-
Notifications
You must be signed in to change notification settings - Fork 14
fix Ors incentive logic #99
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weβll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix Ors incentive logic #99
Conversation
WalkthroughA single Java service file is modified to change user identity resolution for ORS distribution records and incentive creation. Instead of deriving usernames from JWT tokens, the system now uses the provided DTO username for distribution details and resolves usernames via userId repository lookups for both AM and CH incentive paths. Changes
Estimated code review effortπ― 2 (Simple) | β±οΈ ~15 minutes
Suggested reviewers
Poem
Pre-merge checks and finishing touchesβ Failed checks (1 warning)
β Passed checks (2 passed)
β¨ Finishing touches
π§ͺ Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
β Actions performedReview triggered.
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Actionable comments posted: 0
π§Ή Nitpick comments (1)
src/main/java/com/iemr/flw/service/impl/ChildCareServiceImpl.java (1)
731-744: Avoid duplicate user lookups and handle missinguserIdβ username mappings defensivelyBoth AM and CH incentive paths now call
userRepo.getUserNamedByUserId(orsDistribution.getUserId())separately and pass the result intocreateIncentiveRecordforOrsDistribution, which then looks upashaIdagain viabeneficiaryRepo.getUserIDByUserName(createdBy). This works if all mappings are present, but:
- A null or unmapped
userIdwill result increatedBy == null, which may causebeneficiaryRepo.getUserIDByUserName(createdBy)to throw or misbehave.- The same username lookup is performed twice per record (once for AM, once for CH), which is unnecessary.
You can make this safer and a bit more efficient by resolving the username once, checking it, and bailing out early if itβs missing:
@@ private void checkAndAddOrdDistributionIncentive(List<OrsDistribution> orsDistributionList){ orsDistributionList.forEach(orsDistribution -> { IncentiveActivity orsPacketActivityAM = incentivesRepo.findIncentiveMasterByNameAndGroup("ORS_DISTRIBUTION", GroupName.CHILD_HEALTH.getDisplayName()); IncentiveActivity orsPacketActivityCH = incentivesRepo.findIncentiveMasterByNameAndGroup("ORS_DISTRIBUTION", GroupName.ACTIVITY.getDisplayName()); + + String createdBy = userRepo.getUserNamedByUserId(orsDistribution.getUserId()); + if (createdBy == null) { + logger.warn("Skipping ORS incentive creation: no user found for userId={}", orsDistribution.getUserId()); + return; + } if(orsPacketActivityAM!=null){ if(orsDistribution.getNumOrsPackets()!=null){ - createIncentiveRecordforOrsDistribution(orsDistribution,orsDistribution.getBeneficiaryId(),orsPacketActivityAM,userRepo.getUserNamedByUserId(orsDistribution.getUserId()),false); + createIncentiveRecordforOrsDistribution( + orsDistribution, + orsDistribution.getBeneficiaryId(), + orsPacketActivityAM, + createdBy, + false); } } @@ if(orsPacketActivityCH!=null){ if(orsDistribution.getNumOrsPackets()!=null){ - createIncentiveRecordforOrsDistribution(orsDistribution,orsDistribution.getBeneficiaryId(),orsPacketActivityCH,userRepo.getUserNamedByUserId(orsDistribution.getUserId()),true); + createIncentiveRecordforOrsDistribution( + orsDistribution, + orsDistribution.getBeneficiaryId(), + orsPacketActivityCH, + createdBy, + true); } }This keeps the new βderive username from stored
userIdβ behavior, but guards against inconsistent data and avoids redundant repository calls.
π Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
π Files selected for processing (1)
src/main/java/com/iemr/flw/service/impl/ChildCareServiceImpl.java(2 hunks)
π Additional comments (1)
src/main/java/com/iemr/flw/service/impl/ChildCareServiceImpl.java (1)
570-579: Confirm trust model for DTOβprovideduserNamewhen settinguserIdUsing
userRepo.getUserIdByName(orsDistributionDTO.getUserName())makes ORS records and incentives consistently keyed off the stored user id, and aligns with how HBNC/HBYC are persisted. However, this also means the server trusts theuserNamecoming from the DTO to decide which ASHA gets attribution and incentives.If not already enforced upstream, please ensure that:
orsDistributionDTO.getUserName()is either derived from the authenticated principal or at least validated against it, and- Requests cannot arbitrarily spoof another userβs username to reassign ORS incentives.
If this flow intentionally supports delegation (saving on behalf of another ASHA), consider documenting that explicitly and adding tests to lock in the behavior.
|
@coderabbitai generate docstrings |
β Actions performedInitiated docstring generation; will generate only if new commits exist. |
|
Note Docstrings generation - SUCCESS |
Docstrings generation was requested by @SauravBizbRolly. * #99 (comment) The following files were modified: * `src/main/java/com/iemr/flw/service/impl/ChildCareServiceImpl.java`
π Description
fix ors incentive logic
β Type of Change
βΉοΈ Additional Information
Please describe how the changes were tested, and include any relevant screenshots, logs, or other information that provides additional context.
Summary by CodeRabbit
Bug Fixes
βοΈ Tip: You can customize this high-level summary in your review settings.