Skip to content

Commit 4e626a5

Browse files
vanitha1822vanitha1822
committed
fix: role based on both jwt and auth token
1 parent 0889338 commit 4e626a5

File tree

6 files changed

+219
-121
lines changed

6 files changed

+219
-121
lines changed

‎src/main/java/com/iemr/tm/controller/common/main/WorklistController.java‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -35,21 +35,19 @@
3535
import org.springframework.web.bind.annotation.RequestBody;
3636
import org.springframework.web.bind.annotation.RequestHeader;
3737
import org.springframework.web.bind.annotation.RequestMapping;
38-
import org.springframework.web.bind.annotation.RequestMethod;
3938
import org.springframework.web.bind.annotation.RestController;
4039

4140
import com.iemr.tm.data.benFlowStatus.BeneficiaryFlowStatus;
4241
import com.iemr.tm.service.common.transaction.CommonDoctorServiceImpl;
4342
import com.iemr.tm.service.common.transaction.CommonNurseServiceImpl;
4443
import com.iemr.tm.service.common.transaction.CommonServiceImpl;
45-
import com.iemr.tm.utils.CookieUtil;
4644
import com.iemr.tm.utils.JwtUtil;
4745
import com.iemr.tm.utils.mapper.InputMapper;
4846
import com.iemr.tm.utils.response.OutputResponse;
47+
import org.springframework.security.core.Authentication;
4948

5049
import io.lettuce.core.dynamic.annotation.Param;
5150
import io.swagger.v3.oas.annotations.Operation;
52-
import jakarta.servlet.http.HttpServletRequest;
5351

5452
@RestController
5553
@RequestMapping(value = "/common", headers = "Authorization", consumes = "application/json", produces = "application/json")
@@ -711,18 +709,22 @@ public String getBeneficiaryCaseSheetHistory(
711709
@Operation(summary = "Get teleconsultation specialist worklist")
712710
@GetMapping(value = { "/getTCSpecialistWorklist/{providerServiceMapID}/{serviceID}" })
713711
public String getTCSpecialistWorkListNew(@PathVariable("providerServiceMapID") Integer providerServiceMapID,
714-
@PathVariable("serviceID") Integer serviceID, HttpServletRequest request) {
712+
@PathVariable("serviceID") Integer serviceID, Authentication authentication) {
715713
OutputResponse response = new OutputResponse();
716-
try {
717-
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
718-
String userId = jwtUtil.getUserIdFromToken(jwtToken);
719-
Integer userID=Integer.parseInt(userId);
720-
if (providerServiceMapID != null && userId != null ) {
714+
try {
715+
if (authentication == null || !authentication.isAuthenticated()) {
716+
response.setError(403, "Unauthorized access");
717+
return response.toString();
718+
}
719+
720+
Integer userID = Integer.valueOf(authentication.getPrincipal().toString());
721+
722+
if (providerServiceMapID != null && userID != null ) {
721723
String s = commonDoctorServiceImpl.getTCSpecialistWorkListNewForTM(providerServiceMapID, userID,
722724
serviceID);
723725
if (s != null)
724726
response.setResponse(s);
725-
} else if(userId == null || jwtToken == null) {
727+
} else if(userID == null ) {
726728
response.setError(403, "Unauthorized access!");
727729
} else {
728730
logger.error("Invalid request");
@@ -742,20 +744,21 @@ public String getTCSpecialistWorkListNew(@PathVariable("providerServiceMapID") I
742744
"/getTCSpecialistWorklistPatientApp/{providerServiceMapID}/{serviceID}/{vanID}" })
743745
public String getTCSpecialistWorkListNewPatientApp(
744746
@PathVariable("providerServiceMapID") Integer providerServiceMapID,
745-
@PathVariable("serviceID") Integer serviceID, @PathVariable("vanID") Integer vanID, HttpServletRequest request) {
747+
@PathVariable("serviceID") Integer serviceID, @PathVariable("vanID") Integer vanID, Authentication authentication) {
746748
OutputResponse response = new OutputResponse();
747749
try {
748-
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
749-
String userId = jwtUtil.getUserIdFromToken(jwtToken);
750-
Integer userID=Integer.parseInt(userId);
750+
if (authentication == null || !authentication.isAuthenticated()) {
751+
response.setError(403, "Unauthorized access");
752+
return response.toString();
753+
}
754+
755+
Integer userID = Integer.valueOf(authentication.getPrincipal().toString());
751756
if (providerServiceMapID != null && userID != null) {
752757
String s = commonDoctorServiceImpl.getTCSpecialistWorkListNewForTMPatientApp(providerServiceMapID,
753758
userID, serviceID, vanID);
754759
if (s != null)
755760
response.setResponse(s);
756-
} else if(userId == null || jwtToken == null) {
757-
response.setError(403, "Unauthorized access!");
758-
} else {
761+
} else {
759762
logger.error("Invalid request");
760763
response.setError(5000, "Invalid request");
761764
}
@@ -773,21 +776,22 @@ public String getTCSpecialistWorkListNewPatientApp(
773776
"/getTCSpecialistWorklistFutureScheduled/{providerServiceMapID}/{serviceID}" })
774777
public String getTCSpecialistWorklistFutureScheduled(
775778
@PathVariable("providerServiceMapID") Integer providerServiceMapID,
776-
@PathVariable("serviceID") Integer serviceID, HttpServletRequest request) {
779+
@PathVariable("serviceID") Integer serviceID, Authentication authentication) {
777780
OutputResponse response = new OutputResponse();
778781
try {
779782

780-
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
781-
String userId = jwtUtil.getUserIdFromToken(jwtToken);
782-
Integer userID=Integer.parseInt(userId);
783+
if (authentication == null || !authentication.isAuthenticated()) {
784+
response.setError(403, "Unauthorized access");
785+
return response.toString();
786+
}
787+
788+
Integer userID = Integer.valueOf(authentication.getPrincipal().toString());
783789
if (providerServiceMapID != null && userID != null ) {
784790
String s = commonDoctorServiceImpl.getTCSpecialistWorkListNewFutureScheduledForTM(providerServiceMapID,
785791
userID, serviceID);
786792
if (s != null)
787793
response.setResponse(s);
788-
} else if(userId == null || jwtToken == null) {
789-
response.setError(403, "Unauthorized access!");
790-
} else {
794+
} else {
791795
logger.error("Invalid request");
792796
response.setError(5000, "Invalid request");
793797
}

‎src/main/java/com/iemr/tm/controller/login/IemrMmuLoginController.java‎

Lines changed: 32 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -36,17 +36,17 @@
3636

3737
import com.iemr.tm.controller.registrar.main.RegistrarController;
3838
import com.iemr.tm.service.login.IemrMmuLoginServiceImpl;
39-
import com.iemr.tm.utils.CookieUtil;
4039
import com.iemr.tm.utils.JwtUtil;
4140
import com.iemr.tm.utils.mapper.InputMapper;
4241
import com.iemr.tm.utils.response.OutputResponse;
42+
import org.springframework.security.core.Authentication;
4343

4444
import io.swagger.v3.oas.annotations.Operation;
4545
import jakarta.servlet.http.HttpServletRequest;
4646

4747
@RestController
4848
@RequestMapping(value = "/user", headers = "Authorization", consumes = "application/json", produces = "application/json")
49-
@PreAuthorize("hasRole('NURSE') || hasRole('PHARMACIST') || hasRole('LABTECHNICIAN') || hasRole('REGISTRAR') || hasRole('DATASYNC') || hasRole('DATA_SYNC') || hasRole('DOCTOR') || hasRole('LAB_TECHNICIAN') || hasRole('TC_SPECIALIST') || hasRole('ONCOLOGIST') || hasRole('RADIOLOGIST')")
49+
@PreAuthorize("hasRole('NURSE') || hasRole('PHARMACIST') || hasRole('LABTECHNICIAN') || hasRole('REGISTRAR') || hasRole('DATASYNC') || hasRole('DATA_SYNC') || hasRole('DOCTOR') || hasRole('LAB_TECHNICIAN') || hasRole('TC_SPECIALIST') || hasRole('ONCOLOGIST') || hasRole('RADIOLOGIST') || hasRole('ASHA')")
5050
public class IemrMmuLoginController {
5151

5252
private Logger logger = LoggerFactory.getLogger(RegistrarController.class);
@@ -66,17 +66,21 @@ public void setIemrMmuLoginServiceImpl(IemrMmuLoginServiceImpl iemrMmuLoginServi
6666
@Operation(summary = "Get user service point van details")
6767
@PostMapping(value = "/getUserServicePointVanDetails", produces = {
6868
"application/json" })
69-
public String getUserServicePointVanDetails(@RequestBody String comingRequest, HttpServletRequest request) {
69+
public String getUserServicePointVanDetails(@RequestBody String comingRequest, Authentication authentication) {
7070
OutputResponse response = new OutputResponse();
7171
try {
7272

73-
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
74-
String userId = jwtUtil.getUserIdFromToken(jwtToken);
75-
Integer userID=Integer.parseInt(userId);
73+
if (authentication == null || !authentication.isAuthenticated()) {
74+
response.setError(403, "Unauthorized access");
75+
return response.toString();
76+
}
77+
78+
Integer userID = Integer.valueOf(authentication.getPrincipal().toString());
79+
7680

7781
JSONObject obj = new JSONObject(comingRequest);
7882
logger.info("getUserServicePointVanDetails request " + comingRequest);
79-
if (userId == null || jwtToken ==null) {
83+
if (userID == null) {
8084
response.setError(403, "Unauthorized access: Missing or invalid token");
8185
return response.toString();
8286
}
@@ -114,30 +118,31 @@ public String getServicepointVillages(@RequestBody String comingRequest) {
114118

115119
@Operation(summary = "Get user service point van details")
116120
@PostMapping(value = "/getUserVanSpDetails", produces = { "application/json" })
117-
public String getUserVanSpDetails(@RequestBody String comingRequest, HttpServletRequest request) {
121+
public String getUserVanSpDetails(@RequestBody String comingRequest, Authentication authentication) {
118122
OutputResponse response = new OutputResponse();
119123
try {
120-
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
121-
String userId = jwtUtil.getUserIdFromToken(jwtToken);
122-
Integer userID=Integer.parseInt(userId);
124+
if (authentication == null || !authentication.isAuthenticated()) {
125+
response.setError(403, "Unauthorized access");
126+
return response.toString();
127+
}
123128

124-
JSONObject obj = new JSONObject(comingRequest);
125-
logger.info("getServicepointVillages request " + comingRequest);
126-
127-
if (userId !=null && obj.has("providerServiceMapID")) {
128-
String responseData = iemrMmuLoginServiceImpl.getUserVanSpDetails(userID,
129-
obj.getInt("providerServiceMapID"));
130-
response.setResponse(responseData);
131-
} else if(userId == null || jwtToken ==null) {
132-
response.setError(403, "Unauthorized access : Missing or invalid token");
133-
} else {
134-
response.setError(5000, "Invalid request");
135-
}
136-
} catch (Exception e) {
137-
response.setError(5000, "Error while getting van and service points data");
138-
logger.error("getUserVanSpDetails failed with " + e.getMessage(), e);
129+
Integer userID = Integer.valueOf(authentication.getPrincipal().toString());
139130

140-
}
131+
JSONObject obj = new JSONObject(comingRequest);
132+
logger.info("getUserVanSpDetails request {}", comingRequest);
133+
134+
if (obj.has("providerServiceMapID")) {
135+
String responseData = iemrMmuLoginServiceImpl.getUserVanSpDetails(userID, obj.getInt("providerServiceMapID"));
136+
137+
response.setResponse(responseData);
138+
} else {
139+
response.setError(400, "Invalid request");
140+
}
141+
142+
} catch (Exception e) {
143+
response.setError(400, "Error while getting van and service points data");
144+
logger.error("getUserVanSpDetails failed", e);
145+
}
141146
logger.info("getUserVanSpDetails response " + response.toString());
142147
return response.toString();
143148
}

‎src/main/java/com/iemr/tm/controller/teleconsultation/TeleConsultationController.java‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,16 @@
2525
import org.slf4j.LoggerFactory;
2626
import org.springframework.beans.factory.annotation.Autowired;
2727
import org.springframework.security.access.prepost.PreAuthorize;
28+
import org.springframework.security.core.Authentication;
2829

2930
import org.springframework.web.bind.annotation.PostMapping;
3031
import org.springframework.web.bind.annotation.RequestBody;
3132
import org.springframework.web.bind.annotation.RequestHeader;
3233
import org.springframework.web.bind.annotation.RequestMapping;
3334
import org.springframework.web.bind.annotation.RestController;
35+
3436
import jakarta.servlet.http.HttpServletRequest;
37+
3538
import com.iemr.tm.utils.CookieUtil;
3639
import com.iemr.tm.utils.JwtUtil;
3740

@@ -145,19 +148,22 @@ public String createTCRequestForBeneficiary(@RequestBody String requestOBJ, @Req
145148
// TC request List
146149
@Operation(summary = "Get teleconsultation request list for a specialist")
147150
@PostMapping(value = { "/getTCRequestList" })
148-
public String getTCSpecialistWorkListNew(@RequestBody String requestOBJ, HttpServletRequest request) {
151+
public String getTCSpecialistWorkListNew(@RequestBody String requestOBJ, Authentication authentication) {
149152
OutputResponse response = new OutputResponse();
150153
try {
151-
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
152-
String userId = jwtUtil.getUserIdFromToken(jwtToken);
153-
Integer userID=Integer.parseInt(userId);
154+
if (authentication == null || !authentication.isAuthenticated()) {
155+
response.setError(403, "Unauthorized access");
156+
return response.toString();
157+
}
158+
159+
Integer userID = Integer.valueOf(authentication.getPrincipal().toString());
154160

155161
if (requestOBJ != null) {
156162
JsonObject jsnOBJ = new JsonObject();
157163
JsonParser jsnParser = new JsonParser();
158164
JsonElement jsnElmnt = jsnParser.parse(requestOBJ);
159165
jsnOBJ = jsnElmnt.getAsJsonObject();
160-
if (userId != null) {
166+
if (userID != null) {
161167
String s = teleConsultationServiceImpl.getTCRequestListBySpecialistIdAndDate(
162168
jsnOBJ.get("psmID").getAsInt(), userID,
163169
jsnOBJ.get("date").getAsString());

‎src/main/java/com/iemr/tm/controller/videoconsultationcontroller/VideoConsultationController.java‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
import org.slf4j.Logger;
2525
import org.slf4j.LoggerFactory;
2626
import org.springframework.beans.factory.annotation.Autowired;
27+
import org.springframework.security.core.Authentication;
2728

2829
import org.springframework.web.bind.annotation.GetMapping;
2930
import org.springframework.web.bind.annotation.PathVariable;
@@ -32,7 +33,9 @@
3233

3334
import com.iemr.tm.service.videoconsultation.VideoConsultationService;
3435
import com.iemr.tm.utils.response.OutputResponse;
36+
3537
import jakarta.servlet.http.HttpServletRequest;
38+
3639
import com.iemr.tm.utils.CookieUtil;
3740
import com.iemr.tm.utils.JwtUtil;
3841

@@ -53,13 +56,16 @@ public class VideoConsultationController {
5356
@Operation(summary = "Login to video consultation service")
5457
@GetMapping(value = "/login/{userID}", headers = "Authorization", produces = {
5558
"application/json" })
56-
public String login(@PathVariable("userID") Long userID, HttpServletRequest request) {
59+
public String login(@PathVariable("userID") Long userID, Authentication authentication) {
5760

5861
OutputResponse response = new OutputResponse();
5962
try {
60-
String jwtToken = CookieUtil.getJwtTokenFromCookie(request);
61-
String userId = jwtUtil.getUserIdFromToken(jwtToken);
63+
if (authentication == null || !authentication.isAuthenticated()) {
64+
response.setError(403, "Unauthorized access");
65+
return response.toString();
66+
}
6267

68+
String userId = authentication.getPrincipal().toString();
6369
if(userID.toString().equals(userId)) {
6470
String createdData = videoConsultationService.login(userID);
6571

‎src/main/java/com/iemr/tm/utils/CookieUtil.java‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
@Service
1313
public class CookieUtil {
1414

15-
public Optional<String> getCookieValue(HttpServletRequest request, String cookieName) {
15+
public static Optional<String> getCookieValue(HttpServletRequest request, String cookieName) {
1616
Cookie[] cookies = request.getCookies();
1717
if (cookies != null) {
1818
for (Cookie cookie : cookies) {
@@ -36,4 +36,11 @@ public static String getJwtTokenFromCookie(HttpServletRequest request) {
3636
.findFirst()
3737
.orElse(null);
3838
}
39+
40+
/**
41+
* Get auth token from cookies (for legacy support)
42+
*/
43+
public static String getAuthTokenFromCookie(HttpServletRequest request) {
44+
return getCookieValue(request, "Authorization").orElse(null);
45+
}
3946
}

0 commit comments

Comments
 (0)