Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
74 commits
Select commit Hold shift + click to select a range
3c2135e
Bulk registration
SauravBizbRolly Mar 4, 2025
23cccac
Bulk registration
SauravBizbRolly Mar 11, 2025
83f693e
Bulk registration
SauravBizbRolly Mar 13, 2025
8ae4c09
Merge pull request #69 from toarunmishra/bulk_registration
sushant-bizbrolly Mar 13, 2025
cdd7b2a
add userName and password in Bulk registration
SauravBizbRolly Mar 31, 2025
128c8f9
add userName and password in Bulk registration
SauravBizbRolly Jun 19, 2025
a069382
Merge pull request #88 from toarunmishra/bulk_registration
SauravBizbRolly Jun 19, 2025
3fd079a
Merge remote-tracking branch 'upstream/develop' into enhancement
SauravBizbRolly Jun 19, 2025
fcbc3da
Merge pull request #90 from toarunmishra/3.3.0
drtechie Jun 19, 2025
5cd719d
remove unwanted line
SauravBizbRolly Jun 19, 2025
2a55c54
Merge pull request #91 from toarunmishra/3.3.0
SauravBizbRolly Jun 19, 2025
110fa59
fix code
SauravBizbRolly Jun 21, 2025
83d3387
Merge pull request #92 from toarunmishra/3.3.0
SauravBizbRolly Jun 21, 2025
b1a893f
fix code
SauravBizbRolly Aug 21, 2025
b67332f
fix code
SauravBizbRolly Aug 21, 2025
bdde896
fix code
SauravBizbRolly Aug 21, 2025
5315e05
fix code
SauravBizbRolly Aug 21, 2025
486d412
fix code
SauravBizbRolly Aug 21, 2025
4e5dab6
fix code
SauravBizbRolly Aug 21, 2025
cd7f567
fix code
SauravBizbRolly Aug 21, 2025
f06d077
fix code
SauravBizbRolly Aug 28, 2025
84b679a
fix code
SauravBizbRolly Aug 28, 2025
7b123e9
fix code
SauravBizbRolly Aug 28, 2025
a28294f
fix code
SauravBizbRolly Aug 28, 2025
093ba26
fix code
SauravBizbRolly Aug 28, 2025
8820fe2
Httpheader content disposition changed
ravishanigarapu Sep 2, 2025
2aab70e
Coderabbitai comments adrressed
ravishanigarapu Sep 2, 2025
20eaaed
Httpheader content disposition changed (#100)
ravishanigarapu Sep 2, 2025
e04b9e5
Compile error resolved
ravishanigarapu Sep 2, 2025
bd11453
Merge pull request #101 from PSMRI/feature/signaturerelease
SauravBizbRolly Sep 2, 2025
0addca8
fix code
SauravBizbRolly Sep 2, 2025
b313e03
Merge remote-tracking branch 'upstream/release-3.6.0' into release-3.6.0
SauravBizbRolly Sep 2, 2025
adc946d
Main branch changes missed (#102)
ravishanigarapu Sep 2, 2025
4e3a304
Feature/signaturerelease (#103)
ravishanigarapu Sep 2, 2025
875e40a
Feature/signaturerelease (#104)
ravishanigarapu Sep 10, 2025
41162a4
Update pom.xml
5Amogh Sep 25, 2025
27241e1
Cherry-pick the commits related to 3.5.0 form 3.6.0 (#106)
snehar-nd Sep 26, 2025
8fb55ce
fix:casesheet signature
vishwab1 Oct 29, 2025
45250ea
fix:pom file change
vishwab1 Oct 30, 2025
c824879
API changes in Signature enhancement for Casesheet (#107)
vishwab1 Oct 30, 2025
7231794
fix: pom version
vishwab1 Oct 30, 2025
e763f9f
Merge pull request #108 from PSMRI/vb/sign
snehar-nd Oct 30, 2025
3d22060
fix code
SauravBizbRolly Nov 7, 2025
226c101
Merge remote-tracking branch 'upstream/release-3.6.0' into release-3.6.0
SauravBizbRolly Nov 7, 2025
74cd354
fix code
SauravBizbRolly Nov 10, 2025
f719ba5
fix code
SauravBizbRolly Nov 10, 2025
bb00223
fix code
SauravBizbRolly Nov 10, 2025
d52c950
fix code
SauravBizbRolly Nov 10, 2025
86ed8cb
fix code
SauravBizbRolly Nov 10, 2025
3ae6436
fix code
SauravBizbRolly Nov 10, 2025
67a4240
fix code
SauravBizbRolly Nov 10, 2025
f8e646e
fix code
SauravBizbRolly Nov 10, 2025
8c48069
fix code
SauravBizbRolly Nov 11, 2025
5f8dcf2
fix code
SauravBizbRolly Nov 11, 2025
30d3317
fix code
SauravBizbRolly Nov 11, 2025
6f5a101
fix code
SauravBizbRolly Nov 11, 2025
1d45257
Merge branch 'release-3.6.1' into release-3.6.0
5Amogh Nov 17, 2025
0acb505
Merge pull request #109 from PSMRI/release-3.6.0
5Amogh Nov 17, 2025
608773a
fix: amm-1927 send headers only if the request is from the allowed or…
5Amogh Nov 17, 2025
5a7c6bf
fix: amm-1927 coderabbit fixes
5Amogh Nov 17, 2025
ad6ff5e
Update regex handling for localhost URLs
5Amogh Nov 18, 2025
eb98a5a
Enhance regex pattern for URL matching
5Amogh Nov 18, 2025
bffa971
Merge pull request #110 from PSMRI/amm-1927
5Amogh Nov 20, 2025
c6ded08
Merge branch 'release-3.6.0' into release-3.5.0
5Amogh Dec 3, 2025
2a04bfb
Merge pull request #111 from PSMRI/release-3.5.0
5Amogh Dec 3, 2025
75d06ca
Merge pull request #112 from PSMRI/release-3.6.1
5Amogh Dec 3, 2025
b421d8b
fix code
SauravBizbRolly Dec 3, 2025
9c206a4
Merge remote-tracking branch 'upstream/release-3.6.0' into release-3.6.0
SauravBizbRolly Dec 3, 2025
76db67c
fix code
SauravBizbRolly Dec 3, 2025
d5b3e20
Merge branch 'main' into release-3.6.0
SauravBizbRolly Jan 14, 2026
711128e
fix vulnerabilitie code
SauravBizbRolly Jan 14, 2026
091bd75
Merge pull request #115 from PSMRI/fix/vulnerabilitie
SauravBizbRolly Jan 14, 2026
f76f68c
fix security hotspots
SauravBizbRolly Jan 14, 2026
a52081b
Merge pull request #116 from PSMRI/fix/remove_log
SauravBizbRolly Jan 14, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 12 additions & 8 deletions pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
<modelVersion>4.0.0</modelVersion>
<groupId>com.iemr.admin</groupId>
<artifactId>admin-api</artifactId>
<version>3.4.0</version>
<version>3.6.0</version>
<packaging>war</packaging>
<name>Admin-API</name>
<description>Admin Page</description>
Expand Down Expand Up @@ -54,6 +54,10 @@
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-xml</artifactId>
</dependency>
Comment on lines +57 to +60
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ› οΈ Refactor suggestion | 🟠 Major

🧩 Analysis chain

Specify explicit version for jackson-dataformat-xml to align with Jackson ecosystem.

The dependency lacks an explicit <version> tag. Since the project pins Jackson core (2.17.0-rc1) and databind (2.17.0-rc1), add an explicit version to ensure consistency and avoid runtime mismatches.

Apply this diff to pin the version:

 		<dependency>
 			<groupId>com.fasterxml.jackson.dataformat</groupId>
 			<artifactId>jackson-dataformat-xml</artifactId>
+			<version>2.17.0</version>
 		</dependency>

🌐 Web query:

What is the latest stable version of jackson-dataformat-xml and is it compatible with Jackson 2.17.0-rc1?

πŸ’‘ Result:

Latest stable jackson-dataformat-xml: 2.20.0 (released Aug 28, 2025). [1]

Compatibility: modules should generally match the Jackson 2.x minor version. For use with Jackson 2.17.0-rc1 you should stick to the 2.17.x xml module (e.g., 2.17.2) β€” mixing 2.20.0 with a 2.17.0-rc1 core is not recommended and may cause incompatibilities. [2][3]

Sources:

  • Jackson project releases (2.20.0 release listed). [1]
  • Maven/Central listings for jackson-dataformat-xml 2.17.x and 2.17.0-rc1. [2][3]

Specify explicit version for jackson-dataformat-xml; use stable 2.17.x release instead of RC.

The dependency lacks an explicit <version> tag, creating compatibility risk. Since the project pins Jackson core to 2.17.0-rc1, use a matching stable 2.17.x release (e.g., 2.17.2) rather than 2.17.0-rc1. Mixing 2.20.0 (the latest stable version) with 2.17.0-rc1 core is not recommended and may cause incompatibilities.

Apply this diff instead:

 		<dependency>
 			<groupId>com.fasterxml.jackson.dataformat</groupId>
 			<artifactId>jackson-dataformat-xml</artifactId>
+			<version>2.17.2</version>
 		</dependency>
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-xml</artifactId>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-xml</artifactId>
<version>2.17.2</version>
</dependency>
πŸ€– Prompt for AI Agents
In pom.xml around lines 57 to 60, the jackson-dataformat-xml dependency is
missing an explicit <version>, which can cause mismatches with the project's
Jackson core; add an explicit version tag and set it to a stable 2.17.x release
(for example 2.17.2) to match the project's 2.17 baseline and avoid mixing RC or
newer incompatible versions.

<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
Expand All @@ -73,6 +77,11 @@
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.21</version>
</dependency>
Comment on lines +81 to +84
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Verification agent

🧩 Analysis chain

commons-compress 1.21 is old; likely CVEs. Upgrade or let POI manage transitively.

Bump to a current secure version or remove the direct pin.

-			<groupId>org.apache.commons</groupId>
-			<artifactId>commons-compress</artifactId>
-			<version>1.21</version>
+			<groupId>org.apache.commons</groupId>
+			<artifactId>commons-compress</artifactId>
+			<version>REPLACE_WITH_SECURE_VERSION</version>

To check advisories:


🏁 Script executed:

#!/bin/bash
rg -n 'commons-compress'
# If feasible in your env:
# mvn -q org.owasp:dependency-check-maven:check -DskipTests

Length of output: 80


🌐 Web query:

latest version of Apache Commons Compress

πŸ’‘ Result:

Latest release: Apache Commons Compress 1.28.0 β€” released July 26, 2025. [1][2]

Sources:
[1] Apache Commons Compress overview/changes.
[2] Apache Commons Compress download / Maven coordinates.


🌐 Web query:

Apache Commons Compress 1.21 CVE

πŸ’‘ Result:

Apache Commons Compress 1.21 is affected by multiple denial‑of‑service vulnerabilities (notably CVE-2024-25710 β€” infinite loop when parsing DUMP files, and CVE-2024-26308 β€” out‑of‑memory during unpacking of malformed Pack200 files). Upgrade to Commons Compress 1.26.0 or later to fix these issues. [1][2][3]

Sources:

  • Apache Commons Compress security page (fixes listed, upgrade to 1.26.0). [1]
  • IBM security bulletin describing CVE-2024-25710 and CVE-2024-26308. [2]
  • Snyk vulnerability summary for commons-compress 1.21. [3]

Upgrade org.apache.commons:commons-compress to 1.28.0 or later
Addresses CVE-2024-25710 and CVE-2024-26308 and ensures you’re on the latest July 26, 2025 release.

-            <version>1.21</version>
+            <version>1.28.0</version>
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.21</version>
</dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.28.0</version>
</dependency>
πŸ€– Prompt for AI Agents
In pom.xml around lines 81 to 84 the project pins
org.apache.commons:commons-compress to 1.21 which is vulnerable; update the
<version> element to 1.28.0 or later for that dependency, save the POM, then
rebuild/verify (e.g., mvn -U clean verify or mvn dependency:tree) to ensure the
updated artifact is resolved and tests pass.

<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
Expand Down Expand Up @@ -181,12 +190,7 @@
<groupId>org.apache.poi</groupId>
<artifactId>poi-ooxml</artifactId>
<version>5.2.3</version>
<exclusions>
<exclusion>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
</exclusion>
</exclusions>

</dependency>

<!-- start newly added dependencies -->
Expand Down Expand Up @@ -275,7 +279,7 @@
</dependencies>

<build>
<finalName>${artifactId}-${version}</finalName>
<finalName>${project.artifactId}-${project.version}</finalName>
<plugins>
<plugin>
<groupId>org.owasp</groupId>
Expand Down
5 changes: 3 additions & 2 deletions src/main/java/com/iemr/admin/config/CorsConfig.java
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,9 @@ public void addCorsMappings(CorsRegistry registry) {
Arrays.stream(allowedOrigins.split(","))
.map(String::trim)
.toArray(String[]::new))
.allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
.allowedHeaders("*")
.allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS")
.allowedHeaders("Authorization", "Content-Type", "Accept", "Jwttoken",
"serverAuthorization", "ServerAuthorization", "serverauthorization", "Serverauthorization")
.exposedHeaders("Authorization", "Jwttoken")
.allowCredentials(true)
.maxAge(3600);
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,94 @@
package com.iemr.admin.controller.bulkRegistration;

import com.iemr.admin.repo.employeemaster.EmployeeMasterRepoo;
import com.iemr.admin.service.bulkRegistration.BulkRegistrationService;
import com.iemr.admin.service.bulkRegistration.BulkRegistrationServiceImpl;
import com.iemr.admin.service.bulkRegistration.EmployeeXmlService;
import com.iemr.admin.service.locationmaster.LocationMasterServiceInter;
import io.swagger.v3.oas.annotations.Operation;
import jakarta.servlet.http.Cookie;
import jakarta.servlet.http.HttpServletRequest;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.io.ClassPathResource;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

import java.lang.reflect.Method;
import java.util.HashMap;
import java.util.Map;

@RestController
public class BulkRegistrationController {
@Autowired
private EmployeeXmlService employeeXmlService;
@Autowired
BulkRegistrationServiceImpl bulkRegistrationServiceimpl;
private Logger logger = LoggerFactory.getLogger(this.getClass().getSimpleName());


@Autowired
BulkRegistrationService bulkRegistrationService;

@Autowired
private EmployeeMasterRepoo employeeMasterRepoo;
private Map<String, Object> errorResponse = new HashMap<>();
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ› οΈ Refactor suggestion

Remove unused field.

The errorResponse field is declared but never used.

Apply this diff:

-    private Map<String, Object> errorResponse = new HashMap<>();
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
private Map<String, Object> errorResponse = new HashMap<>();
πŸ€– Prompt for AI Agents
In
src/main/java/com/iemr/admin/controller/bulkRegistration/BulkRegistrationController.java
at line 37, the private field "errorResponse" is declared but never referenced;
remove the unused declaration to clean up the class and update imports if the
removal makes any import unused. Ensure no references exist elsewhere before
deleting the field.

@Autowired
private LocationMasterServiceInter locationMasterServiceInter;
private Map<String, Object> response = new HashMap<>();

@PostMapping(value = "/bulkRegistration", headers = "Authorization")
public ResponseEntity<Map<String, Object>> registerBulkUser(@RequestBody String m_user, @RequestHeader String authorization, @RequestParam String userName,
HttpServletRequest request, @RequestParam Integer serviceProviderID
) {

bulkRegistrationServiceimpl.bulkRegistrationErrors.clear();
logger.info("Bulk registration request received. Request payload is omitted from logs.");
try {
bulkRegistrationService.registerBulkUser(m_user, authorization,userName,serviceProviderID);
response.put("status", "Success");
response.put("statusCode", 200);
response.put("totalUser", bulkRegistrationServiceimpl.totalEmployeeListSize);
response.put("registeredUser", bulkRegistrationServiceimpl.m_bulkUser.size());
response.put("error", bulkRegistrationServiceimpl.errorLogs.toString());

bulkRegistrationServiceimpl.m_bulkUser.clear();
bulkRegistrationServiceimpl.m_UserDemographics.clear();
bulkRegistrationServiceimpl.errorLogs.clear();
bulkRegistrationServiceimpl.totalEmployeeListSize=0;

} catch (Exception e) {
response.put("message", e.getMessage());
response.put("statusCode", 500);

}
return ResponseEntity.ok(response);

}

@GetMapping(value = "/download-error-sheet", headers = "Authorization")
public ResponseEntity<byte[]> downloadErrorSheet() {
try {
byte[] fileContent = bulkRegistrationServiceimpl.insertErrorLog();

HttpHeaders headers = new HttpHeaders();
headers.add("Content-Disposition", "attachment; filename=error_log.xlsx");

if(!bulkRegistrationServiceimpl.bulkRegistrationErrors.isEmpty()){
bulkRegistrationServiceimpl.bulkRegistrationErrors.clear();
}
Comment on lines +75 to +82
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Potential race condition when clearing errors.

The error list is cleared after the file content is generated, which could cause issues if multiple concurrent requests download the error sheet. One request might clear the errors while another is still processing them.

Consider refactoring to:

  1. Make insertErrorLog() atomically retrieve and clear errors
  2. Add synchronization around the error collection access
  3. Return errors as part of the file generation and clear them within that method

Additionally, validate that errors exist before generating the file:

     @GetMapping(value = "/download-error-sheet", headers = "Authorization")
     public ResponseEntity<byte[]> downloadErrorSheet() {
         try {
+            if (bulkRegistrationServiceimpl.bulkRegistrationErrors.isEmpty()) {
+                return ResponseEntity.status(404)
+                    .body("No errors to download".getBytes());
+            }
+
             byte[] fileContent = bulkRegistrationServiceimpl.insertErrorLog();

             HttpHeaders headers = new HttpHeaders();
             headers.add("Content-Disposition", "attachment; filename=error_log.xlsx");

-            if(!bulkRegistrationServiceimpl.bulkRegistrationErrors.isEmpty()){
-                bulkRegistrationServiceimpl.bulkRegistrationErrors.clear();
-            }
             return ResponseEntity.ok()
                     .headers(headers)
                     .contentType(MediaType.APPLICATION_OCTET_STREAM)
                     .body(fileContent);

Committable suggestion skipped: line range outside the PR's diff.

return ResponseEntity.ok()
.headers(headers)
.contentType(MediaType.APPLICATION_OCTET_STREAM)
.body(fileContent);

} catch (Exception e) {
return ResponseEntity.status(500).body(null);
}
}


}
Original file line number Diff line number Diff line change
Expand Up @@ -30,16 +30,15 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.PropertySource;
import org.springframework.http.MediaType;

import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;

import com.fasterxml.jackson.databind.ObjectMapper;
import com.google.gson.Gson;
import com.google.gson.GsonBuilder;
import com.iemr.admin.data.employeemaster.M_Community;
import com.iemr.admin.data.employeemaster.M_Designation;
import com.iemr.admin.data.employeemaster.M_Gender;
Expand Down Expand Up @@ -1051,7 +1050,7 @@ public String getEmployeeByDesignation(@RequestBody String getDesignation) {

ArrayList<M_User1> employeeBydesiganation = employeeMasterInter.getEmployeeByDesiganationID(
employeeMaster.getDesignationID(), employeeMaster1.getServiceProviderID());

response.setResponse(employeeBydesiganation.toString());

} catch (Exception e) {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,28 +21,34 @@
*/
package com.iemr.admin.controller.employeemaster;

import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.util.Base64;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.PropertySource;
import org.springframework.http.ContentDisposition;
import org.springframework.http.HttpHeaders;
import org.springframework.http.InvalidMediaTypeException;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;

import com.google.gson.JsonObject;
import com.iemr.admin.data.employeemaster.EmployeeSignature;
import com.iemr.admin.service.employeemaster.EmployeeSignatureServiceImpl;
import com.iemr.admin.utils.mapper.InputMapper;
import com.iemr.admin.utils.response.OutputResponse;

import io.swagger.v3.oas.annotations.Operation;
import jakarta.servlet.http.HttpServletRequest;


@PropertySource("classpath:application.properties")
Expand All @@ -54,12 +60,10 @@ public class EmployeeSignatureController {
@Autowired
EmployeeSignatureServiceImpl employeeSignatureServiceImpl;

private InputMapper inputMapper = new InputMapper();

private Logger logger = LoggerFactory.getLogger(this.getClass().getSimpleName());

@Operation(summary = "Upload")
@RequestMapping(value = "/upload", headers = "Authorization", method = { RequestMethod.POST }, produces = {
@PostMapping(value = "/upload", headers = "Authorization", produces = {
"application/json" })
public String uploadFile(@RequestBody EmployeeSignature emp) {
Comment on lines +66 to 68
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Verification agent

🧩 Analysis chain

Drop mapping-level header constraint; declare consumes; return proper HTTP status codes.

headers="Authorization" is a brittle request-mapping condition, not authorization. Prefer Spring Security for auth and let the mapping match regardless of headers. Also declare consumes and return ResponseEntity with 2xx/4xx/5xx instead of always 200 with a JSON string.

Apply this diff to the mapping:

-@PostMapping(value = "/upload", headers = "Authorization", produces = {
-      "application/json" })
+@PostMapping(
+  value = "/upload",
+  consumes = "application/json",
+  produces = "application/json"
+)

Example minimal method refactor (outside the selected range):

public ResponseEntity<OutputResponse> uploadFile(@RequestBody EmployeeSignature emp) {
  OutputResponse body = new OutputResponse();
  try {
    if (emp == null || emp.getFileContent() == null) {
      body.setError("fileContent is required");
      return ResponseEntity.badRequest().body(body);
    }
    emp.setSignature(Base64.getDecoder().decode(emp.getFileContent()));
    Long id = employeeSignatureServiceImpl.uploadSignature(emp);
    body.setResponse(id.toString());
    return ResponseEntity.status(201).body(body);
  } catch (IllegalArgumentException e) { // invalid Base64
    body.setError("Invalid fileContent (Base64).");
    return ResponseEntity.badRequest().body(body);
  } catch (Exception e) {
    body.setError("Signature upload failed.");
    return ResponseEntity.internalServerError().body(body);
  }
}

To find other controllers still using the mapping-level header constraint:


🏁 Script executed:

#!/bin/bash
rg -nP '@(PostMapping|GetMapping|RequestMapping)\([^)]*headers\s*=\s*"Authorization"' -g 'src/main/java/**'

Length of output: 70355


Remove mapping-level headers="Authorization", declare consumes and return proper HTTP status codes

  • Drop headers="Authorization" from all controller mappings (found in 300+ endpoints)
  • Add consumes="application/json" on endpoints that accept JSON
  • Change return type to ResponseEntity<…> and return appropriate 2xx/4xx/5xx codes (e.g. 201 for create, 400 for invalid input, 500 on server error)
  • Delegate authorization to Spring Security filters rather than mapping conditions
πŸ€– Prompt for AI Agents
In
src/main/java/com/iemr/admin/controller/employeemaster/EmployeeSignatureController.java
around lines 63-65, the mapping currently declares headers="Authorization" and
returns a plain String; remove the mapping-level headers attribute, add
consumes="application/json" to the @PostMapping, change the method signature to
return ResponseEntity<?> and update the method to return appropriate HTTP status
codes (e.g., ResponseEntity.status(201) on successful create,
ResponseEntity.badRequest() for validation errors, ResponseEntity.status(500)
for unexpected errors), and ensure authorization is handled by Spring Security
filters rather than controller mapping attributes.

OutputResponse response = new OutputResponse();
Expand All @@ -83,22 +87,27 @@ public String uploadFile(@RequestBody EmployeeSignature emp) {
}

@Operation(summary = "User id")
@RequestMapping(value = "/{userID}", headers = "Authorization", method = { RequestMethod.GET })
@GetMapping(value = "/{userID}", headers = "Authorization")
public ResponseEntity<byte[]> fetchFile(@PathVariable("userID") Long userID) throws Exception {
Comment on lines +90 to 91
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ› οΈ Refactor suggestion

Remove header constraint from GET mapping; optionally declare produces.

Same rationale as POST. Since the response is binary and type varies, omit produces or use */*.

Apply this diff:

-@GetMapping(value = "/{userID}", headers = "Authorization")
+@GetMapping(value = "/{userID}")

Additionally, handle β€œnot found/empty” explicitly (outside selected range):

EmployeeSignature sig = employeeSignatureServiceImpl.fetchSignature(userID);
if (sig == null || sig.getSignature() == null || sig.getSignature().length == 0) {
  return ResponseEntity.notFound().build();
}
πŸ€– Prompt for AI Agents
In
src/main/java/com/iemr/admin/controller/employeemaster/EmployeeSignatureController.java
around lines 87-88, remove the headers = "Authorization" constraint from the
@GetMapping so the endpoint isn't restricted by a header; optionally add
produces = MediaType.ALL_VALUE or omit produces entirely since the response is
binary and type varies. Also ensure you explicitly handle missing signatures
(outside the current snippet): after fetching EmployeeSignature, check if the
returned object is null or its signature byte[] is null or empty and return
ResponseEntity.notFound().build() in that case; otherwise proceed to return the
byte[] response.

OutputResponse response = new OutputResponse();
logger.debug("File download for userID" + userID);

try {

EmployeeSignature userSignID = employeeSignatureServiceImpl.fetchSignature(userID);
HttpHeaders responseHeaders = new HttpHeaders();
responseHeaders.set(HttpHeaders.CONTENT_DISPOSITION,
"inline; filename=\"" + userSignID.getFileName() + "\"");
responseHeaders.set("filename", userSignID.getFileName());

return ResponseEntity.ok().contentType(MediaType.parseMediaType(userSignID.getFileType()))
.headers(responseHeaders).body(userSignID.getSignature());

ContentDisposition cd = ContentDisposition.attachment()
.filename(userSignID.getFileName(), StandardCharsets.UTF_8).build();
responseHeaders.setContentDisposition(cd);

MediaType mediaType;
try {
mediaType = MediaType.parseMediaType(userSignID.getFileType());
} catch (InvalidMediaTypeException | NullPointerException e) {
mediaType = MediaType.APPLICATION_OCTET_STREAM;
}
byte[] fileBytes = userSignID.getSignature(); // MUST be byte[]
return ResponseEntity.ok().headers(responseHeaders).contentType(mediaType).contentLength(fileBytes.length)
.body(fileBytes);
} catch (Exception e) {
logger.error("Unexpected error:", e);
logger.error("File download for userID failed with exception " + e.getMessage(), e);
Expand All @@ -117,7 +126,15 @@ public String existFile(@PathVariable("userID") Long userID) throws Exception {
try {

Boolean userSignID = employeeSignatureServiceImpl.existSignature(userID);
response.setResponse(userSignID.toString());
Boolean signatureActive = employeeSignatureServiceImpl.isSignatureActive(userID);

// Create JSON response with both fields
JsonObject responseData = new JsonObject();
responseData.addProperty("response", userSignID.toString());
responseData.addProperty("signStatus", signatureActive.toString());

// Set the response (existing setResponse method will handle it)
response.setResponse(responseData.toString());

} catch (Exception e) {
logger.error("Unexpected error:", e);
Expand All @@ -128,4 +145,19 @@ public String existFile(@PathVariable("userID") Long userID) throws Exception {
logger.debug("response" + response);
return response.toString();
}

@Operation(summary = "Active or DeActive user Signature")
@PostMapping(value = "/activateOrdeActivateSignature", headers = "Authorization", produces = { "application/json" })
public String ActivateUser(@RequestBody String activateUser, HttpServletRequest request) {
OutputResponse response = new OutputResponse();
try {
EmployeeSignature empSignature = employeeSignatureServiceImpl.updateUserSignatureStatus(activateUser);
boolean active = empSignature.getDeleted() == null ? false : !empSignature.getDeleted();
response.setResponse("{\"userID\":" + empSignature.getUserID() + ",\"active\":" + active + "}");
} catch (Exception e) {
logger.error("Active or Deactivate User Signature failed with exception " + e.getMessage(), e);
response.setError(e);
}
return response.toString();
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
package com.iemr.admin.data.bulkuser;

import lombok.Data;

import java.util.List;

@Data
public class BulkRegistrationError {
String userName;
Integer rowNumber;
List<String> error;
}
Loading
Loading