Nhances/nhance-enrollment
Nhances/nhance-enrollment
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MERGE_LIVE_LOGIN_API&MINOR

Browse Source
This commit is contained in:
Ubuntu 2025-12-12 17:34:39 +05:30
commit ebca238487
14 changed files with 1539 additions and 239 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
app/Config/Database.php
View File

@ -20,6 +20,7 @@ class Database extends Config
* use if no other is specified.
*/
public string $defaultGroup = 'default';
public string $enableSSL;
/**
* The default database connection.
@ -38,6 +39,7 @@ class Database extends Config
'DBCollat' => 'utf8_general_ci',
'swapPre' => '',
'encrypt' => false,
// 'encrypt' => ['ssl_verify' => true,'ssl_ca' => ROOTPATH .'ca.pem'],
'compress' => false,
'strictOn' => false,
'failover' => [],
@ -95,5 +97,17 @@ class Database extends Config
if (ENVIRONMENT === 'testing') {
$this->defaultGroup = 'tests';
}
$this->enableSSL = env('DB_SSL_ENABLE') ?? false;
if ($this->enableSSL === true || $this->enableSSL === 'true' || $this->enableSSL === 1 || $this->enableSSL === '1') {
// Enable SSL authentication
$this->default['encrypt'] = [
'ssl_ca' => ROOTPATH . 'ca.pem',
'ssl_verify' => true,
];
}
}
}

2
app/Config/Feature.php
View File

@ -21,7 +21,7 @@ class Feature extends BaseConfig
* - property $filtersInfo, instead of $filterInfo
* - CodeIgniter\Router\RouteCollection::getFiltersForRoute(), instead of getFilterForRoute()
*/
public bool $multipleFilters = false;
public bool $multipleFilters = true;
/**
* Use improved new auto routing instead of the default legacy version.

11
app/Config/Filters.php
View File

@ -12,8 +12,10 @@ use CodeIgniter\Filters\SecureHeaders;
use App\Filters\AuthMVC;
use App\Filters\HttpRequestLog;
use App\Filters\CloseDbConnection;
use App\Filters\VerifyAppSignature;
use App\Filters\AuthJWT;
use App\Filters\Cors;
class Filters extends BaseConfig
{
@ -34,7 +36,10 @@ class Filters extends BaseConfig
'authMVC' => AuthMVC::class,
'HttpRequestLog' => HttpRequestLog::class,
'authJWT' => AuthJWT::class,
'CloseDbConnection' => CloseDbConnection::class
'CloseDbConnection' => CloseDbConnection::class,
'Cors' => Cors::class,
'appSignature' => VerifyAppSignature::class,
];
/**
@ -47,11 +52,13 @@ class Filters extends BaseConfig
public array $globals = [
'before' => [
'HttpRequestLog' => ['except' => 'cli/*'],
'Cors',
// 'csrf',
// 'invalidchars',
],
'after' => [
'CloseDbConnection'
'CloseDbConnection',
'Cors',
// 'secureheaders',
],
];

71
app/Config/Routes.php
View File

@ -3,6 +3,14 @@
use CodeIgniter\Router\RouteCollection;
// Allow OPTIONS for all routes
$routes->options('(:any)', function() {
// This will never be called because the CORS filter returns early
// But having this route ensures OPTIONS isn't rejected as 404
});
/**
* @var RouteCollection $routes
*/
@ -431,45 +439,21 @@ $routes->cli('cli/check_bounce_mail_cli', 'MasterController::testCheckBounceMail
$routes->cli('cli/app_check_list', 'MasterController::appCheckList');
$routes->cli('cli/new_gdrive_token', 'GoogleDriveController::generateNewGoogleDriveAccessToken');
//Employee login api's
$routes->post("/employeeRest/verifyEmployeeNumber", "RestAuthenticationController::verifyEmployeeWithMobileNumber");
$routes->post("/employeeRest/getVerifiedUserData", "RestAuthenticationController::getVerifiedUserData");
$routes->post("/employeeRest/verifyEmployeeEmailId", "RestAuthenticationController::verifyEmployeeWithEmailId");
// $routes->post("/employeeRest/saveMpin", "RestAuthenticationController::saveMpin");
//HR login api's
$routes->post("/employeeRest/verifyHrWithMobileNumber", "RestAuthenticationController::verifyHrWithMobileNumber");
$routes->post("/employeeRest/verifyHrWithEmail", "RestAuthenticationController::verifyHrWithEmail");
$routes->post("/employeeRest/getVerifiedHrData", "RestAuthenticationController::getVerifiedHrData");
$routes->group("/api", ["filter" => "authJWT"], function ($routes) {
$routes->post("logined", "RestAuthenticationController::logined");
$routes->post("getId", "RestAuthenticationController::getUserIdFromToken");
});
// MPIN api's
$routes->post("employeeRest/saveMpin", "RestAuthenticationController::saveMpin");
$routes->post("employeeRest/updateMpin", "RestAuthenticationController::updateMpin");
$routes->post("/employeeRest/verifyMpin", "RestAuthenticationController::verifyMpin");
$routes->post("/employeeRest/checkMpin", "RestAuthenticationController::checkMpin");
$routes->post("employeeRest/forgotMPIN", "RestAuthenticationController::forgotMPIN");
$routes->post("employeeRest/updateMobileNumber", "RestAuthenticationController::updateMobileNumber");
// PASSWORD api's
$routes->post("employeeRest/savePassword", "RestAuthenticationController::savePassword");
$routes->post("employeeRest/changePassword", "RestAuthenticationController::changePassword");
$routes->post("employeeRest/verifyPassword", "RestAuthenticationController::verifyPassword");
$routes->post("employeeRest/verifyOtp", "RestAuthenticationController::verifyOtp");
$routes->post("employeeRest/checkPassword", "RestAuthenticationController::checkPassword");
$routes->get("employeeRest/downloadSampleExcel", "EmployeeRestController::downloadSampleExcel");
// $routes->post("employeeRest/createOrUpdateEmployeePolicySiAmount", "EmployeeRestController::createOrUpdateEmployeePolicySiAmount");
// $routes->post("employeeRest/calculatePremium", "EmployeeRestController::calculatePremium");
$routes->group("employeeRest", ["filter" => "authJWT"], function ($routes) {
$routes->group("employeeRest", ['filter' => ['appSignature' , 'authJWT'] ], function ($routes) {
// $routes->post("getVerifiedUserData", "RestAuthenticationController::getVerifiedUserData");
@ -515,6 +499,41 @@ $routes->group("employeeRest", ["filter" => "authJWT"], function ($routes) {
$routes->get("hrFileDownload", "EmployeeRestController::hrFileDownload");
$routes->post("hrFileUpload", "EmployeeRestController::hrFileUpload");
$routes->get("copyActiveEmployeeAndDependentDetails", "EmployeeRestController::copyActiveEmployeeAndDependentDetails");
});
$routes->group("employeeRest", ['filter' => ['appSignature'] ], function ($routes) {
//Employee login api's
$routes->post("verifyEmployeeNumber", "RestAuthenticationController::verifyEmployeeWithMobileNumber");
$routes->post("getVerifiedUserData", "RestAuthenticationController::getVerifiedUserData");
$routes->post("verifyEmployeeEmailId", "RestAuthenticationController::verifyEmployeeWithEmailId");
// $routes->post("saveMpin", "RestAuthenticationController::saveMpin");
//HR login api's
$routes->post("verifyHrWithMobileNumber", "RestAuthenticationController::verifyHrWithMobileNumber");
$routes->post("verifyHrWithEmail", "RestAuthenticationController::verifyHrWithEmail");
$routes->post("getVerifiedHrData", "RestAuthenticationController::getVerifiedHrData");
// MPIN api's
$routes->post("saveMpin", "RestAuthenticationController::saveMpin");
$routes->post("updateMpin", "RestAuthenticationController::updateMpin");
$routes->post("verifyMpin", "RestAuthenticationController::verifyMpin");
$routes->post("checkMpin", "RestAuthenticationController::checkMpin");
$routes->post("forgotMPIN", "RestAuthenticationController::forgotMPIN");
$routes->post("updateMobileNumber", "RestAuthenticationController::updateMobileNumber");
// PASSWORD api's
$routes->post("savePassword", "RestAuthenticationController::savePassword");
$routes->post("changePassword", "RestAuthenticationController::changePassword");
$routes->post("verifyPassword", "RestAuthenticationController::verifyPassword");
$routes->post("verifyOtp", "RestAuthenticationController::verifyOtp");
$routes->post("checkPassword", "RestAuthenticationController::checkPassword");
$routes->get("downloadSampleExcel", "EmployeeRestController::downloadSampleExcel");
});
$routes->get("getEmployeeActiveOrInactivePolicy", "EmployeeRestController::getEmployeeActiveOrInactivePolicy");
@ -530,7 +549,7 @@ $routes->cli("cli/sendCroneRemainderMail", "DashboardController::sendCroneRemain
$routes->get('enrollOpendAndClose', 'DashboardController::updatePolicyEnrollmentStatus');
$routes->get("sendCroneRemainderMail", "DashboardController::sendCroneRemainderMail");
$routes->get("getEmployeePolicy", "EmployeeRestController::getEmployeePolicy");
// $routes->get("getEmployeePolicy", "EmployeeRestController::getEmployeePolicy");
$routes->get("getAddOnPolicy", "EmployeeRestController::getAddOnPolicy");
$routes->post("addEmployeeAndDependence", "EmployeeRestController::addEmployeeAndDependence");
$routes->post("getPreEmployeePolicyCount", "EmployeeRestController::getPreEmployeePolicyCount");

827
app/Controllers/EmployeeRestController.php
View File

File diff suppressed because it is too large Load Diff

105
app/Controllers/RestAuthenticationController.php
View File

@ -69,7 +69,10 @@ class RestAuthenticationController extends AdminController
{
$client = \Config\Services::curlrequest();
$url = env('POST_ENROLLMENT_BASEURL').$endPoint;
$response = $client->post( $url, ['json' => $postData, 'http_errors' => false ] );
$headers = [
'App-Signature' => getenv('APP_SIGNATURE'),
];
$response = $client->post( $url, ['json' => $postData, 'headers' => $headers , 'http_errors' => false ] );
// return json_decode($response->getBody(), true);
return $response->getBody();
}
@ -84,15 +87,17 @@ class RestAuthenticationController extends AdminController
$options = [
'query' => $queryParams,
'http_errors' => false,
'headers' => [
'App-Signature' => getenv('APP_SIGNATURE'),
'Accept' => 'application/json'
]
];
if (isset($params['token']) && !empty($params['token'])) {
$options['headers'] = [
'Authorization' => 'Bearer ' . $params['token'],
'Accept' => 'application/json'
];
if (!empty($params['token'])) {
$options['headers']['Authorization'] = 'Bearer ' . $params['token'];
}
$response = $client->get($url, $options);
return $response->getBody();
@ -261,26 +266,63 @@ class RestAuthenticationController extends AdminController
$empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email]);
// print_r($empdata); die;
$otp = random_int(100000, 999999);
if(empty($empdata)){
$this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: No employee data found both PRE & POST");
log_message('error', ' ');
log_message('error', '************************ PRE END ********************************');
$retailUserdata = RestAuthHelper::getRetailUserData(['email_id' => $email]);
// print_r($retailUserdata); die;
if (!empty($retailUserdata)) {
$retailApiParams['client_id'] = $retailUserdata['id'];
$retailApiParams['email_id'] = $email;
$retailApiParams['otp'] = $otp;
// update the otp in retail user
$api_response = $this->callThirdPartyAPI($retailApiParams, 'updateRetailUserAuthDetails');
$api_response = json_decode($api_response ?? '{}', true) ?? $api_response;
// print_r($api_response); die;
if (isset($api_response['status']) && $api_response['status'] == true) {
//send Email
$retail_common = [
'client_id' => $retailUserdata['id'],
'client_branch_id' => null,
'client_policy_id' => null,
'employee_policy_id' => null,
'employee_id' => null,
'mail_type' => 'retail_user_otp_mail',
];
$this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Sending Retail user OTP email to " . $email);
$res = $this->sendEmailOtp($email, $otp, $retail_common);
if (json_decode($res)->status == 'success') {
$result = ['user_verification' => true, 'message' => "Verified Successfully"];
return $this->respond(['status' => 'success', 'code' => 200, 'data' => $result], 200);
} else {
$result = ['user_verification' => false, 'message' => "Mail sending failed , try again"];
return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
}
}
}
$result = ['user_verification' => false , 'message' => "User not found"];
return $this->respond(['status' => 'failed','code' => 404,'data' => $result],200);
}
$this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: employee data both PRE & POST = " . json_encode($empdata));
$employeeData = [];
if (isset($empdata['pre']) && !empty($empdata['pre'])) {
$employeeData = $empdata['pre'];
$this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Using PRE data");
}
$otp = random_int(100000, 999999);
if (isset($employeeData['employee_id']))
{
@ -318,7 +360,6 @@ class RestAuthenticationController extends AdminController
$this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Calling callThirdPartyAPI for updateEmpOTP");
}
//send Email
$common = [
'client_id' => $employeeData['client_id'],
@ -329,11 +370,8 @@ class RestAuthenticationController extends AdminController
'mail_type' => 'otp_mail',
];
$subject = 'Nhance user verification - OTP';
$mail_content = $otp . ' is your verification code for Nhance.';
$this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Sending OTP email to " . $employeeData['email_corporate']);
$res = MailHelper::send_email(['mail' => $employeeData['email_corporate'], 'subject' => $subject, 'common' => $common, 'message' => $mail_content]);
$res = $this->sendEmailOtp($employeeData['email_corporate'], $otp, $common);
$this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: Mail response = " . $res);
if (json_decode($res)->status == 'success') {
@ -347,6 +385,7 @@ class RestAuthenticationController extends AdminController
$result = ['user_verification' => false, 'message' => "Mail sending failed , try again"];
return $this->respond(['status' => 'failed', 'code' => 404, 'data' => $result], 200);
}
} else {
$this->myLogger->logme("error", "REST-AUTH-CONTROLLER - verifyEmployeeWithEmailId: OTP update failed in PRE DATABASE");
log_message('error', ' ');
@ -390,14 +429,37 @@ class RestAuthenticationController extends AdminController
$email_id = isset($this->request->getJSON()->email_id) ? $this->request->getJSON()->email_id : null;
$otp = isset($this->request->getJSON()->otp) ? $this->request->getJSON()->otp : null;
if(empty($otp)){
return $this->respond(['status' => 'OTP is required','code' => 400,'message' => 'OTP is required'], 200);
}
if (empty($mobile_number) && empty($email_id)) {
return $this->respond(['status' => 'failed','code' => 400,'message' => 'Mobile number or Email ID is required'], 200);
}
$this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: Fetching empdata via RestAuthHelper");
$empdata = RestAuthHelper::getPreAndPostDataByEmailOrMobile(['email_id' => $email_id, 'otp' => $otp, 'mobile_number' => $mobile_number ]);
if(empty($empdata)){
$this->myLogger->logme("error", "REST-AUTH-CONTROLLER - getVerifiedUserData: empdata is empty");
log_message('error', ' ');
log_message('error', '************************ PRE END ********************************');
$retailUserdata = RestAuthHelper::getRetailUserData(['email_id' => $email_id, 'mobile_number' => $mobile_number, 'otp' => $otp]);
// print_r($retailUserdata); die;
if (!empty($retailUserdata)) {
$retailApiParams['client_id'] = $retailUserdata['id'];
$retailApiParams['email_id'] = $email_id;
$retailApiParams['mobile_number'] = $mobile_number;
$retailApiParams['otp'] = $otp;
// Call the third-party API function
$apiResponse = $this->callThirdPartyAPI($retailApiParams, 'getVerifiedRetailUserData');
// print_r($apiResponse); die;
return $this->respond(['status' => 'failed', 'code' => 200, 'data' => [], 'post_enrollment' => json_decode($apiResponse, true)], 200);
}
return $this->respond(['status' => 'Invalid OTP','code' => 404,'data' => "", 'message' => "Invalid OTP"],200);
}
@ -473,6 +535,15 @@ class RestAuthenticationController extends AdminController
// employee auth api's end
public function sendEmailOtp($email, $otp, $common)
{
$subject = 'Nhance user verification - OTP';
$mail_content = $otp . ' is your verification code for Nhance.';
$response = MailHelper::send_email(['mail' => $email, 'subject' => $subject, 'common' => $common, 'message' => $mail_content]);
return $response;
}

2
app/Filters/AuthJWT.php
View File

@ -20,7 +20,7 @@ class AuthJWT implements FilterInterface
{
public function before(RequestInterface $request, $arguments = null)
{
$jwt = $request->getHeader('Authorization');
$jwt = $request->getHeaderLine('Authorization');
if ($jwt) {
if (JWTToken::validateJWT($jwt)) {

422
app/Filters/Cors.php Normal file
View File

@ -0,0 +1,422 @@
<?php
namespace App\Filters;
use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use Config\Services;
/**
* CORS (Cross-Origin Resource Sharing) Filter
*
* Handles CORS preflight requests and adds appropriate CORS headers to responses.
* Configurable via environment variables for flexibility across different environments.
*
* @package App\Filters
*/
class Cors implements FilterInterface
{
/**
* List of allowed origins (domains that can access this API)
* Can include wildcards like *.example.com
*
* @var array<string>
*/
protected array $allowedOrigins = [];
/**
* Whether to allow credentials (cookies, authorization headers) in CORS requests
* WARNING: Cannot be true if using wildcard (*) origin
*
* @var bool
*/
protected bool $allowCredentials = false;
/**
* HTTP methods allowed for CORS requests
*
* @var string
*/
protected string $allowedMethods = 'GET,POST,PUT,PATCH,DELETE,OPTIONS';
/**
* HTTP headers allowed in CORS requests
*
* @var string
*/
protected string $allowedHeaders = 'Content-Type,Authorization,X-Requested-With,Accept,Origin';
/**
* Headers exposed to the client (accessible via JavaScript)
*
* @var string
*/
protected string $exposeHeaders = '';
/**
* How long (in seconds) the preflight response can be cached
* Default: 24 hours (86400 seconds)
*
* @var int
*/
protected int $maxAge = 86400;
/**
* Whether to enable debug logging for CORS requests
*
* @var bool
*/
protected bool $debug = false;
/**
* Initialize CORS configuration from environment variables
*
* @throws \RuntimeException If configuration is invalid
*/
protected $myLogger;
public function __construct()
{
$this->myLogger = \Config\Services::mylogger();
// Parse allowed origins from environment variable
// Format: comma or semicolon separated list
// Examples: "https://example.com,https://app.example.com" or "*.example.com"
$raw = env('CORS_ALLOWED_ORIGINS', '*');
$parts = preg_split('/\s*[,;]\s*/', trim($raw));
$this->allowedOrigins = array_filter(array_map('trim', $parts));
// Load other configuration from environment
$this->allowCredentials = filter_var(
env('CORS_ALLOW_CREDENTIALS', false),
FILTER_VALIDATE_BOOLEAN
);
$this->allowedMethods = env('CORS_ALLOWED_METHODS', $this->allowedMethods);
$this->allowedHeaders = env('CORS_ALLOWED_HEADERS', $this->allowedHeaders);
$this->exposeHeaders = env('CORS_EXPOSE_HEADERS', $this->exposeHeaders);
$this->maxAge = (int) env('CORS_MAX_AGE', $this->maxAge);
$this->debug = filter_var(env('CORS_DEBUG', false), FILTER_VALIDATE_BOOLEAN);
// Security validation: wildcard origin cannot be used with credentials
// This is a browser security requirement, not just a best practice
if ($this->allowCredentials && in_array('*', $this->allowedOrigins, true)) {
throw new \RuntimeException(
'CORS configuration error: Cannot use wildcard (*) origin with credentials enabled. ' .
'This violates browser security policies. Either disable credentials or specify explicit origins.'
);
}
$this->log('CORS filter initialized', [
'allowed_origins' => $this->allowedOrigins,
'allow_credentials' => $this->allowCredentials,
'allowed_methods' => $this->allowedMethods,
]);
}
/**
* Check if a given origin is allowed to access this API
*
* Supports:
* - Exact matches: https://example.com
* - Wildcard origins: *.example.com
* - Scheme-less matching: example.com (matches http and https)
* - Universal wildcard: *
*
* @param string|null $origin The Origin header from the request
* @return bool True if origin is allowed, false otherwise
*/
protected function isOriginAllowed(?string $origin): bool
{
// Reject empty origins
if (empty($origin)) {
$this->log('Origin rejected: empty origin header');
return false;
}
// Validate origin format - must include scheme (http:// or https://)
// This prevents malformed origins from being accepted
if (!preg_match('#^https?://#i', $origin)) {
$this->log('Origin rejected: invalid format (missing scheme)', ['origin' => $origin]);
return false;
}
// If wildcard present in configuration, allow any origin
if (in_array('*', $this->allowedOrigins, true)) {
$this->log('Origin allowed: wildcard match', ['origin' => $origin]);
return true;
}
// Parse the host from the origin for wildcard matching
// Example: https://app.example.com:8080 → app.example.com
$originHost = parse_url($origin, PHP_URL_HOST) ?: $origin;
foreach ($this->allowedOrigins as $allowed) {
if ($allowed === '') {
continue;
}
// 1. Exact match (including scheme and port)
// Example: https://example.com matches https://example.com
if (strcasecmp($allowed, $origin) === 0) {
$this->log('Origin allowed: exact match', [
'origin' => $origin,
'matched_rule' => $allowed
]);
return true;
}
// 2. Handle scheme-less and wildcard patterns
// If the allowed entry doesn't contain ://, it's either a host-only or wildcard pattern
if (strpos($allowed, '://') === false) {
// 2a. Wildcard subdomain pattern: *.example.com
// Matches: app.example.com, api.example.com, dev.app.example.com
// Does NOT match: example.com (use explicit entry for root domain)
if (strpos($allowed, '*.') === 0) {
$allowedRoot = substr($allowed, 2); // Remove *. prefix
// Check if origin host ends with the allowed root domain
if ($originHost === $allowedRoot || str_ends_with($originHost, '.' . $allowedRoot)) {
$this->log('Origin allowed: wildcard subdomain match', [
'origin' => $origin,
'matched_rule' => $allowed,
'origin_host' => $originHost
]);
return true;
}
}
// 2b. Direct host match (scheme-less)
// Allows both http and https for the same host
// Example: example.com matches both http://example.com and https://example.com
else {
if (strcasecmp($allowed, $originHost) === 0) {
$this->log('Origin allowed: host match (scheme-less)', [
'origin' => $origin,
'matched_rule' => $allowed,
'origin_host' => $originHost
]);
return true;
}
}
}
}
// No match found - reject this origin
$this->log('Origin rejected: no matching rule', [
'origin' => $origin,
'checked_rules' => $this->allowedOrigins
]);
return false;
}
/**
* Build the Access-Control-Allow-Origin header value
*
* Returns either:
* - '*' if wildcard is configured and credentials are disabled
* - The actual origin value if credentials are enabled or specific origins configured
*
* Note: When credentials are enabled, you MUST echo back the specific origin,
* browsers reject wildcard with credentials.
*
* @param string $origin The validated origin
* @return string The value for Access-Control-Allow-Origin header
*/
protected function buildAllowOriginHeader(string $origin): string
{
// If wildcard configured and credentials NOT required, can safely return '*'
// This allows any origin to access the resource
if (in_array('*', $this->allowedOrigins, true) && !$this->allowCredentials) {
return '*';
}
// Otherwise, must return the specific origin
// This is required when allow-credentials is true
return $origin;
}
/**
* Add all CORS headers to the response
*
* This method is called for both preflight and actual requests
* to ensure consistent CORS headers across all responses.
*
* @param ResponseInterface $response The response object to add headers to
* @param RequestInterface $request The original request
* @param string $origin The validated origin
* @param bool $isPreflight Whether this is a preflight OPTIONS request
* @return void
*/
protected function addCorsHeaders(
ResponseInterface $response,
RequestInterface $request,
string $origin,
bool $isPreflight = false
): void {
// CRITICAL: Vary header prevents caching issues
// Without this, a cached response for origin A might be served to origin B,
// causing CORS errors because the Access-Control-Allow-Origin won't match
$response->setHeader('Vary', 'Origin');
// Set the allowed origin
$allowOrigin = $this->buildAllowOriginHeader($origin);
$response->setHeader('Access-Control-Allow-Origin', $allowOrigin);
// If credentials are allowed, set the header
// This allows cookies, authorization headers, and TLS client certificates
if ($this->allowCredentials) {
$response->setHeader('Access-Control-Allow-Credentials', 'true');
}
// Allowed HTTP methods
$response->setHeader('Access-Control-Allow-Methods', $this->allowedMethods);
// Handle allowed headers
if ($isPreflight) {
// For preflight: respect what the browser is asking for
// The browser sends Access-Control-Request-Headers to ask permission
$requestedHeaders = $request->getHeaderLine('Access-Control-Request-Headers');
$response->setHeader(
'Access-Control-Allow-Headers',
$requestedHeaders ?: $this->allowedHeaders
);
} else {
// For actual requests: use configured headers
// Access-Control-Request-Headers is only for preflight
$response->setHeader('Access-Control-Allow-Headers', $this->allowedHeaders);
}
// Expose additional headers to the client (accessible via JavaScript)
// Without this, only simple headers are accessible: Cache-Control, Content-Language,
// Content-Type, Expires, Last-Modified, Pragma
if (!empty($this->exposeHeaders)) {
$response->setHeader('Access-Control-Expose-Headers', $this->exposeHeaders);
}
// Cache duration for preflight responses
// Reduces preflight requests by allowing browser to cache the permissions
if ($this->maxAge > 0) {
$response->setHeader('Access-Control-Max-Age', (string) $this->maxAge);
}
}
/**
* Execute before the controller
*
* Handles preflight OPTIONS requests by returning early with appropriate headers.
* For other requests, allows them to proceed to the controller.
*
* @param RequestInterface $request The request object
* @param mixed $arguments Optional arguments
* @return ResponseInterface|null Response for preflight, null for other requests
*/
public function before(RequestInterface $request, $arguments = null)
{
$origin = $request->getHeaderLine('Origin') ?: '';
$method = strtoupper($request->getMethod());
// Handle preflight OPTIONS requests
// Preflight is sent by browsers before actual cross-origin requests
// to check if the actual request is safe to send
if ($method === 'OPTIONS') {
$this->log('Preflight request received', [
'origin' => $origin,
'method' => $method,
'uri' => (string) $request->getUri()
]);
// Validate origin - reject if not allowed
if (empty($origin) || !$this->isOriginAllowed($origin)) {
$this->log('Preflight rejected: origin not allowed', ['origin' => $origin]);
// Return 403 Forbidden for rejected origins
// Some prefer 200 with no CORS headers, but 403 is more explicit
return Services::response()
->setStatusCode(403)
->setJSON(['error' => 'Origin not allowed']);
}
// Origin is valid - build preflight response
$response = Services::response();
$this->addCorsHeaders($response, $request, $origin, true);
// 204 No Content is the standard response for successful preflight
// It indicates "permission granted, but no data to return"
$response->setStatusCode(204);
$response->setBody('');
$this->log('Preflight approved', [
'origin' => $origin,
'allowed_methods' => $this->allowedMethods
]);
return $response;
}
// For non-OPTIONS requests, don't return a response
// Let the request proceed to the controller
// CORS headers will be added in after() method
return null;
}
/**
* Execute after the controller
*
* Adds CORS headers to the response for actual (non-preflight) requests.
* This ensures all API responses include proper CORS headers.
*
* @param RequestInterface $request The request object
* @param ResponseInterface $response The response object
* @param mixed $arguments Optional arguments
* @return void
*/
public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
{
$origin = $request->getHeaderLine('Origin') ?: '';
// Only add CORS headers if origin is present and allowed
// No origin header means it's a same-origin request (no CORS needed)
if (empty($origin)) {
return;
}
if (!$this->isOriginAllowed($origin)) {
$this->log('Response blocked: origin not allowed', [
'origin' => $origin,
'uri' => (string) $request->getUri()
]);
return;
}
// Add CORS headers to the response
$this->addCorsHeaders($response, $request, $origin, false);
$this->log('CORS headers added to response', [
'origin' => $origin,
'status' => $response->getStatusCode()
]);
}
/**
* Log debug information if debug mode is enabled
*
* Logs to CodeIgniter's log system at 'info' level.
* Enable with CORS_DEBUG=true in .env file.
*
* @param string $message The log message
* @param array $context Additional context data
* @return void
*/
protected function log(string $message, array $context = []): void
{
if (!$this->debug) {
return;
}
// $logger = Services::logger();
$contextString = !empty($context) ? json_encode($context, JSON_UNESCAPED_SLASHES) : '';
$this->myLogger->logme('error','[CORS] ' . $message . ($contextString ? ' | ' . $contextString : ''));
// $logger->info('[CORS] ' . $message . ($contextString ? ' | ' . $contextString : ''));
}
}

36
app/Filters/VerifyAppSignature.php Normal file
View File

@ -0,0 +1,36 @@
<?php
namespace App\Filters;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use CodeIgniter\Filters\FilterInterface;
class VerifyAppSignature implements FilterInterface
{
public function before(RequestInterface $request, $arguments = null)
{
// Get the header sent by the Flutter app
$clientSignature = $request->getHeaderLine('App-Signature');
// Load the server's expected signature from the .env
$validSignature = getenv('APP_SIGNATURE');
// Check if signature is valid
if ($clientSignature !== $validSignature) {
return service('response')
->setStatusCode(403)
->setJSON([
'status' => false,
'message' => 'Forbidden: Invalid App Signature',
]);
}
// allow request to proceed
}
public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
{
// nothing to do after response
}
}

63
app/Helpers/RestAuthHelper.php
View File

@ -346,6 +346,9 @@ class RestAuthHelper
$client = \Config\Services::curlrequest();
$endPoint = 'getPostEmployeeDataForAuth';
$url = env('POST_ENROLLMENT_BASEURL') . $endPoint;
$headers = [
'App-Signature' => getenv('APP_SIGNATURE'),
];
$postData = [];
@ -368,7 +371,7 @@ class RestAuthHelper
log_message('error', 'Sending POST to external API: ' . $url);
log_message('error', 'POST payload: ' . json_encode($postData));
$response = $client->post($url, ['json' => $postData, 'http_errors' => false]);
$response = $client->post($url, ['json' => $postData, 'headers' => $headers , 'http_errors' => false]);
$post_json = $response->getBody();
// log_message('error', 'Response from API: ' . $post_json);
@ -380,7 +383,7 @@ class RestAuthHelper
return $data;
}
log_message('warning', 'No mobile or email present in params for post fetch.');
log_message('error', 'No mobile or email present in params for post fetch.');
}
public static function updatePreMpin(array $params)
@ -437,4 +440,60 @@ class RestAuthHelper
log_message('warning', '[updatePostMpin] Missing required parameters: employee_id or mpin');
return false;
}
// ----------------------------------------------------------------------------------------------
public static function getRetailUserData(array $params)
{
log_message('error', 'Function getRetailUserData called with: ' . json_encode($params));
$mobile_number = $params['mobile_number'] ?? null;
$email_id = $params['email_id'] ?? null;
$otp = $params['otp'] ?? null;
$old_mpin = $params['old_mpin'] ?? null;
if (!empty($mobile_number) || !empty($email_id)) {
$client = \Config\Services::curlrequest();
$endPoint = 'getRetailUserData';
$url = env('POST_ENROLLMENT_BASEURL') . $endPoint;
$headers = [
'App-Signature' => getenv('APP_SIGNATURE'),
];
$postData = [];
if (!empty($mobile_number)) {
$postData['mobile_number'] = $mobile_number;
}
if (!empty($email_id)) {
$postData['email_id'] = $email_id;
}
if (!empty($otp)) {
$postData['otp'] = $otp;
}
if (!empty($old_mpin)) {
$postData['old_mpin'] = $old_mpin;
}
log_message('error', 'Sending POST to external API: ' . $url);
log_message('error', 'POST payload: ' . json_encode($postData));
$response = $client->post($url, ['json' => $postData, 'headers' => $headers, 'http_errors' => false]);
$post_json = $response->getBody();
// print_r($post_json);
$post_data = json_decode($post_json, true);
$data = $post_data['data'] ?? [];
log_message('error', 'Parsed post_data: ' . json_encode($data));
return $data;
}
return [];
}
}

32
app/Helpers/utility_helper.php
View File

@ -666,3 +666,35 @@ if (!function_exists('check_pay_by_employee_or_company')) {
}
if (!function_exists('getLatestGMCPolicy')) {
function getLatestGMCPolicy(array $empPolicy)
{
try{
$filtered = array_filter($empPolicy, function ($row) {
$type = is_object($row) ? $row->policy_type_id : $row['policy_type_id'];
return isset($type) && (int)$type === 2;
});
if (count($filtered) > 1) {
usort($filtered, function ($a, $b) {
$dateA = is_object($a) ? $a->policy_end_date : $a['policy_end_date'];
$dateB = is_object($b) ? $b->policy_end_date : $b['policy_end_date'];
return strtotime($dateB) <=> strtotime($dateA);
});
$row = reset($filtered);
return is_object($row) ? ($row->ClientPolicyId ?? null) : ($row['ClientPolicyId'] ?? null);
}
return null;
}catch(\Exception $e){
log_message('error', 'Exception getLatestGMCPolicy :' . $e->getMessage());
return null;
}
}
}

3
app/Models/EmployeeModel.php
View File

@ -166,7 +166,8 @@ class EmployeeModel extends Model
client_policy.disclaimer,
client_policy.policy_type_id ,
employee_polices.tpa_id as tpa_id ,
employee_polices.rand_string as rand_string
employee_polices.rand_string as rand_string,
client_policy.policy_end_date
', FALSE) // Select all columns from both tables
->join('client_policy', 'client_policy.id = employee_polices.client_policy_id')
->join('policy_type', 'policy_type.id = client_policy.policy_type_id')

114
app/Views/client_policy.php
View File

@ -60,8 +60,71 @@
#table-client-policy_filter{
text-align: left;
}
</style>
<style>
.switch {
position: relative;
display: inline-block;
width: 54px;
height: 34px;
}
.switch input {
opacity: 0;
width: 0;
height: 0;
}
.slider {
position: absolute;
cursor: pointer;
top: 0;
left: 0;
right: 0;
bottom: 0;
background-color: #ccc;
-webkit-transition: .4s;
transition: .4s;
}
.slider:before {
position: absolute;
content: "";
height: 19px;
width: 19px;
left: 4px;
bottom: 4px;
background-color: white;
-webkit-transition: .4s;
transition: .4s;
}
input:checked + .slider {
background-color: #2196F3;
}
input:focus + .slider {
box-shadow: 0 0 1px #2196F3;
}
input:checked + .slider:before {
-webkit-transform: translateX(26px);
-ms-transform: translateX(26px);
transform: translateX(26px);
}
/* Rounded sliders */
.slider.round {
border-radius: 34px;
}
.slider.round:before {
border-radius: 50%;
}
</style>
<div class="tab-pane fade" id="police-tab">
@ -227,7 +290,7 @@
required>
</div>
<div class="form-group col-md-4">
<!-- <div class="form-group col-md-4">
<label class="switch" style="position: relative;top: 43px;left: 20px;">
<input id="inception_type" type="checkbox" name="inception_type">
<span class="slider round" style="height: 27px;"></span>
@ -235,6 +298,15 @@
<label for="inception_type" style="position: relative;bottom: 5px;left: 85px;">Enable
Employee Enrolment Process</label>
</div> -->
<div class="form-group col-md-4" style="padding-top:50px;padding-bottom: 0px;">
<label for="inception_type" style=" position: relative;bottom: 5px;">
<label class="switch">
<input id="inception_type" type="checkbox" name="inception_type">
<span class="slider round" style="height: 27px;"></span>
</label>Enable
Employee Enrolment Process
</label>
</div>
<div class="form-row">
<div class="form-group col-md-4">
@ -261,15 +333,26 @@
<textarea class="form-control" placeholder="Enter Disclaimer" name="disclaimer"
id="disclaimer"></textarea>
</div>
<div class="form-group col-md-4">
<div class="form-group col-md-4" style="padding-top:50px;padding-bottom: 0px;">
<label for="policy_visibility" style=" position: relative;bottom: 5px;">
<label class="switch">
<!-- <input id="policy_visibility" type="checkbox" name="policy_visibility" checked > -->
<input id="policy_visibility" type="checkbox" name="enrolment_visibility" checked>
<span class="slider round" style="height: 27px;"></span>
</label>
Policy Visibilty in Enrollment App
</label>
</div>
<!-- <div class="form-group col-md-4">
<label class="switch" style="position: relative;top: 43px;left: 20px;">
<input id="policy_visibility" type="checkbox" name="enrolment_visibility" checked>
<span class="slider round" style="height: 27px;"></span>
</label>
<label for="policy_visibility" style="position: relative;bottom: 5px;left: 85px;">Policy Visibilty in Enrollment App</label>
</div>
</div> -->
<!-- <div class="form-group col-md-4">
<label class="switch" style="position: relative;top: 43px;left: 20px;">
@ -280,7 +363,7 @@
<label for="is_member_modify_allowed" style="position: relative;bottom: 5px;left: 85px;"> In Enrollment Member Data Modification Allowed</label>
</div> -->
<div class="form-group col-md-4">
<!-- <div class="form-group col-md-4">
<label class="switch" style="position: relative;top: 43px;left: 20px;">
<input id="is_lgbtq" type="checkbox" name="is_lgbtq">
<span class="slider round" style="height: 27px;"></span>
@ -296,7 +379,24 @@
</label>
<label for="is_premium_summery" style="position: relative;bottom: 5px;left: 85px;"> Is Premium Summary Display Enabled </label>
</div>
</div> -->
<div class="form-group col-md-4" style="padding-top:50px;padding-bottom: 0px;">
<label for="is_lgbtq" style=" position: relative;bottom: 5px;">
<label class="switch">
<input id="is_lgbtq" type="checkbox" name="is_lgbtq" checked >
<span class="slider round" style="height: 27px;"></span>
</label>
Is LGBTQ Enable</label>
</div>
<div class="form-group col-md-4" style="padding-top:50px;padding-bottom: 0px;">
<label for="is_premium_summery" style=" position: relative;bottom: 5px;">
<label class="switch">
<input id="is_premium_summery" type="checkbox" name="is_premium_summery" checked>
<span class="slider round" style="height: 27px;"></span>
</label>
Is Premium Summary Display Enabled </label>
</div>
</div>

76
ca.pem Normal file
View File

@ -0,0 +1,76 @@
-----BEGIN CERTIFICATE-----
MIIEADCCAuigAwIBAgIQB/57HSuaqUkLaasdjxUdPjANBgkqhkiG9w0BAQsFADCB
mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB
bWF6b24gUkRTIGFwLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH
DAdTZWF0dGxlMCAXDTIxMDUxOTE3NDAzNFoYDzIwNjEwNTE5MTg0MDM0WjCBmDEL
MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6
b24gUkRTIGFwLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT
ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtbkaoVsUS76o
TgLFmcnaB8cswBk1M3Bf4IVRcwWT3a1HeJSnaJUqWHCJ+u3ip/zGVOYl0gN1MgBb
MuQRIJiB95zGVcIa6HZtx00VezDTr3jgGWRHmRjNVCCHGmxOZWvJjsIE1xavT/1j
QYV/ph4EZEIZ/qPq7e3rHohJaHDe23Z7QM9kbyqp2hANG2JtU/iUhCxqgqUHNozV
Zd0l5K6KnltZQoBhhekKgyiHqdTrH8fWajYl5seD71bs0Axowb+Oh0rwmrws3Db2
Dh+oc2PwREnjHeca9/1C6J2vhY+V0LGaJmnnIuOANrslx2+bgMlyhf9j0Bv8AwSi
dSWsobOhNQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQb7vJT
VciLN72yJGhaRKLn6Krn2TAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD
ggEBAAxEj8N9GslReAQnNOBpGl8SLgCMTejQ6AW/bapQvzxrZrfVOZOYwp/5oV0f
9S1jcGysDM+DrmfUJNzWxq2Y586R94WtpH4UpJDGqZp+FuOVJL313te4609kopzO
lDdmd+8z61+0Au93wB1rMiEfnIMkOEyt7D2eTFJfJRKNmnPrd8RjimRDlFgcLWJA
3E8wca67Lz/G0eAeLhRHIXv429y8RRXDtKNNz0wA2RwURWIxyPjn1fHjA9SPDkeW
E1Bq7gZj+tBnrqz+ra3yjZ2blss6Ds3/uRY6NYqseFTZWmQWT7FolZEnT9vMUitW
I0VynUbShVpGf6946e0vgaaKw20=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIICrjCCAjWgAwIBAgIQGKVv+5VuzEZEBzJ+bVfx2zAKBggqhkjOPQQDAzCBlzEL
MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x
EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6
b24gUkRTIGFwLXNvdXRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl
YXR0bGUwIBcNMjEwNTE5MTc1MDU5WhgPMjEyMTA1MTkxODUwNTlaMIGXMQswCQYD
VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG
A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS
RFMgYXAtc291dGgtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs
ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMqdLJ0tZF/DGFZTKZDrGRJZID8ivC2I
JRCYTWweZKCKSCAzoiuGGHzJhr5RlLHQf/QgmFcgXsdmO2n3CggzhA4tOD9Ip7Lk
P05eHd2UPInyPCHRgmGjGb0Z+RdQ6zkitKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAd
BgNVHQ4EFgQUC1yhRgVqU5bR8cGzOUCIxRpl4EYwDgYDVR0PAQH/BAQDAgGGMAoG
CCqGSM49BAMDA2cAMGQCMG0c/zLGECRPzGKJvYCkpFTCUvdP4J74YP0v/dPvKojL
t/BrR1Tg4xlfhaib7hPc7wIwFvgqHes20CubQnZmswbTKLUrgSUW4/lcKFpouFd2
t2/ewfi/0VhkeUW+IiHhOMdU
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIGATCCA+mgAwIBAgIRAKlQ+3JX9yHXyjP/Ja6kZhkwDQYJKoZIhvcNAQEMBQAw
gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ
bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo
QW1hem9uIFJEUyBhcC1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE
BwwHU2VhdHRsZTAgFw0yMTA1MTkxNzQ1MjBaGA8yMTIxMDUxOTE4NDUyMFowgZgx
CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu
MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h
em9uIFJEUyBhcC1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH
U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKtahBrpUjQ6
H2mni05BAKU6Z5USPZeSKmBBJN3YgD17rJ93ikJxSgzJ+CupGy5rvYQ0xznJyiV0
91QeQN4P+G2MjGQR0RGeUuZcfcZitJro7iAg3UBvw8WIGkcDUg+MGVpRv/B7ry88
7E4OxKb8CPNoa+a9j6ABjOaaxaI22Bb7j3OJ+JyMICs6CU2bgkJaj3VUV9FCNUOc
h9PxD4jzT9yyGYm/sK9BAT1WOTPG8XQUkpcFqy/IerZDfiQkf1koiSd4s5VhBkUn
aQHOdri/stldT7a+HJFVyz2AXDGPDj+UBMOuLq0K6GAT6ThpkXCb2RIf4mdTy7ox
N5BaJ+ih+Ro3ZwPkok60egnt/RN98jgbm+WstgjJWuLqSNInnMUgkuqjyBWwePqX
Kib+wdpyx/LOzhKPEFpeMIvHQ3A0sjlulIjnh+j+itezD+dp0UNxMERlW4Bn/IlS
sYQVNfYutWkRPRLErXOZXtlxxkI98JWQtLjvGzQr+jywxTiw644FSLWdhKa6DtfU
2JWBHqQPJicMElfZpmfaHZjtXuCZNdZQXWg7onZYohe281ZrdFPOqC4rUq7gYamL
T+ZB+2P+YCPOLJ60bj/XSvcB7mesAdg8P0DNddPhHUFWx2dFqOs1HxIVB4FZVA9U
Ppbv4a484yxjTgG7zFZNqXHKTqze6rBBAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB
Af8wHQYDVR0OBBYEFCEAqjighncv/UnWzBjqu1Ka2Yb4MA4GA1UdDwEB/wQEAwIB
hjANBgkqhkiG9w0BAQwFAAOCAgEAYyvumblckIXlohzi3QiShkZhqFzZultbFIu9
GhA5CDar1IFMhJ9vJpO9nUK/camKs1VQRs8ZsBbXa0GFUM2p8y2cgUfLwFULAiC/
sWETyW5lcX/xc4Pyf6dONhqFJt/ovVBxNZtcmMEWv/1D6Tf0nLeEb0P2i/pnSRR4
Oq99LVFjossXtyvtaq06OSiUUZ1zLPvV6AQINg8dWeBOWRcQYhYcEcC2wQ06KShZ
0ahuu7ar5Gym3vuLK6nH+eQrkUievVomN/LpASrYhK32joQ5ypIJej3sICIgJUEP
UoeswJ+Z16f3ECoL1OSnq4A0riiLj1ZGmVHNhM6m/gotKaHNMxsK9zsbqmuU6IT/
P6cR0S+vdigQG8ZNFf5vEyVNXhl8KcaJn6lMD/gMB2rY0qpaeTg4gPfU5wcg8S4Y
C9V//tw3hv0f2n+8kGNmqZrylOQDQWSSo8j8M2SRSXiwOHDoTASd1fyBEIqBAwzn
LvXVg8wQd1WlmM3b0Vrsbzltyh6y4SuKSkmgufYYvC07NknQO5vqvZcNoYbLNea3
76NkFaMHUekSbwVejZgG5HGwbaYBgNdJEdpbWlA3X4yGRVxknQSUyt4dZRnw/HrX
k8x6/wvtw7wht0/DOqz1li7baSsMazqxx+jDdSr1h9xML416Q4loFCLgqQhil8Jq
Em4Hy3A=
-----END CERTIFICATE-----