FIX_VAPT_ISSUE_FILE_UPLOAD_VALIDTION

app/Config/Constants.php

@@ -115,4 +115,19 @@ define('ACCOUNT_MANAGER_ROLE_ID', 3);
 define('STAFF_ROLE_ID', 4);
 define('HEAD_ROLE_ID', 5);
 
+/**
+ * @Upload Allowed Extensions by Business Context
+ */
+define('UPLOAD_ALLOWED_EXTENSIONS', [
+    'jpg', 'jpeg', 'png', 'gif', 'webp', 'svg',
+    'pdf', 'doc', 'docx', 'odt', 'rtf',
+    'xls', 'xlsx', 'ods', 'csv', 'txt',
+]);
 
+define('UPLOAD_EXT_IMAGES', ['jpg', 'jpeg', 'png']);
+define('UPLOAD_EXT_KYC_DOCS', ['pdf', 'jpg', 'jpeg', 'png']);
+define('UPLOAD_EXT_CLAIM_DOCS', ['pdf', 'jpg', 'jpeg', 'png']);
+define('UPLOAD_EXT_POLICY_DOCS', ['pdf', 'jpg', 'jpeg', 'png', 'xls', 'xlsx']);
+define('UPLOAD_EXT_LEAD_FILES', ['xls', 'xlsx', 'pdf', 'jpg', 'jpeg', 'png']);
+define('UPLOAD_EXT_EXCEL', ['xls', 'xlsx', 'ods', 'csv']);
+define('UPLOAD_EXT_MAIL_ATTACHMENTS', ['pdf', 'jpg', 'jpeg', 'png', 'doc', 'docx', 'xls', 'xlsx']);

app/Controllers/AppContentManagementController.php

@@ -101,23 +101,22 @@ class AppContentManagementController extends AdminController
 
                 $file = $this->request->getFile('advertise_image');
                 $client_id = $sanitized_post_data['client_id'] ?? null;
-                //1) original file name for vaildations
-                $fileName = $file->getClientName(); //original file name for vaildations
-                $existing = $this->addImgModel->where('name', $fileName)->where('client_id', $fileName)->where('is_active', 1)->first();
-                if($existing){ return $this->respond(['status' => false, 'message' => 'This file has already been uploaded in active state.'], 400); }
-
-                //skip 1) and use this 
-                // $fileName = $file->getRandomName(); // Same Name Multiple time upload means different name
 
                 if (!$file || !$file->isValid()) {
                     return $this->respond(['status' => false, 'message' => 'No file uploaded or invalid file.'], 400);
                 }
 
-                // $uploadPath = WRITEPATH . 'uploads/advertiseImage/';
+                if (!validate_upload_extension($file, UPLOAD_EXT_IMAGES)) {
+                    return $this->respond(['status' => false, 'message' => 'Only JPG, JPEG, PNG files are allowed.'], 400);
+                }
+
+                $fileName = sanitize_upload_filename($file->getClientName());
+                $existing = $this->addImgModel->where('name', $fileName)->where('client_id', $client_id)->where('is_active', 1)->first();
+                if($existing){ return $this->respond(['status' => false, 'message' => 'This file has already been uploaded in active state.'], 400); }
+
                 $uploadPath = ROOTPATH . 'public/uploads/add_image_upload/';
                 if (!is_dir($uploadPath)) mkdir($uploadPath, 0755, true);
 
-                
                 $file->move($uploadPath, $fileName);
 
                 $id = $sanitized_post_data['add_image_id'] ?? null;

app/Controllers/ClaimsUploadController.php

@@ -26,6 +26,13 @@ class ClaimsUploadController extends BaseController
             ], 400);
         }
 
+        if (!validate_upload_extension($file, UPLOAD_EXT_EXCEL)) {
+            return $this->respond([
+                'status' => 'failed',
+                'message' => 'Only Excel files (xls, xlsx, ods, csv) are allowed.'
+            ], 400);
+        }
+
         $data = [
             'client_id'        => $this->request->getPost('client_id'),
             'tpa_id'           => $this->request->getPost('tpa_id'),

app/Controllers/ClientController.php

@@ -1051,7 +1051,7 @@ class ClientController extends AdminController
         
 
         $uploadFilePath = ROOTPATH . 'public/uploads/logo/';
-        $file_name = file_Upload($this->request->getFile('client_logo'), $uploadFilePath);
+        $file_name = file_Upload($this->request->getFile('client_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
         $data   = $this->request->getPost();
         $sanitized_post_data = sanitizeInputArrayAdvanced($data);
         $sanitized_post_data['created_by'] = get_session_userid();
@@ -1149,7 +1149,7 @@ class ClientController extends AdminController
 
         $this->myLogger->logme('error', 'edit client general info function called');
         $uploadFilePath = ROOTPATH . 'public/uploads/logo/';
-        $file_name = file_Upload($this->request->getFile('client_logo'), $uploadFilePath);
+        $file_name = file_Upload($this->request->getFile('client_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
         $id                 = $this->request->getPost('PrimaryKey');
 
         $data               = $this->request->getPost();
@@ -1191,7 +1191,7 @@ class ClientController extends AdminController
         // print_r($data); die;
         unset($data['file_name']);
         $uploadFilePath = WRITEPATH . 'uploads/client_kyc_documents';
-        $File = file_Upload($this->request->getFile('file_name'), $uploadFilePath);
+        $File = file_Upload($this->request->getFile('file_name'), $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
         if (!empty($File)) {
 
             $data['file_name'] = $File;
@@ -1257,7 +1257,7 @@ class ClientController extends AdminController
         
         $file = $this->request->getFile('file_name');
 
-        $fileName = file_Upload($file, $uploadFilePath);
+        $fileName = file_Upload($file, $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
 
         if (!empty($fileName)) {
             $sanitized_data['file_name'] = $fileName;
@@ -1313,7 +1313,7 @@ class ClientController extends AdminController
         
         $file = $this->request->getFile('file_name');
 
-        $fileName = file_Upload($file, $uploadFilePath);
+        $fileName = file_Upload($file, $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
 
         if (!empty($fileName)) {
             $sanitized_data['file_name'] = $fileName;
@@ -1400,7 +1400,7 @@ class ClientController extends AdminController
         $file = $this->request->getFile('file_name');
 
         $uploadFilePath = WRITEPATH . 'uploads/client_kyc_documents';
-        $fileName = file_Upload($file, $uploadFilePath);
+        $fileName = file_Upload($file, $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
 
         if (!empty($fileName)) {
             $sanitized_data['file_name'] = $fileName;
@@ -1472,7 +1472,7 @@ class ClientController extends AdminController
         
         if ($uploadedFile && $uploadedFile->isValid() && !$uploadedFile->hasMoved()) {
             
-            $new_file_name = file_Upload($uploadedFile, $uploadFilePath);
+            $new_file_name = file_Upload($uploadedFile, $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
             if (!$new_file_name) {
                 return $this->respond(['status' => false, 'code' => 500, 'message' => 'New file upload failed on server.'], 200);
             }
@@ -3479,7 +3479,7 @@ class ClientController extends AdminController
 
                 if (!empty($docName) && $file->isValid() && !$file->hasMoved()) {
                     // Upload the file
-                    $uploadedFileName = file_Upload_for_lead($file, $uploadFilePath);
+                    $uploadedFileName = file_Upload_for_lead($file, $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
 
                     if ($uploadedFileName) {
                         // Prepare data for each document upload

app/Controllers/LeadsController.php

@@ -1035,7 +1035,7 @@ class LeadsController extends BaseController
 
         $multi_file_data = [];
         foreach ($files as $index => $value) {
-            $file_name = file_Upload_for_lead($value, $uploadFilePath);
+            $file_name = file_Upload_for_lead($value, $uploadFilePath, UPLOAD_EXT_LEAD_FILES);
             $multi_file_data[] = [
                 'file_name' => $file_name,
                 'docs_name' => $docs_names[$index],

app/Controllers/MasterController.php

@@ -367,7 +367,7 @@ class MasterController extends AdminController
         }
 
         $uploadFilePath = ROOTPATH . 'public/uploads/logo/';
-        $file_name = file_Upload($this->request->getFile('insurer_logo'), $uploadFilePath);
+        $file_name = file_Upload($this->request->getFile('insurer_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
         $data   = $this->request->getPost();
         $sanitized_post_data = sanitizeInputArrayAdvanced($data);
 
@@ -593,7 +593,7 @@ class MasterController extends AdminController
         }
 
         $uploadFilePath = ROOTPATH . 'public/uploads/logo/';
-        $file_name      = file_Upload($this->request->getFile('insurer_logo'), $uploadFilePath);
+        $file_name      = file_Upload($this->request->getFile('insurer_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
         $data           = $this->request->getPost();
         $sanitized_post_data = sanitizeInputArrayAdvanced($data);
         $id                  = $sanitized_post_data['PrimaryKey'];
@@ -974,11 +974,11 @@ class MasterController extends AdminController
 
 
         $uploadFilePath = ROOTPATH . 'public/uploads/logo/';
-        $file_name = file_Upload($this->request->getFile('tpa_logo'), $uploadFilePath);
+        $file_name = file_Upload($this->request->getFile('tpa_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
 
         $template_bg_path = ROOTPATH . 'public/uploads/template_bg';
-        $front_card_file_name = file_Upload($this->request->getFile('fc'), $template_bg_path);
+        $front_card_file_name = file_Upload($this->request->getFile('fc'), $template_bg_path, UPLOAD_EXT_IMAGES);
-        $back_card_file_name = file_Upload($this->request->getFile('bc'), $template_bg_path);
+        $back_card_file_name = file_Upload($this->request->getFile('bc'), $template_bg_path, UPLOAD_EXT_IMAGES);
 
 
         $eCardTemplate = $sanitized_post_data['ecard_content'];
@@ -1264,11 +1264,11 @@ class MasterController extends AdminController
 
 
         $uploadFilePath = ROOTPATH . 'public/uploads/logo/';
-        $file_name = file_Upload($this->request->getFile('tpa_logo'), $uploadFilePath);
+        $file_name = file_Upload($this->request->getFile('tpa_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
 
         $template_bg_path = ROOTPATH . 'public/uploads/template_bg';
-        $front_card_file_name = file_Upload($this->request->getFile('fc'), $template_bg_path);
+        $front_card_file_name = file_Upload($this->request->getFile('fc'), $template_bg_path, UPLOAD_EXT_IMAGES);
-        $back_card_file_name = file_Upload($this->request->getFile('bc'), $template_bg_path);
+        $back_card_file_name = file_Upload($this->request->getFile('bc'), $template_bg_path, UPLOAD_EXT_IMAGES);
 
         $id                 = $sanitized_post_data['PrimaryKey'] ?? null;
         

app/Controllers/NotificationController.php

@@ -364,7 +364,7 @@ class NotificationController extends AdminController
         // Define upload path and attempt file upload
         $uploadFilePath = WRITEPATH . 'uploads/attachments';
         $uploadedFile = $this->request->getFile('file');
-        $fileName = file_Upload_for_lead($uploadedFile, $uploadFilePath); // Assume file_Upload handles file saving
+        $fileName = file_Upload_for_lead($uploadedFile, $uploadFilePath, UPLOAD_EXT_MAIL_ATTACHMENTS);
     
         if ($fileName) {
             // Prepare data for insertion

app/Controllers/PolicyTransactionController.php

@@ -3411,7 +3411,7 @@ class PolicyTransactionController extends BaseController
             if (!empty($docName) && $file->isValid() && !$file->hasMoved()) {
 
                 // Upload the file
-                $uploadedFileName = file_Upload_for_lead($file, $uploadFilePath);
+                $uploadedFileName = file_Upload_for_lead($file, $uploadFilePath, UPLOAD_EXT_POLICY_DOCS);
 
                 if ($uploadedFileName) {
                     // Prepare data for each document upload

app/Controllers/RuleImportController.php

@@ -104,6 +104,10 @@ class RuleImportController extends AdminController
                 return $this->response->setJSON(['status'=>false,'message'=>'No file uploaded or upload error']);
             }
 
+            if (!validate_upload_extension($file, UPLOAD_EXT_EXCEL)) {
+                return $this->response->setJSON(['status'=>false,'message'=>'Only Excel/CSV files (xls, xlsx, ods, csv) are allowed.']);
+            }
+
             // Move uploaded file to writable temp location
             $tmpPath = WRITEPATH . 'uploads/' . $file->getRandomName();
             $file->move(WRITEPATH . 'uploads', $file->getName()); // keep original name inside uploads
@@ -140,6 +144,10 @@ class RuleImportController extends AdminController
                 return $this->respond(['status'  => false, 'code' => 404, 'message' => 'No file uploaded or upload error.'], 200);
             }
 
+            if (!validate_upload_extension($file, UPLOAD_EXT_EXCEL)) {
+                return $this->respond(['status'  => false, 'code' => 400, 'message' => 'Only Excel/CSV files (xls, xlsx, ods, csv) are allowed.'], 200);
+            }
+
             // ---------------------------------------------------------
             // 2. Read POST fields
             // ---------------------------------------------------------

app/Controllers/TicketController.php

@@ -3237,7 +3237,7 @@ class TicketController extends BaseController
             $file_data = [];
             if(isset($get_file_data) && !empty($get_file_data)){
                 $file_path =   WRITEPATH . 'uploads/claim_files/';
-                $file_data = multi_file_Upload($get_file_data, $file_path, $get_docs_name);
+                $file_data = multi_file_Upload($get_file_data, $file_path, $get_docs_name, UPLOAD_EXT_CLAIM_DOCS);
             }
 
             if(!empty($file_data)){
@@ -3932,7 +3932,7 @@ class TicketController extends BaseController
                 
                     if ($is_moved) {
                         $file_path = WRITEPATH.'uploads/claims_mis';
-                        $filename = file_Upload_for_lead($file, $file_path);
+                        $filename = file_Upload_for_lead($file, $file_path, UPLOAD_EXT_EXCEL);
                         $fileSize = $file->getSize(); // File size in bytes
                         $fileSize = $fileSize / (1024 * 1024); // Convert to MB
 
@@ -3983,7 +3983,7 @@ class TicketController extends BaseController
         }
 
         $file_path = WRITEPATH.'uploads/claims_mis';
-        $file_name = file_Upload_for_lead($file, $file_path);
+        $file_name = file_Upload_for_lead($file, $file_path, UPLOAD_EXT_EXCEL);
 
         if(!empty($file_name)){
             $data['file_name'] = $file_name;

app/Controllers/UserController.php

@@ -1010,7 +1010,14 @@ class UserController extends AdminController
 
                 if ($file && $file->isValid() && !$file->hasMoved()) {
 
-                        $originalName = $file->getClientName(); 
+                        if (!validate_upload_extension($file, UPLOAD_EXT_EXCEL)) {
+                            return $this->response->setJSON([
+                                'status'  => 'error',
+                                'message' => 'Only Excel files (xls, xlsx, ods, csv) are allowed.',
+                            ])->setStatusCode(400);
+                        }
+
+                        $originalName = sanitize_upload_filename($file->getClientName());
                         $extension    = $file->getExtension();  
 
                         $fileName = pathinfo($originalName, PATHINFO_FILENAME) . '_' . date('Ymd_His') . '.' . $extension;

app/Helpers/utility_helper.php

@@ -1,12 +1,10 @@
 <?php
-use App\Models\ClientModel;
+use App\Controllers\ApiServiceController;
-use App\Models\UserTeamsModel;
-use App\Models\FileModel;
-use App\Models\BatchFileModelFileModel;
 use App\Controllers\GoogleDriveController;
 use App\Models\BatchFileModel;
-use App\Controllers\ApiServiceController;
+use App\Models\FileModel;
 use App\Models\TicketMasterModel;
+use App\Models\UserTeamsModel;
 
 // File: app/Helpers/Uuid_helper.php
 
@@ -53,13 +51,47 @@ if (!function_exists('change_date_format2')) {
     }
 }
 
+if (! function_exists('sanitize_upload_filename')) {
+    function sanitize_upload_filename(string $fileName): string
+    {
+        $fileName = preg_replace('/[\x00-\x1F\x7F]/u', '', $fileName);
+        $fileName = preg_replace('/[\x{00A0}\x{200B}-\x{200D}\x{FEFF}\x{00AD}\x{2060}\x{180E}\x{2028}\x{2029}]/u', '', $fileName);
+        $fileName = preg_replace('/[\/\\\\:*?"<>|;`${}()\'&!#]/', '', $fileName);
+        $fileName = preg_replace('/\.{2,}/', '.', $fileName);
+        $fileName = trim($fileName, ". \t\n\r");
+
+        if ($fileName === '' || strlen($fileName) > 200) {
+            $fileName = time() . '_' . bin2hex(random_bytes(8));
+        }
+
+        return $fileName;
+    }
+}
+
+if (! function_exists('validate_upload_extension')) {
+    function validate_upload_extension($file, array $allowedExtensions = UPLOAD_ALLOWED_EXTENSIONS): bool
+    {
+        $ext = strtolower($file->getClientExtension());
+        if (! in_array($ext, $allowedExtensions, true)) {
+            log_message('critical', '[UPLOAD_HELPER] Blocked extension: {ext} | File: {name}', [
+                'ext'  => $ext,
+                'name' => $file->getClientName(),
+            ]);
+            return false;
+        }
+        return true;
+    }
+}
+
 if (! function_exists('file_Upload')) {
-    function file_Upload($fileToUpload, $filepath)
+    function file_Upload($fileToUpload, $filepath, array $allowedExtensions = UPLOAD_ALLOWED_EXTENSIONS)
     {
         if ($fileToUpload !== null && $fileToUpload->isValid() && ! $fileToUpload->hasMoved()) {
-            $fileToUpload->move($filepath);
+            if (! validate_upload_extension($fileToUpload, $allowedExtensions)) {
-            $fileName = $fileToUpload->getName();
+                return "";
-            $fileName = preg_replace('/[\s\x{00A0}\x{200B}-\x{200D}\x{FEFF}]/u', '', $fileName);
+            }
+            $fileName = sanitize_upload_filename($fileToUpload->getName());
+            $fileToUpload->move($filepath, $fileName);
             return $fileName;
         } else {
             return "";
@@ -68,11 +100,14 @@ if (!function_exists('file_Upload')) {
 }
 
 if (! function_exists('file_Upload_for_lead')) {
-    function file_Upload_for_lead($fileToUpload, $filepath)
+    function file_Upload_for_lead($fileToUpload, $filepath, array $allowedExtensions = UPLOAD_ALLOWED_EXTENSIONS)
     {
         if ($fileToUpload !== null && $fileToUpload->isValid() && ! $fileToUpload->hasMoved()) {
-            $fileToUpload->move($filepath);
+            if (! validate_upload_extension($fileToUpload, $allowedExtensions)) {
-            $fileName = $fileToUpload->getName();
+                return "";
+            }
+            $fileName = sanitize_upload_filename($fileToUpload->getName());
+            $fileToUpload->move($filepath, $fileName);
             return $fileName;
         } else {
             return "";
@@ -116,7 +151,7 @@ if (!function_exists('file_Upload_for_lead')) {
 
 // function for only using in the Flutter Claim File Upload
 if (! function_exists('multi_file_Upload')) {
-    function multi_file_Upload($fileToUpload, $filepath,  $docs_name = [])
+    function multi_file_Upload($fileToUpload, $filepath, $docs_name = [], array $allowedExtensions = UPLOAD_ALLOWED_EXTENSIONS)
     {
         $uploadedFiles = [];
 
@@ -128,25 +163,31 @@ if (!function_exists('multi_file_Upload')) {
             if (is_array($file)) {
                 foreach ($file as $index => $f) {
                     if ($f !== null && $f->isValid() && ! $f->hasMoved()) {
-                        $fileRandomName = $f->getRandomName(); // safer unique name
+                        if (! validate_upload_extension($f, $allowedExtensions)) {
-                        $fileName = $f->getName();
+                            continue;
+                        }
+                        $fileRandomName = $f->getRandomName();
+                        $fileName       = sanitize_upload_filename($f->getName());
                         $f->move($filepath, $fileRandomName);
                         $uploadedFiles[] = [
                             'file_name' => $fileName,
                             'doc_name'  => $docs_name[$index] ?? $fileName,
-                            // 'file_path' => $filepath . $fileRandomName
+                            'file_path' => $fileRandomName,
-                            'file_path' => $fileRandomName
                         ];
                     }
                 }
             } else {
                 // Single file
                 if ($file !== null && $file->isValid() && ! $file->hasMoved()) {
-                    $fileName = $file->getRandomName();
+                    if (! validate_upload_extension($file, $allowedExtensions)) {
-                    $file->move($filepath, $fileName);
+                        continue;
+                    }
+                    $fileName = sanitize_upload_filename($file->getName());
+                    $diskName = $file->getRandomName();
+                    $file->move($filepath, $diskName);
                     $uploadedFiles[] = [
                         'file_name' => $fileName,
-                        'file_path' => $filepath . $fileName
+                        'file_path' => $filepath . $diskName,
                     ];
                 }
             }
@@ -156,7 +197,6 @@ if (!function_exists('multi_file_Upload')) {
     }
 }
 
-
 if (! function_exists('file_unlink')) {
     function file_unlink($filepath)
     {
@@ -182,7 +222,8 @@ if (!function_exists('compressImage')) {
 }
 
 if (! function_exists('fancy_date_time_format')) {
-    function fancy_date_time_format($datetime,$return_type = 'fancy') {
+    function fancy_date_time_format($datetime, $return_type = 'fancy')
+    {
         date_default_timezone_set('Asia/Kolkata');
 
         $currentDateTime = new DateTime();
@@ -227,7 +268,8 @@ if(!function_exists('check_string_date')){
 
 if (! function_exists('generate_download_link')) {
 
-    function generate_download_link($rand_string) {
+    function generate_download_link($rand_string)
+    {
 
         // Generate the link using provided emp_code and client_policy_id
         $link = htmlspecialchars(base_url('download-e-card/' . $rand_string));
@@ -239,7 +281,8 @@ if (!function_exists('generate_download_link')) {
 }
 
 if (! function_exists('generate_random_alphanumeric')) {
-    function generate_random_alphanumeric($length = 12) {
+    function generate_random_alphanumeric($length = 12)
+    {
         $random_string = '';
         for ($i = 0; $i < $length; $i++) {
             $random_ascii = rand(0, 61);
@@ -274,7 +317,8 @@ if (!function_exists('get_base64_image')) {
 }
 
 if (! function_exists('format_indian_number')) {
-    function format_indian_number($number) {
+    function format_indian_number($number)
+    {
         // Round the number to two decimal places
         $number = isset($number) ? $number : 0;
         $number = round($number, 2);
@@ -307,7 +351,8 @@ if (!function_exists('format_indian_number')) {
 }
 
 if (! function_exists('get_username')) {
-    function get_username($user_id) {
+    function get_username($user_id)
+    {
         // Connect to the database
         $db = \Config\Database::connect();
 
@@ -326,7 +371,8 @@ if (!function_exists('get_username')) {
 }
 
 if (! function_exists('get_role_id')) {
-    function get_role_id() {
+    function get_role_id()
+    {
 
         $role_id = isset(get_session_userdata()->role) ? get_session_userdata()->role : null;
         return $role_id;
@@ -334,7 +380,8 @@ if (!function_exists('get_role_id')) {
 }
 
 if (! function_exists('teams')) {
-    function teams() {
+    function teams()
+    {
         // Load the UserTeamsModel
         $teamModel = new \App\Models\UserTeamsModel();
         // Get the user ID from the session
@@ -358,10 +405,9 @@ if (!function_exists('teams')) {
     }
 }
 
-
-
 if (! function_exists('generate_client_code')) {
-    function generate_client_code($string = 'GC') {
+    function generate_client_code($string = 'GC')
+    {
 
         $clientModel = new \App\Models\ClientModel();
 
@@ -379,7 +425,8 @@ if (!function_exists('generate_client_code')) {
 }
 
 if (! function_exists('generate_tsi_code')) {
-    function generate_tsi_code($type) {
+    function generate_tsi_code($type)
+    {
 
         $PolicyTransactionModel = new \App\Models\PolicyTransactionModel();
 
@@ -405,7 +452,8 @@ if (!function_exists('generate_tsi_code')) {
 }
 
 if (! function_exists('generateRandomCode')) {
-    function generateRandomCode($prefix = 'RTL-', $length = 6) {
+    function generateRandomCode($prefix = 'RTL-', $length = 6)
+    {
         // Generate a random number with the specified length
         $randomNumber = str_pad(mt_rand(0, pow(10, $length) - 1), $length, '0', STR_PAD_LEFT);
 
@@ -416,18 +464,19 @@ if (!function_exists('generateRandomCode')) {
 
 if (! function_exists('excelFileGDriveUpload')) {
 
-    function excelFileGDriveUpload($file_id, $table_name) {
+    function excelFileGDriveUpload($file_id, $table_name)
+    {
         $doc_type       = "UPLOADS";
         $uploadFilePath = WRITEPATH . 'uploads/' . ($table_name == 'batch_file' ? 'import_excel' : 'excel');
 
         $models = [
             'batch_file' => [
                 'model'  => new BatchFileModel(),
-                'select' => "client_id, client_policy_id, file_name"
+                'select' => "client_id, client_policy_id, file_name",
             ],
             'files'      => [
                 'model'  => new FileModel(),
-                'select' => "client_id, policy_id as client_policy_id, file_name"
+                'select' => "client_id, policy_id as client_policy_id, file_name",
             ],
         ];
 
@@ -442,8 +491,6 @@ if (!function_exists('excelFileGDriveUpload')) {
             ->where('is_active', 1)
             ->first();
 
-
-
         if ($data) {
             $uploadFilePath .= '/' . $data['file_name'];
             // dd($data, $uploadFilePath);
@@ -470,7 +517,8 @@ if (!function_exists('excelFileGDriveUpload')) {
 
 if (! function_exists('checkFamilyFloaters')) {
 
-    function checkFamilyFloaters($policy_premium_data, $client_policy_data, $emp_data){
+    function checkFamilyFloaters($policy_premium_data, $client_policy_data, $emp_data)
+    {
 
         if ($policy_premium_data['premium_type'] == 1) {
 
@@ -500,7 +548,7 @@ if(!function_exists('checkFamilyFloaters')){
 if (! function_exists('numberToWords')) {
     function numberToWords($number)
     {
-        $words = array(
+        $words = [
             '0'  => 'Zero',
             '1'  => 'One',
             '2'  => 'Two',
@@ -528,8 +576,8 @@ if (!function_exists('numberToWords')) {
             '60' => 'Sixty',
             '70' => 'Seventy',
             '80' => 'Eighty',
-            '90' => 'Ninety'
+            '90' => 'Ninety',
-        );
+        ];
 
         if ($number < 21) {
             return $words[$number];
@@ -547,7 +595,7 @@ if (!function_exists('numberToWords')) {
             return $words[$hundreds] . ' Hundred' . ($remainder ? ' and ' . numberToWords($remainder) : '');
         }
 
-        $levels = array('', ' Thousand', ' Million', ' Billion', ' Trillion', ' Quadrillion', ' Quintillion');
+        $levels = ['', ' Thousand', ' Million', ' Billion', ' Trillion', ' Quadrillion', ' Quintillion'];
 
         for ($i = 0, $unit = 1; $i < count($levels); $i++, $unit *= 1000) {
             if ($number < $unit * 1000) {
@@ -598,7 +646,8 @@ if (!function_exists('isJsonString')) {
 }
 
 if (! function_exists('isValidDate')) {
-    function isValidDate($date, $format) {
+    function isValidDate($date, $format)
+    {
         $parsed_date = DateTime::createFromFormat($format, $date);
         return $parsed_date && $parsed_date->format($format) === $date;
     }
@@ -606,7 +655,8 @@ if (!function_exists('isValidDate')) {
 
 if (! function_exists('change_date_format')) {
 
-    function change_date_format($date_str, $source_format = null, $output_format = 'Y-m-d') {
+    function change_date_format($date_str, $source_format = null, $output_format = 'Y-m-d')
+    {
 
         $date_str = trim($date_str);
         // Allowed date formats
@@ -757,7 +807,7 @@ if (!function_exists('check_pay_by_employee_or_company')) {
             'father'        => 'elders',
             'mother'        => 'elders',
             'father_in_law' => 'elders',
-            'mother_in_law' => 'elders'
+            'mother_in_law' => 'elders',
         ];
 
         if (array_key_exists($relationship, $relationshipMap)) {
@@ -859,7 +909,6 @@ if (!function_exists('expected_amount_calc')) {
         $standard_tp_per  = (float) ($data['standard_tp'][$index] ?? 0);
         $standard_tep_per = (float) ($data['standard_ter'][$index] ?? 0);
 
-
         if ($data['bro_payable_by'] == 0) {
             $base_premium       = (float) ($data['co_premium'][$index] ?? 0);
             $third_part_premium = (float) ($data['co_tp_premium'][$index] ?? 0);
@@ -963,7 +1012,7 @@ if (!function_exists('validateExcelFile')) {
             'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
             'application/vnd.oasis.opendocument.spreadsheet',
             'application/zip',
-            'application/octet-stream'
+            'application/octet-stream',
         ];
 
         $allowedExtensions = ['xls', 'xlsx', 'ods', 'xlsm'];
@@ -983,7 +1032,8 @@ if (!function_exists('validateExcelFile')) {
 
 if (! function_exists('generate_ecard_download_link_based_on_tpa')) {
 
-    function generate_ecard_download_link_based_on_tpa($params) {
+    function generate_ecard_download_link_based_on_tpa($params)
+    {
 
         $apiServiceController = new ApiServiceController();
         $data                 = $apiServiceController->ecardRequest($params, $return_type = 'internal');
@@ -1015,7 +1065,7 @@ if (!function_exists('canSendOtp')) {
         if ($currentTime < $allowedAfter) {
             return [
                 'allowed'     => false,
-                'retry_after' => $allowedAfter - $currentTime
+                'retry_after' => $allowedAfter - $currentTime,
             ];
         }
 
@@ -1053,7 +1103,6 @@ if (!function_exists('checkDuplicateClaim')) {
     }
 }
 
-
 function getRealClientIP()
 {
     $request = service('request');
@@ -1103,9 +1152,6 @@ function generateFingerprint(bool $exclude_ua = false): string
     return hash('sha256', $ua . '|' . $ipGroup);
 }
 
-
-
-
 if (! function_exists('convertGoogleDriveToDownloadLink')) {
     function convertGoogleDriveToDownloadLink(?string $url): ?string
     {
@@ -1120,7 +1166,7 @@ if (!function_exists('convertGoogleDriveToDownloadLink')) {
         $patterns = [
             '#https?://drive\.google\.com/file/d/([^/]+)/?#',
             '#https?://drive\.google\.com/open\?id=([^&]+)#',
-            '#https?://drive\.google\.com/uc\?id=([^&]+)#'
+            '#https?://drive\.google\.com/uc\?id=([^&]+)#',
         ];
 
         foreach ($patterns as $pattern) {
@@ -1165,14 +1211,23 @@ if (!function_exists('clear_cd_balance_session')) {
 }
 
 if (! function_exists('format_gender_v2')) {
-    function format_gender_v2($gender) {
+    function format_gender_v2($gender)
-        if (empty($gender)) return null;
+    {
+        if (empty($gender)) {
+            return null;
+        }
 
         $g = strtoupper(trim($gender));
 
         // Direct-ah check pannuvom
-        if (str_starts_with($g, 'M')) return 'M'; // Male, M
+        if (str_starts_with($g, 'M')) {
-        if (str_starts_with($g, 'F')) return 'F'; // Female, F
+            return 'M';
+        }
+        // Male, M
+        if (str_starts_with($g, 'F')) {
+            return 'F';
+        }
+        // Female, F
 
         // Others, Transgender, O - ivatrai 'O' ena return seiyum
         if (str_starts_with($g, 'O') || str_starts_with($g, 'T')) {
@@ -1187,16 +1242,18 @@ if (!function_exists('map_relationship')) {
     /**
      * Employee -> self, WIFE -> spouse ena maatri return seiyum.
      */
-    function map_relationship($relation) {
+    function map_relationship($relation)
-        if (empty($relation)) return '';
+    {
+        if (empty($relation)) {
+            return '';
+        }
 
         // Case prechanai varaamal irukka lowercase-kku maatri check seivom
         $r = strtolower(trim($relation));
 
         if ($r == 'employee') {
             return 'self';
-        } 
+        } else if ($r == 'wife') {
-        else if ($r == 'wife') {
             return 'spouse';
         }
 
@@ -1205,7 +1262,6 @@ if (!function_exists('map_relationship')) {
     }
 }
 
-
 /**
  * Extract identity from POST body or GET params.
  * Looks for 'email' or 'mobile_number'.
@@ -1232,8 +1288,7 @@ if (!function_exists('map_relationship')) {
 
         $email = $req_data->email ?? null;
 
-          if (!$email)
+        if (! $email) {
-          {
             $email = $req_data->email_id ?? null;
         }
         // return trim($email);
@@ -1250,7 +1305,6 @@ if (!function_exists('map_relationship')) {
     return null;
 }
 
-
 function recordRateLimitFailure(string $context = 'authApi'): void
 {
     /** @var IncomingRequest $request */
@@ -1258,13 +1312,9 @@ if (!function_exists('map_relationship')) {
 
     $limiter = \Config\Services::limiter(); // or your custom limiter service
 
-        $fingerprint = $request->getVar('rateLimitFingerprint')
+    $fingerprint = $request->getVar('rateLimitFingerprint') ?? generateFingerprint(exclude_ua: true);
-            ?? generateFingerprint(exclude_ua: true);
 
-        
+    $identity = $request->getVar('rateLimitIdentity') ?? resolveIdentity($request);
-
-        $identity = $request->getVar('rateLimitIdentity')
-            ?? resolveIdentity($request);
 
     // Record IP-level failure
     $limiter->recordIpFailure($fingerprint);
@@ -1275,7 +1325,6 @@ if (!function_exists('map_relationship')) {
     }
 }
 
-
 if (! function_exists('getCurrentFinancialYear')) {
     function getCurrentFinancialYear()
     {
@@ -1297,7 +1346,6 @@ if (!function_exists('map_relationship')) {
     }
 }
 
-
 if (! function_exists('format_financial_year')) {
     function format_financial_year(string $financialYear): string
     {
@@ -1315,9 +1363,9 @@ if (!function_exists('map_relationship')) {
     }
 }
 
-
 if (! function_exists('add_google_calender_event')) {
-        function add_google_calender_event($data){
+    function add_google_calender_event($data)
+    {
 
         $calendar = new \App\Libraries\GoogleCalendarService();
 
@@ -1334,6 +1382,3 @@ if (!function_exists('map_relationship')) {
         }
     }
 }
-
-
-