From 1455390cd9143c3aec060128d6799fc42fc6e681 Mon Sep 17 00:00:00 2001 From: Ravi Shanigarapu Date: Thu, 17 Apr 2025 18:02:59 +0530 Subject: [PATCH 1/2] Swagger changes --- src/main/environment/common_ci.properties | 4 ++++ .../java/com/iemr/tm/utils/JwtUserIdValidationFilter.java | 3 +++ 2 files changed, 7 insertions(+) diff --git a/src/main/environment/common_ci.properties b/src/main/environment/common_ci.properties index f2d1307..6e7d5de 100644 --- a/src/main/environment/common_ci.properties +++ b/src/main/environment/common_ci.properties @@ -21,3 +21,7 @@ jwt.secret=@env.JWT_SECRET_KEY@ #ELK logging file name logging.file.name=@env.SCHEDULER_API_LOGGING_FILE_NAME@ +springdoc.api-docs.enabled=@env.SWAGGER_DOC_ENABLED@ +springdoc.swagger-ui.enabled=@env.SWAGGER_DOC_ENABLED@ + + diff --git a/src/main/java/com/iemr/tm/utils/JwtUserIdValidationFilter.java b/src/main/java/com/iemr/tm/utils/JwtUserIdValidationFilter.java index 06e3a5e..3da6123 100644 --- a/src/main/java/com/iemr/tm/utils/JwtUserIdValidationFilter.java +++ b/src/main/java/com/iemr/tm/utils/JwtUserIdValidationFilter.java @@ -55,6 +55,9 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo // Skip login and public endpoints if (path.equals(contextPath + "/user/userAuthenticate") || path.equalsIgnoreCase(contextPath + "/user/logOutUserFromConcurrentSession") + || path.startsWith(contextPath + "/swagger-ui") + || path.startsWith(contextPath + "/v3/api-docs") + || path.startsWith(contextPath + "/user/refreshToken") || path.startsWith(contextPath + "/public")) { logger.info("Skipping filter for path: " + path); filterChain.doFilter(servletRequest, servletResponse); From 148f699b361ed663e6c2f96861bfb591827170c7 Mon Sep 17 00:00:00 2001 From: Ravi Shanigarapu Date: Tue, 20 May 2025 17:36:14 +0530 Subject: [PATCH 2/2] Amm-1456 --- .../tm/utils/JwtUserIdValidationFilter.java | 47 ++++++++++++------- 1 file changed, 31 insertions(+), 16 deletions(-) diff --git a/src/main/java/com/iemr/tm/utils/JwtUserIdValidationFilter.java b/src/main/java/com/iemr/tm/utils/JwtUserIdValidationFilter.java index 3da6123..fb57d50 100644 --- a/src/main/java/com/iemr/tm/utils/JwtUserIdValidationFilter.java +++ b/src/main/java/com/iemr/tm/utils/JwtUserIdValidationFilter.java @@ -65,32 +65,47 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo } try { - // Retrieve JWT token from cookies - String jwtTokenFromCookie = getJwtTokenFromCookies(request); - logger.info("JWT token from cookie: "); - - // Determine which token (cookie or header) to validate - String jwtToken = jwtTokenFromCookie != null ? jwtTokenFromCookie : jwtTokenFromHeader; - if (jwtToken == null) { - response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "JWT token not found in cookies or headers"); - return; + String jwtFromCookie = getJwtTokenFromCookies(request); + String jwtFromHeader = request.getHeader("JwtToken"); + String authHeader = request.getHeader("Authorization"); + + if (jwtFromCookie != null) { + logger.info("Validating JWT token from cookie"); + if (jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtFromCookie)) { + filterChain.doFilter(servletRequest, servletResponse); + return; + } } - // Validate JWT token and userId - boolean isValid = jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtToken); + if (jwtFromHeader != null) { + logger.info("Validating JWT token from header"); + if (jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtFromHeader)) { + filterChain.doFilter(servletRequest, servletResponse); + return; + } + } + String userAgent = request.getHeader("User-Agent"); + logger.info("User-Agent: " + userAgent); - if (isValid) { - // If token is valid, allow the request to proceed + if (userAgent != null && isMobileClient(userAgent) && authHeader != null) { filterChain.doFilter(servletRequest, servletResponse); - } else { - response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid JWT token"); + return; } + + logger.warn("No valid authentication token found"); + response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized: Invalid or missing token"); + } catch (Exception e) { logger.error("Authorization error: ", e); response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Authorization error: " + e.getMessage()); } } - + private boolean isMobileClient(String userAgent) { + if (userAgent == null) + return false; + userAgent = userAgent.toLowerCase(); + return userAgent.contains("okhttp"); + } private String getJwtTokenFromCookies(HttpServletRequest request) { Cookie[] cookies = request.getCookies(); if (cookies != null) {