7Aug Api modifications

src/oracle/manage-holders/manage-holders.controller.ts

@@ -32,35 +32,43 @@ export class ManageHoldersController {
 
   @Get('SearchHolder/:P_SPID/:P_USERID')
   @ApiQuery({ name: "P_HOLDERNAME", type: String, required: false, description: "Optional" })
+  @ApiQuery({ name: "P_HOLDERID", type: Number, required: false, description: "Optional" })
   SearchHolder(
     @Param('P_SPID') P_SPID: number,
     @Param('P_USERID') P_USERID: string,
+    @Query('P_HOLDERID') P_HOLDERID?: number,
     @Query('P_HOLDERNAME') P_HOLDERNAME?: string | null | undefined,
   ) {
-    let rawHolderName: string | null | undefined = P_HOLDERNAME;
-
-    if (typeof rawHolderName === 'string') {
-      rawHolderName = rawHolderName.trim();
-      rawHolderName = rawHolderName.replace(/^['"]|['"]$/g, '');
-
-      if (rawHolderName === '' || rawHolderName.toLowerCase() === 'null') {
-        rawHolderName = null;
-      } else {
-        const allowedPattern = /^[A-Za-z0-9 _@&.-]+$/;
-
-        // uncomment for strict validation
-
-        // if (!allowedPattern.test(rawHolderName)) {
-        //   rawHolderName = null;
-        // }
-      }
-    } else {
-      rawHolderName = null;
-    }
     if (!P_USERID) {
-      return new BadRequestException();
+      throw new BadRequestException('User ID is required');
     }
-    const body = { P_SPID,P_USERID,P_HOLDERNAME: rawHolderName }
+
+    // Sanitize holder name
+    let rawHolderName: string | null = null;
+
+    if (typeof P_HOLDERNAME === 'string') {
+      const trimmed = P_HOLDERNAME.trim().replace(/^['"]|['"]$/g, '');
+      rawHolderName = trimmed === '' || trimmed.toLowerCase() === 'null' ? null : trimmed;
+    }
+
+    // Validate and coerce P_HOLDERID
+    let holderId: number | null = null;
+
+    if (P_HOLDERID !== undefined && P_HOLDERID !== null) {
+      const parsed = Number(P_HOLDERID);
+      if (isNaN(parsed)) {
+        throw new BadRequestException('Invalid holder ID');
+      }
+      holderId = parsed;
+    }
+
+    const body = {
+      P_SPID,
+      P_USERID,
+      P_HOLDERID: holderId,
+      P_HOLDERNAME: rawHolderName,
+    };
+
     return this.manageHoldersService.SearchHolder(body)
   }
 

src/oracle/manage-holders/manage-holders.service.ts

@@ -631,7 +631,7 @@ export class ManageHoldersService {
     }
   };
 
-  SearchHolder = async (body: { P_SPID: number, P_USERID: string, P_HOLDERNAME: string | null }) => {
+  SearchHolder = async (body: { P_SPID: number, P_USERID: string, P_HOLDERID: number | null, P_HOLDERNAME: string | null }) => {
     let connection;
 
     try {
@@ -640,11 +640,12 @@ export class ManageHoldersService {
       const result: Result<any> = await connection.execute(
         `BEGIN
             MANAGEHOLDER_PKG.SearchHolder(
-              :P_SPID,  :P_HOLDERNAME, :P_USERID, :P_CURSOR
+              :P_SPID, :P_HOLDERID, :P_HOLDERNAME, :P_USERID, :P_CURSOR
             );
         END;`,
         {
           P_SPID: { val: body.P_SPID, type: oracledb.DB_TYPE_NUMBER },
+          P_HOLDERID: { val: body.P_SPID, type: oracledb.DB_TYPE_NUMBER },
           P_HOLDERNAME: { val: body.P_HOLDERNAME, type: oracledb.DB_TYPE_NVARCHAR },
           P_USERID: { val: body.P_USERID, type: oracledb.DB_TYPE_NVARCHAR },
           P_CURSOR: { type: oracledb.CURSOR, dir: oracledb.BIND_OUT }

src/oracle/param-table/param-table.controller.ts

@@ -1,10 +1,10 @@
-import { Body, Controller, Get, Patch, Post, Put, Query, UseGuards } from '@nestjs/common';
+import { Body, Controller, Get, Param, Patch, Post, Put, Query, UseGuards } from '@nestjs/common';
 import { ApiQuery, ApiTags } from '@nestjs/swagger';
 import { ParamTableService } from './param-table.service';
 
 import {
   ActivateOrInactivateParamRecordDTO, CreateParamRecordDTO, CreateTableRecordDTO,
-  getParamValuesDTO, UpdateParamRecordDTO
+  getParamValuesDTO, SPID_DTO, UpdateParamRecordDTO
 } from 'src/dto/property.dto';
 import { Roles } from 'src/decorators/roles.decorator';
 import { JwtAuthGuard } from 'src/guards/jwt-auth.guard';
@@ -53,10 +53,10 @@ export class ParamTableController {
     return this.paramTableService.GETALLPARAMVALUES(body);
   }
 
-  @Get('GetCountriesAndMessages')
+  @Get('GetCountriesAndMessages/:P_SPID')
   @Roles('ca', 'sa', 'ua')
-  GET_COUNTRIES_AND_MESSAGES() {
-    return this.paramTableService.GET_COUNTRIES_AND_MESSAGES();
+  GET_COUNTRIES_AND_MESSAGES(@Param() body: SPID_DTO) {
+    return this.paramTableService.GET_COUNTRIES_AND_MESSAGES(body);
   }
 
   @Post('/CreateTableRecord')

src/oracle/param-table/param-table.service.ts

@@ -8,7 +8,7 @@ import { closeOracleDbConnection, fetchCursor, handleError } from 'src/utils/hel
 
 import {
   ActivateOrInactivateParamRecordDTO, CreateParamRecordDTO, CreateTableRecordDTO,
-  getParamValuesDTO, UpdateParamRecordDTO
+  getParamValuesDTO, SPID_DTO, UpdateParamRecordDTO
 } from 'src/dto/property.dto';
 
 @Injectable()
@@ -109,16 +109,17 @@ export class ParamTableService {
     }
   }
 
-  async GET_COUNTRIES_AND_MESSAGES() {
+  async GET_COUNTRIES_AND_MESSAGES(body: SPID_DTO) {
     let connection;
     try {
       connection = await this.oracleDBService.getConnection();
 
       const result = await connection.execute(
         `BEGIN
-            MANAGEPARAMTABLE_PKG.GetCountriesAndMessages(:P_CURSOR);
+            MANAGEPARAMTABLE_PKG.GetCountriesAndMessages(:P_SPID, :P_CURSOR);
           END;`,
         {
+          P_SPID: { val: body.P_SPID, type: oracledb.DB_TYPE_NUMBER },
           P_CURSOR: { type: oracledb.CURSOR, dir: oracledb.BIND_OUT }
         },
         { outFormat: oracledb.OUT_FORMAT_OBJECT }