Merge master into k8s (#16384)

* Refactor uploads spec, simple forms (#16380)

* Refactor uploads spec, simple forms

* rubocop

* BTSSS-77372 Add mocked responses for BTSSS  (#16231)

* Revert to original token URL in service

* Add authorized ping mock, too

* Handle Bearer Token parsing failures gracefully

* Clean up services config

* Revert some accidental deletions

* Final bit of cleanup

* Switch to correct file path

* Move authorize method to a before_action

* Update mockdata paths

* Fix some linting errors

---------

Co-authored-by: Eric Tillberg <[email protected]>
Co-authored-by: Dan Hinze <[email protected]>

config/betamocks/services_config.yml

@@ -9,6 +9,18 @@
       :path: <%= "/#{Settings.ask_va_api.crm_api.veis_api_path}/ping" %>
       :file_path: "/ask_va/dynamics_api"
       :response_delay: 15
+    - :method: :get
+      :path: "/veis/api/btsss/travelclaim/api/v1/Sample/ping"
+      :file_path: "/travel_pay/ping/default"
+      :response_delay: 0.3
+    - :method: :get
+      :path: "/veis/api/btsss/travelclaim/api/v1/Sample/authorized-ping"
+      :file_path: "/travel_pay/ping/default"
+      :response_delay: 0.3
+    - :method: :post
+      :path: "/veis/api/btsss/travelclaim/api/v1/Auth/access-token"
+      :file_path: "/travel_pay/token/default"
+      :response_delay: 0.3
     - :method: :post
       :path: <%= "/#{Settings.ask_va_api.crm_api.veis_api_path}/inquiries/new" %>
       :file_path: "/ask_va/crm_api/post_inquiries/default"
@@ -22,6 +34,10 @@
       :path: <%= "/#{Settings.ask_va_api.crm_api.tenant_id}/oauth2/v2.0/token" %>
       :file_path: "/ask_va/token/default"
       :response_delay: 0.3
+    - :method: :post
+      :path: <%= "/#{Settings.travel_pay.veis.tenant_id}/oauth2/token" %>
+      :file_path: "/travel_pay/token/default"
+      :response_delay: 0.3
 
 - :name: 'carma'
   :base_uri: <%= "#{URI(Settings['salesforce-carma'].url).host}:#{URI(Settings['salesforce-carma'].url).port}" %>

config/settings.yml

@@ -1669,6 +1669,7 @@ brd:
 
 
 travel_pay:
+  mock: true
   veis:
     client_id: ~
     client_secret: ~

modules/travel_pay/app/controllers/travel_pay/application_controller.rb

@@ -38,6 +38,16 @@ def after_logger
       logger.info('travel-pay') { Utils::Logger.build(self).after }
     end
 
+    def authorize
+      auth_header = request.headers['Authorization']
+      raise_unauthorized('Missing Authorization header') if auth_header.nil?
+      raise_unauthorized('Authorization header missing Bearer token') unless auth_header.start_with?('Bearer ')
+    end
+
+    def raise_unauthorized(detail)
+      raise Common::Exceptions::Unauthorized.new(detail:)
+    end
+
     # Blocks requests from being handled if feature flag is disabled
     def block_if_flag_disabled
       unless Flipper.enabled?(:travel_pay_power_switch, @current_user)

modules/travel_pay/app/controllers/travel_pay/claims_controller.rb

@@ -2,9 +2,10 @@
 
 module TravelPay
   class ClaimsController < ApplicationController
+    before_action :authorize
+
     def index
       veis_token = client.request_veis_token
-
       # Non-intuitive Ruby behavior: #split splits a string on space by default
       vagov_token = request.headers['Authorization'].split[1]
       btsss_token = client.request_btsss_token(veis_token, vagov_token)

modules/travel_pay/app/controllers/travel_pay/pings_controller.rb

@@ -2,6 +2,8 @@
 
 module TravelPay
   class PingsController < ApplicationController
+    before_action :authorize, only: [:authorized_ping]
+
     def ping
       veis_token = client.request_veis_token
 

modules/travel_pay/app/services/travel_pay/client.rb

@@ -112,7 +112,7 @@ def connection(server_url:)
       Faraday.new(url: server_url) do |conn|
         conn.use :breakers
         conn.response :raise_error, error_prefix: service_name, include_request: true
-        conn.response :betamocks if use_fakes?
+        conn.response :betamocks if mock_enabled?
         conn.response :json
         conn.request :json
 
@@ -123,8 +123,8 @@ def connection(server_url:)
     ##
     # Syntactic sugar for determining if the client should use
     # fake api responses or actually connect to the BTSSS API
-    def use_fakes?
-      Settings.useFakes
+    def mock_enabled?
+      Settings.travel_pay.mock
     end
   end
 end