Skip to content
Open
Show file tree
Hide file tree
Changes from 23 commits
Commits
Show all changes
74 commits
Select commit Hold shift + click to select a range
3c2135e
Bulk registration
SauravBizbRolly Mar 4, 2025
23cccac
Bulk registration
SauravBizbRolly Mar 11, 2025
83f693e
Bulk registration
SauravBizbRolly Mar 13, 2025
8ae4c09
Merge pull request #69 from toarunmishra/bulk_registration
sushant-bizbrolly Mar 13, 2025
cdd7b2a
add userName and password in Bulk registration
SauravBizbRolly Mar 31, 2025
128c8f9
add userName and password in Bulk registration
SauravBizbRolly Jun 19, 2025
a069382
Merge pull request #88 from toarunmishra/bulk_registration
SauravBizbRolly Jun 19, 2025
3fd079a
Merge remote-tracking branch 'upstream/develop' into enhancement
SauravBizbRolly Jun 19, 2025
fcbc3da
Merge pull request #90 from toarunmishra/3.3.0
drtechie Jun 19, 2025
5cd719d
remove unwanted line
SauravBizbRolly Jun 19, 2025
2a55c54
Merge pull request #91 from toarunmishra/3.3.0
SauravBizbRolly Jun 19, 2025
110fa59
fix code
SauravBizbRolly Jun 21, 2025
83d3387
Merge pull request #92 from toarunmishra/3.3.0
SauravBizbRolly Jun 21, 2025
b1a893f
fix code
SauravBizbRolly Aug 21, 2025
b67332f
fix code
SauravBizbRolly Aug 21, 2025
bdde896
fix code
SauravBizbRolly Aug 21, 2025
5315e05
fix code
SauravBizbRolly Aug 21, 2025
486d412
fix code
SauravBizbRolly Aug 21, 2025
4e5dab6
fix code
SauravBizbRolly Aug 21, 2025
cd7f567
fix code
SauravBizbRolly Aug 21, 2025
f06d077
fix code
SauravBizbRolly Aug 28, 2025
84b679a
fix code
SauravBizbRolly Aug 28, 2025
7b123e9
fix code
SauravBizbRolly Aug 28, 2025
a28294f
fix code
SauravBizbRolly Aug 28, 2025
093ba26
fix code
SauravBizbRolly Aug 28, 2025
8820fe2
Httpheader content disposition changed
ravishanigarapu Sep 2, 2025
2aab70e
Coderabbitai comments adrressed
ravishanigarapu Sep 2, 2025
20eaaed
Httpheader content disposition changed (#100)
ravishanigarapu Sep 2, 2025
e04b9e5
Compile error resolved
ravishanigarapu Sep 2, 2025
bd11453
Merge pull request #101 from PSMRI/feature/signaturerelease
SauravBizbRolly Sep 2, 2025
0addca8
fix code
SauravBizbRolly Sep 2, 2025
b313e03
Merge remote-tracking branch 'upstream/release-3.6.0' into release-3.6.0
SauravBizbRolly Sep 2, 2025
adc946d
Main branch changes missed (#102)
ravishanigarapu Sep 2, 2025
4e3a304
Feature/signaturerelease (#103)
ravishanigarapu Sep 2, 2025
875e40a
Feature/signaturerelease (#104)
ravishanigarapu Sep 10, 2025
41162a4
Update pom.xml
5Amogh Sep 25, 2025
27241e1
Cherry-pick the commits related to 3.5.0 form 3.6.0 (#106)
snehar-nd Sep 26, 2025
8fb55ce
fix:casesheet signature
vishwab1 Oct 29, 2025
45250ea
fix:pom file change
vishwab1 Oct 30, 2025
c824879
API changes in Signature enhancement for Casesheet (#107)
vishwab1 Oct 30, 2025
7231794
fix: pom version
vishwab1 Oct 30, 2025
e763f9f
Merge pull request #108 from PSMRI/vb/sign
snehar-nd Oct 30, 2025
3d22060
fix code
SauravBizbRolly Nov 7, 2025
226c101
Merge remote-tracking branch 'upstream/release-3.6.0' into release-3.6.0
SauravBizbRolly Nov 7, 2025
74cd354
fix code
SauravBizbRolly Nov 10, 2025
f719ba5
fix code
SauravBizbRolly Nov 10, 2025
bb00223
fix code
SauravBizbRolly Nov 10, 2025
d52c950
fix code
SauravBizbRolly Nov 10, 2025
86ed8cb
fix code
SauravBizbRolly Nov 10, 2025
3ae6436
fix code
SauravBizbRolly Nov 10, 2025
67a4240
fix code
SauravBizbRolly Nov 10, 2025
f8e646e
fix code
SauravBizbRolly Nov 10, 2025
8c48069
fix code
SauravBizbRolly Nov 11, 2025
5f8dcf2
fix code
SauravBizbRolly Nov 11, 2025
30d3317
fix code
SauravBizbRolly Nov 11, 2025
6f5a101
fix code
SauravBizbRolly Nov 11, 2025
1d45257
Merge branch 'release-3.6.1' into release-3.6.0
5Amogh Nov 17, 2025
0acb505
Merge pull request #109 from PSMRI/release-3.6.0
5Amogh Nov 17, 2025
608773a
fix: amm-1927 send headers only if the request is from the allowed or…
5Amogh Nov 17, 2025
5a7c6bf
fix: amm-1927 coderabbit fixes
5Amogh Nov 17, 2025
ad6ff5e
Update regex handling for localhost URLs
5Amogh Nov 18, 2025
eb98a5a
Enhance regex pattern for URL matching
5Amogh Nov 18, 2025
bffa971
Merge pull request #110 from PSMRI/amm-1927
5Amogh Nov 20, 2025
c6ded08
Merge branch 'release-3.6.0' into release-3.5.0
5Amogh Dec 3, 2025
2a04bfb
Merge pull request #111 from PSMRI/release-3.5.0
5Amogh Dec 3, 2025
75d06ca
Merge pull request #112 from PSMRI/release-3.6.1
5Amogh Dec 3, 2025
b421d8b
fix code
SauravBizbRolly Dec 3, 2025
9c206a4
Merge remote-tracking branch 'upstream/release-3.6.0' into release-3.6.0
SauravBizbRolly Dec 3, 2025
76db67c
fix code
SauravBizbRolly Dec 3, 2025
d5b3e20
Merge branch 'main' into release-3.6.0
SauravBizbRolly Jan 14, 2026
711128e
fix vulnerabilitie code
SauravBizbRolly Jan 14, 2026
091bd75
Merge pull request #115 from PSMRI/fix/vulnerabilitie
SauravBizbRolly Jan 14, 2026
f76f68c
fix security hotspots
SauravBizbRolly Jan 14, 2026
a52081b
Merge pull request #116 from PSMRI/fix/remove_log
SauravBizbRolly Jan 14, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 13 additions & 9 deletions pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.iemr.admin</groupId>
<artifactId>admin-api</artifactId>
<version>3.1.0</version>
<artifactId>adminapi</artifactId>
<version>v3.1.0</version>
<packaging>war</packaging>
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
<name>Admin-API</name>
<description>Admin Page</description>
Expand Down Expand Up @@ -54,6 +54,10 @@
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-xml</artifactId>
</dependency>
Comment on lines +57 to +60
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ› οΈ Refactor suggestion | 🟠 Major

🧩 Analysis chain

Specify explicit version for jackson-dataformat-xml to align with Jackson ecosystem.

The dependency lacks an explicit <version> tag. Since the project pins Jackson core (2.17.0-rc1) and databind (2.17.0-rc1), add an explicit version to ensure consistency and avoid runtime mismatches.

Apply this diff to pin the version:

 		<dependency>
 			<groupId>com.fasterxml.jackson.dataformat</groupId>
 			<artifactId>jackson-dataformat-xml</artifactId>
+			<version>2.17.0</version>
 		</dependency>

🌐 Web query:

What is the latest stable version of jackson-dataformat-xml and is it compatible with Jackson 2.17.0-rc1?

πŸ’‘ Result:

Latest stable jackson-dataformat-xml: 2.20.0 (released Aug 28, 2025). [1]

Compatibility: modules should generally match the Jackson 2.x minor version. For use with Jackson 2.17.0-rc1 you should stick to the 2.17.x xml module (e.g., 2.17.2) β€” mixing 2.20.0 with a 2.17.0-rc1 core is not recommended and may cause incompatibilities. [2][3]

Sources:

  • Jackson project releases (2.20.0 release listed). [1]
  • Maven/Central listings for jackson-dataformat-xml 2.17.x and 2.17.0-rc1. [2][3]

Specify explicit version for jackson-dataformat-xml; use stable 2.17.x release instead of RC.

The dependency lacks an explicit <version> tag, creating compatibility risk. Since the project pins Jackson core to 2.17.0-rc1, use a matching stable 2.17.x release (e.g., 2.17.2) rather than 2.17.0-rc1. Mixing 2.20.0 (the latest stable version) with 2.17.0-rc1 core is not recommended and may cause incompatibilities.

Apply this diff instead:

 		<dependency>
 			<groupId>com.fasterxml.jackson.dataformat</groupId>
 			<artifactId>jackson-dataformat-xml</artifactId>
+			<version>2.17.2</version>
 		</dependency>
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-xml</artifactId>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-xml</artifactId>
<version>2.17.2</version>
</dependency>
πŸ€– Prompt for AI Agents
In pom.xml around lines 57 to 60, the jackson-dataformat-xml dependency is
missing an explicit <version>, which can cause mismatches with the project's
Jackson core; add an explicit version tag and set it to a stable 2.17.x release
(for example 2.17.2) to match the project's 2.17 baseline and avoid mixing RC or
newer incompatible versions.

<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter</artifactId>
Expand All @@ -73,6 +77,11 @@
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.21</version>
</dependency>
Comment on lines +81 to +84
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Verification agent

🧩 Analysis chain

commons-compress 1.21 is old; likely CVEs. Upgrade or let POI manage transitively.

Bump to a current secure version or remove the direct pin.

-			<groupId>org.apache.commons</groupId>
-			<artifactId>commons-compress</artifactId>
-			<version>1.21</version>
+			<groupId>org.apache.commons</groupId>
+			<artifactId>commons-compress</artifactId>
+			<version>REPLACE_WITH_SECURE_VERSION</version>

To check advisories:


🏁 Script executed:

#!/bin/bash
rg -n 'commons-compress'
# If feasible in your env:
# mvn -q org.owasp:dependency-check-maven:check -DskipTests

Length of output: 80


🌐 Web query:

latest version of Apache Commons Compress

πŸ’‘ Result:

Latest release: Apache Commons Compress 1.28.0 β€” released July 26, 2025. [1][2]

Sources:
[1] Apache Commons Compress overview/changes.
[2] Apache Commons Compress download / Maven coordinates.


🌐 Web query:

Apache Commons Compress 1.21 CVE

πŸ’‘ Result:

Apache Commons Compress 1.21 is affected by multiple denial‑of‑service vulnerabilities (notably CVE-2024-25710 β€” infinite loop when parsing DUMP files, and CVE-2024-26308 β€” out‑of‑memory during unpacking of malformed Pack200 files). Upgrade to Commons Compress 1.26.0 or later to fix these issues. [1][2][3]

Sources:

  • Apache Commons Compress security page (fixes listed, upgrade to 1.26.0). [1]
  • IBM security bulletin describing CVE-2024-25710 and CVE-2024-26308. [2]
  • Snyk vulnerability summary for commons-compress 1.21. [3]

Upgrade org.apache.commons:commons-compress to 1.28.0 or later
Addresses CVE-2024-25710 and CVE-2024-26308 and ensures you’re on the latest July 26, 2025 release.

-            <version>1.21</version>
+            <version>1.28.0</version>
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.21</version>
</dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.28.0</version>
</dependency>
πŸ€– Prompt for AI Agents
In pom.xml around lines 81 to 84 the project pins
org.apache.commons:commons-compress to 1.21 which is vulnerable; update the
<version> element to 1.28.0 or later for that dependency, save the POM, then
rebuild/verify (e.g., mvn -U clean verify or mvn dependency:tree) to ensure the
updated artifact is resolved and tests pass.

<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
Expand Down Expand Up @@ -181,12 +190,7 @@
<groupId>org.apache.poi</groupId>
<artifactId>poi-ooxml</artifactId>
<version>5.2.3</version>
<exclusions>
<exclusion>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
</exclusion>
</exclusions>

</dependency>

<!-- start newly added dependencies -->
Expand Down Expand Up @@ -275,7 +279,7 @@
</dependencies>

<build>
<finalName>${artifactId}-${version}</finalName>
<finalName>adminapi-v3.0.0</finalName>
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
<plugins>
<plugin>
<groupId>org.owasp</groupId>
Expand Down
4 changes: 2 additions & 2 deletions src/main/environment/admin_example.properties
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@ server.port=8082
# local env
# DB Connections
spring.datasource.url=jdbc:mysql://localhost:3306/db_iemr
spring.datasource.username=root
spring.datasource.password=1234
spring.datasource.username=<Enter userName>
spring.datasource.password=<Enter password>
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver

callcentre-server-ip=10.208.122.99
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,90 @@
package com.iemr.admin.controller.bulkRegistration;

import com.iemr.admin.repo.employeemaster.EmployeeMasterRepoo;
import com.iemr.admin.service.bulkRegistration.BulkRegistrationService;
import com.iemr.admin.service.bulkRegistration.BulkRegistrationServiceImpl;
import com.iemr.admin.service.bulkRegistration.EmployeeXmlService;
import com.iemr.admin.service.locationmaster.LocationMasterServiceInter;
import io.swagger.v3.oas.annotations.Operation;
import jakarta.servlet.http.HttpServletRequest;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.io.ClassPathResource;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

import java.lang.reflect.Method;
import java.util.HashMap;
import java.util.Map;

@RestController
public class BulkRegistrationController {
@Autowired
private EmployeeXmlService employeeXmlService;
@Autowired
BulkRegistrationServiceImpl bulkRegistrationServiceimpl;
private Logger logger = LoggerFactory.getLogger(this.getClass().getSimpleName());


@Autowired
BulkRegistrationService bulkRegistrationService;

@Autowired
private EmployeeMasterRepoo employeeMasterRepoo;
private Map<String, Object> errorResponse = new HashMap<>();
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ› οΈ Refactor suggestion

Remove unused field.

The errorResponse field is declared but never used.

Apply this diff:

-    private Map<String, Object> errorResponse = new HashMap<>();
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
private Map<String, Object> errorResponse = new HashMap<>();
πŸ€– Prompt for AI Agents
In
src/main/java/com/iemr/admin/controller/bulkRegistration/BulkRegistrationController.java
at line 37, the private field "errorResponse" is declared but never referenced;
remove the unused declaration to clean up the class and update imports if the
removal makes any import unused. Ensure no references exist elsewhere before
deleting the field.

@Autowired
private LocationMasterServiceInter locationMasterServiceInter;
private Map<String, Object> response = new HashMap<>();

@PostMapping(value = "/bulkRegistration", headers = "Authorization")
public ResponseEntity<Map<String, Object>> registerBulkUser(@RequestBody String m_user, @RequestHeader String authorization) {
bulkRegistrationServiceimpl.bulkRegistrationErrors.clear();
logger.info("Bulk registration request received. Request payload is omitted from logs.");
try {
bulkRegistrationService.registerBulkUser(m_user, authorization);
response.put("status", "Success");
response.put("statusCode", 200);
response.put("totalUser", bulkRegistrationServiceimpl.totalEmployeeListSize);
response.put("registeredUser", bulkRegistrationServiceimpl.m_bulkUser.size());
response.put("error", bulkRegistrationServiceimpl.errorLogs.toString());

bulkRegistrationServiceimpl.m_bulkUser.clear();
bulkRegistrationServiceimpl.m_UserDemographics.clear();
bulkRegistrationServiceimpl.errorLogs.clear();
bulkRegistrationServiceimpl.totalEmployeeListSize=0;

} catch (Exception e) {
response.put("message", e.getMessage());
response.put("statusCode", 500);

}
return ResponseEntity.ok(response);

}
Comment on lines +48 to +70
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Thread safety issue with direct field access.

Directly accessing and modifying public fields in BulkRegistrationServiceImpl is not thread-safe and violates encapsulation. Multiple concurrent requests could interfere with each other.

Consider refactoring the service to:

  1. Return a result object containing these values
  2. Use thread-safe collections or synchronization
  3. Make fields private and provide synchronized accessor methods

Example refactor:

public class BulkRegistrationResult {
    private final int totalUsers;
    private final int registeredUsers;
    private final List<String> errors;
    // constructor, getters...
}

// In service
public BulkRegistrationResult registerBulkUser(String xml, String authorization) {
    // ... processing ...
    return new BulkRegistrationResult(totalUsers, registeredUsers, errors);
}
πŸ€– Prompt for AI Agents
In
src/main/java/com/iemr/admin/controller/bulkRegistration/BulkRegistrationController.java
around lines 44-66 you are directly reading and mutating public fields on
BulkRegistrationServiceImpl (m_bulkUser, m_UserDemographics, errorLogs,
totalEmployeeListSize), which is not thread-safe and breaks encapsulation;
refactor the service to return a single immutable result object (e.g.,
BulkRegistrationResult with totalUsers, registeredUsers, errors) and make
service internals private with thread-safe collections or internal
synchronization, then update this controller to call that method, read values
from the returned result and stop directly clearing service fields here (remove
calls to clear()/reset), and handle error state via the result or exceptions so
controller only uses return values rather than manipulating service fields.

⚠️ Potential issue

Security concern: Response map is reused across requests.

The response field is a class-level mutable map that's shared across all requests, creating thread safety issues and potential data leaks between concurrent requests.

Apply this diff to use local variables:

-    private Map<String, Object> response = new HashMap<>();
 
     @PostMapping(value = "/bulkRegistration", headers = "Authorization")
     public ResponseEntity<Map<String, Object>> registerBulkUser(@RequestBody String m_user, @RequestHeader String authorization) {
         bulkRegistrationServiceimpl.bulkRegistrationErrors.clear();
         logger.info("Bulk registration request received. Request payload is omitted from logs.");
+        Map<String, Object> response = new HashMap<>();
         try {
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
bulkRegistrationServiceimpl.bulkRegistrationErrors.clear();
logger.info("Bulk registration request received. Request payload is omitted from logs.");
try {
bulkRegistrationService.registerBulkUser(m_user, authorization);
response.put("status", "Success");
response.put("statusCode", 200);
response.put("totalUser", bulkRegistrationServiceimpl.totalEmployeeListSize);
response.put("registeredUser", bulkRegistrationServiceimpl.m_bulkUser.size());
response.put("error", bulkRegistrationServiceimpl.errorLogs.toString());
bulkRegistrationServiceimpl.m_bulkUser.clear();
bulkRegistrationServiceimpl.m_UserDemographics.clear();
bulkRegistrationServiceimpl.errorLogs.clear();
bulkRegistrationServiceimpl.totalEmployeeListSize=0;
} catch (Exception e) {
response.put("message", e.getMessage());
response.put("statusCode", 500);
}
return ResponseEntity.ok(response);
}
@PostMapping(value = "/bulkRegistration", headers = "Authorization")
public ResponseEntity<Map<String, Object>> registerBulkUser(@RequestBody String m_user, @RequestHeader String authorization) {
bulkRegistrationServiceimpl.bulkRegistrationErrors.clear();
logger.info("Bulk registration request received. Request payload is omitted from logs.");
Map<String, Object> response = new HashMap<>();
try {
bulkRegistrationService.registerBulkUser(m_user, authorization);
response.put("status", "Success");
response.put("statusCode", 200);
response.put("totalUser", bulkRegistrationServiceimpl.totalEmployeeListSize);
response.put("registeredUser", bulkRegistrationServiceimpl.m_bulkUser.size());
response.put("error", bulkRegistrationServiceimpl.errorLogs.toString());
bulkRegistrationServiceimpl.m_bulkUser.clear();
bulkRegistrationServiceimpl.m_UserDemographics.clear();
bulkRegistrationServiceimpl.errorLogs.clear();
bulkRegistrationServiceimpl.totalEmployeeListSize = 0;
} catch (Exception e) {
response.put("message", e.getMessage());
response.put("statusCode", 500);
}
return ResponseEntity.ok(response);
}
πŸ€– Prompt for AI Agents
In
src/main/java/com/iemr/admin/controller/bulkRegistration/BulkRegistrationController.java
around lines 44 to 66, the controller reuses a class-level mutable response Map
across requests which is not thread-safe and can leak data between concurrent
requests; change this by creating and using a new local Map<String, Object>
response = new HashMap<>() inside the method before populating it, use that
local variable for all response.put(...) calls, and return
ResponseEntity.ok(response) so no shared mutable state is used across requests.


@GetMapping(value = "/download-error-sheet", headers = "Authorization")
public ResponseEntity<byte[]> downloadErrorSheet() {
try {
byte[] fileContent = bulkRegistrationServiceimpl.insertErrorLog();

HttpHeaders headers = new HttpHeaders();
headers.add("Content-Disposition", "attachment; filename=error_log.xlsx");

if(!bulkRegistrationServiceimpl.bulkRegistrationErrors.isEmpty()){
bulkRegistrationServiceimpl.bulkRegistrationErrors.clear();
}
Comment on lines +75 to +82
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Potential race condition when clearing errors.

The error list is cleared after the file content is generated, which could cause issues if multiple concurrent requests download the error sheet. One request might clear the errors while another is still processing them.

Consider refactoring to:

  1. Make insertErrorLog() atomically retrieve and clear errors
  2. Add synchronization around the error collection access
  3. Return errors as part of the file generation and clear them within that method

Additionally, validate that errors exist before generating the file:

     @GetMapping(value = "/download-error-sheet", headers = "Authorization")
     public ResponseEntity<byte[]> downloadErrorSheet() {
         try {
+            if (bulkRegistrationServiceimpl.bulkRegistrationErrors.isEmpty()) {
+                return ResponseEntity.status(404)
+                    .body("No errors to download".getBytes());
+            }
+
             byte[] fileContent = bulkRegistrationServiceimpl.insertErrorLog();

             HttpHeaders headers = new HttpHeaders();
             headers.add("Content-Disposition", "attachment; filename=error_log.xlsx");

-            if(!bulkRegistrationServiceimpl.bulkRegistrationErrors.isEmpty()){
-                bulkRegistrationServiceimpl.bulkRegistrationErrors.clear();
-            }
             return ResponseEntity.ok()
                     .headers(headers)
                     .contentType(MediaType.APPLICATION_OCTET_STREAM)
                     .body(fileContent);

Committable suggestion skipped: line range outside the PR's diff.

return ResponseEntity.ok()
.headers(headers)
.contentType(MediaType.APPLICATION_OCTET_STREAM)
.body(fileContent);

} catch (Exception e) {
return ResponseEntity.status(500).body(null);
}
}


}
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
package com.iemr.admin.data.bulkuser;

import lombok.Data;

import java.util.List;

@Data
public class BulkRegistrationError {
String userName;
Integer rowNumber;
List<String> error;
}
102 changes: 102 additions & 0 deletions src/main/java/com/iemr/admin/data/bulkuser/Employee.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,102 @@
package com.iemr.admin.data.bulkuser;

import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty;
import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
import lombok.Data;

@Data
@JacksonXmlRootElement(localName = "Employee")
public class Employee {

@JacksonXmlProperty(localName = "Title")
private String title="";

@JacksonXmlProperty(localName = "FirstName")
private String firstName="";

@JacksonXmlProperty(localName = "MiddleName")
private String middleName="";

@JacksonXmlProperty(localName = "LastName")
private String lastName="";

@JacksonXmlProperty(localName = "Gender")
private String gender="";

@JacksonXmlProperty(localName = "ContactNo")
private String contactNo="";

@JacksonXmlProperty(localName = "Designation")
private String designation="";

@JacksonXmlProperty(localName = "EmergencyContactNo")
private String emergencyContactNo="";

@JacksonXmlProperty(localName = "DateOfBirth")
private String dob="";

@JacksonXmlProperty(localName = "Age")
private int age=0;

@JacksonXmlProperty(localName = "Email")
private String email="";

@JacksonXmlProperty(localName = "MaritalStatus")
private String maritalStatus="";

@JacksonXmlProperty(localName = "AadhaarNo")
private String aadhaarNo="";

@JacksonXmlProperty(localName = "PAN")
private String pan="";

@JacksonXmlProperty(localName = "Qualification")
private String qualification="";

@JacksonXmlProperty(localName = "FatherName")
private String fatherName="";

@JacksonXmlProperty(localName = "MotherName")
private String motherName="";

@JacksonXmlProperty(localName = "Community")
private String community="";

@JacksonXmlProperty(localName = "Religion")
private String religion="";

@JacksonXmlProperty(localName = "CurrentAddressLine1")
private String addressLine1="";

@JacksonXmlProperty(localName = "CurrentState")
private String state="";

@JacksonXmlProperty(localName = "CurrentDistrict")
private String district="";

@JacksonXmlProperty(localName = "CurrentPincode")
private String pincode="";

@JacksonXmlProperty(localName = "PermanentAddressLine1")
private String permanentAddressLine1="";

@JacksonXmlProperty(localName = "PermanentState")
private String permanentState="";

@JacksonXmlProperty(localName = "PermanentDistrict")
private String permanentDistrict="";

@JacksonXmlProperty(localName = "PermanentPincode")
private String permanentPincode="";

@JacksonXmlProperty(localName = "DateOfJoining")
private String dateOfJoining="";

@JacksonXmlProperty(localName = "UserName")
private String UserName="";

@JacksonXmlProperty(localName = "Password")
private String Password="";

Comment on lines +95 to +100
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Hide secrets/PII from logs and responses

Lombok @DaTa generates toString that will include Password (and other PII). Mark sensitive fields write-only for serialization and exclude from toString.

Apply:

@@
-import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import lombok.ToString;
@@
-    @JacksonXmlProperty(localName = "AadhaarNo")
-    private String aadhaarNo="";
+    @JacksonXmlProperty(localName = "AadhaarNo")
+    @ToString.Exclude
+    private String aadhaarNo="";
@@
-    @JacksonXmlProperty(localName = "PAN")
-    private String pan="";
+    @JacksonXmlProperty(localName = "PAN")
+    @ToString.Exclude
+    private String pan="";
@@
-    @JacksonXmlProperty(localName = "Password")
-    private String Password="";
+    @JacksonXmlProperty(localName = "Password")
+    @JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
+    @ToString.Exclude
+    private String Password="";
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
@JacksonXmlProperty(localName = "UserName")
private String UserName="";
@JacksonXmlProperty(localName = "Password")
private String Password="";
// At top of src/main/java/com/iemr/admin/data/bulkuser/Employee.java, update imports:
import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty;
import com.fasterxml.jackson.annotation.JsonProperty;
import lombok.ToString;
// ... other imports ...
// Then, on the PII fields:
@JacksonXmlProperty(localName = "AadhaarNo")
@ToString.Exclude
private String aadhaarNo="";
@JacksonXmlProperty(localName = "PAN")
@ToString.Exclude
private String pan="";
@JacksonXmlProperty(localName = "UserName")
private String UserName="";
@JacksonXmlProperty(localName = "Password")
@JsonProperty(access = JsonProperty.Access.WRITE_ONLY)
@ToString.Exclude
private String Password="";
πŸ€– Prompt for AI Agents
In src/main/java/com/iemr/admin/data/bulkuser/Employee.java around lines 95-100,
the Password (and potentially other PII like UserName) are plain fields and
Lombok's @Data will include them in toString and serialization; mark sensitive
fields as write-only for Jackson and exclude them from Lombok toString. Fix by
adding Lombok's @ToString.Exclude to the sensitive fields and Jackson's
@JsonProperty(access = JsonProperty.Access.WRITE_ONLY) (import
com.fasterxml.jackson.annotation.JsonProperty and Access) to Password (and any
other PII you want hidden), leaving existing @JacksonXmlProperty for XML names
intact.


}
17 changes: 17 additions & 0 deletions src/main/java/com/iemr/admin/data/bulkuser/EmployeeList.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
package com.iemr.admin.data.bulkuser;

import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
import lombok.Data;

import java.util.List;

@Data
@JacksonXmlRootElement(localName = "Employees")
public class EmployeeList {

@JsonProperty("Employee")
@JacksonXmlElementWrapper(useWrapping = false) // To avoid extra nested array in XML
private List<Employee> employees;
}
Comment on lines +14 to +17
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ› οΈ Refactor suggestion

Prevent NPE by default-initializing list

Initialize employees to an empty list.

+import java.util.ArrayList;
@@
-    private List<Employee> employees;
+    private List<Employee> employees = new ArrayList<>();
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
@JsonProperty("Employee")
@JacksonXmlElementWrapper(useWrapping = false) // To avoid extra nested array in XML
private List<Employee> employees;
}
// add at top of file with other imports
import java.util.ArrayList;
@JsonProperty("Employee")
@JacksonXmlElementWrapper(useWrapping = false) // To avoid extra nested array in XML
private List<Employee> employees = new ArrayList<>();
}
πŸ€– Prompt for AI Agents
In src/main/java/com/iemr/admin/data/bulkuser/EmployeeList.java around lines 14
to 17, the employees field can be null and cause NPEs; initialize it to an empty
list (e.g., private List<Employee> employees = new ArrayList<>();) so callers
always get a non-null list, and add the necessary import for java.util.ArrayList
if not already present.

Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,7 @@

@Entity
@Table(name = "m_Religion")
public class M_Religion
{
public class M_Religion {

@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,16 @@ public interface EmployeeMasterRepoo extends CrudRepository<M_User1, Integer>
@Query("SELECT u FROM M_User1 u WHERE u.userID=:userID AND deleted=false")
M_User1 editEmployee(@Param("userID") Integer userID);

@Query("SELECT u FROM M_User1 u WHERE u.aadhaarNo=:aadhaar AND deleted=false ")
M_User1 findEmployeeAadhaarNo(@Param("aadhaar") String userName);

@Query("SELECT u FROM M_User1 u WHERE u.userName=:userName AND deleted=false ")
M_User1 findEmployeeByName(@Param("userName") String userName);


@Query("SELECT u FROM M_User1 u WHERE u.contactNo=:contactNo AND deleted=false ")
M_User1 findEmployeeByContact(@Param("contactNo") String userName);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ› οΈ Refactor suggestion

Fix incorrect parameter name in repository method.

The parameter name userName is misleading since this method searches by contact number, not username.

Apply this diff:

-    M_User1 findEmployeeByContact(@Param("contactNo") String userName);
+    M_User1 findEmployeeByContact(@Param("contactNo") String contactNo);
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
M_User1 findEmployeeByContact(@Param("contactNo") String userName);
M_User1 findEmployeeByContact(@Param("contactNo") String contactNo);
πŸ€– Prompt for AI Agents
In src/main/java/com/iemr/admin/repo/employeemaster/EmployeeMasterRepoo.java
around line 51, the repository method parameter is incorrectly named userName
even though the @Param and query expect a contact number; rename the method
parameter from userName to contactNo (or contactNumber) so it matches the
@Param("contactNo") and update any references accordingly to ensure clear intent
and correct binding.


@Query("SELECT u FROM M_User1 u WHERE u.userName=:userName OR u.aadhaarNo=:aadhaarNo OR u.pAN=:getpAN OR u.employeeID=:employeeID OR u.healthProfessionalID=:healthProfessionalID AND deleted=false ")
M_User1 checkingEmpDetails(@Param("userName") String userName, @Param("aadhaarNo") String aadhaarNo,
@Param("getpAN") String getpAN,@Param("employeeID") String employeeID, @Param("healthProfessionalID") String healthProfessionalID);
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
package com.iemr.admin.service.bulkRegistration;

public interface BulkRegistrationService {
void registerBulkUser(String user,String authorization);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

πŸ’‘ Verification agent

🧩 Analysis chain

Return a result and clarify parameter intent.

Void makes error handling opaque; name β€˜user’ doesn’t convey XML payload. Also space after comma.

-    void registerBulkUser(String user,String authorization);
+    // Consider returning per-row outcome or error list
+    // e.g., List<BulkRegistrationError> registerBulkUsers(String xmlPayload, String authorization);
+    void registerBulkUser(String xmlPayload, String authorization);

Search callers/impls that will need updating:


🏁 Script executed:

#!/bin/bash
rg -n -C2 '\bregisterBulkUser\s*\('
rg -n -C2 'class\s+\w+BulkRegistrationServiceImpl|implements\s+BulkRegistrationService'

Length of output: 3244


Use a structured return and clarify the XML parameter

  • Change the signature in BulkRegistrationService from
    void registerBulkUser(String user, String authorization)
    to something like
    List<BulkRegistrationError> registerBulkUsers(String xmlPayload, String authorization)
    so callers can inspect per‐row errors.
  • Rename the user parameter to xmlPayload (and add the missing space after the comma) in the interface, then update BulkRegistrationServiceImpl and BulkRegistrationController accordingly.
πŸ€– Prompt for AI Agents
In
src/main/java/com/iemr/admin/service/bulkRegistration/BulkRegistrationService.java
around line 4, change the method signature from void registerBulkUser(String
user,String authorization) to a structured return and clearer parameter name,
e.g. List<BulkRegistrationError> registerBulkUsers(String xmlPayload, String
authorization); update the interface name and parameter (add the missing space
after the comma), then refactor BulkRegistrationServiceImpl and
BulkRegistrationController to implement the new signature: rename parameter
usages from user to xmlPayload, return a List<BulkRegistrationError> containing
per-row error details (create a BulkRegistrationError DTO if it doesn't exist),
update imports and any callers to handle the returned list and adjust unit tests
accordingly.

}
Loading