ti2 1.0.104 → 1.0.106

package/controllers/__tests__/app.js

@@ -47,7 +47,7 @@ describe('app', () => {
     }));
     expect(appKey).toBeTruthy();
   });
-  it('should encode an airbitrary object', async () => {
+  it('should encode an arbitrary object', async () => {
     ({ value: encodedKey } = await doApiPut({
       url: `/app/encode/${appName}`,
       token: appKey,
@@ -96,7 +96,7 @@ describe('app', () => {
           cron: '0 9 * * *',
         });
     });
-    it.todo('if a new version of the plugin has a different set of scheduled tasks, they shoul dbe re-syncjed');
+    it.todo('if a new version of the plugin has a different set of scheduled tasks, they should be re-synced');
     let jobId;
     it('should be able to run a job', async () => {
       let status;
@@ -142,4 +142,49 @@ describe('app', () => {
       ]),
     );
   });
+
+  describe('token and settings merge', () => {
+    const hint = apiKey.split('-')[0];
+    const settingsOverrideEndpoint = 'https://settings-override.example.com';
+
+    it('getAppToken returns token with appKey payload (endpoint, apiKey)', async () => {
+      // No settings created yet – token is purely from appKey.
+      const body = await doApiGet({
+        url: `/${appName}/${userId}/${hint}/token`,
+        token: appKey,
+        payload: {},
+      });
+      expect(body.token).toEqual(expect.objectContaining({
+        endpoint: token.endpoint,
+        apiKey: token.apiKey,
+      }));
+    });
+
+    it('createAppSettings updates user settings for the app', async () => {
+      await doApiPost({
+        url: `/settings/${appName}/${userId}`,
+        token: adminKey,
+        payload: {
+          settings: {
+            endpoint: settingsOverrideEndpoint,
+            onlyInSettings: true,
+          },
+        },
+      });
+    });
+
+    it('getAppToken returns merged token with settings overriding appKey for same keys', async () => {
+      const body = await doApiGet({
+        url: `/${appName}/${userId}/${hint}/token`,
+        token: appKey,
+        payload: {},
+      });
+      // Settings override: endpoint from appKey is overridden by UserIntegrationSettings.settings
+      expect(body.token.endpoint).toBe(settingsOverrideEndpoint);
+      // Settings add new keys
+      expect(body.token.onlyInSettings).toBe(true);
+      // appKey-only keys still present
+      expect(body.token.apiKey).toBe(token.apiKey);
+    });
+  });
 });

package/index.js

@@ -257,7 +257,7 @@ module.exports = async ({
             requestId: req.requestId,
             err: errMsg,
             ...(err.request ? { request: axiosSafeRequest(err.request) } : {}),
-            ...(err.response ? { response: axiosSafeRequest(err.response) } : {}),
+            ...(err.response ? { response: axiosSafeResponse(err.response) } : {}),
           });
         }
         return Promise.reject(errMsg);

package/models/__tests__/userappkey.js

@@ -0,0 +1,35 @@
+/* globals describe it expect */
+const { UserAppKey } = require('../index');
+
+describe('UserAppKey.mergeTokenPayload', () => {
+  it('uses appKey as base, then settings override same keys, then configuration', () => {
+    const appKey = { endpoint: 'https://old.example.com', apiKey: 'secret' };
+    const settings = { endpoint: 'https://updated.example.com', onlyInSettings: true };
+    const configuration = { foo: 'bar' };
+
+    const result = UserAppKey.mergeTokenPayload(appKey, settings, configuration);
+
+    expect(result.endpoint).toBe('https://updated.example.com');
+    expect(result.onlyInSettings).toBe(true);
+    expect(result.apiKey).toBe('secret');
+    expect(result.configuration).toEqual({ foo: 'bar' });
+  });
+
+  it('returns only appKey when settings and configuration are empty', () => {
+    const appKey = { access_token: 'x', refresh_token: 'y' };
+    const result = UserAppKey.mergeTokenPayload(appKey, {}, null);
+    expect(result).toEqual({ access_token: 'x', refresh_token: 'y' });
+  });
+
+  it('strips empty and nil values from appKey', () => {
+    const appKey = { a: 1, b: '', c: null, d: [] };
+    const result = UserAppKey.mergeTokenPayload(appKey, {}, null);
+    expect(result).toEqual({ a: 1 });
+  });
+
+  it('handles null/undefined appKey or settings', () => {
+    expect(UserAppKey.mergeTokenPayload(null, { x: 1 }, null)).toEqual({ x: 1 });
+    expect(UserAppKey.mergeTokenPayload({ a: 1 }, null, null)).toEqual({ a: 1 });
+    expect(UserAppKey.mergeTokenPayload({}, {}, undefined)).toEqual({});
+  });
+});

package/models/userappkey.js

@@ -1,5 +1,6 @@
 const Sequelize = require('sequelize');
 const R = require('ramda');
+const jwt = require('jsonwebtoken');
 const { encrypt, decrypt } = require('../lib/security');
 const buildCorruptedTokenError = require('../lib/corrupted-token-error');
 const db = require('./db');
@@ -53,28 +54,52 @@ const UserAppKey = db.define('UserAppKey', {
       if (!encryptedAppKey) return {};
 
       let appKey;
-      try {
-        const decryptedAppKey = decrypt(encryptedAppKey);
-        if (!decryptedAppKey) return {};
-        appKey = JSON.parse(decryptedAppKey);
-      } catch (err) {
-        throw buildCorruptedTokenError({
-          integrationId: this.getDataValue('integrationId'),
-          userId: this.getDataValue('userId'),
-          hint: this.getDataValue('hint'),
-          cause: err,
-        });
+      if (encryptedAppKey.includes('%')) {
+        try {
+          const decryptedAppKey = decrypt(encryptedAppKey);
+          if (!decryptedAppKey) return {};
+          appKey = JSON.parse(decryptedAppKey);
+        } catch (err) {
+          throw buildCorruptedTokenError({
+            integrationId: this.getDataValue('integrationId'),
+            userId: this.getDataValue('userId'),
+            hint: this.getDataValue('hint'),
+            cause: err,
+          });
+        }
+      } else {
+        // Legacy unencrypted JWT stored in appKey – decode payload as token object
+        try {
+          const decodedAppKey = jwt.decode(encryptedAppKey);
+          if (!decodedAppKey) {
+            throw buildCorruptedTokenError({
+              integrationId: this.getDataValue('integrationId'),
+              userId: this.getDataValue('userId'),
+              hint: this.getDataValue('hint'),
+              cause: new Error('Invalid or corrupted JWT'),
+            });
+          }
+          appKey = decodedAppKey;
+        } catch (err) {
+          if (err.name === 'CorruptedTokenError') throw err;
+          throw buildCorruptedTokenError({
+            integrationId: this.getDataValue('integrationId'),
+            userId: this.getDataValue('userId'),
+            hint: this.getDataValue('hint'),
+            cause: err,
+          });
+        }
       }
 
       const sqldb = require('./index');
       const userIntegrationSettings = await sqldb.UserIntegrationSettings.findOne({
         where: { userId: this.getDataValue('userId'), integrationId: this.getDataValue('integrationId') },
       });
-      return {
-        ...R.pathOr({}, ['settings'], userIntegrationSettings),
-        ...removeEmptyAttributes(appKey),
-        ...(this.getDataValue('configuration') ? { configuration: this.getDataValue('configuration') } : {}),
-      };
+      return UserAppKey.mergeTokenPayload(
+        appKey,
+        R.pathOr({}, ['settings'], userIntegrationSettings),
+        this.getDataValue('configuration'),
+      );
     },
   },
   configuration: {
@@ -82,6 +107,19 @@ const UserAppKey = db.define('UserAppKey', {
     allowNull: true,
   },
 }, {});
+
+/** Merge order: appKey base, then settings (so updated UserIntegrationSettings are used), then configuration. */
+UserAppKey.mergeTokenPayload = (appKey, settings, configuration) => {
+  const base = appKey ? removeEmptyAttributes(appKey) : {};
+  const settingsObj = settings || {};
+  const configPart = configuration != null ? { configuration } : {};
+  return {
+    ...base,
+    ...settingsObj,
+    ...configPart,
+  };
+};
+
 UserAppKey.associate = models => {
   UserAppKey.belongsTo(models.User, {
     foreignKey: 'userId',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ti2",
-  "version": "1.0.104",
+  "version": "1.0.106",
   "description": "Tourist Industry Exchange (TI2)",
   "main": "index.js",
   "scripts": {