Skip to content

Jwttoken implementation #106

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ravishanigarapu wants to merge 18 commits into from
Closed

Jwttoken implementation #106

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
ff301e4
AMM-1217
ravishanigarapu Mar 21, 2025
ecabd88
removed unused imports
ravishanigarapu Mar 21, 2025
4030d56
removed unused imports
ravishanigarapu Mar 25, 2025
71b15ba
Merge branch 'PSMRI:develop' into develop
ravishanigarapu Apr 2, 2025
1d2e222
AMM-1252
ravishanigarapu Apr 2, 2025
9688378
Merge branch 'PSMRI:develop' into develop
ravishanigarapu Apr 17, 2025
5670ba5
swagger changes
ravishanigarapu Apr 17, 2025
2c61996
Merge branch 'PSMRI:develop' into develop
ravishanigarapu May 15, 2025
f679f75
bug(Identity-API) Edit family tagging null condition added
ravishanigarapu May 15, 2025
d995ab9
Merge branch 'PSMRI:develop' into develop
ravishanigarapu Jul 4, 2025
ea9d72c
Jwttoken implementation and Crossorigin changes.
ravishanigarapu Jul 30, 2025
9fd406e
code rabbit comments addressed
ravishanigarapu Jul 30, 2025
f484251
coderabbitai comments addressed
ravishanigarapu Jul 30, 2025
f2161c8
coderabbit commments addressed
ravishanigarapu Jul 30, 2025
635263c
code optimised
ravishanigarapu Jul 30, 2025
8fe74d9
redis runtime issuefixed
ravishanigarapu Jul 30, 2025
1439253
Coderabbit changes
ravishanigarapu Jul 31, 2025
ca3a465
removed unused method
ravishanigarapu Jul 31, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,26 @@
<artifactId>spring-web</artifactId>
<version>6.1.12</version>
</dependency>
<!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt-api -->
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>0.12.6</version>
</dependency>
<!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt-impl -->
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>0.12.6</version>
<scope>runtime</scope>
</dependency>
<!-- https://mvnrepository.com/artifact/io.jsonwebtoken/jjwt-jackson -->
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId>
<version>0.12.6</version>
<scope>runtime</scope>
</dependency>
<!--END NEW DEPENDENCIES ADDED-->
</dependencies>
<profiles>
Expand Down
4 changes: 3 additions & 1 deletion src/main/environment/1097_ci.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,6 @@ tm-url=@TM_API@
fhir-url=@FHIR_API@

# Redis Config
spring.redis.host=@env.REDIS_HOST@
spring.redis.host=@env.REDIS_HOST@

cors.allowed-origins=@env.CORS_ALLOWED_ORIGINS@
4 changes: 3 additions & 1 deletion src/main/environment/1097_docker.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,6 @@ tm-url=${TM_API}
fhir-url=${FHIR_API}

# Redis Config
spring.redis.host=${REDIS_HOST}
spring.redis.host=${REDIS_HOST}

cors.allowed-origins=${CORS_ALLOWED_ORIGINS}
3 changes: 2 additions & 1 deletion src/main/environment/1097_example.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,4 +17,5 @@ tm-url=http://localhost:8089/
fhir-url=http://localhost:8093/

# Redis Config
spring.redis.host=localhost
spring.redis.host=localhost
cors.allowed-origins=http://localhost:*
Comment on lines +20 to +21
Copy link

@coderabbitai coderabbitai bot Jul 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

❓ Verification inconclusive

Wildcard port in cors.allowed-origins is likely ignored by Spring
http://localhost:* is not interpreted as a valid wildcard by Spring’s CorsConfiguration#setAllowedOrigins, so no origin will actually match and CORS will still fail in local testing.

Suggested fix – either enumerate the concrete ports you use, or switch the Java config to setAllowedOriginPatterns and keep a wildcard there:

-cors.allowed-origins=http://localhost:*
+# Example: explicit ports
+cors.allowed-origins=http://localhost:3000,http://localhost:4200

or update CorsConfig to rely on setAllowedOriginPatterns instead.

Fix CORS allowed-origins: wildcard port is ignored
Spring’s CorsConfiguration#setAllowedOrigins only matches exact origins. The pattern http://localhost:* will not match any origin, so CORS requests will still be blocked.

Please update src/main/environment/1097_example.properties (lines 20–21) using one of these options:

  • Enumerate explicit ports: 
    - cors.allowed-origins=http://localhost:*
+ cors.allowed-origins=http://localhost:3000,http://localhost:4200
  • Switch to origin patterns (requires Spring Framework 5.3+): 
    - cors.allowed-origins=http://localhost:*
+ cors.allowed-origin-patterns=http://localhost:*
    Or update your Java CORS config to call setAllowedOriginPatterns(...) instead of setAllowedOrigins(...).
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
spring.redis.host=localhost
cors.allowed-origins=http://localhost:*
spring.redis.host=localhost
cors.allowed-origins=http://localhost:3000,http://localhost:4200
Suggested change
spring.redis.host=localhost
cors.allowed-origins=http://localhost:*
spring.redis.host=localhost
cors.allowed-origin-patterns=http://localhost:*
🤖 Prompt for AI Agents 
In src/main/environment/1097_example.properties at lines 20-21, the CORS
allowed-origins setting uses a wildcard port (http://localhost:*), which
Spring's setAllowedOrigins does not support and causes CORS requests to be
blocked. Fix this by either listing explicit allowed origins with specific ports
instead of a wildcard or, if using Spring Framework 5.3 or newer, switch to
using origin patterns by updating the configuration to use
setAllowedOriginPatterns instead of setAllowedOrigins to allow wildcard ports.

4 changes: 3 additions & 1 deletion src/main/environment/common_ci.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,6 @@ tm-url=@TM_API@
fhir-url=@FHIR_API@

# Redis Config
spring.redis.host=@env.REDIS_HOST@
spring.redis.host=@env.REDIS_HOST@

cors.allowed-origins=@env.CORS_ALLOWED_ORIGINS@
4 changes: 3 additions & 1 deletion src/main/environment/common_docker.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,6 @@ tm-url=${TM_API}
fhir-url=${FHIR_API}

# Redis Config
spring.redis.host=${REDIS_HOST}
spring.redis.host=${REDIS_HOST}

cors.allowed-origins=${CORS_ALLOWED_ORIGINS}
3 changes: 2 additions & 1 deletion src/main/environment/common_example.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,5 @@ tm-url=http://localhost:8089/
fhir-url=http://localhost:8093/

# Redis Config
spring.redis.host=localhost
spring.redis.host=localhost
cors.allowed-origins=http://localhost:*
Copy link

@coderabbitai coderabbitai bot Jul 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Security concern: Wildcard port in CORS configuration.

Using http://localhost:* allows cross-origin requests from any service running on any port on localhost. This could be a security risk as it permits requests from potentially malicious local services.

Consider specifying explicit ports or using environment-specific configurations instead of wildcards.

-cors.allowed-origins=http://localhost:*
+cors.allowed-origins=http://localhost:3000,http://localhost:4200

Verify if this wildcard configuration is used in production environments:

🏁 Script executed:

#!/bin/bash
# Check if wildcard CORS origins are used in production configs
echo "Checking for wildcard CORS configurations in production-like environments..."
rg -n "cors\.allowed-origins.*\*" --type properties

Length of output: 251

🏁 Script executed:

#!/bin/bash
echo "Searching for wildcard CORS origins in all .properties files..."
# Use glob filter instead of --type to include .properties files
rg -n "cors\.allowed-origins.*\*" -g '*.properties'

Length of output: 368

Restrict wildcard ports in CORS configuration

Allowing http://localhost:* opens CORS to any local service on any port, which can be exploited by malicious processes. Please tighten these entries to only the necessary development ports or use environment-specific overrides.

Files to update:

  • src/main/environment/common_example.properties (line 20)
  • src/main/environment/1097_example.properties (line 21)

Suggested change (example ports—adjust as needed):

-cors.allowed-origins=http://localhost:*
+cors.allowed-origins=http://localhost:3000,http://localhost:4200
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
cors.allowed-origins=http://localhost:*
cors.allowed-origins=http://localhost:3000,http://localhost:4200
🤖 Prompt for AI Agents 
In src/main/environment/common_example.properties at line 20, the CORS allowed
origins entry uses a wildcard port with http://localhost:*, which is insecure.
Replace the wildcard with specific allowed ports needed for development, such as
http://localhost:3000 or http://localhost:8080, to restrict access. Apply a
similar change in src/main/environment/1097_example.properties at line 21 to
ensure consistent and secure CORS configuration.

23 changes: 23 additions & 0 deletions src/main/java/com/iemr/common/identity/config/CorsConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
package com.iemr.common.identity.config;

import java.util.Arrays;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.CorsRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class CorsConfig implements WebMvcConfigurer {
@Value("${cors.allowed-origins}")
private String allowedOrigins;

@Override
public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**").allowedOriginPatterns(
allowedOrigins != null && !allowedOrigins.trim().isEmpty() ? Arrays.stream(allowedOrigins.split(","))
.map(String::trim).filter(s -> !s.isEmpty()).toArray(String[]::new) : new String[0])
.allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS").allowedHeaders("*")
.exposedHeaders("Authorization", "Jwttoken").allowCredentials(true).maxAge(3600);
}
}
22 changes: 0 additions & 22 deletions src/main/java/com/iemr/common/identity/controller/IdentityController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
Expand Down Expand Up @@ -83,7 +82,6 @@ public class IdentityController {
@Autowired
IdentityMapper mapper;

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Get beneficiaries by advance search")
@PostMapping(path = "/advanceSearch", headers = "Authorization")
public String getBeneficiaries(
Expand Down Expand Up @@ -112,7 +110,6 @@ public String getBeneficiaries(
return response;
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Search beneficiary based on beneficiary registration id")
@PostMapping(path = "/getByBenRegId", headers = "Authorization")
public String getBeneficiariesByBeneficiaryRegId(
Expand All @@ -137,7 +134,6 @@ public String getBeneficiariesByBeneficiaryRegId(
return response;
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Search identity based on beneficiary registration id")
@PostMapping(path = "/getByBenId", headers = "Authorization")
public String getBeneficiariesByBeneficiaryId(
Expand Down Expand Up @@ -172,7 +168,6 @@ public String getBeneficiariesByBeneficiaryId(
return response;
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Search beneficiary based on phone number")
@PostMapping(path = "/getByPhoneNum", headers = "Authorization")
public String getBeneficiariesByPhoneNum(
Expand Down Expand Up @@ -203,7 +198,6 @@ public String getBeneficiariesByPhoneNum(
return response;
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Search beneficiary based on health ID / ABHA Address")
@PostMapping(path = "/getByAbhaAddress", headers = "Authorization")
public String searhBeneficiaryByABHAAddress(
Expand Down Expand Up @@ -235,7 +229,6 @@ public String searhBeneficiaryByABHAAddress(
return response;
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Search beneficiary based on health ID number / ABHA ID number")
@PostMapping(path = "/getByAbhaIdNo", headers = "Authorization")
public String searhBeneficiaryByABHAIdNo(
Expand Down Expand Up @@ -267,7 +260,6 @@ public String searhBeneficiaryByABHAIdNo(
return response;
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Search beneficiary based on family id")
@PostMapping(path = "/searchByFamilyId", headers = "Authorization")
public String searhBeneficiaryByFamilyId(
Expand Down Expand Up @@ -297,7 +289,6 @@ public String searhBeneficiaryByFamilyId(
}

// search beneficiary by lastModDate and districtID
@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary ="Search beneficiary by villageId and last modified date-time")
@PostMapping(path = "/searchByVillageIdAndLastModifiedDate")
public String searchBeneficiaryByVillageIdAndLastModDate(
Expand All @@ -322,7 +313,6 @@ public String searchBeneficiaryByVillageIdAndLastModDate(
return response;
}
// search beneficiary by lastModDate and districtID
@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary ="Get count of beneficiary by villageId and last modified date-time")
@PostMapping(path = "/countBenByVillageIdAndLastModifiedDate")
public String countBeneficiaryByVillageIdAndLastModDate(
Expand All @@ -342,7 +332,6 @@ public String countBeneficiaryByVillageIdAndLastModDate(
}
return response;
}
@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Search beneficiary based on government identity number")
@PostMapping(path = "/searhByGovIdentity", headers = "Authorization")
public String searhBeneficiaryByGovIdentity(
Expand Down Expand Up @@ -376,7 +365,6 @@ public String searhBeneficiaryByGovIdentity(
* @param identityEditData
* @return
*/
@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Edit identity by agent")
@PostMapping(path = "/edit", headers = "Authorization")
public String editIdentity(@Param(value = "{\r\n" + " \"eventTypeName\": \"String\",\r\n"
Expand Down Expand Up @@ -508,7 +496,6 @@ public String editIdentity(@Param(value = "{\r\n" + " \"eventTypeName\": \"Stri
* @param identityData
* @return
*/
@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Create identity by agent")
@PostMapping(path = "/create", headers = "Authorization")
public String createIdentity(@Param(value = "{\r\n" + " \"eventTypeName\": \"String\",\r\n"
Expand Down Expand Up @@ -615,7 +602,6 @@ public String createIdentity(@Param(value = "{\r\n" + " \"eventTypeName\": \"St
return response;
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Reserve identity by agent")
@PostMapping(path = "/reserve", headers = "Authorization")
public String reserveIdentity(@RequestBody String reserveIdentity) {
Expand All @@ -635,7 +621,6 @@ public String reserveIdentity(@RequestBody String reserveIdentity) {
return response;
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Unreserve identity by agent")
@PostMapping(path = "/unreserve", headers = "Authorization")
public String unreserveIdentity(@RequestBody String unreserve) {
Expand All @@ -661,7 +646,6 @@ public String unreserveIdentity(@RequestBody String unreserve) {
* @param benRegIds
* @return
*/
@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Get beneficiaries partial details by beneficiary registration id list")
@PostMapping(path = "/getByPartialBenRegIdList", headers = "Authorization")
public String getPartialBeneficiariesByBenRegIds(
Expand Down Expand Up @@ -693,7 +677,6 @@ public String getPartialBeneficiariesByBenRegIds(
* @param benRegIds
* @return
*/
@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Get beneficiaries by beneficiary registration id")
@PostMapping(path = "/getByBenRegIdList", headers = "Authorization")
public String getBeneficiariesByBenRegIds(
Expand Down Expand Up @@ -792,7 +775,6 @@ public String getJsonAsString(Object obj) {
return sb.toString();
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Get finite beneficiaries")
@PostMapping(path = "/finiteSearch", headers = "Authorization")
public String getFiniteBeneficiaries(@RequestBody String searchFilter) {
Expand All @@ -816,7 +798,6 @@ public String getFiniteBeneficiaries(@RequestBody String searchFilter) {
}

// New API for getting beneficiary image only.
@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Get beneficiary image by beneficiary registration id")
@PostMapping(path = "/benImageByBenRegID", headers = "Authorization")
public String getBeneficiaryImageByBenRegID(@RequestBody String identityData) {
Expand All @@ -830,7 +811,6 @@ public String getBeneficiaryImageByBenRegID(@RequestBody String identityData) {
return benImage;
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Edit education or community by agent")
@PostMapping(path = "/editEducationOrCommunity", headers = "Authorization")
public String editIdentityEducationOrCommunity(@Param(value = "{\r\n"
Expand Down Expand Up @@ -957,7 +937,6 @@ public String editIdentityEducationOrCommunity(@Param(value = "{\r\n"
}
}

@CrossOrigin()
@Operation(summary = "Check available beneficary id in local server")
@GetMapping(path = "/checkAvailablBenIDLocalServer", headers = "Authorization")
public String checkAvailablBenIDLocalServer() {
Expand All @@ -972,7 +951,6 @@ public String checkAvailablBenIDLocalServer() {
return response.toString();
}

@CrossOrigin(origins = { "*commonapi*" })
@Operation(summary = "Save server generated beneficiary ID & beneficiary registration ID to local server")
@PostMapping(path = "/saveGeneratedBenIDToLocalServer", headers = "Authorization", consumes = "application/json", produces = "application/json")
public String saveGeneratedBenIDToLocalServer(
Expand Down
8 changes: 0 additions & 8 deletions src/main/java/com/iemr/common/identity/controller/familyTagging/FamilyTaggingController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,6 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
Expand All @@ -35,15 +34,13 @@

import io.swagger.v3.oas.annotations.Operation;

@CrossOrigin
@RestController
@RequestMapping({ "/family" })
public class FamilyTaggingController {
private Logger logger = LoggerFactory.getLogger(FamilyTaggingController.class);
@Autowired
private FamilyTagService familyTagService;

@CrossOrigin()
@Operation(summary = "Create and modify family tagging")
@PostMapping(value = { "/addTag" }, consumes = "application/json", produces = "application/json")
public String saveFamilyTagging(@RequestBody String comingReq) {
Expand All @@ -59,7 +56,6 @@ public String saveFamilyTagging(@RequestBody String comingReq) {
return response.toString();
}

@CrossOrigin()
@Operation(summary = "Create family")
@PostMapping(value = { "/createFamily" }, consumes = "application/json", produces = "application/json")
public String createFamily(@RequestBody String comingReq) {
Expand All @@ -75,7 +71,6 @@ public String createFamily(@RequestBody String comingReq) {
return response.toString();
}

@CrossOrigin()
@Operation(summary = "Search family")
@PostMapping(value = { "/searchFamily" }, consumes = "application/json", produces = "application/json")
public String searchFamily(@RequestBody String comingReq) {
Expand All @@ -91,7 +86,6 @@ public String searchFamily(@RequestBody String comingReq) {
return response.toString();
}

@CrossOrigin()
@Operation(summary = "Get family members details")
@PostMapping(value = { "/getFamilyDetails" }, consumes = "application/json", produces = "application/json")
public String getFamilyDatails(@RequestBody String comingReq) {
Expand All @@ -107,7 +101,6 @@ public String getFamilyDatails(@RequestBody String comingReq) {
return response.toString();
}

@CrossOrigin()
@Operation(summary = "Untag beneficiary from a family")
@PostMapping(value = { "/untag" }, consumes = "application/json", produces = "application/json")
public String untagFamily(@RequestBody String comingReq) {
Expand All @@ -123,7 +116,6 @@ public String untagFamily(@RequestBody String comingReq) {
return response.toString();
}

@CrossOrigin()
@Operation(summary = "Edit beneficiary family details")
@PostMapping(value = { "/editFamilyTagging" }, consumes = "application/json", produces = "application/json")
public String editFamilyDetails(@RequestBody String comingReq) {
Expand Down
2 changes: 0 additions & 2 deletions src/main/java/com/iemr/common/identity/controller/version/VersionController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,6 @@

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

Expand All @@ -41,7 +40,6 @@ public class VersionController {

private Logger logger = LoggerFactory.getLogger(this.getClass().getSimpleName());

@CrossOrigin()
@Operation(summary = "Get version information")
@GetMapping(value = "/version",consumes = "application/json", produces = "application/json")
public String versionInformation() {
Expand Down
Loading
Loading