DTC-795

[Jordan3900]

References: DTC-795

Code PR: https://github.com/GannettDigital/rentcafe/pull/40

Description:
Summary

Update the Yardi RentCafe proxy to support a simpler authorization model for DevHub while preserving backward compatibility with the existing GUID-based mechanism. The new model should allow DevHub requests to authenticate with a trusted HTTP Authorization header and identify the target property through a propertyId request parameter.

Background

Yardi offers RentCafe, a product used to host websites for rental properties, and provides APIs for building custom property pages. Example site: https://www.livespringside.com/ .

LocaliQ is entering the residential property website market and needs Yardi RentCafe functionality exposed through a LocaliQ-branded API. LocaliQ partnered with DevHub to build the property landing pages, while LocaliQ retains ownership of the Yardi integration.

The RentCafe proxy sits between DevHub and RentCafe. It is a Java Spring project that exposes LocaliQ APIs, calls the corresponding Yardi RentCafe APIs, and returns the Yardi response as the LocaliQ response.

Initially, DevHub’s client-side JavaScript was expected to call the LocaliQ API directly from the browser. To prevent property enumeration, support expiration of compromised API keys, and enforce CORS restrictions, the proxy implemented a GUID-based authorization mechanism. Each property is assigned a GUID, which is sent in the Authorization header and used both to authenticate the request and identify the property.

The GUID-based model is secure, but operationally difficult to manage because the RentCafe proxy has no UI and no database. GUID-to-property mappings are maintained in source control, making onboarding and disabling properties difficult for Product to manage.

DevHub will now create its own proxy to receive all API calls from its client. As a result, calls from DevHub to the LocaliQ proxy will originate from a specific network. Network restrictions were added in DTC-752, and FAM was removed. With these controls in place, the existing GUID-based model is more complex than necessary.

Development Task

Implement a new authorization path that accepts a trusted HTTP Authorization header value injected into the build through the standard LocaliQ security mechanism. This should be configured through an environment variable, similar to YARDI_RENTCAFE_USERNAME, YARDI_RENTCAFE_PASSWORD, and YARDI_RENTCAFE_CLIENT_ID.

Retain backward compatibility with the existing GUID-based authorization mechanism so DevHub’s implementation schedule does not need to be tightly coupled to this change.

Functional Requirements

Requests that provide a valid legacy GUID in the Authorization header must continue to work as they do today.

Requests that use the new trusted Authorization header must include a propertyId request parameter.

If a request includes both a GUID and a propertyId, the request is valid, but the propertyId parameter must be ignored.

If a request includes a valid trusted Authorization header and an invalid propertyId, the proxy must return whatever response Yardi returns for that invalid propertyId.

The proxy must not maintain or validate an onboarded-property list.

The proxy should validate propertyId only for length. PropertyIds are alphanumeric strings.

Acceptance Criteria

Existing requests using a valid GUID continue to authorize and resolve the property using the current behavior.

Requests using the new trusted Authorization header are rejected unless a propertyId request parameter is provided.

Requests using the new trusted Authorization header and a syntactically valid propertyId are forwarded to Yardi.

Requests using the new trusted Authorization header and an invalid propertyId return Yardi’s response without additional LocaliQ property-onboarding validation.

Requests that include both a GUID and propertyId authorize through the GUID path and ignore propertyId.

The new authorization value is configurable through an environment variable and can be supplied through the standard LocaliQ secret-management process.

Existing tests are updated, and new tests cover the legacy GUID path, the new trusted-header path, missing propertyId, invalid propertyId, and the mixed GUID/propertyId case.

Documentation Requirements

Update all existing documentation to describe the new trusted Authorization header mechanism.

Document the required propertyId request parameter for the new authorization path.

Document the legacy GUID behavior and clearly mark it as deprecated.

Prepare the documentation in a format suitable for delivery to DevHub.

References

Source & setup instructions

Technical Design

API documentation for the LocaliQ Yardi RentCafe proxy

Source code and setup instructions

Yardi RentCafe API Postman collection

LocaliQ RentCafe proxy Postman collection

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[gemini-code-assist]

Code Review

This pull request updates several RentCafe API documentation files to include details about the two supported authorization mechanisms: the recommended trusted header (which requires a propertyId parameter) and the deprecated GUID token. It also adds corresponding curl examples for both methods. The review feedback suggests changing the plural phrasing "These endpoints" to the singular "This endpoint" across multiple files since each file only documents a single endpoint. Additionally, for consistency, it is recommended to move the placement of the Authorization section in _rentcafe_images_units.md to be after the parameters table.

[Copilot]

Pull request overview

Updates the RentCafe proxy API documentation to describe the new “trusted Authorization header + propertyId query param” authorization path while retaining and clearly labeling the legacy GUID token mechanism as deprecated, aligning the docs with the DTC-795 requirements.

Changes:

• Added an Authorization section to RentCafe endpoints documenting both trusted-header and legacy GUID token mechanisms, including propertyId requirements and precedence rules.
• Updated cURL examples across endpoints to show both authorization paths (trusted header with propertyId, and legacy GUID token without it).
• Minor doc hygiene updates (e.g., closing a missing code fence in the available slots doc).

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
source/includes/_rentcafe_property_pet_policy.md	Adds trusted-header + propertyId authorization docs and examples; retains deprecated GUID guidance.
source/includes/_rentcafe_property_office_hours.md	Adds trusted-header + propertyId authorization docs and examples; retains deprecated GUID guidance.
source/includes/_rentcafe_property_marketing_details.md	Adds trusted-header + propertyId authorization docs and examples; retains deprecated GUID guidance.
source/includes/_rentcafe_property_details.md	Adds trusted-header + propertyId authorization docs and examples; retains deprecated GUID guidance.
source/includes/_rentcafe_property_appointment_settings.md	Adds trusted-header + propertyId authorization docs and examples; retains deprecated GUID guidance.
source/includes/_rentcafe_property_amenities.md	Adds trusted-header + propertyId authorization docs and examples; retains deprecated GUID guidance.
source/includes/_rentcafe_images_units.md	Documents trusted-header + propertyId authorization and updates examples for /images/units.
source/includes/_rentcafe_images_property.md	Adds trusted-header + propertyId authorization docs and examples; retains deprecated GUID guidance.
source/includes/_rentcafe_floor_plans.md	Adds trusted-header + propertyId authorization docs and examples; retains deprecated GUID guidance.
source/includes/_rentcafe_create_appointment.md	Documents trusted-header + propertyId (query string) for POST create appointment; retains deprecated GUID guidance.
source/includes/_rentcafe_availability_slots.md	Adds trusted-header + propertyId authorization docs and examples; fixes code fence closure.
source/includes/_rentcafe_apartment_availability.md	Adds trusted-header + propertyId authorization docs and examples; retains deprecated GUID guidance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.