From 9e80fda5964c7d226a5a8c0a8fc0ce77137e5a7e Mon Sep 17 00:00:00 2001
From: khushal <pskhushal@gmail.com>
Date: Wed, 15 Jan 2025 14:00:40 +0530
Subject: [PATCH] (20250115) Allowing internal IPs to send SMS messages.

---
 api/blueprints/sms/send_v2.py                          | 10 +++++++---
 .../finstitutions/payments/safaricom_mpesa_express.py  |  7 +++++--
 models/api/finstitutions/payments/request.py           | 10 ++++++++--
 3 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/api/blueprints/sms/send_v2.py b/api/blueprints/sms/send_v2.py
index a8f885e..d575db9 100644
--- a/api/blueprints/sms/send_v2.py
+++ b/api/blueprints/sms/send_v2.py
@@ -207,12 +207,16 @@ async def send_sms_messages_api(
     # ┣┫┓┏╋┣┓  ┃ ┣┓┏┓┏┃┏
     # ┛┗┗┻┗┛┗  ┗┛┛┗┗ ┗┛┗
 
-    # If the session token is invalid/expired:
-    if kwargs.get("session_info") is None:
+    # Either the session must be valid, or
+    # the IP address requesting the service must be whitelisted:
+    if (
+            kwargs.get("session_info") is None and
+            inbound_headers["Remote-IP"] not in current_app.whitelisted_ips
+    ):
         return ResponseModel(
             status_code = StatusCodes.FAILED,
             http_code = HttpCodes.UNAUTHORIZED,
-            message = "invalid session"
+            message = "Invalid session and/or bad IP addr."
         )
 
     # Get the token  from the token key:
diff --git a/controllers_v2/finstitutions/payments/safaricom_mpesa_express.py b/controllers_v2/finstitutions/payments/safaricom_mpesa_express.py
index e82bc72..21b6460 100644
--- a/controllers_v2/finstitutions/payments/safaricom_mpesa_express.py
+++ b/controllers_v2/finstitutions/payments/safaricom_mpesa_express.py
@@ -189,8 +189,9 @@ class SafaricomMPesaExpressPaymentsController(PaymentsController):
         # Start by assuming failure:
         result = PaymentRequestOneResult()
 
-        # Initialize the payment request by creating a placeholder record in the database:
-        payment_id = await self.init_payment(
+        # Either use the id from a separately queued payment request, or
+        # initialize (queue) the payment request by creating a placeholder record in the database:
+        payment_id = payment_request.paymentId or await self.init_payment(
             mongo_data_conn = mongo_data_conn,
             auth_token = auth_token,
             user_info = user_info,
@@ -214,6 +215,8 @@ class SafaricomMPesaExpressPaymentsController(PaymentsController):
             http_client = self._http_client
         )
 
+        # # If the token was refreshed successfully,
+        # # store the updated value(s):
         # if token_refreshed:
         #     auth_token.token = client_auth.model_dump()
         #     await self.set_token(
diff --git a/models/api/finstitutions/payments/request.py b/models/api/finstitutions/payments/request.py
index ad275a9..4c02365 100644
--- a/models/api/finstitutions/payments/request.py
+++ b/models/api/finstitutions/payments/request.py
@@ -150,10 +150,16 @@ class PaymentRequestMetadata(BaseModel):
 class PGPaymentRequestData(BaseModel):
 
     tokenKey: ObjectId = Field(
-        description = "the auth token to use to send this message",
+        description = "the auth token of the account that must be used to request the payment",
         frozen = True,
     )
 
+    paymentId: ObjectId | None = Field(
+        description = "if you had queued the payment request separately, pass the id here",
+        frozen = True,
+        default = None
+    )
+
     customerName: str | None = Field(
         description = "the name of the registered customer who must make the payment",
         frozen = True,
@@ -222,7 +228,7 @@ class PGPaymentRequestData(BaseModel):
     # ┃┃┏┓┃┓┏┫┏┓╋┓┏┓┏┓
     # ┗┛┗┻┗┗┗┻┗┻┗┗┗┛┛┗
 
-    @field_validator("tokenKey", mode = "before")
+    @field_validator("tokenKey", "paymentId", mode = "before")
     def parse_oid(cls, value):
         try: value = ObjectId(value)
         except: pass