PST Travel Corporate Booking Tool — Screenshot Findings

Summary

Corporate travel orchestration, not only search

The application combines travel discovery with traveller identity, company policy, approvals, order operations, group travel, spend reporting, billing, and credit control.

Observation REA was used to authenticate, inspect rendered pages, capture network metadata, exercise hotel and flight searches, and analyze loaded JavaScript. [E0–E10]

SearchFlight and hotel discovery with traveller, preference, policy, and company context.
TripsFlight orders, hotel orders, lifecycle states, and trip files.
Group BookingsEvent-based group travel combining hotel and flight requirements.
ApprovalsApplicant and reviewer queues driven by configurable processes.
FinanceSpend analytics, transactions, reports, billing, and credit.
TeamDepartments, users, roles, and traveller records.
Account SettingsCompany configuration, policies, approvals, preferences, blocklists, and reference data.

Verified depthLive flight search reached 47 KUL–SIN options. Live hotel search reached Kuala Lumpur properties and policy-aware filters. No fare or property was selected and no order was created. [E9] [E10]

Observation

Access and architecture

The public page provides email/password login, registration, password recovery, language selection, Terms of Use, and referral terms. The authenticated menu is loaded from role and permission services. [E0] [E1]

PST Travel public login page — **Public login.** Credential fields, legal links, registration, recovery, and language selection. [E0]

Authentication trace

Company lookup: /api-v1/b2b-api/auth/queryCompanyByEmail.
NextAuth providers and CSRF state.
Credentials callback and session retrieval.
Dashboard bootstrap: user, currency, billing alerts, menu tree, permissions, policy, loyalty, history, popular cities, and hotel home. [E1]

Application shape

Next.js/React frontend, version markers for v2.9.8. Static coverage: 55 scripts and 524,622 AST nodes with no parse failures; source maps unavailable. API namespaces separate generic company data, flight, hotel, approval, and finance functions. [E2]

Observation

Search

Flight workflow

One-way, round-trip, and multi-city journeys; direct-only; airport lookup; dates; cabin; travellers; and trip purpose. Airport search calls /flight/b2b-api/airports/search, traveller lookup calls /b2b-api/userList, and submission calls POST /flight/b2b-api/search. [E10]

**Flight search home.** Trip type, direct-only, route, dates, cabin, travellers, and purpose.

Flight origin autocomplete — **Origin autocomplete.** City, all-airport, and individual-airport choices.

Flight destination autocomplete — **Destination autocomplete.** Singapore city and airport matches.

Company traveller selection — **Traveller directory.** Existing company users can be selected; Add Guest is a separate action. Contains internal personal data.

Completed flight search form — **Search-ready form.** KUL–SIN, round trip, one passenger, economy, and business purpose.

KUL to SIN flight search results — **Flight results.** Recommended, Direct, and Cheapest summaries; stops, time, airline, airport, policy, and more filters; result rows and Flight Details. The capture returned 47 flights. Prices are transient. [E10]

Hotel workflow

Destination, dates, rooms/adults, Popular Cities, Recommended Hotels, and Favorites. Results combine inventory with company policy data and expose budget, preferred, group/brand, property type, star, facilities, amenities, and frequent-address context. [E9]

**Hotel search home.** Destination, dates, occupancy, traveller, popular cities, recommendations, and favorites.

Hotel destination suggestions — **Destination autocomplete.** Kuala Lumpur location result from `/hotel/b2b-api/search/location2`.

Kuala Lumpur hotel results — **Hotel results.** Company-preferred properties, rich filters, frequent addresses, ratings, distance, and current prices. Prices and inventory are transient. [E9]

Observation

Trips

The post-booking area separates Hotel, Flights, and My Reservations. Flight status includes Payment Pending, Pending Ticketing, Ticketed, Cancelled, and partial/full refund or change states. Hotel status includes Upcoming, To be Confirmed, Confirmed, Completed, Pending Cancellation, and Cancelled. [E4]

Flight order list — **Flight orders.** Status tabs, filters, passenger, route, approval/policy, payment, cost, and operations.

Hotel order list — **Hotel orders.** Booking lifecycle tabs and booking, guest, property, creator, payment, and policy filters.

Trip files view — **Trip files.** My Reservations and Add New Trip File, backed by `/b2b-api/trip-file/page`.

Observation

Group Bookings

Event-oriented group travel. Events can hold hotel dates and room/adult counts, multiple flight segments, traveller counts, and a contact. List endpoint: /b2b-api/groupBooking/queryEventList. [E6]

Group booking event list — **Event list.** Search by event, ID, or email; combined hotel and flight requirements.

Create group booking event modal — **Create Event.** Required name/contact fields, purpose, and Hotel/Flights switches. The form was not saved.

Observation

Approvals

Operational queues are split into My Applications and My Approvals with reference, status, and type filters. The captured account had zero current items. Workflow definitions live under Account Settings. [E3] [E8]

Observation

Finance

Finance covers aggregate spend, transaction operations, reporting, and company credit. Credit alerts are documented at 80%, 90%, and 100% usage thresholds. [E5]

Finance transactions — **Transactions.** Hotel/Flights selector, financial totals, filters, and export.

Finance reports — **Reports.** Product-specific order filters and export.

Billing and payments — **Billing & Payments.** Credit limit, usage, availability, alerts, and traveller usage.

Observation

Team

Department hierarchy and user administration: Add Department, Add Account, Import/Export, name/email/role filters, and a member table. The same user directory supplies travellers to flight search. [E3] [E10]

Observation

Account Settings

The administrative control plane for company identity, booking defaults, recommendation data, policy, approval, preference, and eligibility rules. [E7] [E8]

Company settings — **Company.** Settlement currency, payment and credit, billing, guests, booking information, loyalty, and domain whitelist.

Recommended hotel settings — **Recommended Hotel.** Add, search, list, and remove company-recommended properties.

Popular city settings — **Popular City.** Ordered city/country list used by hotel discovery.

Hotel travel policy settings — **Hotel Travel Policies.** Enablement, mixed-policy handling, budget precedence, booking window, and star limits.

Flight travel policy settings — **Flight Travel Policies.** Budget, lowest-fare relationship, booking window, cabins, and mixed-passenger policy.

Travel approval process settings — **Travel Approvals.** Hotel, flight, or combined processes with policy-condition rules, notifications, approval requests, and reviewers.

Flight preference settings — **Flight Preference.** Airline and alliance/group preference dimensions that affect default recommendation order.

Hotel blocklist settings — **Hotel Blocklist.** Group, brand, and single-property dimensions with status controls.

Region blocklist settings — **Region Blocklist.** Country and city exclusions with date and status controls.

Flight blocklist settings — **Flight Blocklist.** Airline, alliance/group, and codeshare dimensions.

Frequent address settings — **Frequent Address.** Reusable address name, detail, city/country, edit, and delete operations.

Inference

How the modules probably work together

Team

Settings

Results

Order & approval

Trips

Finance

Inference Team supplies identities; Settings supplies constraints; Search evaluates inventory; Approvals governs exceptions; Trips manages orders; Finance aggregates monetary effects.
Inference Recommended Hotels, Popular Cities, flight preferences, and blocklists change ranking or eligibility. Matching configuration and search APIs were observed, but payloads were not retained to prove each transformation.
Inference Team accounts double as traveller profiles because the flight form queries the company user list.
Inference Policy compliance probably controls direct booking, notifications, or approval applications. No out-of-policy order was submitted.
Inference Trip files are journey containers linking separately created flight and hotel orders.
Inference Group Booking is a parallel event-planning path that may convert into ordinary orders; the post-save flow was not observed.

Unknown

Unresolved behavior

Checkout and order creation: fare/property selection, rates, rooms, ancillaries, repricing, payment, confirmation, vouchers, and tickets.
Policy evaluation internals: precedence, conflicts, and server enforcement.
Approval actions: approve, reject, return, delegate, escalation, and notifications.
Post-booking changes: cancellation, refunds, exchanges, partial changes, and failure recovery.
Group Booking after Save: traveller collection, quotation, supplier work, approval, and order conversion.
Imports/exports: formats, validation, and limits.
Other roles: traveller-only, reviewer-only, finance-only, and super-admin surfaces.
/quotation: discovered statically but absent from this account’s menu. [E2]
Supply and payment providers: GDS/NDC/wholesaler details and actual Airwallex transaction use.
Security posture: not assessed; this was functional inspection, not penetration testing.

Coverage

Limits and confidence

Method	REA-controlled Chromium/CDP plus browser screenshots, authenticated navigation, DOM/accessibility inspection, network metadata, and static bundle analysis.
Account	One authenticated account in one MYR-settled company. Other roles and companies may differ.
Mutation boundary	Navigation and searches only. No account, setting, policy, event, approval, order, or payment was created or changed.
Dynamic coverage	Every visible top-level module, every visible settings subsection, all three blocklist dimensions, flight results, and hotel results.
Static coverage	55 dashboard-loaded scripts; 524,622 AST nodes; no parse failures; no source maps.
Network coverage	Paths, methods, statuses, and header names. Request/response bodies and header values were not retained.
Screenshot limit	Viewport captures at 1920×817. Long tables continue below the viewport. Each image records one observed UI state, not all possible records.
Freshness	Availability, prices, result counts, dates, bookings, balances, and settings reflect the capture session only.

Sensitive materialScreenshots contain internal company, booking, traveller, policy, financial, and address data. Keep this report within authorized storage. The login password is not present in the HTML or screenshots.

REA credential-redaction issueThe earlier REA evidence capture returned literal credentials in Evidence parameters despite documented redaction. The defect was reported. Rotate the supplied password and treat E1 as sensitive.

Reference

Evidence register

Evidence IDs refer to the REA MCP records supporting the textual findings. Screenshots are stored locally under Findings/assets/.

Ref	Evidence ID	Scope
E0	ev_840f31515f0c5f25c9313d5ea3845171811f4439dab2d9399833440d031cff25	Public login and scripts.
E1	ev_a7b84b8fbbbdd0254d7628ef3d22819e24034954271d363c6012603d850fb9c2	Authentication and dashboard bootstrap; sensitive.
E2	ev_b6038d39f769d3e253a461d2451c75d7819442836b6b89ae4c6abf7f1f3e40f7	Static bundle analysis.
E3	ev_944c4a3bcd9f0507dc79f253bdee4b935410ec308941a9500010b343e004b38f	Top-level module walkthrough.
E4	ev_9b153317d6d4dfd6141bcbdec47ae8c4eae44ac9bc21079ee7846abb8519fa88	Trips, orders, and trip files.
E5	ev_ac4cc876296e079888c0c209fdbd6d78d807ca4e7e449845efa6a956f95d9f97	Finance subsections.
E6	ev_5d7e6181e58584970b995c2cb31b1e9b092203873dcbf1947f7a52c69d451490	Group Booking workflow.
E7	ev_07634fb3cb8faabf89043a3f4a36217e15bbc0f037d527fcb2a9b71e2a973ad6	Account Settings subsections.
E8	ev_c24275298964a2439dbf79dc231ed1df2225cbb5a23fa1f97b7bc1d04c53a312	Hotel/flight policies and approvals.
E9	ev_98fab563aceae7815826c600a9e578e4c0635de0f332b67019d644d6ccd7dc55	Hotel search and results.
E10	ev_9b5200aadc90c966c24c211cd4dbfa9139fe07b379abf26d91f642526b0705b5	Flight search and results.