src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIDWithUID.java (1)

41-43: headers = "Authorization" may block OPTIONS pre-flight

@RequestMapping(... headers = "Authorization") rejects requests whose header set does not include Authorization.
CORS pre-flight calls (OPTIONS) never include this header, so they will be rejected before Spring’s CORS layer sees them, nullifying the new central CORS setup.

Consider dropping the headers constraint or duplicating the mapping without it:

-@RequestMapping(value = "/healthIDWithUID", headers = "Authorization", ...
+@RequestMapping(value = "/healthIDWithUID", ...

src/main/java/com/wipro/fhir/controller/patientdatahandler/HigherHealthFacilityController.java (1)

37-39: Same pre-flight issue with headers = "Authorization"

All routes under this controller inherit the headers="Authorization" restriction. OPTIONS requests will be blocked.

See suggestion in CreateHealthIDWithUID.java.

src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIDWithMobileOTP.java (1)

43-45: Pre-flight blocked by headers="Authorization"

Same concern: OPTIONS calls will not match this mapping. Remove the header constraint or add an alternative mapping.

src/main/java/com/wipro/fhir/controller/eaushdhi/EAushadhiController.java (1)

49-51: headers="Authorization" again blocks OPTIONS

Same issue as other controllers. Consolidate the fix project-wide.

src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIdRecord.java (1)

5-6: Prefer constructor injection over field injection
Field injection via @Autowired reduces testability and immutability. Switch to constructor-based injection for HealthIDService:

- @Autowired
- private HealthIDService healthIDService;
+ private final HealthIDService healthIDService;
+
+ public CreateHealthIdRecord(HealthIDService healthIDService) {
+     this.healthIDService = healthIDService;
+ }

src/main/java/com/wipro/fhir/controller/test/Test.java (1)

26-27: Prefer constructor injection over field injection
Field injection via @Autowired reduces testability and immutability. Switch to constructor-based injection for HttpUtils and OPConsultRecordBundleImpl:

- @Autowired
- HttpUtils httpUtils;
- @Autowired
- private OPConsultRecordBundleImpl oPConsultRecordBundleImpl;
+ private final HttpUtils httpUtils;
+ private final OPConsultRecordBundleImpl oPConsultRecordBundleImpl;
+
+ public Test(HttpUtils httpUtils,
+             OPConsultRecordBundleImpl oPConsultRecordBundleImpl) {
+     this.httpUtils = httpUtils;
+     this.oPConsultRecordBundleImpl = oPConsultRecordBundleImpl;
+ }

src/main/java/com/wipro/fhir/controller/generateresource/ResourceRequestGateway.java (1)

26-27: Prefer constructor injection over field injection
Field injection with @Autowired hinders immutability and testing. Convert to constructor-based injection for all three bundles:

- @Autowired
- private OPConsultRecordBundle opConsultRecordBundle;
- @Autowired
- private PrescriptionRecordBundle prescriptionRecordBundle;
- @Autowired
- private DiagnosticReportRecord diagnosticReportRecord;
+ private final OPConsultRecordBundle opConsultRecordBundle;
+ private final PrescriptionRecordBundle prescriptionRecordBundle;
+ private final DiagnosticReportRecord diagnosticReportRecord;
+
+ public ResourceRequestGateway(OPConsultRecordBundle opConsultRecordBundle,
+                               PrescriptionRecordBundle prescriptionRecordBundle,
+                               DiagnosticReportRecord diagnosticReportRecord) {
+     this.opConsultRecordBundle = opConsultRecordBundle;
+     this.prescriptionRecordBundle = prescriptionRecordBundle;
+     this.diagnosticReportRecord = diagnosticReportRecord;
+ }

src/main/java/com/wipro/fhir/controller/patientdatahandler/PatientDataGatewayController.java (1)

29-29: Prefer constructor injection over field injection
Field injection via @Autowired reduces testability and immutability. Refactor to constructor-based injection for PatientDataGatewayService:

- @Autowired
- private PatientDataGatewayService patientDataGatewayService;
+ private final PatientDataGatewayService patientDataGatewayService;
+
+ public PatientDataGatewayController(PatientDataGatewayService patientDataGatewayService) {
+     this.patientDataGatewayService = patientDataGatewayService;
+ }

src/main/java/com/wipro/fhir/controller/v3/abha/CreateAbhaV3Controller.java (1)

5-6: Prefer constructor injection over field injection
Field injection with @Autowired reduces testability and immutability. Switch to constructor-based injection for CreateAbhaV3Service:

- @Autowired
- private CreateAbhaV3Service createAbhaV3Service;
+ private final CreateAbhaV3Service createAbhaV3Service;
+
+ public CreateAbhaV3Controller(CreateAbhaV3Service createAbhaV3Service) {
+     this.createAbhaV3Service = createAbhaV3Service;
+ }

src/main/java/com/wipro/fhir/controller/healthID/CreateHealthIDWithMobileOTP.java (1)

133-134: Incorrect logger invocation — placeholder lost

logger.info("NDHM_FHIR Response:", response); passes two arguments but only a single {} placeholder exists, so the second arg is appended by toString() and the literal colon stays.
Use the placeholder API:

-logger.info("NDHM_FHIR Response:", response);
+logger.info("NDHM_FHIR Response: {}", response);

src/main/java/com/wipro/fhir/utils/FilterConfig.java (1)

23-24: Give the filter a deterministic name

FilterRegistrationBean without an explicit name is fine, but naming helps when
debug-printing the filter chain or tweaking precedence later.

 registrationBean.setFilter(filter);
+registrationBean.setName("jwtUserIdValidationFilter");

src/main/java/com/wipro/fhir/utils/JwtUserIdValidationFilter.java (2)

8-9: Remove now-unused @Component import

org.springframework.stereotype.Component is no longer required after the
class stopped being a Spring bean. Leaving it in will trigger an “unused import”
warning.

-import org.springframework.stereotype.Component;

---

129-146: Regex is too permissive & recomputed per request

1. matches() is executed on every call; compiling patterns once would be
   cheaper.
2. Without anchors an origin like http://evil.com.example.com will satisfy
   the rule example.com.

-		return Arrays.stream(allowedOrigins.split(","))
-				.map(String::trim)
-				.anyMatch(pattern -> {
-					String regex = pattern
-							.replace(".", "\\.")
-							.replace("*", ".*")
-							.replace("http://localhost:.*", "http://localhost:\\d+"); // special case for wildcard port
-
-					boolean matched = origin.matches(regex);
-					return matched;
-				});
+		return Arrays.stream(allowedOrigins.split(","))
+				.map(String::trim)
+				.map(p -> p.replace(".", "\\.")
+						   .replace("*", ".*")
+						   .replace("http://localhost:.*", "http://localhost:\\d+"))
+				.map(r -> "^" + r + "$")          // anchor the pattern
+				.anyMatch(origin::matches);

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

Learnt from: helenKaryamsetty
PR: PSMRI/FHIR-API#52
File: src/main/java/com/wipro/fhir/controller/v3/abha/LoginAbhaV3Controller.java:18-20
Timestamp: 2024-12-09T16:09:31.513Z
Learning: In the Java Spring Boot project, all controllers, including `LoginAbhaV3Controller.java` at `src/main/java/com/wipro/fhir/controller/v3/abha/`, use the `@CrossOrigin` annotation without parameters to maintain consistency across the codebase.

Learnt from: helenKaryamsetty
PR: PSMRI/FHIR-API#52
File: src/main/java/com/wipro/fhir/controller/v3/abha/LoginAbhaV3Controller.java:18-20
Timestamp: 2024-12-09T16:09:31.513Z
Learning: In the Java Spring Boot project, all controllers, including `LoginAbhaV3Controller.java` at `src/main/java/com/wipro/fhir/controller/v3/abha/`, use the `@CrossOrigin` annotation without parameters to maintain consistency across the codebase.

Learnt from: helenKaryamsetty
PR: PSMRI/FHIR-API#52
File: src/main/java/com/wipro/fhir/controller/v3/abha/LoginAbhaV3Controller.java:18-20
Timestamp: 2024-12-09T16:09:31.513Z
Learning: In the Java Spring Boot project, all controllers, including `LoginAbhaV3Controller.java` at `src/main/java/com/wipro/fhir/controller/v3/abha/`, use the `@CrossOrigin` annotation without parameters to maintain consistency across the codebase.

Learnt from: helenKaryamsetty
PR: PSMRI/FHIR-API#52
File: src/main/java/com/wipro/fhir/controller/v3/abha/LoginAbhaV3Controller.java:18-20
Timestamp: 2024-12-09T16:09:31.513Z
Learning: In the Java Spring Boot project, all controllers, including `LoginAbhaV3Controller.java` at `src/main/java/com/wipro/fhir/controller/v3/abha/`, use the `@CrossOrigin` annotation without parameters to maintain consistency across the codebase.