Middleware — Google rates / ARI

Folder: src/routes/google-rates/
Mount: api/v1/bookdirect/google-rates
Status: to implement. Talks to GuestTraction / Google Hotel Ads. Core only stores the result.

Middleware · winner

POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/google-rates/push

POST https://middleware-dev.bookdirect.live/api/v1/bookdirect/google-rates/pull

GET https://middleware-dev.bookdirect.live/api/v1/bookdirect/google-rates/status/{property_uuid}

Frontend (owner / admin) calls these. The browser never talks to GuestTraction.

Push (outbound ARI)

Body:

{
  "property_uuid": "{property_uuid}",
  "from": "2026-10-01",
  "to": "2026-10-31"
}

Middleware:

1. Confirm JWT owns the property (Core GET property owned_by).
2. Read rooms, rate plans, bookings from Core.
3. Push room types, availability, rates, restrictions to GuestTraction.
4. Store sync status on property metadata (ari_last_push_at, ari_last_error).

Pull / check (inbound rates)

Used for price-match later. v1: return competitor or Google-quoted rates and optionally write extra_data.google_rate_ngn on the rate_plan via Core PUT. Do not invent a Middleware-only rate table as source of truth.

IDOR

Owners only push/pull their property_uuid. Admin may use a Core role. Inbound OTA stubs must not update inventory without auth (legacy /api/ota/ari-push was ACK-only — keep it that way until a signed contract exists).