fix: ensure get login response passes right response #201
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
## Walkthrough
The changes update the authentication flow in `IEMRAdminController` to support retrieving JWT tokens from multiple sources (headers and cookies) and refactor response preparation into a helper method. Additionally, a new utility method is added in `JwtUtil` to extract the user ID from a JWT token. The user service interface and implementation were updated to expose user service role mappings publicly.
## Changes
| File(s) | Summary |
|-----------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|
| `src/main/java/com/iemr/common/controller/users/IEMRAdminController.java` | Enhanced `getLoginResponse` to support JWT retrieval from headers/cookies, added helper for response preparation, added null checks, minor comment update. |
| `src/main/java/com/iemr/common/utils/JwtUtil.java` | Added `getUserIdFromToken(String token)` to extract user ID from JWT token. |
| `src/main/java/com/iemr/common/service/users/IEMRAdminUserService.java` | Added method declaration `getUserServiceRoleMapping(Long userID)` to retrieve user service role mappings. |
| `src/main/java/com/iemr/common/service/users/IEMRAdminUserServiceImpl.java` | Changed `getUserServiceRoleMapping(Long userID)` method access from private to public without changing implementation. |
## Sequence Diagram(s)
```mermaid
sequenceDiagram
participant Client
participant IEMRAdminController
participant JwtUtil
participant UserService
Client->>IEMRAdminController: getLoginResponse(request)
alt Authorization header present
IEMRAdminController->>SessionService: getSession(Authorization)
SessionService-->>IEMRAdminController: Session object
IEMRAdminController->>Client: Return session-based response
else Authorization header missing
IEMRAdminController->>Request: Get Jwttoken header or jwtToken cookie
alt JWT token found
IEMRAdminController->>JwtUtil: getUserIdFromToken(token)
JwtUtil-->>IEMRAdminController: userId
IEMRAdminController->>UserService: getUser(userId)
UserService-->>IEMRAdminController: User object
IEMRAdminController->>IEMRAdminController: prepareAuthenticationResponse(User, remoteAddress, remoteHost)
IEMRAdminController->>Client: Return authentication response
else No JWT token found
IEMRAdminController->>Client: Throw exception (token missing)
end
endSuggested reviewers
Poem
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
src/main/java/com/iemr/common/controller/users/IEMRAdminController.java (1)
212-213: Remove or clarify the incomplete comment.The comment
// responseObj ==> helperappears to be an incomplete TODO or reminder. Either remove it or provide a meaningful comment explaining the intent.- // responseObj ==> helper -
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
src/main/java/com/iemr/common/controller/users/IEMRAdminController.java(3 hunks)src/main/java/com/iemr/common/utils/JwtUtil.java(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (4)
- GitHub Check: style-check / checkstyle
- GitHub Check: Package-test
- GitHub Check: Analyze (java)
- GitHub Check: Build
🔇 Additional comments (1)
src/main/java/com/iemr/common/controller/users/IEMRAdminController.java (1)
1104-1128: Good refactoring to reduce code duplication!The extraction of response preparation logic into a separate helper method improves code maintainability and reduces duplication across authentication methods.
Comment on lines
+93
to
+96
| public String getUserIdFromToken(String token) { | ||
| return getAllClaimsFromToken(token).get("userId", String.class); | ||
| } | ||
|
|
Contributor
There was a problem hiding this comment.
Add error handling for token validation and missing claims.
The method should handle potential exceptions and validate that the userId claim exists before returning it. Consider wrapping in try-catch or documenting the expected exceptions.
Apply this diff to add error handling:
public String getUserIdFromToken(String token) {
- return getAllClaimsFromToken(token).get("userId", String.class);
+ try {
+ Claims claims = getAllClaimsFromToken(token);
+ String userId = claims.get("userId", String.class);
+ if (userId == null || userId.isEmpty()) {
+ throw new IllegalArgumentException("JWT token does not contain userId claim");
+ }
+ return userId;
+ } catch (Exception e) {
+ throw new IllegalArgumentException("Failed to extract userId from token", e);
+ }
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| public String getUserIdFromToken(String token) { | |
| return getAllClaimsFromToken(token).get("userId", String.class); | |
| } | |
| public String getUserIdFromToken(String token) { | |
| try { | |
| Claims claims = getAllClaimsFromToken(token); | |
| String userId = claims.get("userId", String.class); | |
| if (userId == null || userId.isEmpty()) { | |
| throw new IllegalArgumentException("JWT token does not contain userId claim"); | |
| } | |
| return userId; | |
| } catch (Exception e) { | |
| throw new IllegalArgumentException("Failed to extract userId from token", e); | |
| } | |
| } |
🤖 Prompt for AI Agents
In src/main/java/com/iemr/common/utils/JwtUtil.java around lines 93 to 96, the
method getUserIdFromToken lacks error handling for invalid tokens or missing
userId claims. Modify the method to wrap the claim extraction in a try-catch
block to handle exceptions from token parsing, and check if the userId claim is
present before returning it. If the claim is missing or an exception occurs,
handle it appropriately, such as returning null or throwing a custom exception,
and document the behavior or exceptions thrown.
Comment on lines
+506
to
+512
| if (jwtToken == null) { | ||
| throw new IEMRException("No authentication token found in header or cookie"); | ||
| } | ||
|
|
||
| // Extract user ID from the JWT token | ||
| String userId = jwtUtil.getUserIdFromToken(jwtToken); | ||
|
|
Contributor
There was a problem hiding this comment.
Validate JWT token before extracting userId.
The code extracts userId from the JWT token without validating it first. This could lead to security issues if an invalid or expired token is provided.
Add JWT validation before extracting the userId:
if (jwtToken == null) {
throw new IEMRException("No authentication token found in header or cookie");
}
+// Validate the JWT token first
+Claims claims = jwtUtil.validateToken(jwtToken);
+if (claims == null) {
+ throw new IEMRException("Invalid or expired JWT token");
+}
+
// Extract user ID from the JWT token
String userId = jwtUtil.getUserIdFromToken(jwtToken);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| if (jwtToken == null) { | |
| throw new IEMRException("No authentication token found in header or cookie"); | |
| } | |
| // Extract user ID from the JWT token | |
| String userId = jwtUtil.getUserIdFromToken(jwtToken); | |
| if (jwtToken == null) { | |
| throw new IEMRException("No authentication token found in header or cookie"); | |
| } | |
| // Validate the JWT token first | |
| Claims claims = jwtUtil.validateToken(jwtToken); | |
| if (claims == null) { | |
| throw new IEMRException("Invalid or expired JWT token"); | |
| } | |
| // Extract user ID from the JWT token | |
| String userId = jwtUtil.getUserIdFromToken(jwtToken); |
🤖 Prompt for AI Agents
In src/main/java/com/iemr/common/controller/users/IEMRAdminController.java
around lines 506 to 512, the JWT token is used to extract the userId without
validating the token first. To fix this, add a validation step using jwtUtil to
check if the token is valid and not expired before calling getUserIdFromToken.
If the token is invalid, throw an appropriate exception to prevent further
processing with an invalid token.
| String authHeader = request.getHeader("Authorization"); | ||
| if (authHeader == null) { | ||
| // Try JWT token from header first | ||
| String jwtToken = request.getHeader("Jwttoken"); |
Contributor
There was a problem hiding this comment.
🛠️ Refactor suggestion
Use consistent header naming convention.
The header name "Jwttoken" should follow a consistent naming convention. Consider using "JWT-Token", "JwtToken", or "Authorization" with "Bearer" prefix as per standard practices.
- String jwtToken = request.getHeader("Jwttoken");
+ String jwtToken = request.getHeader("JwtToken");🤖 Prompt for AI Agents
In src/main/java/com/iemr/common/controller/users/IEMRAdminController.java at
line 491, the header name "Jwttoken" is inconsistent with standard naming
conventions. Update the header name to a consistent and standard format such as
"Authorization" and handle the token with the "Bearer" prefix, or alternatively
use "JWT-Token" or "JwtToken" to align with common practices.
ravishanigarapu
previously approved these changes
May 23, 2025
|
ravishanigarapu
approved these changes
May 23, 2025
This was referenced Jun 27, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
📋 Description
JIRA ID:
Please provide a summary of the change and the motivation behind it. Include relevant context and details.
✅ Type of Change
ℹ️ Additional Information
Please describe how the changes were tested, and include any relevant screenshots, logs, or other information that provides additional context.
Summary by CodeRabbit