +1,22 @@
+const buildCorruptedTokenError = ({
+  integrationId,
+  userId,
+  hint,
+  cause,
+}) => {
+  const error = new Error(
+    'Stored integration token is invalid. Please re-save credentials.',
+  );
+  error.name = 'CorruptedTokenError';
+  error.code = 'CORRUPTED_TOKEN';
+  error.status = 422;
+  error.context = {
+    integrationId,
+    userId,
+    hint,
+  };
+  error.cause = cause;
+  return error;
+};
+
+module.exports = buildCorruptedTokenError;

package/models/__tests__/userappkey.js

@@ -0,0 +1,35 @@
+/* globals describe it expect */
+const { UserAppKey } = require('../index');
+
+describe('UserAppKey.mergeTokenPayload', () => {
+  it('uses appKey as base, then settings override same keys, then configuration', () => {
+    const appKey = { endpoint: 'https://old.example.com', apiKey: 'secret' };
+    const settings = { endpoint: 'https://updated.example.com', onlyInSettings: true };
+    const configuration = { foo: 'bar' };
+
+    const result = UserAppKey.mergeTokenPayload(appKey, settings, configuration);
+
+    expect(result.endpoint).toBe('https://updated.example.com');
+    expect(result.onlyInSettings).toBe(true);
+    expect(result.apiKey).toBe('secret');
+    expect(result.configuration).toEqual({ foo: 'bar' });
+  });
+
+  it('returns only appKey when settings and configuration are empty', () => {
+    const appKey = { access_token: 'x', refresh_token: 'y' };
+    const result = UserAppKey.mergeTokenPayload(appKey, {}, null);
+    expect(result).toEqual({ access_token: 'x', refresh_token: 'y' });
+  });
+
+  it('strips empty and nil values from appKey', () => {
+    const appKey = { a: 1, b: '', c: null, d: [] };
+    const result = UserAppKey.mergeTokenPayload(appKey, {}, null);
+    expect(result).toEqual({ a: 1 });
+  });
+
+  it('handles null/undefined appKey or settings', () => {
+    expect(UserAppKey.mergeTokenPayload(null, { x: 1 }, null)).toEqual({ x: 1 });
+    expect(UserAppKey.mergeTokenPayload({ a: 1 }, null, null)).toEqual({ a: 1 });
+    expect(UserAppKey.mergeTokenPayload({}, {}, undefined)).toEqual({});
+  });
+});

package/models/userappkey.js

@@ -1,10 +1,10 @@
-const jwt = require('jsonwebtoken');
 const Sequelize = require('sequelize');
 const R = require('ramda');
+const jwt = require('jsonwebtoken');
 const { encrypt, decrypt } = require('../lib/security');
+const buildCorruptedTokenError = require('../lib/corrupted-token-error');
 const db = require('./db');
 
-const { env: { dbCryptoKey } } = process;
 const removeEmptyAttributes = obj => R.reject(R.anyPass([R.isEmpty, R.isNil]))(obj);
 
 const UserAppKey = db.define('UserAppKey', {
@@ -50,18 +50,56 @@ const UserAppKey = db.define('UserAppKey', {
   token: {
     type: Sequelize.VIRTUAL,
     async get() {
-      if (!this.getDataValue('appKey')) return {};
-      if (!decrypt(this.getDataValue('appKey'))) return {};
+      const encryptedAppKey = this.getDataValue('appKey');
+      if (!encryptedAppKey) return {};
+
+      let appKey;
+      if (encryptedAppKey.includes('%')) {
+        try {
+          const decryptedAppKey = decrypt(encryptedAppKey);
+          if (!decryptedAppKey) return {};
+          appKey = JSON.parse(decryptedAppKey);
+        } catch (err) {
+          throw buildCorruptedTokenError({
+            integrationId: this.getDataValue('integrationId'),
+            userId: this.getDataValue('userId'),
+            hint: this.getDataValue('hint'),
+            cause: err,
+          });
+        }
+      } else {
+        // Legacy unencrypted JWT stored in appKey – decode payload as token object
+        try {
+          const decodedAppKey = jwt.decode(encryptedAppKey);
+          if (!decodedAppKey) {
+            throw buildCorruptedTokenError({
+              integrationId: this.getDataValue('integrationId'),
+              userId: this.getDataValue('userId'),
+              hint: this.getDataValue('hint'),
+              cause: new Error('Invalid or corrupted JWT'),
+            });
+          }
+          appKey = decodedAppKey;
+        } catch (err) {
+          if (err.name === 'CorruptedTokenError') throw err;
+          throw buildCorruptedTokenError({
+            integrationId: this.getDataValue('integrationId'),
+            userId: this.getDataValue('userId'),
+            hint: this.getDataValue('hint'),
+            cause: err,
+          });
+        }
+      }
+
       const sqldb = require('./index');
       const userIntegrationSettings = await sqldb.UserIntegrationSettings.findOne({
         where: { userId: this.getDataValue('userId'), integrationId: this.getDataValue('integrationId') },
       });
-      const appKey = JSON.parse(decrypt(this.getDataValue('appKey')));
-      return {
-        ...R.pathOr({}, ['settings'], userIntegrationSettings),
-        ...removeEmptyAttributes(appKey),
-        ...(this.getDataValue('configuration') ? { configuration: this.getDataValue('configuration') } : {}),
-      };
+      return UserAppKey.mergeTokenPayload(
+        appKey,
+        R.pathOr({}, ['settings'], userIntegrationSettings),
+        this.getDataValue('configuration'),
+      );
     },
   },
   configuration: {
@@ -69,6 +107,19 @@ const UserAppKey = db.define('UserAppKey', {
     allowNull: true,
   },
 }, {});
+
+/** Merge order: appKey base, then settings (so updated UserIntegrationSettings are used), then configuration. */
+UserAppKey.mergeTokenPayload = (appKey, settings, configuration) => {
+  const base = appKey ? removeEmptyAttributes(appKey) : {};
+  const settingsObj = settings || {};
+  const configPart = configuration != null ? { configuration } : {};
+  return {
+    ...base,
+    ...settingsObj,
+    ...configPart,
+  };
+};
+
 UserAppKey.associate = models => {
   UserAppKey.belongsTo(models.User, {
     foreignKey: 'userId',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ti2",
-  "version": "1.0.102",
+  "version": "1.0.106",
   "description": "Tourist Industry Exchange (TI2)",
   "main": "index.js",
   "scripts": {

package/test/plugin.js

@@ -718,12 +718,13 @@ class Plugin {
    * @param {string} args.payload.QB - 'Q' for quote, 'B' for booking
    * @param {string} args.payload.quoteName - Name of the booking/quote
    * @param {string} [args.payload.quoteId] - identifier of the booking/quote, if one is provided, we are expecting the service line to be inserted to an existing booking/quote
+   * @param {boolean} [args.payload.shellOnly] - Optional flag to create/update booking header only and skip service-line insertion
    * @param {string} [args.payload.lineId] - identifier of the service line in the booking/quote, if one is provided, we are expecting an existing service line to be updated
    * @param {string} [args.payload.rateId] - Rate identifier, we are sending 'Default' if no rates are provided by the check availability call
-   * @param {string} args.payload.optionId - Option identifier of the service line
-   * @param {string} args.payload.startDate - Start date always in (YYYY-MM-DD) format
+   * @param {string} args.payload.optionId - Option identifier of the service line (required unless shellOnly is true)
+   * @param {string} args.payload.startDate - Start date always in (YYYY-MM-DD) format (required unless shellOnly is true)
    * @param {string} [args.payload.reference] - Reference number from external system
-   * @param {Array<PaxConfig>} args.payload.paxConfigs - Passenger configurations
+   * @param {Array<PaxConfig>} args.payload.paxConfigs - Passenger configurations (required unless shellOnly is true)
    * @param {Array<Object>} [args.payload.extras] - Additional extras
    * @param {Extra} args.payload.extras.selectedExtra - Selected extra
    * @param {number} args.payload.extras.quantity - quantity

package/tutorials/itinerary-assist-plugin-dev.md

@@ -267,8 +267,9 @@ No, we don't have a specific test scenarios, but we recommend you to cover the f
   quoteName: String,
   rateId: String,           // Optional
   quoteId: String,          // Optional
-  optionId: String,
-  startDate: String,        // YYYY-MM-DD
+  shellOnly: Boolean,       // Optional. If true, create/update quote header only and skip service insertion
+  optionId: String,         // Required unless shellOnly is true
+  startDate: String,        // YYYY-MM-DD, required unless shellOnly is true
   reference: String,        // Optional
   paxConfigs: [{
     roomType: String,       // Optional
@@ -280,7 +281,7 @@ No, we don't have a specific test scenarios, but we recommend you to cover the f
       dob: String,            // Optional, YYYY-MM-DD
       personId: String        // Optional
     }]
-  }],
+  }],                       // Required unless shellOnly is true
   extras: [{                // Optional
     selectedExtra: {
       id: String