(20250115) Allowing internal IPs to send SMS messages.

api/blueprints/sms/send_v2.py

@@ -207,12 +207,16 @@ async def send_sms_messages_api(
     # ┣┫┓┏╋┣┓  ┃ ┣┓┏┓┏┃┏
     # ┛┗┗┻┗┛┗  ┗┛┛┗┗ ┗┛┗
 
-    # If the session token is invalid/expired:
+    # Either the session must be valid, or
-    if kwargs.get("session_info") is None:
+    # the IP address requesting the service must be whitelisted:
+    if (
+            kwargs.get("session_info") is None and
+            inbound_headers["Remote-IP"] not in current_app.whitelisted_ips
+    ):
         return ResponseModel(
             status_code = StatusCodes.FAILED,
             http_code = HttpCodes.UNAUTHORIZED,
-            message = "invalid session"
+            message = "Invalid session and/or bad IP addr."
         )
 
     # Get the token  from the token key:

controllers_v2/finstitutions/payments/safaricom_mpesa_express.py

@@ -189,8 +189,9 @@ class SafaricomMPesaExpressPaymentsController(PaymentsController):
         # Start by assuming failure:
         result = PaymentRequestOneResult()
 
-        # Initialize the payment request by creating a placeholder record in the database:
+        # Either use the id from a separately queued payment request, or
-        payment_id = await self.init_payment(
+        # initialize (queue) the payment request by creating a placeholder record in the database:
+        payment_id = payment_request.paymentId or await self.init_payment(
             mongo_data_conn = mongo_data_conn,
             auth_token = auth_token,
             user_info = user_info,
@@ -214,6 +215,8 @@ class SafaricomMPesaExpressPaymentsController(PaymentsController):
             http_client = self._http_client
         )
 
+        # # If the token was refreshed successfully,
+        # # store the updated value(s):
         # if token_refreshed:
         #     auth_token.token = client_auth.model_dump()
         #     await self.set_token(

models/api/finstitutions/payments/request.py

@@ -150,10 +150,16 @@ class PaymentRequestMetadata(BaseModel):
 class PGPaymentRequestData(BaseModel):
 
     tokenKey: ObjectId = Field(
-        description = "the auth token to use to send this message",
+        description = "the auth token of the account that must be used to request the payment",
         frozen = True,
     )
 
+    paymentId: ObjectId | None = Field(
+        description = "if you had queued the payment request separately, pass the id here",
+        frozen = True,
+        default = None
+    )
+
     customerName: str | None = Field(
         description = "the name of the registered customer who must make the payment",
         frozen = True,
@@ -222,7 +228,7 @@ class PGPaymentRequestData(BaseModel):
     # ┃┃┏┓┃┓┏┫┏┓╋┓┏┓┏┓
     # ┗┛┗┻┗┗┗┻┗┻┗┗┗┛┛┗
 
-    @field_validator("tokenKey", mode = "before")
+    @field_validator("tokenKey", "paymentId", mode = "before")
     def parse_oid(cls, value):
         try: value = ObjectId(value)
         except: pass