Howto validate reservation number in additional fields with extension

[SilentResonance]

Hello,
first of all thank you soooo much for this great piece of software.
As there is no discussion tab at alf.io-extensions repo and as it is not really an issue, I am asking here for a little help.

What I would like to achieve: Create ticket 'parings'.
After the user has selected a ticket, there is an additional field partner_x (length: 8 digits to match reservation number).
It should be filled with the reservation number of an already finished registration (left empty for the first of a pair)

What I started doing:
I used the extension template and changed the events from INVOICE_GENERATION to RESERVATION_VALIDATION. In the logs I already see the log.warn outputs like the reservation id.

Problems:

• I don't get access to the form.additionalServices. Checking form.hasAdditionalServices() seems to return false.

Questions:

• Are the variables listed here reservation validation directly accessible in function executeScript(scriptEvent) {}?
• How do I get the additional field contents?
• How can I access the already finished reservations to validate the field input?
• Is there a way to have a drop-down with all already finished registrations for the user to choose from?
• How do I return a bindingresult for valid/unvalid registration numbers?

Thanks in advance for an answer and some more insights on how to write an extension.

[cbellone]

Hi @SilentResonance ,

thank you for using alf.io!

Extensions run in a controlled environment (a sandbox) and cannot query / update the underlying database.
This prevents security issues.

That being said, what you can do is:

• create a RESERVATION_VALIDATION extension to validate user input
• from within the extension, call an external application that has access to alf.io's database (i.e. a sidecar container, or another process on the same server)
• the external application performs the required checks
• the extension notifies any errors

I don't get access to the form.additionalServices. Checking form.hasAdditionalServices() seems to return false.

From what I understand, you need to access / validate additional fields, not additional services.
an additional service is an add-on to the reservation, such as merchandise items.

here's an example of a working script:

var ticketIds = Object.keys(form.tickets);
for(var i=0; i < ticketIds.length; i++) {
    var ticketId = ticketIds[i];
    log.info("validating ticket {}", ticketId);
    var ticket = form.tickets[ticketId];
    if(ticket.additional["fieldName"]) {
        //... your checks here
        // in case of a failed validation, you can reject the field content
        bindingResult.rejectValue("tickets['"+ticketId+"'].additional['"+fieldName+"'][0]", 'error.restrictedValue', null);
    }
}

Is there a way to have a drop-down with all already finished registrations for the user to choose from?

this is not possible at the moment.

How do I return a bindingresult for valid/unvalid registration numbers?

You don't need to notify a successful validation. That's the default (happy) path.
You should only add an error to the provided bindingResult object. See above.
The user can proceed with the booking only if bindingResult do not contain errors.

Celestino

[SilentResonance]

Hi @cbellone,

thanks for this fast response.
I tried your code snippet but in console I got some exceptions.
After commenting line by line of the example, the exception still persists even with a completely empty function executeScript(scriptEvent)

The Error: (I ommitted most lines in between to not exceed text limits here)

alfio.extension.exception.AlfioScriptingException: java.lang.IllegalStateException: Expected BEGIN_OBJECT but was STRING at line 1 column 2 path $
        at alfio.extension.ScriptingExecutionService.executeScriptFinally(ScriptingExecutionService.java:215) ~[classes/:?]

[...]

Caused by: com.google.gson.JsonSyntaxException: java.lang.IllegalStateException: Expected BEGIN_OBJECT but was STRING at line 1 column 2 path $
        at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$Adapter.read(ReflectiveTypeAdapterFactory.java:395) ~[gson-2.10.jar:?]

[...]

Caused by: java.lang.IllegalStateException: Expected BEGIN_OBJECT but was STRING at line 1 column 2 path $
        at com.google.gson.stream.JsonReader.beginObject(JsonReader.java:393) ~[gson-2.10.jar:?]
        at com.google.gson.internal.bind.ReflectiveTypeAdapterFactory$Adapter.read(ReflectiveTypeAdapterFactory.java:384) ~[gson-2.10.jar:?]

So I have some more questions:

• Do you have an idea where that might come from? From point of functionality it does not seem to interfere, but blows up log size a lot...
• How do I check for null object? In case of an empty field (which is also valid) I got error Cannot invoke "Object.getClass()" because "obj" is null. This error only seems to rise, when the field is untouched and empty. The error does not arrise, if I type some letters and delete them completely (leaving an empty field)

Update:
The timeout error was a typo in for loop parameters.... my bad
I managed to run another container with alfio, which connects to the postgres database offering a REST API.
With this API I managed to query reservation numbers.

Update2:
I managed to get clearer on field values:

• If untouched and empty, console.log("Field: ", ticket.additional[fieldName]); writes [null] to console
• If a letter was typed, but still empty same call writes [] to console
  How do I check for the null case?
  Tried:
• ticket.additional[fieldName] === ['null']
• ticket.additional[fieldName] === [null]
• ticket.additional[fieldName] === null
• ticket.additional[fieldName] == []
• And all of those with ticket.additional[fieldName][0] to no avail

Thanks again for your help.

Chris

P.S.: Using Alf.io in docker with version v.2.0-M4-2402-3

[SilentResonance]

For someone trying to build something similar, here ist my now working solution:

function executeScript(scriptEvent) {
    var ticketIds = Object.keys(form.tickets);
    var validationFailure = 0;
    log.info('hello from script with event: ' + scriptEvent);
    log.info('extension parameters are: ' + extensionParameters);
    log.info('the reservation number is: ' + reservationId);
    for(var i=0; i < ticketIds.length; i++) {
        var ticketId = ticketIds[i];
        log.info("validating ticket {}", ticketId);
        var ticket = form.tickets[ticketId];
        if(ticket.additional !== null){
            var additionalFields = Object.keys(ticket.additional);
            for(var j=0; j<additionalFields.length; j++) {
                var fieldName = additionalFields[j];
                //console.log("Field: ", ticket.additional[fieldName]);
                if(fieldName === 'partner_latin' || fieldName === 'partner_standard') {
                    if(ticket.additional[fieldName].toString() == '[null]' || ticket.additional[fieldName].isEmpty() || ticket.additional[fieldName].toString() == '[]') {
                        console.log("Empty: ", fieldName);
                    } else {
                        log.info(ticket.additional[fieldName].toString());
                        //log.info("Partner: {}",fieldName,ticket.additional[fieldName]);
                        // SQL Query: Select split_part(id, '-', 1) as reservation from tickets_reservation where id like '" + ticket.additional[fieldName][0].toLowerCase() + "%';
                        var reservation = simpleHttpClient.get("http://postgrest:3000/tickets_reservation?select=id&id=ilike." + ticket.additional[fieldName][0] + "%25");
                        //console.log('Reservation response', reservation.getJsonBody());
                        if(reservation.getJsonBody()[0] === undefined) {
                            console.log('No matching reservation found');
                            bindingResult.rejectValue("tickets['"+ticketId+"'].additional['"+fieldName+"'][0]", 'error.restrictedValue', null);
                            break;
                        } else {
                            console.log('reservation found:', reservation.getJsonBody()[0]['id'].split("-")[0]);
                            if(reservation.getJsonBody()[0]['id'].split("-")[0] != ticket.additional[fieldName][0].toLowerCase()) {
                                bindingResult.rejectValue("tickets['"+ticketId+"'].additional['"+fieldName+"'][0]", 'error.restrictedValue', null);
                            }
                        }
                    }
                }
            }
        }
    }
}

Any comments to shorten the code are appreciated. I don't actually like to compare with toString() to detect null values.
@cbellone Where should I put my docker-compose.yml and the tutorial for this?
The error Expected BEGIN_OBJECT but was STRING at line 1 column 2 path $ still persists.
Any idea what causes this?
Is there a way to trigger the same validation on ticket update via the link in the ticket email? The update button leads to the same form, so the same validations should be performed, right?

[cbellone]

Any comments to shorten the code are appreciated. I don't actually like to compare with toString() to detect null values.

the extension runs in a javascript-compatible engine, so you can just check

if(ticket.additional[fieldName]) {
...
}

by quickly looking at the code, I would suggest you to validate the field value before performing the query, just to make sure that your code is not vulnerable to SQL Injections.

The error Expected BEGIN_OBJECT but was STRING at line 1 column 2 path $ still persists.
Any idea what causes this?

Can't say for sure without the full stack trace, however I think that the problem lies in the response from the service you're calling. We expect a JSON Object to be returned, from the exception it seems you're returning a string?

Where should I put my docker-compose.yml and the tutorial for this?

I would say that a good starting point for this would be a post on your own website (if you have one), or a gist. Then we can create an "examples" page on alf.io's extension documentation linking your URL.

WDYT?

[SilentResonance]

the extension runs in a javascript-compatible engine, so you can just check

if(ticket.additional[fieldName]) {
...
}

I tried that and it probably works for checking null, but I also got undefined as value and the true case of the if statement being run.
So I do tried to check like:

if(ticket.additional[fieldName] && ticket.additional[fieldName] != undefined) {
    console.log(...
}

Still printing to console as undefined. Any further suggestions how to safely check for existing ticket.additional and ticket.additional[fieldName]?

by quickly looking at the code, I would suggest you to validate the field value before performing the query, just to make sure that your code is not vulnerable to SQL Injections.

I would appreciate any hints on which regex functions are availabe in extension and how to check for match or miss. My suggested pattern would be "^[0-9a-zA-Z]{8}", which should disallow any SQL injections.

Can't say for sure without the full stack trace, however I think that the problem lies in the response from the service you're calling. We expect a JSON Object to be returned, from the exception it seems you're returning a string?

The above mentioned error does not come from my code, because it is also printed in console with a completely empty executeScript(scriptEvent) function. I attached a complete example extension code and stack trace as text file to not clutter this thread... extensionExample.txt

I would say that a good starting point for this would be a post on your own website (if you have one), or a gist. Then we can create an "examples" page on alf.io's extension documentation linking your URL.

WDYT?

I don't have my own website for this. I will look how gist works and try to put some up.
I already added code to also validate on TICKET_UPDATE_VALIDATION event