# `/api` repo

This repository contains the code for Vector API. It's primarily a PHP-based codebase, some of which is PHP-classic a.k.a. non-MVC. The MVC is Zend 1. It accepts requests from [OA/Workstation](https://github.com/theorchard/orchard).

## Getting Started

See [this Notion doc](https://www.notion.so/PHP-Monolith-Development-1b899e3ad94143b6a3fbdcb6834d4b1b) for how to get started with development using either a dev box or running locally.

## Development

### Database

Typically, your squad will have it's own mysql instance (running `art_relations` and other databases), and you will usually also be granted read-only permission to the PROD replica, `reportsar`.

### Pull Requests

Code should be [PSR-2](https://github.com/theorchard/orchard/wiki/PSR-2-Coding-Standard) compliant.

### Missing a Configuration Variable? Please Contribute!

During development, you may run into a config that has not been captured by the ansible script.

An uncaptured config can typically be identified by the fact that it's value has not been templated in `{{ HANDLEBAR }}` format, and is still set to a value on the lines of `"REPLACE_ME"` or `"CHANGE_ME"` or some other non-unique string.

If it doesn't exist in the [ansible `devorch` variables file](https://github.com/theorchard/ansible-dev-box-setup/blob/master/config/vars.devorch.yml):

- **Create the new config:** Pick a unique name for your config like `NOTIFICATION_EMAIL_ADDRESS` and put it in the [variables file](https://github.com/theorchard/ansible-dev-box-setup/blob/master/config/vars.devorch.yml) so that it gets picked up for translating the shadow files task.
- **Update the shadow file:** In the `/api` repo, update your shadow to have the value be your new template variable.

#### Example shadow update:
In some file like `/application/configs/someconfig.shadow.ini` you will want to update from:

```Makefile
NOTIFICATION_EMAIL_ADDRESS= REPLACE_ME
```
to:
```Makefile
NOTIFICATION_EMAIL_ADDRESS= "{{ NOTIFICATION_EMAIL_ADDRESS }}"
```

## Verifying Setup

### Access Token

VAPI endpoints are protected by access tokens that were previously exchanged
with/looked up by caller clients.  You will need to obtain a currently valid
access token in order to make calls to the endpoints.  In the case of endpoints
that are scoped at the vendor level, you must provide an access token
corresponding to a user associated with that vendor.

1. Log in to OA/WS as the user in question.  Example: 'Patrick Walch' of
Nuclear Blast Entertainment, vendor_id = 17989

1. Find the user id of this user with respect to the application:

    Workstation:

    ```
    select id from vend_contact as vc join contact as c on vc.contact_id =
    c.contact_id where c.contact_first_name = 'Patrick' and c.contact_last_name =
    'Walch' and vc.vendor_id = <some_vendor_id>
    ```

    OA:

    Find the OA user id within OA itself, or try:

    ```
    select id from orchadmin_users where f_name = '<first_name' or l_name =
    '<last_name>' or email = '<email>'
    ```


1. Find the access token for this user id:

    Workstation:

    ```
    select oauth_token from vectorapi_access_tokens where user_id=<some_user_id> and
    user_type = 'alw'
    ```

    OA:

    ```
    select oauth_token from vectorapi_access_tokens where user_id=<some_user_id> and
    user_type = 'oa'
    ```

#### Param vs. Request Header

The access token can be provided as either a URL param or as part of the
request header.  _BE AWARE_ of the naming difference in how the access token is
provided in both cases:

Query Param: `...&access_token=<some_token>`

Request Header: `access-token=<some_token>`

### Verify Country List

If everything worked, you should be able to see a country list at:

[https://vapi.{{username}}.{{squad}}.devorch.com/vectorapi/country?access_token={{access_token}}]()

### Verify Data Warehouse

To validate datawarehouse/redshift settings are correct:

[https://vapi.{{username}}.{{squad}}.devorch.com/datawarehouse/countries/index?access_token={{access_token}}]()

### DO NOT FORGET:

Use **HTTPS** and NOT **HTTP** for vapi calls