Reviewing files that changed from the base of the PR and between 75b6f91 and 35d8a7a.

• src/main/environment/common_ci.properties (1 hunks)
• src/main/environment/common_example.properties (1 hunks)
• src/main/java/com/wipro/fhir/config/CorsConfig.java (1 hunks)
• src/main/java/com/wipro/fhir/controller/carecontext/CareContextController.java (3 hunks)
• src/main/java/com/wipro/fhir/controller/eaushdhi/EAushadhiController.java (5 hunks)
• src/main/java/com/wipro/fhir/controller/facility/FacilityController.java (3 hunks)
• src/main/java/com/wipro/fhir/controller/generateresource/ResourceRequestGateway.java (4 hunks)
• src/main/java/com/wipro/fhir/controller/healthCard/GenerateHealthIDCardController.java (2 hunks)
• src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIDWithBio.java (4 hunks)
• src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIDWithMobileOTP.java (5 hunks)
• src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIDWithUID.java (6 hunks)
• src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIdRecord.java (3 hunks)
• src/main/java/com/wipro/fhir/controller/healthIDvalidate/HealthIDValidateController.java (3 hunks)
• src/main/java/com/wipro/fhir/controller/patientdatahandler/HigherHealthFacilityController.java (2 hunks)
• src/main/java/com/wipro/fhir/controller/patientdatahandler/PatientDataGatewayController.java (3 hunks)
• src/main/java/com/wipro/fhir/controller/test/Test.java (2 hunks)
• src/main/java/com/wipro/fhir/controller/v3/abha/CreateAbhaV3Controller.java (5 hunks)
• src/main/java/com/wipro/fhir/controller/v3/abha/LoginAbhaV3Controller.java (4 hunks)
• src/main/java/com/wipro/fhir/utils/DynamicCorsFilter.java (1 hunks)
• src/main/java/com/wipro/fhir/utils/FilterConfig.java (1 hunks)
• src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java (4 hunks)

• GitHub Check: Analyze (java)

src/main/environment/common_ci.properties (1)

118-118: Add cors.allowed-origins placeholder for CI environment.
This introduces the central CORS origins configuration; ensure that the CORS_ALLOWED_ORIGINS environment variable is defined in your CI settings and that its value is injected correctly at build time.

src/main/environment/common_example.properties (1)

114-115: Define default allowed origins in example config.
The pattern http://localhost:* may not be recognized by Spring’s allowedOrigins (which expects exact matches). Verify whether your CorsConfig uses allowedOriginPatterns for wildcard support or adjust this to an explicit list of ports.

src/main/java/com/wipro/fhir/controller/patientdatahandler/HigherHealthFacilityController.java (2)

37-37: Removed class-level @CrossOrigin annotation.
Ensure that the global CORS configuration (via CorsConfig/DynamicCorsFilter) covers the /higher/health/facility base path for all HTTP methods and handles preflight requests.

---

67-67: Removed method-level @CrossOrigin annotation.
Confirm that the dynamic CORS filter correctly applies to the /get/clinical/data endpoint, including OPTIONS preflight handling and header allowances.

src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIdRecord.java (3)

19-19: Removed class-level @CrossOrigin annotation.
Verify that the centralized CORS policy applies to the /healthIDRecord controller and that no endpoints are inadvertently blocked.

---

35-35: Removed method-level @CrossOrigin annotation on mapHealthIDToBeneficiary.
Ensure the global filter covers /healthIDRecord/mapHealthIDToBeneficiary, including CORS preflight and header propagation.

---

57-57: Removed method-level @CrossOrigin annotation on addHealthIdRecord.
Confirm that /healthIDRecord/addHealthIdRecord is included in your centralized CORS configuration, handling both actual requests and preflight checks.

src/main/java/com/wipro/fhir/controller/healthIDvalidate/HealthIDValidateController.java (1)

41-94:

Details

✅ Verification successful

Verify centralized CORS configuration is working properly.

The systematic removal of @CrossOrigin annotations from the class and methods is well-executed as part of centralizing CORS management. Ensure that the new centralized CORS configuration properly handles cross-origin requests for all endpoints in this controller.

---

🏁 Script executed:

#!/bin/bash
# Description: Verify that centralized CORS configuration exists and is properly configured

# Check for CorsConfig class
fd -t f "CorsConfig.java" | head -5

# Check for CORS configuration properties
fd -t f -e properties | xargs grep -l "cors.allowed-origins" 2>/dev/null

# Check for DynamicCorsFilter
fd -t f "DynamicCorsFilter.java" | head -5

Length of output: 338

---

🏁 Script executed:

#!/bin/bash
# Display the central CORS configuration to verify global mappings
echo "+++ CorsConfig.java +++"
sed -n '1,200p' src/main/java/com/wipro/fhir/config/CorsConfig.java
echo ""
echo "+++ DynamicCorsFilter.java +++"
sed -n '1,200p' src/main/java/com/wipro/fhir/utils/DynamicCorsFilter.java

Length of output: 2450

---

Centralized CORS configuration covers all controller endpoints

Your global CORS setup in CorsConfig (registry.addMapping("/**")…) and the DynamicCorsFilter both apply to every endpoint—including those in HealthIDValidateController—so you can safely remove all method-level @crossorigin annotations.
No further changes are needed.

src/main/java/com/wipro/fhir/controller/carecontext/CareContextController.java (1)

41-113: LGTM! Systematic CORS annotation removal.

The removal of @CrossOrigin annotations from class and method levels is consistent with the centralized CORS configuration approach. The controller logic remains intact.

src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIDWithMobileOTP.java (1)

43-169: LGTM! Complete CORS annotation removal.

All @CrossOrigin annotations have been systematically removed from the class and all endpoint methods. The controller functionality remains unchanged, and this aligns with the centralized CORS configuration approach.

src/main/java/com/wipro/fhir/controller/generateresource/ResourceRequestGateway.java (1)

52-147:

Details

✅ Verification successful

Excellent! Complete CORS refactoring.

The systematic removal of all @CrossOrigin annotations from class and method levels is well-executed. This completes the centralization of CORS configuration for this controller.

---

🏁 Script executed:

#!/bin/bash
# Description: Verify that CORS refactoring is complete across the entire codebase

# Check for any remaining @CrossOrigin annotations in controllers
rg -A 2 -B 2 "@CrossOrigin" --type java src/

# Verify centralized CORS configuration files exist
echo "=== Checking for CorsConfig class ==="
fd "CorsConfig.java" src/ | xargs cat 2>/dev/null || echo "CorsConfig.java not found"

echo "=== Checking for DynamicCorsFilter class ==="
fd "DynamicCorsFilter.java" src/ | xargs cat 2>/dev/null || echo "DynamicCorsFilter.java not found"

echo "=== Checking CORS properties ==="
fd -e properties src/ | xargs grep "cors" 2>/dev/null || echo "No CORS properties found"

Length of output: 2979

---

🏁 Script executed:

#!/bin/bash
# Verify that the required CORS property definitions are present

echo "=== Searching for 'cors.allowed-origins' across the repository ==="
rg -n "cors.allowed-origins" .

echo "=== Searching for any 'cors' entries in .properties/.yml/.yaml files ==="
rg -n "cors" --glob "*.properties" --glob "*.yml" --glob "*.yaml" .

Length of output: 1200

---

CORS Refactoring Complete: Centralized Configuration Verified

• No @CrossOrigin annotations remain in any controller.
• CorsConfig.java and DynamicCorsFilter.java are present and correctly configured.
• The cors.allowed-origins property is defined in common_example.properties and common_ci.properties.

src/main/java/com/wipro/fhir/controller/v3/abha/LoginAbhaV3Controller.java (1)

18-18: Verify central CORS configuration applies correctly to this controller

Per-controller @CrossOrigin annotations were removed in favor of a global CORS setup (CorsConfig and DynamicCorsFilter), which is appropriate. Please ensure that requests to /abhaLogin endpoints (including preflight OPTIONS) correctly include the configured CORS headers. Add integration tests or use tooling (e.g., curl or browser devtools) to confirm the allowed origins and methods are applied as expected.

Also applies to: 28-28, 48-48

src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIDWithBio.java (1)

20-20: Validate global CORS handling for bio-based health ID endpoints

The removal of method-level @CrossOrigin annotations is intentional to centralize CORS. Ensure that the /healthIDWithBio endpoints (verifyBio, generateMobileOTP, confirmWithAadhaarBio) are still reachable from the configured origins and properly support preflight OPTIONS requests under the new DynamicCorsFilter and CorsConfig.

Also applies to: 53-53, 75-75

src/main/java/com/wipro/fhir/controller/facility/FacilityController.java (1)

23-23: Confirm removal of @crossorigin is covered by global CORS config

Controller- and method-level @CrossOrigin annotations were removed. Please verify that the global CORS settings (in CorsConfig) correctly apply to /facility endpoints (getAbdmRegisteredFacilities and saveAbdmFacilityId), including allowing the necessary HTTP methods and handling OPTIONS preflight.

Also applies to: 34-34, 57-57

src/main/java/com/wipro/fhir/controller/eaushdhi/EAushadhiController.java (1)

50-50: Ensure central CORS filter manages all eAushadhi endpoints

All @CrossOrigin annotations were stripped to enforce centralized settings. Double-check that DynamicCorsFilter (and CorsConfig) correctly set the necessary headers for the /eAushadhi endpoints (getStoreStockDetails, syncDrugDispenseDetails, getFacilityStockProcessLog, updatePatientIssueSyncStatus), including preflight responses.

Also applies to: 59-59, 93-93, 116-116

src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIDWithUID.java (1)

41-41: Validate global CORS coverage for UID-based health ID API

Method- and class-level @CrossOrigin annotations were removed for /healthIDWithUID. Confirm that the centralized CORS setup covers all operations (generateOTP, verifyOTP, checkAndGenerateMobileOTP, verifyMobileOTP, createHealthIDWithUID) and that OPTIONS preflight requests succeed for allowed origins.

Also applies to: 73-73, 96-96, 120-120, 144-144

src/main/java/com/wipro/fhir/config/CorsConfig.java (1)

11-12:

Details

❓ Verification inconclusive

Verify CORS allowed origins property configuration.

The configuration reads from cors.allowed-origins property. Ensure this property is properly configured in all environments to prevent security vulnerabilities.

---

🏁 Script executed:

#!/bin/bash
# Description: Verify that cors.allowed-origins property is defined in configuration files
# Expected: Property should be found in environment configuration files

echo "Searching for cors.allowed-origins property definition..."
fd -e properties . --exec grep -l "cors.allowed-origins" {}

echo -e "\nShowing property values:"
fd -e properties . --exec grep "cors.allowed-origins" {}

Length of output: 487

---

Confirm CORS allowed-origins property definitions across all environments

The cors.allowed-origins property is currently defined in:

• src/main/environment/common_example.properties → cors.allowed-origins=@CORS_ALLOWED_ORIGINS@
• src/main/environment/common_ci.properties → cors.allowed-origins=http://localhost:*

Please ensure:

• The @CORS_ALLOWED_ORIGINS@ placeholder is replaced with a restricted, explicit list of origins in each deployment environment (dev, staging, prod).
• No environment relies on overly broad patterns (e.g., wildcards) that could inadvertently expose the API.
• Environment-specific property files or variables properly override the example/CI defaults.

src/main/java/com/wipro/fhir/controller/v3/abha/CreateAbhaV3Controller.java (1)

18-89: Verify that global CORS configuration covers all endpoints.

The removal of @CrossOrigin annotations from this controller is part of centralizing CORS configuration. Ensure that the new global CORS configuration in CorsConfig.java provides the same level of access for all endpoints that previously had individual annotations.

Based on the retrieved learning, this change breaks the previous consistency of using @CrossOrigin annotations across controllers, but this is intentional as part of the centralization effort.

src/main/java/com/wipro/fhir/utils/FilterConfig.java (2)

12-13: LGTM: Proper injection of CORS configuration.

The addition of @Value annotation to inject the cors.allowed-origins property is correctly implemented.

---

20-21:

Details

✅ Verification successful

Verify JwtUserIdValidationFilter constructor supports allowedOrigins parameter.

The filter instantiation now passes allowedOrigins to the constructor. Ensure that JwtUserIdValidationFilter has been updated to accept this parameter and handle CORS appropriately.

---

🏁 Script executed:

#!/bin/bash
# Description: Verify JwtUserIdValidationFilter constructor accepts allowedOrigins parameter
# Expected: Constructor should accept (JwtAuthenticationUtil, String) parameters

echo "Searching for JwtUserIdValidationFilter constructor..."
ast-grep --pattern 'class JwtUserIdValidationFilter {
  $$$
  public JwtUserIdValidationFilter($_, $_) {
    $$$
  }
  $$$
}'

Length of output: 246

---

🏁 Script executed:

#!/bin/bash
echo "Locating JwtUserIdValidationFilter file..."
fd JwtUserIdValidationFilter.java

echo "Searching for constructor declarations in JwtUserIdValidationFilter..."
rg -n "public class JwtUserIdValidationFilter" .
rg -n "JwtUserIdValidationFilter(" .

Length of output: 670

---

🏁 Script executed:

#!/bin/bash
echo "Listing constructors in JwtUserIdValidationFilter..."
rg -n "public JwtUserIdValidationFilter" src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java || true

echo "Checking for allowedOrigins usage in constructors or fields..."
rg -n "allowedOrigins" src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java || true

Length of output: 839

---

Confirmed: JwtUserIdValidationFilter supports allowedOrigins parameter

The constructor in src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java now declares

public JwtUserIdValidationFilter(
    JwtAuthenticationUtil jwtAuthenticationUtil,
    @Value("${cors.allowed-origins}") String allowedOrigins
) { … }

and assigns allowedOrigins to the corresponding field. The filter’s CORS logic (lines 126–131) correctly checks and splits this value. No further changes required.

src/main/java/com/wipro/fhir/controller/healthCard/GenerateHealthIDCardController.java (1)

41-71: LGTM: Consistent with CORS centralization effort.

The removal of @CrossOrigin annotations from class and method levels is consistent with the centralized CORS configuration approach implemented in CorsConfig.java. The controller functionality remains unchanged.

src/main/java/com/wipro/fhir/controller/patientdatahandler/PatientDataGatewayController.java (1)

44-75: LGTM: @crossorigin annotations successfully removed for centralized CORS configuration.

The removal of @CrossOrigin annotations from this controller aligns with the PR objective to centralize CORS handling through the new DynamicCorsFilter and enhanced JwtUserIdValidationFilter. This approach provides better maintainability and consistent CORS policy across the application.

src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java (3)

29-33: LGTM: Constructor properly enhanced for CORS support.

The constructor correctly accepts the allowedOrigins configuration parameter and stores it for use in CORS validation.

---

46-58: LGTM: Proper CORS header handling and OPTIONS support.

The CORS header implementation correctly:

• Validates origins using the isOriginAllowed method
• Sets comprehensive CORS headers including credentials support
• Handles OPTIONS preflight requests appropriately
• Logs the OPTIONS request handling for debugging

---

125-133: LGTM: Robust origin validation with wildcard support.

The isOriginAllowed method properly:

• Handles null/empty checks
• Supports comma-separated origins
• Implements wildcard pattern matching with proper regex escaping
• Includes appropriate logging for debugging