feat(validation): Adds response and service-code validation.

.env.example

@@ -13,6 +13,7 @@ DATABASE_URL=
 DEFAULT_VOUCHER_ADDRESS=
 DEFAULT_VOUCHER_SYMBOL=
 DISABLE_REQUEST_LOGGING=
+KE_SERVICE_CODES=
 KE_SUPPORT_PHONE=
 LOG_LEVEL=
 LOG_NAME=

src/config.ts

@@ -2,7 +2,7 @@ import * as process from 'process';
 
 function stringToList (value: string | undefined): string[] | void {
   if (value === undefined) {
-    throw new Error('Value is undefined')
+    console.error('Error parsing string to list.')
   } else {
     return value.split(',')
   }
@@ -17,8 +17,7 @@ export const config = {
     USERNAME: process.env.AT_USERNAME ?? 'x',
     USSD_ENDPOINT_SECRET: process.env.AT_USSD_ENDPOINT_SECRET ?? 'xE',
     VALID_IPS: stringToList(process.env.AT_VALID_IPS) ?? [
-      '0.0.0.0',
-      '127.0.0.1'
+      '0.0.0.0', '127.0.0.1'
     ]
   },
   CIC: {
@@ -37,6 +36,9 @@ export const config = {
   DEV: process.env.NODE_ENV !== 'production',
   KE: {
     SUPPORT_PHONE: process.env.SUPPORT_PHONE ?? '0757628885',
+    SERVICE_CODES: stringToList(process.env.KE_SERVICE_CODES) ?? [
+      '*384*96#', '*483*061#', '*483*46#'
+    ],
   },
   LOG: {
     LEVEL: process.env.LOG_LEVEL ?? 'info',

src/services/africasTalking.ts

@@ -1,6 +1,7 @@
 import { SystemError } from '@lib/errors';
 import { SessionRequest } from '@services/session';
 import { getCountryCode } from '@lib/ussd';
+import { config } from '@/config';
 
 export const ATRequestBody = {
   type: 'object',
@@ -33,6 +34,10 @@ export async function ATPreHandlerHook(request: SessionRequest) {
     throw new SystemError(`Could not determine country code from phone number: ${phoneNumber}`);
   }
 
+  if(!config.KE.SERVICE_CODES.includes(serviceCode)) {
+    throw new SystemError(`Invalid service code: ${serviceCode}`);
+  }
+
   request.uContext.ussd = {
     countryCode,
     input: text.split('*').pop() || '',

src/services/session.ts

@@ -9,6 +9,8 @@ import { Connections } from '@machines/utils';
 import { UserService } from '@services/user';
 import { buildResponse, MachineContext } from '@services/machine';
 import { fallbackLanguage, tHelpers } from '@i18n/translators';
+import { logger } from '@/app';
+import { Locales } from '@i18n/i18n-types';
 
 declare module 'fastify' {
   interface FastifyRequest {
@@ -78,7 +80,7 @@ async function buildContext(request: SessionRequest): Promise<MachineContext> {
   return {...context, user}
 }
 
-export async function sessionHandler(request: SessionRequest, reply: FastifyReply){
+export async function sessionHandler(request: SessionRequest, reply: FastifyReply) {
   try {
     const context = await buildContext(request)
     const sessionService = new SessionService(context.connections.db, context.ussd.requestId, context.connections.redis.ephemeral)
@@ -97,13 +99,31 @@ export async function sessionHandler(request: SessionRequest, reply: FastifyRepl
       context.data = session.data
     }
     const response = await buildResponse(context, session)
-    reply.send(response)
+    let language = fallbackLanguage();
+    if ('user' in context && context.user) {
+      language = context.user.account.language
+    }
+    await handleResponse(language, reply, response)
   } catch (error: any){
-    const response = tHelpers("systemError", fallbackLanguage())
-    reply.send(response)
+    logger.error(`Error handling session: ${error.message}`)
+    await handleError(reply)
+  }
+}
+
+async function handleResponse(language: Locales, reply: FastifyReply, response: string) {
+  if (!response || !response.startsWith("CON") && !response.startsWith("END")) {
+    logger.error(`Error building response. Invalid response: ${response}`)
+    await handleError(reply, language)
+    return
   }
+  reply.send(response)
 }
 
+async function handleError(reply: FastifyReply, language = fallbackLanguage()) {
+  reply.send(tHelpers("systemError", language))
+}
+
+
 export class SessionService {
 
   private cache: CacheService<SessionInterface>