From ad748be61ddfcfdd236d290054767f21f288d266 Mon Sep 17 00:00:00 2001 From: Kallesh B S Date: Thu, 7 Aug 2025 15:14:44 +0530 Subject: [PATCH] 7Aug Api modifications --- .../manage-holders.controller.ts | 44 +++++++++++-------- .../manage-holders/manage-holders.service.ts | 5 ++- .../param-table/param-table.controller.ts | 10 ++--- src/oracle/param-table/param-table.service.ts | 7 +-- 4 files changed, 38 insertions(+), 28 deletions(-) diff --git a/src/oracle/manage-holders/manage-holders.controller.ts b/src/oracle/manage-holders/manage-holders.controller.ts index d6627d7..e7f83ca 100644 --- a/src/oracle/manage-holders/manage-holders.controller.ts +++ b/src/oracle/manage-holders/manage-holders.controller.ts @@ -32,35 +32,43 @@ export class ManageHoldersController { @Get('SearchHolder/:P_SPID/:P_USERID') @ApiQuery({ name: "P_HOLDERNAME", type: String, required: false, description: "Optional" }) + @ApiQuery({ name: "P_HOLDERID", type: Number, required: false, description: "Optional" }) SearchHolder( @Param('P_SPID') P_SPID: number, @Param('P_USERID') P_USERID: string, + @Query('P_HOLDERID') P_HOLDERID?: number, @Query('P_HOLDERNAME') P_HOLDERNAME?: string | null | undefined, ) { - let rawHolderName: string | null | undefined = P_HOLDERNAME; + if (!P_USERID) { + throw new BadRequestException('User ID is required'); + } - if (typeof rawHolderName === 'string') { - rawHolderName = rawHolderName.trim(); - rawHolderName = rawHolderName.replace(/^['"]|['"]$/g, ''); + // Sanitize holder name + let rawHolderName: string | null = null; - if (rawHolderName === '' || rawHolderName.toLowerCase() === 'null') { - rawHolderName = null; - } else { - const allowedPattern = /^[A-Za-z0-9 _@&.-]+$/; + if (typeof P_HOLDERNAME === 'string') { + const trimmed = P_HOLDERNAME.trim().replace(/^['"]|['"]$/g, ''); + rawHolderName = trimmed === '' || trimmed.toLowerCase() === 'null' ? null : trimmed; + } - // uncomment for strict validation + // Validate and coerce P_HOLDERID + let holderId: number | null = null; - // if (!allowedPattern.test(rawHolderName)) { - // rawHolderName = null; - // } + if (P_HOLDERID !== undefined && P_HOLDERID !== null) { + const parsed = Number(P_HOLDERID); + if (isNaN(parsed)) { + throw new BadRequestException('Invalid holder ID'); } - } else { - rawHolderName = null; + holderId = parsed; } - if(!P_USERID){ - return new BadRequestException(); - } - const body = { P_SPID,P_USERID,P_HOLDERNAME: rawHolderName } + + const body = { + P_SPID, + P_USERID, + P_HOLDERID: holderId, + P_HOLDERNAME: rawHolderName, + }; + return this.manageHoldersService.SearchHolder(body) } diff --git a/src/oracle/manage-holders/manage-holders.service.ts b/src/oracle/manage-holders/manage-holders.service.ts index a737dc2..979f561 100644 --- a/src/oracle/manage-holders/manage-holders.service.ts +++ b/src/oracle/manage-holders/manage-holders.service.ts @@ -631,7 +631,7 @@ export class ManageHoldersService { } }; - SearchHolder = async (body: { P_SPID: number, P_USERID: string, P_HOLDERNAME: string | null }) => { + SearchHolder = async (body: { P_SPID: number, P_USERID: string, P_HOLDERID: number | null, P_HOLDERNAME: string | null }) => { let connection; try { @@ -640,11 +640,12 @@ export class ManageHoldersService { const result: Result = await connection.execute( `BEGIN MANAGEHOLDER_PKG.SearchHolder( - :P_SPID, :P_HOLDERNAME, :P_USERID, :P_CURSOR + :P_SPID, :P_HOLDERID, :P_HOLDERNAME, :P_USERID, :P_CURSOR ); END;`, { P_SPID: { val: body.P_SPID, type: oracledb.DB_TYPE_NUMBER }, + P_HOLDERID: { val: body.P_SPID, type: oracledb.DB_TYPE_NUMBER }, P_HOLDERNAME: { val: body.P_HOLDERNAME, type: oracledb.DB_TYPE_NVARCHAR }, P_USERID: { val: body.P_USERID, type: oracledb.DB_TYPE_NVARCHAR }, P_CURSOR: { type: oracledb.CURSOR, dir: oracledb.BIND_OUT } diff --git a/src/oracle/param-table/param-table.controller.ts b/src/oracle/param-table/param-table.controller.ts index 24b52ed..b47c9cd 100644 --- a/src/oracle/param-table/param-table.controller.ts +++ b/src/oracle/param-table/param-table.controller.ts @@ -1,10 +1,10 @@ -import { Body, Controller, Get, Patch, Post, Put, Query, UseGuards } from '@nestjs/common'; +import { Body, Controller, Get, Param, Patch, Post, Put, Query, UseGuards } from '@nestjs/common'; import { ApiQuery, ApiTags } from '@nestjs/swagger'; import { ParamTableService } from './param-table.service'; import { ActivateOrInactivateParamRecordDTO, CreateParamRecordDTO, CreateTableRecordDTO, - getParamValuesDTO, UpdateParamRecordDTO + getParamValuesDTO, SPID_DTO, UpdateParamRecordDTO } from 'src/dto/property.dto'; import { Roles } from 'src/decorators/roles.decorator'; import { JwtAuthGuard } from 'src/guards/jwt-auth.guard'; @@ -53,10 +53,10 @@ export class ParamTableController { return this.paramTableService.GETALLPARAMVALUES(body); } - @Get('GetCountriesAndMessages') + @Get('GetCountriesAndMessages/:P_SPID') @Roles('ca', 'sa', 'ua') - GET_COUNTRIES_AND_MESSAGES() { - return this.paramTableService.GET_COUNTRIES_AND_MESSAGES(); + GET_COUNTRIES_AND_MESSAGES(@Param() body: SPID_DTO) { + return this.paramTableService.GET_COUNTRIES_AND_MESSAGES(body); } @Post('/CreateTableRecord') diff --git a/src/oracle/param-table/param-table.service.ts b/src/oracle/param-table/param-table.service.ts index 5414f5e..f85cc49 100644 --- a/src/oracle/param-table/param-table.service.ts +++ b/src/oracle/param-table/param-table.service.ts @@ -8,7 +8,7 @@ import { closeOracleDbConnection, fetchCursor, handleError } from 'src/utils/hel import { ActivateOrInactivateParamRecordDTO, CreateParamRecordDTO, CreateTableRecordDTO, - getParamValuesDTO, UpdateParamRecordDTO + getParamValuesDTO, SPID_DTO, UpdateParamRecordDTO } from 'src/dto/property.dto'; @Injectable() @@ -109,16 +109,17 @@ export class ParamTableService { } } - async GET_COUNTRIES_AND_MESSAGES() { + async GET_COUNTRIES_AND_MESSAGES(body: SPID_DTO) { let connection; try { connection = await this.oracleDBService.getConnection(); const result = await connection.execute( `BEGIN - MANAGEPARAMTABLE_PKG.GetCountriesAndMessages(:P_CURSOR); + MANAGEPARAMTABLE_PKG.GetCountriesAndMessages(:P_SPID, :P_CURSOR); END;`, { + P_SPID: { val: body.P_SPID, type: oracledb.DB_TYPE_NUMBER }, P_CURSOR: { type: oracledb.CURSOR, dir: oracledb.BIND_OUT } }, { outFormat: oracledb.OUT_FORMAT_OBJECT }