ti2 1.0.120 → 1.0.122

package/api.yml

@@ -101,6 +101,17 @@ components:
       properties:
         value:
           type: string
+    CreateAppTokenResponse:
+      type: object
+      required:
+        - value
+        - isFirstIntegration
+      properties:
+        value:
+          type: string
+        isFirstIntegration:
+          type: boolean
+          description: True only when this transaction created the user's first integration credential.
     Status:
       type: object
       properties:
@@ -422,6 +433,15 @@ components:
           required: false
           description: Product Name wildcard match
           example: '*bus*'
+        omitServiceCodes:
+          required: false
+          description: Service codes to omit from the product catalog. When the integration has productSearchOmitServiceCodes, that list is used instead.
+          example: ['AC', 'SM']
+          oneOf:
+            - type: string
+            - type: array
+              items:
+                type: string
         credentials:
           required: false
           $ref: '#/components/schemas/integrationCredentials'
@@ -862,7 +882,7 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/Message'
+                $ref: '#/components/schemas/CreateAppTokenResponse'
     delete:
       tags:
         - app

package/controllers/README.md

@@ -7,7 +7,8 @@ The `$bookingsProductSearch` function in `controllers/bookings.js` implements a
 1.  **Initialization**:
     *   Retrieves user, application (`appKey`), and token details (including `hint`).
     *   Determines the specific plugin function to call for product search (e.g., `searchProducts` or `searchProductsForItinerary`).
-    *   Calculates a `cacheKey` based on `userId`, `hint`, and a static `operationId` ('bookingsProductSearch').
+    *   Injects the integration's configured `productSearchOmitServiceCodes` into the plugin payload so every caller for that token omits the same service codes. When the setting is empty, the request body is unchanged.
+    *   Calculates a `cacheKey` based on `userId`, `hint`, and a static `operationId` (`bookingsProductSearch`). Changing the omit setting does not change the key; clear that integration's product-search cache and resync.
     *   Defines two distinct lock keys derived from this `cacheKey`:
         *   `pluginExecutionLockKey` (resolves to `${cacheKey}:lock`): Used to serialize direct calls to the plugin.
         *   `jobQueueLockKey` (resolves to `${cacheKey}:jobLock`): Used to prevent multiple submissions of background refresh jobs.

package/controllers/__tests__/bookings-searchProducts.js

@@ -271,6 +271,112 @@ describe('user: bookings controller - searchProducts', () => {
 
       });
     });
+    describe('configured productSearchOmitServiceCodes', () => {
+      const configuredOmitHint = 'configured-product-omit-service-codes';
+      let cacheKey;
+
+      beforeAll(async () => {
+        await globalUtils.appSetup({
+          appName: testAppName,
+          userId: testUserId,
+          tokenHint: configuredOmitHint,
+          token: {
+            endpoint: 'https://api.travelgatex.com/configured-omit',
+            apiKey: chance.guid(),
+            client: 'tourconnect-configured-omit',
+            productSearchOmitServiceCodes: ' sm, AC, ac ',
+          },
+        });
+        cacheKey = hash({
+          userId: testUserId,
+          hint: configuredOmitHint,
+          operationId: 'bookingsProductSearch',
+        });
+      });
+
+      beforeEach(async () => {
+        await Promise.all([
+          cache.drop({ pluginName: testAppName, key: cacheKey }),
+          cache.drop({ pluginName: testAppName, key: `${cacheKey}:lastUpdated` }),
+          cache.drop({ pluginName: testAppName, key: `${cacheKey}:lock` }),
+          cache.drop({ pluginName: testAppName, key: `${cacheKey}:jobLock` }),
+        ]);
+      });
+
+      it('sends configured omissions when the caller omits the field', async () => {
+        await doApiPost({
+          url: `/products/${testAppName}/${testUserId}/${configuredOmitHint}/search`,
+          token: userToken,
+          payload: {},
+        });
+
+        expect(travelgatePlugin.searchProducts).toHaveBeenCalledTimes(1);
+        expect(
+          travelgatePlugin.searchProducts.mock.calls[0][0].payload.omitServiceCodes,
+        ).toEqual(['AC', 'SM']);
+        expect(await cache.get({ pluginName: testAppName, key: cacheKey })).toBeTruthy();
+      });
+
+      it('keeps configured omissions during an empty-scope force refresh', async () => {
+        await doApiPost({
+          url: `/products/${testAppName}/${testUserId}/${configuredOmitHint}/search`,
+          token: userToken,
+          payload: { forceRefresh: true, omitServiceCodes: [] },
+        });
+
+        expect(travelgatePlugin.searchProducts).toHaveBeenCalledTimes(1);
+        expect(travelgatePlugin.searchProducts.mock.calls[0][0].payload).toEqual({
+          forceRefresh: true,
+          omitServiceCodes: ['AC', 'SM'],
+        });
+      });
+
+      it('ignores extra request omit codes once the integration is configured', async () => {
+        await doApiPost({
+          url: `/products/${testAppName}/${testUserId}/${configuredOmitHint}/search`,
+          token: userToken,
+          payload: { omitServiceCodes: ['TR'] },
+        });
+
+        expect(
+          travelgatePlugin.searchProducts.mock.calls[0][0].payload.omitServiceCodes,
+        ).toEqual(['AC', 'SM']);
+      });
+
+      it('preserves configured omissions in stale background refreshes', async () => {
+        await cache.save({
+          pluginName: testAppName,
+          key: cacheKey,
+          value: { products: [{ productId: 'stale-product' }] },
+          ttl: 60,
+        });
+        await cache.save({
+          pluginName: testAppName,
+          key: `${cacheKey}:lastUpdated`,
+          value: 1,
+          ttl: 60,
+        });
+
+        const result = await doApiPost({
+          url: `/products/${testAppName}/${testUserId}/${configuredOmitHint}/search`,
+          token: userToken,
+          payload: {},
+        });
+
+        expect(result.products).toEqual([{ productId: 'stale-product' }]);
+        expect(travelgatePlugin.searchProducts).not.toHaveBeenCalled();
+        expect(addJob).toHaveBeenCalledTimes(1);
+        expect(addJob.mock.calls[0][0].payload.payload).toEqual({
+          forceRefresh: false,
+          omitServiceCodes: ['AC', 'SM'],
+        });
+        expect(addJob.mock.calls[0][0].postProcess.args).toEqual({
+          appKey: testAppName,
+          userId: testUserId,
+          hint: configuredOmitHint,
+        });
+      });
+    });
     describe('cache TTR and lock mechanism', () => {
       const ttrTestHint = 'ttr-test'; // This hint is for UserAppKey within 'travelgate' appName
       const shortTTRToken = {

package/controllers/__tests__/user.js

@@ -20,7 +20,7 @@ describe('user', () => {
   let doApiGet; let doApiPost; let
     doApiDelete;
   let app;
-  let sqldb;
+  let db;
   let appKey;
   const userId = chance.guid();
   let apiKey = chance.guid();
@@ -33,7 +33,7 @@ describe('user', () => {
   beforeAll(async () => {
     ({
       app,
-      sqldb,
+      sqldb: db,
       doApiDelete,
       doApiGet,
       doApiPost,
@@ -41,6 +41,7 @@ describe('user', () => {
     } = await testUtils({
       plugins: [appName],
     }));
+    await db.models.UserAppKey.destroy({ where: { userId } });
     // create an App
     ({ value: appKey } = await doApiPost({
       url: '/app',
@@ -117,7 +118,7 @@ describe('user', () => {
     // set up new token
     apiKey = chance.guid();
     token.apiKey = apiKey;
-    await doApiPost({
+    const createResult = await doApiPost({
       url: `/${appName}/${userId}`,
       token: userKey,
       payload: {
@@ -125,6 +126,7 @@ describe('user', () => {
         token,
       },
     });
+    expect(createResult.isFirstIntegration).toBe(true);
     // make sure the app token is there
     const { userAppKeys } = await doApiGet({
       url: `/user/${userId}/apps`,
@@ -140,11 +142,117 @@ describe('user', () => {
       ]),
     );
   });
+  it('reports post-save cron setup failure while preserving the committed credential', async () => {
+    const postCommitUserId = chance.guid();
+    const postCommitUserKey = (await doApiPost({
+      url: '/user',
+      token: adminKey,
+      payload: { userId: postCommitUserId },
+    })).value;
+    const cronLookup = jest.spyOn(db.models.CronJobs, 'findOne')
+      .mockRejectedValueOnce(new Error('cron unavailable'));
+    const consoleError = jest.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      const result = await doApiPost({
+        url: `/${appName}/${postCommitUserId}`,
+        token: postCommitUserKey,
+        payload: { tokenHint: 'post-commit', token },
+        expectStatusCode: 500,
+      });
+
+      expect(result.message).toContain('cron unavailable');
+      expect(await db.models.UserAppKey.count({ where: { userId: postCommitUserId } })).toBe(1);
+    } finally {
+      cronLookup.mockRestore();
+      consoleError.mockRestore();
+    }
+  });
+
+  it('serializes competing first integrations and marks exactly one as first', async () => {
+    const concurrentUserId = chance.guid();
+    const concurrentUserKey = (await doApiPost({
+      url: '/user',
+      token: adminKey,
+      payload: { userId: concurrentUserId },
+    })).value;
+    const lockTransaction = await db.transaction();
+    await db.models.User.findOne({
+      where: { userId: concurrentUserId },
+      transaction: lockTransaction,
+      lock: lockTransaction.LOCK.UPDATE,
+    });
+    const originalFindOne = db.models.User.findOne.bind(db.models.User);
+    const lockAttempts = [];
+    let releaseLockAttempts;
+    const bothLockAttempts = new Promise(resolveLockAttempts => {
+      releaseLockAttempts = resolveLockAttempts;
+    });
+    const findOne = jest.spyOn(db.models.User, 'findOne').mockImplementation(options => {
+      if (options.transaction !== lockTransaction && options.lock) {
+        lockAttempts.push(options);
+        if (lockAttempts.length === 2) releaseLockAttempts();
+      }
+      return originalFindOne(options);
+    });
+    let settled = 0;
+    let requests;
+    try {
+      requests = [
+        doApiPost({
+          url: `/${appName}/${concurrentUserId}`,
+          token: concurrentUserKey,
+          payload: { tokenHint: 'first-a', token },
+        }),
+        doApiPost({
+          url: `/${appName}/${concurrentUserId}`,
+          token: concurrentUserKey,
+          payload: { tokenHint: 'first-b', token },
+        }),
+      ].map(postRequest => postRequest.finally(() => { settled += 1; }));
+      await bothLockAttempts;
+      expect(lockAttempts).toHaveLength(2);
+      expect(settled).toBe(0);
+    } finally {
+      findOne.mockRestore();
+      await lockTransaction.commit();
+    }
+    const results = await Promise.all(requests);
+
+    expect(results.map(result => result.isFirstIntegration).sort())
+      .toEqual([false, true]);
+    expect(await db.models.UserAppKey.count({ where: { userId: concurrentUserId } })).toBe(2);
+  });
   const apiKey2 = chance.guid();
   const token2 = { ...token };
+  it('replaces a sole existing integration without marking the update as first', async () => {
+    const replaceUserId = chance.guid();
+    const replaceUserKey = (await doApiPost({
+      url: '/user',
+      token: adminKey,
+      payload: { userId: replaceUserId },
+    })).value;
+    const replaceHint = 'replace-existing';
+    const first = await doApiPost({
+      url: `/${appName}/${replaceUserId}`,
+      token: replaceUserKey,
+      payload: { tokenHint: replaceHint, token },
+    });
+    const replacement = await doApiPost({
+      url: `/${appName}/${replaceUserId}`,
+      token: replaceUserKey,
+      payload: { tokenHint: replaceHint, token: { ...token, apiKey: chance.guid() } },
+    });
+
+    expect(first.isFirstIntegration).toBe(true);
+    expect(replacement.isFirstIntegration).toBe(false);
+    expect(await db.models.UserAppKey.count({
+      where: { userId: replaceUserId, integrationId: appName, hint: replaceHint },
+    })).toBe(1);
+  });
+
   it('create a second token', async () => {
     // set up new token
-    await doApiPost({
+    const createResult = await doApiPost({
       url: `/${appName}/${userId}`,
       token: userKey,
       payload: {
@@ -152,6 +260,7 @@ describe('user', () => {
         token: token2,
       },
     });
+    expect(createResult.isFirstIntegration).toBe(false);
   });
   it('should be able to read a user/app token', async () => {
     const returnValue = await doApiGet({
@@ -257,7 +366,7 @@ describe('user', () => {
   it('should return 422 when stored app token is corrupted', async () => {
     const consoleWarnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
     const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
-    const [originalRows] = await sqldb.query(
+    const [originalRows] = await db.query(
       'SELECT id, appKey FROM UserAppKeys WHERE integrationId = :integrationId AND userId = :userId',
       {
         replacements: {
@@ -266,7 +375,7 @@ describe('user', () => {
         },
       },
     );
-    await sqldb.query(
+    await db.query(
       'UPDATE UserAppKeys SET appKey = :appKey WHERE integrationId = :integrationId AND userId = :userId',
       {
         replacements: {
@@ -284,7 +393,7 @@ describe('user', () => {
       });
       expect(returnValue.message).toBe('Stored integration token is invalid. Please re-save credentials.');
     } finally {
-      await Promise.all(originalRows.map(currentRow => sqldb.query(
+      await Promise.all(originalRows.map(currentRow => db.query(
         'UPDATE UserAppKeys SET appKey = :appKey WHERE id = :id',
         {
           replacements: {
@@ -300,7 +409,7 @@ describe('user', () => {
   it('should return 422 when stored app token is corrupted for hinted endpoint', async () => {
     const consoleWarnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
     const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation(() => {});
-    const [originalRows] = await sqldb.query(
+    const [originalRows] = await db.query(
       'SELECT id, appKey FROM UserAppKeys WHERE integrationId = :integrationId AND userId = :userId AND hint = :hint',
       {
         replacements: {
@@ -310,7 +419,7 @@ describe('user', () => {
         },
       },
     );
-    await sqldb.query(
+    await db.query(
       'UPDATE UserAppKeys SET appKey = :appKey WHERE integrationId = :integrationId AND userId = :userId AND hint = :hint',
       {
         replacements: {
@@ -329,7 +438,7 @@ describe('user', () => {
       });
       expect(returnValue.message).toBe('Stored integration token is invalid. Please re-save credentials.');
     } finally {
-      await Promise.all(originalRows.map(currentRow => sqldb.query(
+      await Promise.all(originalRows.map(currentRow => db.query(
         'UPDATE UserAppKeys SET appKey = :appKey WHERE id = :id',
         {
           replacements: {

package/controllers/app.js

@@ -50,7 +50,6 @@ const tokenTemplate = async (req, res, next) => {
   try {
     const thePlugin = req.app.plugins.find(({ name }) => name === pluginName);
     assert(thePlugin);
-    let template = thePlugin.tokenTemplate();
     const safeRegExp = el => {
       if (!el || !(el.regExp instanceof RegExp)) {
         return el;
@@ -64,24 +63,28 @@ const tokenTemplate = async (req, res, next) => {
         },
       };
     };
-    template = R.map(safeRegExp, template);
-    return res.json({
-      template: {
-        ...template,
-        // ttlProducts and doNotCallPluginForProducts are being used at ti2 level
-        // hence we should just by default allow them for all ti2 plugins
-        ttlForProducts: {
-          type: 'number',
-          regExp: /.+/,
-          default: 60 * 60 * 24, // 1 day
-        },
-        doNotCallPluginForProducts: {
-          type: 'boolean',
-          regExp: /.+/,
-          default: false,
-        },
+    const template = R.map(safeRegExp, {
+      ...thePlugin.tokenTemplate(),
+      // ttlProducts and doNotCallPluginForProducts are being used at ti2 level
+      // hence we should just by default allow them for all ti2 plugins
+      ttlForProducts: {
+        type: 'number',
+        regExp: /.+/,
+        default: 60 * 60 * 24, // 1 day
+      },
+      doNotCallPluginForProducts: {
+        type: 'boolean',
+        regExp: /.+/,
+        default: false,
+      },
+      productSearchOmitServiceCodes: {
+        type: 'text',
+        regExp: /^[\sA-Za-z0-9,]*$/,
+        default: '',
+        description: 'Service codes that every product search for this integration must omit',
       },
     });
+    return res.json({ template });
   } catch (err) {
     return next(err);
   }
@@ -98,6 +101,7 @@ const createAppToken = async (req, res, next) => {
       userId,
     },
   } = req;
+  let transaction;
   try {
     const payload = {
       integrationId,
@@ -105,20 +109,45 @@ const createAppToken = async (req, res, next) => {
       hint,
       appKey,
     };
-    // check if the user exists
-    const userRecord = await sqldb.User.findOne({ where: { userId } });
-    if (!userRecord) { // create the user record
-      await sqldb.User.create({ userId });
-    }
-    // check if the user already has the same app with the same hint
+    await sqldb.User.findOrCreate({ where: { userId }, defaults: { userId } });
+
+    transaction = await sqldb.sequelize.transaction();
+    await sqldb.User.findOne({
+      where: { userId },
+      transaction,
+      lock: transaction.LOCK.UPDATE,
+    });
+    const integrationCount = await sqldb.UserAppKey.count({
+      where: { userId },
+      transaction,
+    });
+    const isFirstIntegration = integrationCount === 0;
+    // Replacing an existing app/hint is an update, never a first integration.
     const userAppKeyDup = await sqldb.UserAppKey.findOne({
       where: { userId, integrationId, hint },
+      transaction,
     });
-    if (userAppKeyDup) await userAppKeyDup.destroy();
-    const newAppKey = await sqldb.UserAppKey.create(payload);
-    // create any cronjobs related to the app
-        await bb.each(req.app.plugins, async plugin => {
-      if (Array.isArray(plugin.jobs)) {
+    if (userAppKeyDup) await userAppKeyDup.destroy({ transaction });
+    const newAppKey = await sqldb.UserAppKey.create(payload, { transaction });
+    try {
+      await transaction.commit();
+    } catch (commitErr) {
+      // Sequelize marks failed commits as finished, so a rollback would mask the original error.
+      transaction = null;
+      throw commitErr;
+    }
+    transaction = null;
+
+    const responsePayload = {
+      value: newAppKey.get('id').toString(),
+      isFirstIntegration,
+    };
+
+    // Credential persistence is already committed, but cron provisioning must
+    // remain caller-visible so missing scheduled functionality is not silent.
+    try {
+      await bb.each(req.app.plugins, async plugin => {
+        if (!Array.isArray(plugin.jobs)) return;
         const validJobs = plugin.jobs.filter(job => Boolean(job.cron) && Boolean(job.method));
         await bb.each(validJobs, async job => {
           const where = {
@@ -144,40 +173,48 @@ const createAppToken = async (req, res, next) => {
             ...(job.params || {}),
             removeOnComplete: false,
           };
-          let bullJobId;
           if (existing) {
             const bullJob = await queue.getJob(job.bullJobId);
             if (!bullJob) {
-              let rawBullJobId = await addJob(jobPayload, jobParams);
-              existing.bullJobId = (rawBullJobId && typeof rawBullJobId === 'object' && rawBullJobId.id) ? rawBullJobId.id : rawBullJobId;
+              const rawBullJobId = await addJob(jobPayload, jobParams);
+              existing.bullJobId = (rawBullJobId && typeof rawBullJobId === 'object'
+                && rawBullJobId.id) ? rawBullJobId.id : rawBullJobId;
               await existing.save();
             } else {
-              // make sure the cron is the same
-              // bullJobId here is from existing.bullJobId, which should be a string.
-              // The queue.getJob expects a string ID.
               const bullCron = R.path(
                 ['opts', 'repeat', 'cron'],
-                await queue.getJob(existing.bullJobId), // Use existing.bullJobId
+                await queue.getJob(existing.bullJobId),
               );
               if (bullCron !== job.cron) {
-                await queue.removeJobs(existing.bullJobId); // Use existing.bullJobId
-                let rawBullJobId = await addJob(jobPayload, jobParams);
-                existing.bullJobId = (rawBullJobId && typeof rawBullJobId === 'object' && rawBullJobId.id) ? rawBullJobId.id : rawBullJobId;
+                await queue.removeJobs(existing.bullJobId);
+                const rawBullJobId = await addJob(jobPayload, jobParams);
+                existing.bullJobId = (rawBullJobId && typeof rawBullJobId === 'object'
+                  && rawBullJobId.id) ? rawBullJobId.id : rawBullJobId;
                 await existing.save();
               }
             }
           } else {
-            let rawBullJobId = await addJob(jobPayload, jobParams);
-            const actualBullJobId = (rawBullJobId && typeof rawBullJobId === 'object' && rawBullJobId.id) ? rawBullJobId.id : rawBullJobId;
+            const rawBullJobId = await addJob(jobPayload, jobParams);
+            const actualBullJobId = (rawBullJobId && typeof rawBullJobId === 'object'
+              && rawBullJobId.id) ? rawBullJobId.id : rawBullJobId;
             await sqldb.CronJobs.create({ ...where, bullJobId: actualBullJobId });
           }
         });
-      }
-    });
-
+      });
+    } catch (cronErr) {
+      console.error('Unable to configure integration cron jobs after save', cronErr);
+      throw cronErr;
+    }
 
-    return res.json({ value: newAppKey.get('id').toString() });
+    return res.json(responsePayload);
   } catch (err) {
+    if (transaction && !transaction.finished) {
+      try {
+        await transaction.rollback();
+      } catch (rollbackErr) {
+        console.error('Unable to roll back integration credential transaction', rollbackErr);
+      }
+    }
     return next(err);
   }
 };

package/controllers/bookings.js

@@ -50,7 +50,19 @@ const legacyProductSearchCacheEvents = {
 };
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
 
-const productSearchCacheKey = ({ userId, hint }) => hash({ userId, hint, operationId: productSearchOperationId });
+const normalizeOmitServiceCodes = (...values) => [...new Set(
+  values
+    .reduce((items, value) => items.concat(Array.isArray(value) ? value : [value]), [])
+    .reduce((items, value) => items.concat(String(value == null ? '' : value).split(',')), [])
+    .map(value => value.trim().toUpperCase())
+    .filter(Boolean),
+)].sort();
+
+const productSearchCacheKey = ({ userId, hint }) => hash({
+  userId,
+  hint,
+  operationId: productSearchOperationId,
+});
 
 const productSearchSelectorFields = [
   'searchInput',
@@ -58,7 +70,6 @@ const productSearchSelectorFields = [
   'productId',
   'productName',
   'lastUpdatedFrom',
-  'skipAccommodation',
 ];
 
 const hasProductSearchSelector = payload => productSearchSelectorFields.some(field => {
@@ -79,7 +90,17 @@ const hasProductCache = cacheContent => Boolean(cacheContent && cacheContent.pro
 
 const safeHash = value => (value === undefined || value === null ? undefined : hash(String(value)));
 
-const emitProductSearchCacheDecision = ({ app, cacheKey, userId, hint, requestId, searchInput, optionId, forceRefresh, startedAt }, action, extra = {}) => {
+const emitProductSearchCacheDecision = ({
+  app,
+  cacheKey,
+  userId,
+  hint,
+  requestId,
+  searchInput,
+  optionId,
+  forceRefresh,
+  startedAt,
+}, action, extra = {}) => {
   if (!app.events || !app.events.emit) return;
   const payload = {
     action,
@@ -303,27 +324,40 @@ const $bookingsProductSearch = plugins => async ({
   requestId,
   headers, // To pass original request headers for background job
 }) => {
+  const { app, token } = await getAppAndToken({ plugins, appKey, userId, hint });
+  assert(userId, 'userId is required');
+  assert(appKey, 'appKey is required');
+  assert(app.searchProducts || app.searchProductsForItinerary, `searchProducts or searchProductsForItinerary is not available for ${appKey}`);
+  const func = (app.searchProducts || app.searchProductsForItinerary).bind(app);
+
+  const configuredOmitServiceCodes = normalizeOmitServiceCodes(
+    R.path(['productSearchOmitServiceCodes'], token),
+  );
+  const normalizedRequestBody = {
+    ...originalRequestBody,
+    ...(configuredOmitServiceCodes.length ? {
+      omitServiceCodes: configuredOmitServiceCodes,
+    } : {}),
+  };
+
   // Extract controller-specific flags from originalRequestBody
   const {
     searchInput = '', // Provide defaults
     optionId = '',
     forceRefresh = false,
-  } = originalRequestBody;
+  } = normalizedRequestBody;
 
-  // Payload for the plugin function (func) - pass forceRefresh so plugins can trigger background cache rebuilds
-  const payloadForPlugin = { ...R.omit(['forceRefresh'], originalRequestBody), forceRefresh };
-  const isScopedSearch = hasProductSearchSelector(originalRequestBody);
+  // Keep forceRefresh in the plugin payload so plugins can trigger their own rebuilds.
+  const payloadForPlugin = {
+    ...R.omit(['forceRefresh'], normalizedRequestBody),
+    forceRefresh,
+  };
+  const isScopedSearch = hasProductSearchSelector(normalizedRequestBody);
   const payloadForBackgroundJob = R.omit(
     ['credentials', ...productSearchSelectorFields],
     payloadForPlugin,
   );
 
-  const { app, token } = await getAppAndToken({ plugins, appKey, userId, hint });
-  assert(userId, 'userId is required');
-  assert(appKey, 'appKey is required');
-  assert(app.searchProducts || app.searchProductsForItinerary, `searchProducts or searchProductsForItinerary is not available for ${appKey}`);
-  const func = (app.searchProducts || app.searchProductsForItinerary).bind(app);
-
   const cacheKey = productSearchCacheKey({ userId, hint });
   const telemetryContext = {
     app,
@@ -336,7 +370,11 @@ const $bookingsProductSearch = plugins => async ({
     forceRefresh,
     startedAt: Date.now(),
   };
-  const emitDecision = (action, extra = {}) => emitProductSearchCacheDecision(telemetryContext, action, extra);
+  const emitDecision = (action, extra = {}) => emitProductSearchCacheDecision(
+    telemetryContext,
+    action,
+    extra,
+  );
   const pluginExecutionLockKey = `${cacheKey}:lock`; // Lock for direct plugin execution
   const jobQueueLockKey = `${cacheKey}:jobLock`;   // Lock for preventing multiple job queues
 
@@ -349,6 +387,7 @@ const $bookingsProductSearch = plugins => async ({
   const hasPluginExecutionLock = await app.cache.get({ key: pluginExecutionLockKey });
   emitDecision(hasProductCache(initialActualCacheContent) ? 'cache_hit' : 'cache_miss', {
     cacheProductCount: productCount(initialActualCacheContent),
+    cacheOptionCount: optionCount(initialActualCacheContent),
     cacheAgeMs: lastUpdated ? Date.now() - lastUpdated : undefined,
     ttrMs: ttr * 1000,
     reason: hasPluginExecutionLock ? 'lockActive' : undefined,
@@ -416,6 +455,7 @@ const $bookingsProductSearch = plugins => async ({
           reason: 'waitedForLeader',
           lockWaitMs,
           cacheProductCount: productCount(cacheContent),
+          cacheOptionCount: optionCount(cacheContent),
         });
         return cacheContent;
       }
@@ -457,6 +497,7 @@ const $bookingsProductSearch = plugins => async ({
           reason,
           pluginElapsedMs,
           cacheProductCount: productCount(pluginResults),
+          cacheOptionCount: optionCount(pluginResults),
         });
       } else if (pluginResults && (pluginResults.catalogPartial || pluginResults.partial)) {
         emitDecision('partial_refresh_skipped', {
@@ -492,7 +533,9 @@ const $bookingsProductSearch = plugins => async ({
       emitDecision('cache_hit', {
         reason: 'doNotCallPluginForProducts',
         cacheProductCount: initialActualCacheContent.products.length,
+        cacheOptionCount: optionCount(initialActualCacheContent),
         returnedProductCount: searchResults.length,
+        returnedOptionCount: optionCount({ products: searchResults }),
       });
       return { ...initialActualCacheContent, products: searchResults, ...(token.configuration || {}) };
     }
@@ -522,7 +565,9 @@ const $bookingsProductSearch = plugins => async ({
         const searchResults = $searchProductList(initialActualCacheContent.products, searchInput, optionId);
         emitDecision(action, {
           cacheProductCount: initialActualCacheContent.products.length,
+          cacheOptionCount: optionCount(initialActualCacheContent),
           returnedProductCount: searchResults.length,
+          returnedOptionCount: optionCount({ products: searchResults }),
           cacheAgeMs: lastUpdated ? Date.now() - lastUpdated : undefined,
           ttrMs: ttr * 1000,
           ...extra,
@@ -879,7 +924,10 @@ const $updateProductSearchCache = plugins => async ({
   if (hasCacheableProductResults(pluginResult)) {
     await markRefreshAttempted();
     await app.cache.save({ key: cacheKey, value: pluginResult, ttl: productSearchCacheTtlSeconds });
-    emitCacheEvent('cache_saved', { cacheProductCount: productCount(pluginResult) });
+    emitCacheEvent('cache_saved', {
+      cacheProductCount: productCount(pluginResult),
+      cacheOptionCount: optionCount(pluginResult),
+    });
   } else {
     const isPartialRefresh = pluginResult && (pluginResult.catalogPartial || pluginResult.partial);
     const existingCacheContent = await app.cache.get({ key: cacheKey });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ti2",
-  "version": "1.0.120",
+  "version": "1.0.122",
   "description": "Tourist Industry Exchange (TI2)",
   "main": "index.js",
   "scripts": {

package/.windsurfrules

@@ -1,9 +0,0 @@
-This is a Node.js project using Sequelize for database operations and Express.js for the web server.
-The API is defined in api.yml using OpenAPI 3.0.2
-The database is defined in models/index.js
-The models are defined in models/
-to run tests you have to run them on the ti2 named docker container, and consider this codebase is part of node_modules/ti2 path for example : 
-`` $ docker exec ti2 bash -c "cd /ti2 && npx jest lib/__tests__/callback.js --forceExit"``
-When writing / editing tests, make use of test/utils.js and review their implementation to understand how to mock the environment.
-Do not make any changes until you 95% confident of the changes you want to make, ask follow up questions until you have that confidence.
-when sending jobs to the background worker using the queue, asssume a worker is always runing to execute it but is on a different instance thread, so to review / wait for jobs we have to use the wokrer/queue.js listJobs fn to check for it

package/CLAUDE.md

@@ -1,166 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Ti2 (Tourism Information Interchange) is an open-source integration framework for the tourism industry. It provides standardized functions for bookings, content, and rates management through a plugin-based architecture.
-
-## Critical Development Rules
-
-1. **Docker Container Execution**: ALL commands must be run inside the `ti2` Docker container
-   - The codebase is located at `/ti2` path inside the container
-   - This project is part of `node_modules/ti2` in the container environment
-   - **NEVER run npm, node, or npx commands on the host machine**
-   - Always use: `docker exec ti2 bash -c "cd /ti2 && <command>"`
-   - Example for npm install: `docker exec ti2 bash -c "cd /ti2 && npm install <package>"`
-
-2. **Testing Rules**:
-   - Tests MUST be run inside the Docker container
-   - Example: `docker exec ti2 bash -c "cd /ti2 && npx jest lib/__tests__/callback.js --forceExit"`
-   - Use `test/utils.js` for mocking the environment
-   - Review test utility implementations before writing/editing tests
-
-3. **Background Jobs**:
-   - Jobs sent to the queue run on a separate worker thread/instance
-   - Use `worker/queue.js` `listJobs` function to check job status
-   - Workers are always assumed to be running
-
-4. **Code Confidence**: Do not make changes until 95% confident. Ask follow-up questions if uncertain.
-
-## Public Repo Privacy
-
-- `ti2` is open source. Before opening or updating public PRs, review summaries, inline comments, release notes, or commit messages, scrub internal TourConnect service names and private implementation details.
-- Do not mention internal services such as `pyfilematch`, `filematch`, `tcoutlook`, private frontend names, private trace URLs, private customer identifiers, or internal deployment architecture in public GitHub text.
-- Use generic wording such as `upstream caller`, `internal catalog caller`, `private frontend`, `caller-side timeout`, or `internal workflow` when context is needed.
-- After editing public GitHub text, search the PR body, issue comments, review comments, and review summaries for internal service names before handoff.
-
-## Common Development Commands
-
-```bash
-# Run tests (inside Docker container)
-docker exec ti2 bash -c "cd /ti2 && npm test"
-docker exec ti2 bash -c "cd /ti2 && npx jest [test-file] --forceExit"
-
-# Run specific test file
-docker exec ti2 bash -c "cd /ti2 && npx jest controllers/__tests__/bookings.js --forceExit"
-
-# Database migrations
-docker exec ti2 bash -c "cd /ti2 && npm run sequelize db:migrate"
-
-# Generate documentation
-docker exec ti2 bash -c "cd /ti2 && npm run doc"
-```
-
-## Architecture
-
-### Core Components
-
-1. **Main Entry Point** (`index.js`):
-   - Initializes Express server on port 10010 (default)
-   - Sets up Swagger documentation at `/api-docs`
-   - Handles plugin instantiation and middleware
-   - Implements caching mechanism
-   - Manages background job processing via `worker/queue.js`
-
-2. **API Definition** (`api.yml`):
-   - OpenAPI 3.0.0 specification
-   - Defines all endpoints and schemas
-   - JWT Bearer authentication
-
-3. **Plugin System**:
-   - Two types: Integration Plugins (connect systems) and App Plugins (value-added tools)
-   - Plugins are instantiated with cache, axios, events, and configuration
-   - Plugin schemas are merged with main API schema
-   - Each plugin gets its own routes under `/apps/{pluginName}`
-
-4. **Controllers** (`controllers/`):
-   - `app.js`: Core application controller
-   - `bookings.js`: Booking operations (searchProducts, createBooking, etc.)
-   - `admin.js`: Administrative functions
-   - `user.js`: User management
-   - `ping.js`: Health check endpoints
-   - `allotment.js`: Allotment management
-
-5. **Database Models** (`models/`):
-   - Sequelize ORM with MySQL
-   - Key models: Integration, User, UserAppKey, CronJobs, ApiCronJobs
-   - Migrations in `migrations/` directory
-
-6. **Worker System** (`worker/`):
-   - Bull queue for background job processing
-   - Redis-backed job queue
-   - Supports plugin jobs, API jobs, and callback jobs
-   - Multi-worker support with throng
-
-7. **Authentication** (`auth/authHandler.js`):
-   - JWT-based authentication
-   - Bearer token scheme
-
-### Key Features
-
-- **Caching**: Redis-based caching with configurable TTL
-- **Event System**: EventEmitter2 for plugin communication
-- **Background Jobs**: Async job processing with Bull/Redis
-- **Cron Jobs**: Scheduled task execution
-- **Multi-tenancy**: Support for multiple integrations/plugins
-
-### Plugin Development
-
-Plugins must implement standard methods:
-- `validateToken`: Token validation
-- `tokenTemplate`: Token configuration template
-- Booking methods: `searchProducts`, `searchAvailability`, `createBooking`, `cancelBooking`
-- Content methods: `getProducts`, `getProduct`, `createProduct`, `updateProduct`
-
-### Testing Strategy
-
-- Jest testing framework
-- Test fixtures in `__fixtures__/`
-- Mock plugins in `__mocks__/`
-- Use `test/utils.js` for creating test environments
-- Tests organized by controller in `controllers/__tests__/`
-
-## Database
-
-- Sequelize ORM with MySQL/MariaDB
-- Connection managed through `models/db.js`
-- Migrations handled via sequelize-cli
-- Models auto-loaded from `models/` directory
-
-## Environment Variables
-
-Key variables:
-- `PORT`: Server port (default: 10010)
-- `REDIS_URL`: Redis connection (default: redis://redis:6379)
-- `jwtSecret`: JWT signing secret
-- `adminKey`: Admin authentication key
-- `WEB_CONCURRENCY`: Number of workers
-- `MAX_JOBS_PER_WORKER`: Job concurrency per worker
-- `SSL_INSECURE_ALLOWED_DOMAINS`: Pipe-separated list of domains where SSL certificate verification is skipped (e.g., `localhost|staging.example.com|192.168.1.100`)
-
-Plugin-specific variables follow pattern: `ti2_{pluginName}_{setting}`
-
-### SSL Configuration
-
-The `SSL_INSECURE_ALLOWED_DOMAINS` environment variable allows you to specify domains where SSL certificate verification should be skipped. This is useful for:
-- Development environments with self-signed certificates
-- Testing against staging servers with invalid certificates
-- Local development with HTTPS
-
-Example usage:
-```bash
-# Skip SSL verification for specific domains
-export SSL_INSECURE_ALLOWED_DOMAINS="localhost|staging.api.com|192.168.1.100"
-
-# Multiple domains separated by pipe
-export SSL_INSECURE_ALLOWED_DOMAINS="dev.example.com|test.example.com"
-```
-
-**Important Implementation Notes**:
-- SSL configuration is ONLY applied to plugin axios instances (for external API calls) and worker axios instances
-- Internal communication (callbacks, per-request axios) do NOT use SSL configuration  
-- SSL configuration uses a per-request interceptor approach for better isolation
-- The configuration checks domains dynamically on each request
-
-**Warning**: Only use this in development/testing environments. Never skip SSL verification in production for security reasons.