Plugin 1.1.16-dev
Alya Hotel System
WordPress booking layer for hotels and flights via Nuitee Connect (LiteAPI). Browser → REST alya/v1 only. WooCommerce is not the payment engine. This is not a hotel PMS. On WordPress, the same pack is a single page via [alya_documentation] (preview: portal-preview.html).
Who it is for
Agencies that integrate the plugin: Administrator, Agency Admin, Agency Staff. Not a traveler booking help site.
Supplier of record
LiteAPI bookingId. Local CPT and tables are mirrors.
Contact
https://alyatrip.com · contact@alyatrip.com · +213 550 108 856
Features
Only features evidenced in the plugin. Status vocabulary: AVAILABLE, PARTIALLY IMPLEMENTED, CONFIGURATION REQUIRED, DEPENDENCY REQUIRED, PLANNED, NOT FOUND.
Hotel search and book
Public funnel: search, fiche, rates, prebook, Stripe Payment SDK, book.
- Purpose
- Obtain a LiteAPI hotel
bookingId without exposing API keys in JavaScript.
- Screenshot
screenshots/live/02-hotels-01-search-page.png, 04-checkout-02-prebook-pay.png- Functions
- Shortcodes
alya_hotel_search, alya_hotel_details, alya_hotel_rates, alya_hotel_checkout, alya_hotel_confirmation.
- User roles
- Traveler (public). Agent book is a separate admin page.
- Workflow
- SearchFicheRatesPrebookPayBook
- Configuration
- LiteAPI key in vault. Stripe
pk_ via constant or payment-wrapper. Min-rates default off.
- Related
- Hotel cancel is staff-only. Prebook ≠ reservation.
- Status
- AVAILABLE (Stripe pk often CONFIGURATION REQUIRED)
Flight search and book
IATA search, verify, extras before book, prebook with usePaymentSdk, book with server-side TRANSACTION_ID.
- Purpose
- Confirmed flight booking through the same WordPress REST isolation.
- Screenshot
screenshots/live/05-flights-01-search.png (search). Search this pass: nonce expired.- Functions
- Shortcode
alya_flight_booking. Traveler cancel quote then confirm.
- User roles
- Traveler; staff can also cancel.
- Workflow
- SearchVerifyExtrasPrebookPayBook
- Configuration
- Same LiteAPI key. Flight prebook rate limit 8 / 600s. Circuit 5×429/60s.
- Related
- Post-book extras: NOT FOUND. Front must not send
transactionId.
- Status
- AVAILABLE in code; live CONFIRMED booking historically incomplete (UNKNOWN on a given host)
Agency cockpit
Staff UI at /function-user-settings/ plus WordPress Alya Hotels menu.
- Purpose
- Operate bookings without exposing the API vault to every staff user.
- Screenshot
screenshots/backoffice/01-dashboard-01-overview.png- Functions
- Dashboard, ops console, CRM, agent book, reports, documents, logs.
- User roles
- Administrator, Agency Admin, Agency Staff (caps differ).
- Workflow
- Login → cockpit or wp-admin → module allowed by cap.
- Configuration
- Roles registered by
AgencyRoles.
- Related
- Helpdesk shortcode
alya_support is not the LiteAPI chatbot.
- Status
- AVAILABLE
Documents (voucher / receipt)
Local HTML documents; PDF if Dompdf is installed. Invoice label requires SIRET + address.
- Purpose
- Issue a local voucher/confirmation/receipt from a bookingId.
- Screenshot
- Not captured. QR: NOT FOUND — do not invent.
- Functions
- Documents admin page; optional wp_mail attach.
- User roles
- View: Admin / Agency Admin / Staff. Manage documents: Administrator (matrix).
- Workflow
- Open Documents → issue → download PDF if vendor present.
- Configuration
- Prefixes in settings; invoice_enabled.
- Related
- Not a French tax invoice without legal fields.
- Status
- DEPENDENCY REQUIRED (Dompdf) / CONFIGURATION REQUIRED (invoice)
LiteAPI chatbot
Official script components.liteapi.travel/chatbot/v1.js?liteApiKey=.
- Purpose
- Hotel concierge widget on public pages.
- Screenshot
- Not captured. Capture the official launcher only.
- Functions
- Embed with public keys
sand_public_ / prod_public_.
- User roles
- Traveler sees the widget; Administrator configures the public key.
- Workflow
- Settings public key → widget loads on front.
- Configuration
- Never put a private
sand_/prod_ key in this field.
- Related
- Booking remains on the Nuitee widget unless separately bridged. Support form is a different shortcode.
- Status
- AVAILABLE (embed)
Modules
Implemented modules only. Room PMS, corporate TMS, and QR check-in are not modules of this product.
| Module | Purpose | Status |
|---|
| Public hotel funnel | Search → book via LiteAPI | AVAILABLE |
| Public flight funnel | Search → book; extras before book | AVAILABLE |
| Unified search | alya_unified_search | AVAILABLE |
| Traveler account | My bookings, FAQ, local wishlist | AVAILABLE |
| Agency cockpit + admin | Staff operations | AVAILABLE |
| CRM / agencies / customers | Local tables | AVAILABLE |
| Hotel / destination cache | Not PMS rooms | AVAILABLE |
| Pricing rules | Agency markup | AVAILABLE |
| Payments | TRANSACTION_ID + agent methods | AVAILABLE / CONFIG |
| Documents & mail | Voucher / receipt / wp_mail | PARTIAL / DEPENDENCY |
| Reports | Local CPT figures | AVAILABLE |
| Security & logs | Vault, redaction, circuit, GDPR | AVAILABLE |
| Room / allotment PMS | — | NOT FOUND |
| Corporate module | — | NOT FOUND |
Roles & permissions
WordPress roles registered by the plugin, plus the public traveler. Hotel Manager / Reception / Accountant are not registered.
| Role | Typical access | Restricted |
|---|
| Administrator | All Alya caps, vault, settings, purge | — |
| Agency Admin | Agent book, CRM, team, pricing, documents | Vault, purge, manage_options |
| Agency Staff | Read dashboard, CRM, reports, logs | Edit bookings, settings, vault |
| Traveler | Public shortcodes + nonce REST | Hotel cancel, cockpit |
Full matrix: audit/permissions-matrix.csv.
User guide
Task-oriented manuals live in Markdown. This page summarizes the traveler hotel path as it exists in the UI.
How to create a hotel reservation (traveler)
- Open the Hotels page (
[alya_hotel_search]).
- Enter destination, dates, occupancy and search.
- Open a hotel fiche.
- Load rates and choose an offer.
- Complete prebook (guest/holder).
- Pay in the Stripe box.
- Confirm book — only then is there a
bookingId.
- Generate a voucher from Documents only if staff issues one; travelers see confirmation/voucher shortcodes if those pages exist.
Role-specific files: user-guide/traveler.md, agency-admin.md, agency-staff.md, administrator.md.
Technical
Plugin header requires PHP ≥ 8.1. REST namespace alya/v1. Live runtime details stay internal.
REST
Namespace alya/v1. Public hotel/flight routes use wp_rest nonce. Staff routes use capabilities. API key never leaves the server.
Database
CPT alya_booking plus tables prefixed alya_hs_ (logs, webhooks, documents, CRM, flight sessions, …). Schema version in code: 1.1.21-perf-idx.
Not in plugin
License key system, native backup, QR, WhatsApp sender, CIB/Dahabia/PayPal.
Full write-up: technical/technical-documentation.md and technical/rest-api-reference.md.
Screenshots
Real captures 30 Aug 2026. No placeholders.
Public
Cockpit
Index: screenshots/SCREENSHOT-INDEX.md
VERIFIED LIVE — prebook only
Hotel booking
Search → fiche → rates → checkout → prebook → Pay. Payment submission not performed. bookingId not generated in this audit.
Guide: user-guide/hotel-booking-complete.md. API: /alya/v1/search → /prebook. /book not called this audit.
VERIFIED LIVE — nonce error
Flights
UI on /flights/. ALG–CDG search this pass: “Session de page expirée”. Do not claim a successful flight booking.
Guide: user-guide/flight-booking-complete.md. Post-book extras: NOT FOUND.
VERIFIED LIVE · SANDBOX
Back Office
Cockpit /function-user-settings/. Nine modules screenshot. Remaining hashes: SCREENSHOT REQUIRED (see back-office/README.md).
VERIFIED LIVE
Agencies
One agency in the test environment. Banner: unique agency, not a multi-tenant PMS. No Alya prepaid wallet UI. Not a published customer.
VERIFIED BOTH
Pricing
Global margin 10%. Overlay 0. Cap 90%. No second WordPress markup. PricingEngine injects LiteAPI margin.
OBSERVED / VERIFIED FORMULA
Commission
Reports: CA 3446.72 EUR, commission 313.30, markup 0.00. Estimate: selling × margin / (100 + margin) when net not persisted.
DEMONSTRATION ONLY: 110 EUR at 10% → commission 10 EUR. Not live data.
VERIFIED IN CODE · widget LIVE
Payments
Traveler: Stripe SDK → TRANSACTION_ID. Agency: traveler card, account card, LiteAPI wallet. Prepaid Alya ledger: not found. WooCommerce is NOT the engine. CIB/SATIM/PayPal: NOT FOUND.
VERIFIED LIVE
Reports & documents
Reports: local SQL, prebook excluded, not Analytics Connect. Documents: PARTIEL, SCREENSHOT REQUIRED. Voucher not generated this audit.
VERIFIED BOTH
Nuitee Connect / LiteAPI
Browser → alya/v1 → vault → api.liteapi.travel / book.liteapi.travel. Inbound supplier events are logged.
Dashboard fournisseur (nouvel onglet, pas le cockpit Alya). Canvas 14 août 2026 : connector/alya-connector-audit.html.
See technical/nuitee-liteapi-audit.md.
VERIFIED IN CODE
Security
Vaulted keys, nonce + rate limits, circuit breaker, log redaction, staff hotel cancel. No invented certifications. HMAC inbound OFF (live).
VERIFIED LIVE
Theme
Traveler 3.2.9, no child theme. hoteldz.tech is NOT the live theme. Alya injects shortcodes; Traveler owns header/footer.
VERIFIED LIVE · SSH read-only
Infrastructure
Hostinger de-fra-web2149.main-hosting.eu, PHP 8.5.4, WordPress 7.1, HTTPS. DNS records UNKNOWN. Passwords not in docs. Production modifications: NONE.
HTTPS on alyatrip.com. DNS records UNKNOWN. Production modifications: NONE. Runtime details stay internal.
NOT LIVE
hoteldz.tech migration
hoteldz.tech is not the installed theme. Traveler 3.2.9 is live. Alya shortcodes are theme-agnostic; chrome is not. Do not switch production.
Plan: theme-migration/
Limitations
- No live hotel/flight PASS this audit.
- Wallet is not an Alya ledger.
- Not a hotel PMS. Not CIB/SATIM/PayPal.
- CRM counts ≠ dashboard counts.
- See
audit/completeness-report.md.
FAQ
Is this a hotel PMS?
No. Rooms and rates come from LiteAPI. Admin “Hôtels” is a cache.
Does WooCommerce take the card?
No. Public payment is Nuitee Payment SDK (TRANSACTION_ID).
Can a traveler cancel a hotel?
No. Staff only. Flights: traveler can request a cancel quote then confirm.
Is there a QR voucher?
Not found in the plugin.
Is production certified?
Do not invent a PASS. Stay on sandbox keys until ops gates are green. Health warnings are not a PASS.
Where is the commercial deck?
Open presentation/index.html (no backend required).