From 0a308a545109450c8684d2b142daf1bf4336f72e Mon Sep 17 00:00:00 2001
From: Mark Williams <mark.williams@diamond.ac.uk>
Date: Fri, 24 Jul 2026 15:11:48 +0100
Subject: [PATCH] LIMS-2282: Use the same callback URL for both incoming and
 outgoing dewars

---
 .../Controllers/AuthenticationController.php  |  2 +-
 api/src/Page/Shipment.php                     | 51 ++++++++++++++-----
 2 files changed, 38 insertions(+), 15 deletions(-)

diff --git a/api/src/Controllers/AuthenticationController.php b/api/src/Controllers/AuthenticationController.php
index 23f83a8b1..d929cc04e 100644
--- a/api/src/Controllers/AuthenticationController.php
+++ b/api/src/Controllers/AuthenticationController.php
@@ -118,7 +118,7 @@ private function checkAuthRequiredForSpecificSituations($parts): bool
             ($parts[0] == 'shipment' && $parts[1] == 'containers' && $parts[2] == 'history' && in_array($_SERVER["REMOTE_ADDR"], $bcr)) ||
 
                 # Allow shipping service to update dewar status
-            ($parts[0] == 'shipment' && $parts[1] == 'dewars' && ($parts[2] == 'confirmdispatch' || $parts[2] == 'confirmpickup'))
+            ($parts[0] == 'shipment' && $parts[1] == 'dewars' && $parts[2] == 'confirm')
             )
             {
                 $need_auth = false;
diff --git a/api/src/Page/Shipment.php b/api/src/Page/Shipment.php
index f4b897ad4..fb31bc4b6 100644
--- a/api/src/Page/Shipment.php
+++ b/api/src/Page/Shipment.php
@@ -155,6 +155,7 @@ class Shipment extends Page
         'PROPOSALTYPE' => '\w+',
         'pickup_confirmation_code' => '\w+',
         'status' => '\w+',
+        'journey_type' => '\w+',
 
         'manifest' => '\d',
         'currentuser' => '\d',
@@ -210,8 +211,7 @@ class Shipment extends Page
 
         array('/dewars/transfer', 'post', '_transfer_dewar'),
         array('/dewars/dispatch', 'post', '_dispatch_dewar'),
-        array('/dewars/confirmdispatch/did/:did/token/:TOKEN', 'post', '_outgoing_shipment_confirmation'),
-        array('/dewars/confirmpickup/sid/:sid/token/:TOKEN', 'post', '_incoming_shipment_confirmation'),
+        array('/dewars/confirm/did/:did/token/:TOKEN', 'post', '_shipment_confirmation'),
 
         array('/dewars/tracking(/:DEWARID)', 'get', '_get_dewar_tracking'),
 
@@ -1109,7 +1109,7 @@ function _dispatch_dewar_shipment_request($dewar)
             array($token, $external_id)
         );
 
-        $callback_url = "/api/shipment/dewars/confirmdispatch/did/{$external_id}/token/{$token}";
+        $callback_url = "/api/shipment/dewars/confirm/did/{$external_id}/token/{$token}";
         $external_shipping_id = $this->_create_dewars_shipment_request($dewars, $proposal, $session_number, $external_id, $shipping_id, $callback_url);
 
         $this->db->pq(
@@ -1403,15 +1403,43 @@ function _dispatch_dewar()
         }
     }
 
-    function _outgoing_shipment_confirmation()
+    function _shipment_confirmation()
     {
+        if (!$this->has_arg('journey_type'))
+            $this->_error('No journey type specified');
         if (!$this->has_arg('did'))
             $this->_error('No dewar specified');
-        if (!$this->has_arg('TOKEN'))
-            $this->_error('No token specified');
         if (!$this->has_arg('status'))
             $this->_error('No status specified');
 
+        $dew = $this->db->pq(
+            "SELECT d.shippingid,
+                json_unquote(json_extract(d.extra, '$.token')) as token
+                FROM dewar d
+                WHERE d.dewarid=:1",
+            array($this->arg('did'))
+        );
+        if (!sizeof($dew))
+            $this->_error('No such dewar');
+        else
+            $dew = $dew[0];
+
+        if (!$this->has_arg('TOKEN') || $this->arg('TOKEN') !== $dew['TOKEN']) {
+            $this->_error('Incorrect token');
+        }
+
+        if ($this->arg('journey_type') === 'TO_FACILITY') {
+            $this->set_arg('sid', $dew['SHIPPINGID']);
+            $this->_incoming_shipment_confirmation();
+        } else if ($this->arg('journey_type') === 'FROM_FACILITY') {
+            $this->_outgoing_shipment_confirmation();
+        } else {
+            $this->_error('Invalid journey type');
+        }
+    }
+
+    function _outgoing_shipment_confirmation()
+    {
         if ($this->arg('status') === 'CREATED') {
             $this->_cancel_dispatch_dewar_confirmation();
         } else if ($this->arg('status') === 'BOOKED' || $this->arg('status') === 'PENDING') {
@@ -1563,13 +1591,6 @@ function _cancel_dispatch_dewar_confirmation()
 
     function _incoming_shipment_confirmation()
     {
-        if (!$this->has_arg('sid'))
-            $this->_error('No shipment specified');
-        if (!$this->has_arg('TOKEN'))
-            $this->_error('No token specified');
-        if (!$this->has_arg('status'))
-            $this->_error('No status specified');
-
         if ($this->arg('status') === 'CREATED') {
             $this->_cancel_pickup_dewar_confirmation();
         } else if ($this->arg('status') === 'BOOKED' || $this->arg('status') === 'PENDING') {
@@ -3514,6 +3535,8 @@ function _create_shipment_shipment_request($shipment, array $dewars): int
     {
 
         $shipping_id = (int) $shipment['SHIPPINGID'];
+        // Any dewar id is ok for callback as it will be converted back to a shipping id
+        $dewar_id = (int) $dewars[0]['DEWARID'];
 
         $token = Utils::generateRandomMd5(7);
         $this->db->pq(
@@ -3521,7 +3544,7 @@ function _create_shipment_shipment_request($shipment, array $dewars): int
             array($token, $shipping_id)
         );
 
-        $callback_url = "/api/shipment/dewars/confirmpickup/sid/{$shipping_id}/token/{$token}";
+        $callback_url = "/api/shipment/dewars/confirm/did/{$dewar_id}/token/{$token}";
 
         $external_shipping_id = $this->_create_dewars_shipment_request(
             $dewars,