Files
Flights/FlightsTests
Trey T 92a69cf16c Add Sun Country (SY) load integration
Sun Country runs Navitaire (same PSS as JSX) but exposes their public
availability search endpoint that returns BETTER load data than AA:
per-flight `capacity` AND `sold` (booked passenger count), so we can
compute exact load factor.

Implementation:
- AirlineLoadService.fetchSunCountryLoad: POSTs to
  syprod-api.suncountry.com/api/nsk/v4/availability/search/simple.
  Parses results→trips→journeysAvailableByMarket, matches by flight
  number, pulls capacity + sold + equipmentType from legInfo.
- Returns a single Economy CabinLoad with capacity/booked = sold.
  No standby program — SY is single-cabin Y.
- Auth: Azure APIM subscription key + a long-lived dotREZ JWT
  (both static, captured from suncountry.com network traffic, neither
  is a user session token).
- Anti-bot: Imperva WAF in front of syprod-api.suncountry.com is gated
  on User-Agent + Referer + Origin headers. applySunCountryBrowserHeaders
  mirrors the pattern we use for UA / AA. NO WebView needed.
- Explicit ⚠️ log when 403 Incapsula response detected, pointing at
  the header helper.

Test infrastructure:
- knownDailyFlights now carries a dayOffset (today vs tomorrow) per
  carrier — different upstreams have different snapshot windows:
  AM is T-1d..T+0 (today); SY's Navitaire only returns future flights
  (tomorrow); others default to tomorrow as a safer choice.
- Added test_SY_sunCountry with hubs MSP/LAS/MCO/DEN. Fallback is
  SY104 LAS-MSP tomorrow.

Docs:
- AIRLINE_INTEGRATION_GUIDE: SY status row + full section 5c covering
  endpoint, auth, headers, response shape, failure modes, and how to
  re-capture tokens when they rotate.

Reverse-engineering notes:
- SY app is Flutter (Dart AOT) — bridge smali is minimal. Strings
  extracted from libapp.so revealed isNonRevTrip/isStandby/
  inventoryControl keywords + the syprod-api hostname.
- Token endpoint is PUT (not POST). Returns {"data":null} — token is
  the existing Authorization JWT, not a session refresh.
- Confirmed working from plain curl with browser headers (no Imperva
  TLS-fingerprint gate beyond UA/Referer/Origin).

Test run 2026-05-26 (xcodebuild test):
   AA, AM, AS, B6, EK, KE, SY (capacity=186 sold=184 load=99%), UA
  ⏭️ XE
  8 passing, 1 skipped, 0 failures, 11s total.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-26 20:30:55 -05:00
..