Release 3.8.2 to main

pom.xml

@@ -6,7 +6,7 @@
 
 	<groupId>com.iemr.common-API</groupId>
 	<artifactId>common-api</artifactId>
-	<version>3.8.1</version>
+	<version>3.8.2</version>
 	<packaging>war</packaging>
 
 	<name>Common-API</name>

src/main/java/com/iemr/common/controller/connect/ConnectController.java

@@ -0,0 +1,57 @@
+/*
+* AMRIT – Accessible Medical Records via Integrated Technology
+* Integrated EHR (Electronic Health Records) Solution
+*
+* Copyright (C) "Piramal Swasthya Management and Research Institute"
+*
+* This file is part of AMRIT.
+*
+* This program is free software: you can redistribute it and/or modify
+* it under the terms of the GNU General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*
+* You should have received a copy of the GNU General Public License
+* along with this program.  If not, see https://www.gnu.org/licenses/.
+*/
+package com.iemr.common.controller.connect;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.iemr.common.utils.NetworkUtil;
+
+import io.swagger.v3.oas.annotations.Operation;
+
+/**
+ * Exposes the server's LAN address so a mobile device on the same wifi
+ * network can connect to this API.
+ */
+@RestController
+@RequestMapping(value = "/public/connect")
+public class ConnectController {
+
+	@Value("${server.port:8080}")
+	private int serverPort;
+
+	@Operation(summary = "Get the server's LAN IP address and port")
+	@GetMapping(value = "/info", produces = MediaType.APPLICATION_JSON_VALUE)
+	public ResponseEntity<Map<String, Object>> getConnectInfo() {
+		Map<String, Object> response = new LinkedHashMap<>();
+		response.put("ip", NetworkUtil.getLanIPAddress());
+		response.put("port", serverPort);
+		return ResponseEntity.ok(response);
+	}
+}

src/main/java/com/iemr/common/controller/users/IEMRAdminController.java

@@ -82,6 +82,7 @@
 	private static final String USER_ID_FIELD = "userId";
 	private final Logger logger = LoggerFactory.getLogger(this.getClass().getName());
 	private InputMapper inputMapper = new InputMapper();
+	private static final Set<String> CONCURRENT_SESSION_EXEMPT_ROLES = Set.of("provideradmin", "superadmin");
 
 //	@Value("${captcha.enable-captcha}")
 	private boolean enableCaptcha =false;
@@ -172,7 +173,17 @@
 			}
 
 			String decryptPassword = aesUtil.decrypt("Piramal12Piramal", m_User.getPassword());
-			List<User> mUser = iemrAdminUserServiceImpl.userAuthenticate(m_User.getUserName(), decryptPassword);
+
+
+			List<User> mUser = iemrAdminUserServiceImpl
+					.userAuthenticate(m_User.getUserName(), decryptPassword);
+
+
+			User loggedInUser = mUser.get(0);
+
+			loggedInUser.setFailedAttempt(0);
+
+			iemrAdminUserServiceImpl.save(loggedInUser);
 			JSONObject resMap = new JSONObject();
 			JSONObject serviceRoleMultiMap = new JSONObject();
 			JSONObject serviceRoleMap = new JSONObject();
@@ -181,11 +192,22 @@
 			if (m_User.getUserName() != null
 					    && (m_User.getDoLogout() == null || !m_User.getDoLogout())
 					    && (m_User.getWithCredentials() != null && m_User.getWithCredentials())) {
-				String tokenFromRedis = getConcurrentCheckSessionObjectAgainstUser(
-						m_User.getUserName().trim().toLowerCase());
-				if (tokenFromRedis != null) {
-					throw new IEMRException(
-							"You are already logged in,please confirm to logout from other device and login again");
+				String userRole = "";
+				if (mUser.size() == 1 && mUser.get(0).getM_UserServiceRoleMapping() != null) {
+					for (UserServiceRoleMapping usrm : mUser.get(0).getM_UserServiceRoleMapping()) {
+						if (usrm.getM_Role() != null && usrm.getM_Role().getRoleName() != null) {
+							userRole = usrm.getM_Role().getRoleName();
+							break;
+						}
+					}
+				}
+				if (!CONCURRENT_SESSION_EXEMPT_ROLES.contains(userRole.trim().toLowerCase())) {
+					String tokenFromRedis = getConcurrentCheckSessionObjectAgainstUser(
+							m_User.getUserName().trim().toLowerCase());
+					if (tokenFromRedis != null) {
+						throw new IEMRException(
+								"You are already logged in,please confirm to logout from other device and login again");
+					}
 				}
 			} else if (m_User.getUserName() != null && m_User.getDoLogout() != null && m_User.getDoLogout() == true) {
 				deleteSessionObject(m_User.getUserName().trim().toLowerCase());
@@ -254,7 +276,6 @@
 			// Facility data for ALL users - common pattern, empty if not applicable
 			try {
 				if (mUser.size() == 1) {
-					User loggedInUser = mUser.get(0);
 					String userRoleName = "";
 					if (loggedInUser.getM_UserServiceRoleMapping() != null) {
 						for (UserServiceRoleMapping usrm : loggedInUser.getM_UserServiceRoleMapping()) {
@@ -413,16 +434,28 @@
 						deleteSessionObjectByGettingSessionDetails(previousTokenFromRedis);
 						sessionObject.deleteSessionObject(previousTokenFromRedis);
 
-						// Denylist the active JWT so System 1's requests are immediately rejected
-						String usernameKey = mUsers.get(0).getUserName().trim().toLowerCase();
-						String jtiData = stringRedisTemplate.opsForValue().get("jti:" + usernameKey);
-						if (jtiData != null) {
-							String[] parts = jtiData.split("\\|", 2);
-							tokenDenylist.addTokenToDenylist(parts[0], jwtUtil.getAccessTokenExpiration());
-							if (parts.length > 1) {
-								redisTemplate.delete("user_" + parts[1]);
+						String userRole = "";
+						if (mUsers.get(0).getM_UserServiceRoleMapping() != null) {
+							for (UserServiceRoleMapping usrm : mUsers.get(0).getM_UserServiceRoleMapping()) {
+								if (usrm.getM_Role() != null && usrm.getM_Role().getRoleName() != null) {
+									userRole = usrm.getM_Role().getRoleName();
+									break;
+								}
+							}
+						}
+						if (!CONCURRENT_SESSION_EXEMPT_ROLES.contains(userRole.trim().toLowerCase())) {
+							// Denylist the active JWT so the first system's requests are immediately rejected
+							String usernameKey = mUsers.get(0).getUserName().trim().toLowerCase();
+							String jtiData = stringRedisTemplate.opsForValue().get("jti:" + usernameKey);
+							if (jtiData != null) {
+								String[] parts = jtiData.split("\\|", 2);
+								String jti = parts[0];
+								tokenDenylist.addTokenToDenylist(jti, jwtUtil.getAccessTokenExpiration());
+								if (parts.length > 1) {
+									redisTemplate.delete("user_" + parts[1]);
+								}
+								stringRedisTemplate.delete("jti:" + usernameKey);
 							}
-							stringRedisTemplate.delete("jti:" + usernameKey);
 						}
 
 						response.setResponse("User successfully logged out");
@@ -537,11 +570,13 @@
 			String refreshToken = null;
 			boolean isMobile = false;
 			if (m_User.getUserName() != null && (m_User.getDoLogout() == null || m_User.getDoLogout() == false)) {
-				String tokenFromRedis = getConcurrentCheckSessionObjectAgainstUser(
-						m_User.getUserName().trim().toLowerCase());
-				if (tokenFromRedis != null) {
-					throw new IEMRException(
-							"You are already logged in,please confirm to logout from other device and login again");
+				if (!CONCURRENT_SESSION_EXEMPT_ROLES.contains(m_User.getUserName().trim().toLowerCase())) {
+					String tokenFromRedis = getConcurrentCheckSessionObjectAgainstUser(
+							m_User.getUserName().trim().toLowerCase());
+					if (tokenFromRedis != null) {
+						throw new IEMRException(
+								"You are already logged in,please confirm to logout from other device and login again");
+					}
 				}
 			} else if (m_User.getUserName() != null && m_User.getDoLogout() != null && m_User.getDoLogout() == true) {
 				deleteSessionObject(m_User.getUserName().trim().toLowerCase());
@@ -1000,6 +1035,13 @@
 		try {
 			deleteSessionObjectByGettingSessionDetails(request.getHeader("Authorization"));
 			sessionObject.deleteSessionObject(request.getHeader("Authorization"));
+			try {
+				stringRedisTemplate.delete("camp:vanID");
+				stringRedisTemplate.delete("camp:parkingPlaceID");
+				logger.info("Camp config cleared from Redis on MMU logout");
+			} catch (Exception redisEx) {
+				logger.warn("Failed to clear camp Redis keys on logout: {}", redisEx.getMessage());
+			}
 			response.setResponse("Success");
 		} catch (Exception e) {
 			response.setError(e);

src/main/java/com/iemr/common/data/dynamic_from/FormFieldOption.java

@@ -27,6 +27,9 @@ public class FormFieldOption {
     @Column(name = "label_as")
     private String labelAs;
 
+    @Column(name = "label_bn")
+    private String labelBn;
+
     @Column(name = "sort_order")
     private Integer sortOrder;
 

src/main/java/com/iemr/common/data/translation/Translation.java

@@ -20,6 +20,8 @@ public class Translation {
     private String hindiTranslation;
     @Column(name = "assamese_translation")
     private String assameseTranslation;
+    @Column(name = "bengali_translation")
+    private String bengaliTranslation;
     @Column(name = "is_active")
     private Boolean isActive;
 

src/main/java/com/iemr/common/service/dynamicForm/FormMasterServiceImpl.java

@@ -160,6 +160,9 @@ public FormResponseDTO getStructuredFormByFormId(String formId, String lang, Str
                             } else if ("en".equalsIgnoreCase(lang)) {
                                 translatedLabel = label.getEnglish();
 
+                            }else if ("bn".equalsIgnoreCase(lang)) {
+                                translatedLabel = label.getBengaliTranslation();
+
                             }
                         }
 
@@ -171,6 +174,9 @@ public FormResponseDTO getStructuredFormByFormId(String formId, String lang, Str
                             } else if ("en".equalsIgnoreCase(lang)) {
                                 translatedPlaceHolder = placeHolder.getEnglish();
 
+                            } else if ("bn".equalsIgnoreCase(lang)) {
+                                translatedPlaceHolder = placeHolder.getBengaliTranslation();
+
                             }
                         }
 
@@ -203,7 +209,8 @@ public FormResponseDTO getStructuredFormByFormId(String formId, String lang, Str
                                             map.put("value", opt.getValue());
                                             if ("hi".equalsIgnoreCase(lang))      map.put("label", opt.getLabelHi());
                                             else if ("as".equalsIgnoreCase(lang)) map.put("label", opt.getLabelAs());
-                                            else                                   map.put("label", opt.getLabelEn());
+                                            else if("en".equals(lang))            map.put("label", opt.getLabelEn());
+                                            else if("bn".equals(lang))            map.put("label", opt.getLabelBn());
                                             return map;
                                         })
                                         .collect(Collectors.toList());

src/main/java/com/iemr/common/service/users/IEMRAdminUserService.java

@@ -133,4 +133,5 @@ public List<ServiceRoleScreenMapping> getUserServiceRoleMappingForProvider(Integ
 
 	boolean hasAdminPrivileges(Long userId) throws IEMRException;
 
+	User save(User loggedInUser);
 }

src/main/java/com/iemr/common/service/users/IEMRAdminUserServiceImpl.java

@@ -308,7 +308,13 @@ private void handleFailedLoginAttempt(User user, int failedAttemptThreshold) thr
 			user.setFailedAttempt(currentAttempts + 1);
 			iEMRUserRepositoryCustom.save(user);
 			logger.warn("User Password Wrong");
-			throw new IEMRException("Invalid username or password");
+			int remainingAttempts = failedAttemptThreshold - (currentAttempts + 1);
+			if (remainingAttempts == 1) {
+				throw new IEMRException(
+						"Invalid username or password. Remaining attempts: 1. "
+								+ "If you enter wrong username or password again, your account will be locked.");
+			}
+			throw new IEMRException("Invalid username or password. Remaining attempts: " + remainingAttempts);
 		} else {
 			java.sql.Timestamp lockTime = new java.sql.Timestamp(System.currentTimeMillis());
 			user.setFailedAttempt(currentAttempts + 1);
@@ -317,7 +323,8 @@ private void handleFailedLoginAttempt(User user, int failedAttemptThreshold) thr
 			iEMRUserRepositoryCustom.save(user);
 			logger.warn("User Account has been locked after reaching the limit of {} failed login attempts.",
 					failedAttemptThreshold);
-			throw new IEMRException(generateLockoutErrorMessage(lockTime));
+			throw new IEMRException(
+					"Your account has been locked due to multiple failed login attempts. Please contact administrator.");
 		}
 	}
 
@@ -1377,4 +1384,9 @@ public boolean hasAdminPrivileges(Long userId) throws IEMRException {
 			return false;
 		}
 	}
+
+	@Override
+	public User save(User loggedInUser) {
+		return iEMRUserRepositoryCustom.save(loggedInUser);
+	}
 }

src/main/java/com/iemr/common/utils/CookieUtil.java

@@ -35,8 +35,8 @@ public void addJwtTokenToCookie(String Jwttoken, HttpServletResponse response, H
 	    // Make the cookie HttpOnly to prevent JavaScript access for security
 	    cookie.setHttpOnly(true);
 
-	    // Set the Max-Age (expiry time) in seconds (8 hours)
-	    cookie.setMaxAge(60 * 60 * 8); // 8 hours expiration
+	    // Set the Max-Age (expiry time) in seconds (10 hours)
+	    cookie.setMaxAge(60 * 60 * 10); // 10 hours expiration
 
 	    // Set the path to "/" so the cookie is available across the entire application
 	    cookie.setPath("/");

src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java

@@ -168,15 +168,15 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo
 				logger.info("Validating JWT token from cookie");
 				if (jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtFromCookie)) {
 					AuthorizationHeaderRequestWrapper authorizationHeaderRequestWrapper = new AuthorizationHeaderRequestWrapper(
-							request, "");
+							request, authHeader != null ? authHeader : "");
 					filterChain.doFilter(authorizationHeaderRequestWrapper, servletResponse);
 					return;
 				}
 			} else if (jwtFromHeader != null) {
 				logger.info("Validating JWT token from header");
 				if (jwtAuthenticationUtil.validateUserIdAndJwtToken(jwtFromHeader)) {
 					AuthorizationHeaderRequestWrapper authorizationHeaderRequestWrapper = new AuthorizationHeaderRequestWrapper(
-							request, "");
+							request, authHeader != null ? authHeader : "");
 					filterChain.doFilter(authorizationHeaderRequestWrapper, servletResponse);
 					return;
 				}

src/main/java/com/iemr/common/utils/NetworkUtil.java

@@ -0,0 +1,56 @@
+/*
+* AMRIT – Accessible Medical Records via Integrated Technology
+* Integrated EHR (Electronic Health Records) Solution
+*
+* Copyright (C) "Piramal Swasthya Management and Research Institute"
+*
+* This file is part of AMRIT.
+*
+* This program is free software: you can redistribute it and/or modify
+* it under the terms of the GNU General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* This program is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU General Public License for more details.
+*
+* You should have received a copy of the GNU General Public License
+* along with this program.  If not, see https://www.gnu.org/licenses/.
+*/
+package com.iemr.common.utils;
+
+import java.net.DatagramSocket;
+import java.net.InetAddress;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Resolves the single LAN-facing IPv4 address the OS would use for outbound
+ * traffic, used to build a URL that a device on the same wifi network (e.g.
+ * a mobile phone) can connect to. A machine can have several network
+ * interfaces (wifi, ethernet, VPN, virtual adapters); connecting a UDP
+ * socket to an external address - without sending any packet - makes the OS
+ * routing table pick the one real outbound interface, avoiding ambiguity
+ * from iterating all interfaces.
+ */
+public final class NetworkUtil {
+
+	private static final Logger logger = LoggerFactory.getLogger(NetworkUtil.class);
+	private static final String FALLBACK_IP = "127.0.0.1";
+
+	private NetworkUtil() {
+	}
+
+	public static String getLanIPAddress() {
+		try (DatagramSocket socket = new DatagramSocket()) {
+			socket.connect(InetAddress.getByName("8.8.8.8"), 10002);
+			return socket.getLocalAddress().getHostAddress();
+		} catch (Exception e) {
+			logger.error("Failed to resolve LAN IP address", e);
+			return FALLBACK_IP;
+		}
+	}
+}

src/main/resources/application.properties

@@ -177,7 +177,7 @@ account.lock.duration.hours=24
 
 #Jwt Token configuration
 jwt.access.expiration=28800000
-jwt.refresh.expiration=604800000
+jwt.refresh.expiration=7776000000
 
 # local env