Merge branch 'master' of bitbucket.org:jubilian/fcsc_ipi_backend

2025-12-18 15:58:34 +05:30 · 2025-12-18 15:58:34 +05:30 · 581674f269
commit 581674f269
parent e511d1fbb8 c4ade7db4e
17 changed files with 210 additions and 342 deletions
--- a/app/controllers/auth.controller.js
+++ b/app/controllers/auth.controller.js
@ -3,6 +3,7 @@ const bcrypt = require("bcryptjs");
 const jwt = require("jsonwebtoken");
 require("dotenv").config();
 const sanitize = require("sanitize-html");
+const logger = require("../services/logger");

 const User = db.user;
 const EstablishmentUser = db.EstablishmentUser;
@ -79,9 +80,9 @@ exports.login = async (req, res) => {

    res.cookie("auth_token", token, {
      httpOnly: true,
-      secure: isProd,               // only true in production (HTTPS)
-      sameSite: isProd ? "none" : "lax", // 'none' requires HTTPS, so use 'lax' locally
-      maxAge: 6 * 60 * 60 * 1000,   // 6 hours
+      secure: isProd,               
+      sameSite: isProd ? "none" : "lax", 
+      maxAge: 6 * 60 * 60 * 1000,   
    });


@ -95,9 +96,10 @@ exports.login = async (req, res) => {
    // return res.status(200).json({ status: "success", message: "Login successful", data: token });
    
  } catch (err) {
+    logger.error(err.message);
    return res.status(500).json({
      status: "failed",
-      message: err.message,
+      message: "Internal server error",
    });
  }
 };
--- a/app/controllers/config.controller.js
+++ b/app/controllers/config.controller.js
@ -1,5 +1,6 @@
 const db = require("../models");
 const SubmissionDeadline = db.SubmissionDeadline;
+const logger = require("../services/logger");



@ -45,8 +46,8 @@ exports.updateDeadlineData = async (req, res) => {
      res.status(201).json({ status: "success", message: "Deadline created successfully", data: newRecord });
    }

-  } catch (err) {
-    console.error(err);
-    res.status(500).json({ status: "failed", message: err.message });
+  } catch (err) {    
+    logger.error(err.message);
+    res.status(500).json({ status: "failed", message: "Internal server error" });
  }
 };
--- a/app/controllers/dashboard.controller.js
+++ b/app/controllers/dashboard.controller.js
@ -1,6 +1,7 @@

 const { Sequelize, Op } = require("sequelize");
 const { Establishment, Submission, Emirate, EstablishmentUser, SubmissionProduct, SubmissionDeadline, QuarterlyWindowsConfiguration } = require("../models");
+const logger = require("../services/logger");



@ -179,30 +180,14 @@ exports.getEstablishmentDashboard = async (req, res) => {
    });

  } catch (err) {
-    console.error(err);
-    res.status(500).json({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).json({ status: "failed", message: "Internal server error" });
  }
 };

 exports.adminDashboard = async (req, res) => {
  try {
    let { quarter, year } = req.query;
-
-    // if quarter/year not passed → take latest open config
-    // if (!quarter || !year) {
-    //   const lastConfig = await QuarterlyWindowsConfiguration.findOne({
-    //     order: [
-    //       ['year', 'DESC'],
-    //       ['quarter', 'DESC']
-    //     ]
-    //   });
-
-    //   if (lastConfig) {
-    //     quarter = lastConfig.quarter;
-    //     year = lastConfig.year;
-    //   }
-    // }
-
    let whereCond = {};
    if (quarter === 'All') quarter = null;
    if (year === 'All') year = null;
@ -296,95 +281,8 @@ exports.adminDashboard = async (req, res) => {
    });

  } catch (err) {
-    console.error(err);
-    return res.status(500).json({ status: "failed", message: err.message });
+    logger.error(err.message);
+    return res.status(500).json({ status: "failed", message: "Internal server error" });
  }
 };

-
-
-// exports.adminDashboard = async (req, res) => {
-//   try {
-//     const { quarter, year } = req.query; // e.g., Q1, 2025
-
-//     // --- Summary Counts ---
-//     const [
-//       totalEstablishments,
-//       submittedCount,
-//       approvedCount,
-//       rejectedCount,
-//       pendingCount
-//     ] = await Promise.all([
-//       Establishment.count(),
-//       Submission.count(),
-//       Submission.count({ where: { status: "Approved" } }),
-//       Submission.count({ where: { status: "Rejected" } }),
-//       Submission.count({ where: { status: "Pending" } }),
-//     ]);
-
-//     // Not Started = total establishments - those that have any submission
-//     const startedEstIds = await Submission.findAll({
-//       attributes: [[Sequelize.fn("DISTINCT", Sequelize.col("establishment_id")), "id"]],
-//       raw: true,
-//     });
-//     const startedIds = startedEstIds.map(e => e.id);
-//     const notStartedCount = await Establishment.count({
-//       where: { id: { [Op.notIn]: startedIds } },
-//     });
-
-//     // ---  Recent 10 submissions for given quarter & year ---
-//     const whereCond = {};
-//     if (quarter) whereCond.quarter = quarter;
-//     if (year) whereCond.year = year;
-
-//     const recentSubmissions = await Submission.findAll({
-//       where: whereCond,
-//       include: [
-//         {
-//           model: Establishment,
-//           as: "establishment",
-//           attributes: ["factory_name"],
-//           include: [
-//             { model: Emirate, as: "establishment_emirate", attributes: ["name"] },
-//           ],
-//         },
-//         {
-//           model: EstablishmentUser,
-//           as: "created_user",
-//           attributes: ["name"],
-//         },
-//       ],
-//       attributes: {
-//         include: [
-//           [
-//             Sequelize.literal(`(
-//               SELECT COUNT(*) 
-//               FROM submission_products AS sp 
-//               WHERE sp.submission_id = submission.id
-//             )`),
-//             "product_count",
-//           ],
-//         ],
-//       },
-//       order: [["created_at", "DESC"]],
-//       limit: 10,
-//     });
-
-//     // ---  Send Response ---
-//     return res.status(200).json({
-//       status: "success",
-//       summary: {
-//         total_establishments: totalEstablishments,
-//         submitted: submittedCount,
-//         approved: approvedCount,
-//         rejected: rejectedCount,
-//         pending: pendingCount,
-//         not_started: notStartedCount,
-//       },
-//       recent_submissions: recentSubmissions,
-//     });
-//   } catch (err) {
-//     console.error(err);
-//     return res.status(500).json({ status: "failed", message: err.message });
-//   }
-// };
--- a/app/controllers/deployment.controller.js
+++ b/app/controllers/deployment.controller.js
@ -121,6 +121,6 @@ exports.deployment = async (req, res) => {


    } catch (err) {
-      res.status(500).send({'status':"failed",'message':err.message });
+      res.status(500).send({'status':"failed",'message': "Internal server error" });
    }
  };
--- a/app/controllers/establishment.controller.js
+++ b/app/controllers/establishment.controller.js
@ -20,6 +20,7 @@ const { version } = require("os");
 const sequelize = db.sequelize;
 const { sanitizeForLog } = require("../utils/sanitize");
 const sanitize = require("sanitize-html");
+const crypto = require('crypto');

 const sanitizeStringValue = (value) =>
  typeof value === "string"
@ -28,10 +29,10 @@ const sanitizeStringValue = (value) =>

 exports.testEmail = async (req, res) => {
  placeHolderData = { 
-    contact_name : 'Gowtham', 
+    contact_name : '<contactName>', 
    portal_url : process.env.FE_BASE_URL,
-    username: 'test_user',
-    password: 'Test@123!',
+    username: '<userName>',
+    password: '<pwd>',
    support_email : process.env.SUPPORT_EMAIL,
    support_phone : process.env.SUPPORT_PHONE,

@ -266,7 +267,8 @@ exports.createEstablishment = async (req, res) => {
        message: `${field} already exists`
      });
    }
-    return res.status(500).send({status: "failed",message: err.message,});
+    logger.error('Error creating establishment', { error: err.message });
+    return res.status(500).send({status: "failed",message: "Internal server error" });
  }
 };
  
@ -427,15 +429,13 @@ exports.getAllEstablishments = async (req, res) => {
    });

  } catch (err) {
-    console.error(err);
-    
-    // Set security headers even for error responses
+    logger.error('Error on get all establishment', { error: err.message });    
    res.setHeader('X-Frame-Options', 'DENY');
    res.setHeader('X-Content-Type-Options', 'nosniff');
    
    return res.status(500).json({
      status: "failed",
-      message: err.message || "Internal server error",
+      message: "Internal server error",
    });
  }
 };
@ -517,7 +517,8 @@ exports.getEstablishmentById = async (req, res) => {
    return res.status(200).send({'status':"success",'message':"Fetched successfully",'data': data }); 

  } catch (err) {
-    return res.status(500).send({'status':"failed",'message':err.message });
+    logger.error('Error on get establishment by Id', { error: err.message });
+    return res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -541,13 +542,7 @@ exports.updateEstablishment = async (req, res) => {
    const { id } = req.params;
    const { establishment_products, establishment_user, ...estData } = req.body;
    const user = await EstablishmentUser.findOne({where:{establishment_id:id}});
-    // console.log("Establishment User email: ",user.email)
-    // if (user?.email === 'bhavinkumar.chandulal@fcsc.gov.ae') {
-    //     return res.status(403).json({
-    //       status: "error",
-    //       message: "You cannot modify Super Admin data."
-    //     });
-    //   }
+  
    const resolveActionDoneBy = (item) => {
      if (item?.action_done_by) return item.action_done_by;

@ -611,27 +606,6 @@ exports.updateEstablishment = async (req, res) => {
      }
    }

-    // update establishment products
-    // if (Array.isArray(establishment_products)) {
-    //   let incomingIds = establishment_products.map(e => e.product_id);
-
-    //   const oldProducts = await EstablishmentProduct.findAll({ where:{ establishment_id:id } });
-    //   const oldIds = oldProducts.map(e => e.product_id);
-
-    //   // remove products not in new list
-    //   const removeIds = oldIds.filter(v => !incomingIds.includes(v));
-    //   if (removeIds.length) {
-    //     await EstablishmentProduct.destroy({ where:{ establishment_id:id, product_id:removeIds } });
-    //   }
-
-    //   // add only new ones
-    //   const newIds = incomingIds.filter(v => !oldIds.includes(v));
-
-    //   for (let pid of newIds) {
-    //     await EstablishmentProduct.create({ establishment_id:id, product_id:pid, created_by: req.user.id});
-    //   }
-    // }
-
    if (Array.isArray(establishment_products)) {

      const incoming = establishment_products;
@ -707,36 +681,18 @@ exports.updateEstablishment = async (req, res) => {
      }
    }

-    return res.json({ status:"success", message:"Updated successfully" , data:"" });
+    return res.json({ status:"success", message:"Updated successfully" });

  } catch(err) {
    if (err.name === "SequelizeUniqueConstraintError") {
      const field = err.errors[0].path;
      return res.status(400).json({ status:"failed", message:`${field} already exists` });
    }
-    return res.status(500).json({ status:"failed", message: err.message });
+    logger.error('Error updating establishment', { error: err.message });
+    return res.status(500).json({ status:"failed", message: "Internal server error"  });
  }
 };

-// exports.updateEstablishment = async (req, res) => {
-//   try {
-
-//     const [updated] = await Establishment.update(req.body, {
-//       where: { id: req.params.id },
-//     });
-
-//     if (!updated){ return res.status(404).send({'status':"failed",'message':"Record Not found",'data': "" }); }
-    
-//     return res.status(200).send({'status':"success",'message':"Updated successfully",'data': "" }); 
-
-//   } catch (err) {
-//     return res.status(500).send({'status':"failed",'message':err.message });
-//   }
-// };
-
-
-
-
 // Delete establishment
 exports.deleteEstablishment = async (req, res) => {
  try {
@ -748,7 +704,8 @@ exports.deleteEstablishment = async (req, res) => {
    return res.status(200).send({'status':"success",'message':"Deleted successfully",'data': "" }); 

  } catch (err) {
-    return res.status(500).send({'status':"failed",'message':err.message });
+    logger.error('Error deleting establishment', { error: err.message });
+    return res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -762,7 +719,8 @@ exports.getAllEmirates = async (req, res) => {
    return res.status(200).send({status: "success", message: "Emirates fetched successfully", data: emirates,});

  } catch (err) {
-    return res.status(500).send({status: "failed",message: err.message || "Internal server error", });
+    logger.error('Error on get all emirates', { error: err.message });
+    return res.status(500).send({status: "failed",message: "Internal server error", });
  }
 };

@ -811,7 +769,8 @@ exports.getAllCityTowns = async (req, res) => {
    return res.status(200).send({status: "success", message: "City/Town fetched successfully", data: sanitizedCities, });

  } catch (err) {
-    return res.status(500).send({ status: "failed",  message: err.message || "Internal server error", });
+    logger.error('Error getting all city towns', { error: err.message });
+    return res.status(500).send({ status: "failed",  message: "Internal server error" });
  }
 };

@ -826,7 +785,8 @@ exports.getAllRequests = async (req, res) => {
      data: requests,
    });
  } catch (err) {
-    res.status(500).json({ status: "failed", message: err.message });
+    logger.error('Error on getall request', { error: err.message });
+    res.status(500).json({ status: "failed", message: "Internal server error" });
  }
 };

@ -904,7 +864,8 @@ exports.createRequest = async (req, res) => {
    });
  } catch (err) {
    console.error(err);
-    res.status(500).json({ status: "failed", message: err.message });
+    logger.error('Error on create request', { error: err.message });
+    res.status(500).json({ status: "failed", message: "Internal server error"});
  }
 };

@ -987,8 +948,8 @@ exports.forgotPasswordRequestOTP = async (req, res) => {
    });

  } catch (err) {
-    logger.error(`Error in forgotPasswordRequestOTP: ${err.message}`);
-    return res.status(500).json({ status: "failed", message: err.message });
+    logger.error(err.message);
+    return res.status(500).json({ status: "failed", message: "Internal server error" });
  }
 };

@ -1062,8 +1023,8 @@ exports.forgotPasswordVerifyOTP = async (req, res) => {
    });

  } catch (err) {
-    logger.error(`Error in forgotPasswordVerifyOTP: ${err.message}`);
-    return res.status(500).json({ status: "failed", message: err.message });
+    logger.error(err.message);
+    return res.status(500).json({ status: "failed", message: "Internal server error" });
  }
 };

@ -1512,7 +1473,17 @@ exports.establishmentBulkUpload = async (req, res) => {
        created_by: req.user.id
      }, { transaction: transaction });

-      const autoPassword = Math.random().toString(36).slice(-10);
+      const generateSecurePassword = (length = 12) => {
+      const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789@#$%';
+      let password = '';
+      const randomBytes = crypto.randomBytes(length);      
+      for (let i = 0; i < length; i++) {
+        password += chars[randomBytes[i] % chars.length];
+      }      
+      return password;
+    };
+
+      const autoPassword = generateSecurePassword(12);
      const hashed = await bcrypt.hash(autoPassword, 10);

      await EstablishmentUser.create({
@ -1634,8 +1605,7 @@ exports.establishmentBulkUpload = async (req, res) => {
    }
    return res.status(500).send({
      status: "failed",
-      message: "Unexpected error occurred during bulk upload",
-      error: err.message
+      message: "Unexpected error occurred during bulk upload"
    });
  }
 };
@ -1655,7 +1625,8 @@ exports.downloadCompanyProfileSample = async (req, res) => {
        
     return res.download(safeFilePath, "company_profile_upload_sample.csv");
  } catch (error) {
-    return res.status(500).send({ status: "failed", message: error.message });
+    logger.error('Error on downloading company profile sample file' + error.message );
+    return res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

--- a/app/controllers/establishment_products.controller.js
+++ b/app/controllers/establishment_products.controller.js
@ -3,6 +3,7 @@ const db = require("../models");
 const EstablishmentProduct = db.EstablishmentProduct;
 const Product = db.Product;
 const UnitMaster = db.UnitMaster;
+const logger = require("../services/logger");


 exports.createEstablishmentProduct = async (req, res) => {
@ -73,7 +74,8 @@ exports.createEstablishmentProduct = async (req, res) => {
    res.status(201).send({'status':"success",'message':"Establishment Product Created successfully."}); 

  } catch (err) {
-    res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -115,7 +117,8 @@ exports.getAllEstablishmentProducts = async (req, res) => {
    res.status(200).send({'status':"success",'message':"Fetched successfully",'data': data }); 

  } catch (err) {
-    res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -129,7 +132,8 @@ exports.getEstablishmentProductById = async (req, res) => {
    res.status(200).send({'status':"success",'message':"Fetched successfully",'data': data }); 

  } catch (err) {
-    res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -153,7 +157,8 @@ exports.updateEstablishmentProduct = async (req, res) => {
    res.status(200).send({'status':"success",'message':"Record updated successfully",'data': "" }); 

  } catch (err) {
-    res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -167,6 +172,7 @@ exports.deleteEstablishmentProduct = async (req, res) => {
    res.status(200).send({'status':"success",'message':"Record deleted successfully",'data': "" });

  } catch (err) {
-    res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };
--- a/app/controllers/establishment_user.controller.js
+++ b/app/controllers/establishment_user.controller.js
@ -5,6 +5,7 @@ const Establishment = db.Establishment;
 const crypto = require("crypto");
 const { sendEmailService } = require("../services/email.service"); 
 const { sanitizeForLog } = require("../utils/sanitize");
+const logger = require("../services/logger");

 // Create User
 exports.createUser = async (req, res) => {
@ -106,10 +107,8 @@ exports.createUser = async (req, res) => {
      message: "Establishment User created successfully.",
    });
  } catch (error) {
-    return res.status(500).json({
-      status: "error",
-      message: error.message
-    });
+    logger.error(err.message);
+    return res.status(500).json({ status: "error", message: "Internal server error" });
  }
 };

@ -133,7 +132,8 @@ exports.getAllUsers = async (req, res) => {
    return res.status(200).send({'status':"success",'message':"Fetched successfully",'data': users }); 

  } catch (err) {
-    return res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    return res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -148,7 +148,8 @@ exports.getUserById = async (req, res) => {
    return res.status(200).send({'status':"success",'message':"Fetched successfully",'data': user }); 

  } catch (err) {
-    return res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    return res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -176,7 +177,8 @@ exports.updateUser = async (req, res) => {
    return res.status(200).send({'status':"success",'message':"Record updated successfully",'data': "" }); 

  } catch (err) {
-    return res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    return res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -189,16 +191,14 @@ exports.changeUserPassword = async (req, res) => {
    // Validate inputs
    if (!old_password || !new_password || !confirm_password) {
      return res.status(400).send({
-        status: "error",
-        code: "MISSING_FIELDS",
+        status: "failed",
        message: "All password fields are required"
      });
    }

    if (new_password !== confirm_password) {
      return res.status(400).send({
-        status: "error",
-        code: "PASSWORD_MISMATCH",
+        status: "failed",
        message: "New password and confirm password do not match"
      });
    }
@ -207,8 +207,7 @@ exports.changeUserPassword = async (req, res) => {
    const user = await EstablishmentUser.findByPk(userId);
    if (!user) {
      return res.status(404).send({
-        status: "error",
-        code: "USER_NOT_FOUND",
+        status: "failed",
        message: "User not found"
      });
    }
@ -217,8 +216,7 @@ exports.changeUserPassword = async (req, res) => {
    const isMatch = await bcrypt.compare(old_password, user.password);
    if (!isMatch) {
      return res.status(401).send({
-        status: "error",
-        code: "OLD_PASSWORD_INCORRECT",
+        status: "failed",
        message: "Old password is incorrect"
      });
    }
@ -231,20 +229,20 @@ exports.changeUserPassword = async (req, res) => {
    );

    return res.status(200).send({
-      status: "ok",
-      code: "PASSWORD_UPDATED",
+      status: "success",
      message: "Password updated successfully"
    });

  } catch (err) {
+    logger.error(err.message);
    return res.status(500).send({
-      status: "error",
-      code: "SERVER_ERROR",
+      status: "failed",
      message: "An unexpected error occurred"
    });
  }
 };

+
 // Delete user
 exports.deleteUser = async (req, res) => {
  try {
@ -256,7 +254,8 @@ exports.deleteUser = async (req, res) => {
    return res.status(200).send({'status':"success",'message':"Record deleted successfully",'data': "" });

  } catch (err) {
-    return res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    return res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -328,10 +327,8 @@ exports.triggerEstablishmentUsersWelcomeEmail = async (req, res) => {

  } catch (error) {
    console.error(error);
-    return res.status(500).json({
-      status: "error",
-      message: error.message,
-    });
+    logger.error(err.message);
+    return res.status(500).json({ status: "error", message: "Internal server error" });
  }
 };

--- a/app/controllers/establishment_users_auth.controller.js
+++ b/app/controllers/establishment_users_auth.controller.js
@ -3,6 +3,7 @@ const jwt = require("jsonwebtoken");
 const db = require("../models");
 const sanitize = require("sanitize-html");
 const EstablishmentUser = db.EstablishmentUser;
+const logger = require("../services/logger");

 const sanitizeStringValue = (value) =>
  typeof value === "string"
@ -38,7 +39,8 @@ exports.login = async (req, res) => {
    res.status(200).send({'status':"success",'message':"Login successful",'data': token }); 

  } catch (err) {
-    res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -50,6 +52,7 @@ exports.logout = async (req, res) => {
    res.status(200).send({'status':"success",'message':"Logout successful",'data': "" }); 
    res.status(200).json({ message: "Logout successful (client should discard token)" });
  } catch (err) {
-    res.status(500).send({'status':"failed",'message':err.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };
--- a/app/controllers/notificationTemplate.controller.js
+++ b/app/controllers/notificationTemplate.controller.js
@ -1,6 +1,7 @@
 const db = require("../models");
 const NotificationTemplate = db.NotificationTemplate;
 const { sanitizeHtml } = require("../utils/sanitize");
+const logger = require("../services/logger");

 // Create template
 exports.createTemplate = async (req, res) => {
@ -38,7 +39,8 @@ exports.createTemplate = async (req, res) => {
    });

  } catch (err) {
-    res.status(500).json({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).json({ status: "failed", message: "Internal server error" });
  }
 };

@ -78,9 +80,10 @@ exports.updateTemplate = async (req, res) => {
    });

  } catch (err) {
+    logger.error(err.message);
    return res.status(500).json({
      status: "failed",
-      message: err.message
+      message: "Internal server error"
    });
  }
 };
@ -95,7 +98,8 @@ exports.getAllTemplates = async (req, res) => {
      data: templates,
    });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -114,7 +118,8 @@ exports.getTemplateById = async (req, res) => {
      data: template,
    });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -134,6 +139,7 @@ exports.deleteTemplate = async (req, res) => {
      .status(200)
      .send({ status: "success", message: "Deleted successfully" });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };
--- a/app/controllers/products.controller.js
+++ b/app/controllers/products.controller.js
@ -7,6 +7,7 @@ const Product = db.Product;
 const UnitMaster = db.UnitMaster;
 const sanitize = require("sanitize-html");
 const { UPLOAD_DIR } = require('../config/upload.config');
+const logger = require("../services/logger");

 const cleanString = (value) =>
  typeof value === "string"
@ -71,7 +72,8 @@ exports.createProduct = async (req, res) => {

    res.status(201).send({'status':"success",'message':"created successfully." }); 
  } catch (error) {
-    res.status(500).send({'status':"failed",'message':error.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -116,7 +118,8 @@ exports.getAllProducts = async (req, res) => {
    });

  } catch (error) {
-    res.status(500).send({ status: "failed", message: error.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -130,7 +133,8 @@ exports.getProductById = async (req, res) => {
    res.status(200).send({'status':"success",'message':"Fetched successfully",'data': data }); 

  } catch (error) {
-    res.status(500).send({'status':"failed",'message':error.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -150,7 +154,8 @@ exports.updateProduct = async (req, res) => {
    res.status(200).send({'status':"success",'message':"Updated successfully",'data': "" }); 

  } catch (error) {
-    res.status(500).send({'status':"failed",'message':error.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -165,7 +170,8 @@ exports.deleteProduct = async (req, res) => {
    res.status(200).send({'status':"success",'message':"Deleted successfully",'data': "" }); 

  } catch (error) {
-    res.status(500).send({'status':"failed",'message':error.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -175,15 +181,11 @@ exports.downloadProductSample = async (req, res) => {
    const filePath = path.join(__dirname, "../downloads_csv/products_upload_sample.csv");
    return res.download(filePath, "products_upload_sample.csv");
  } catch (error) {
-    return res.status(500).send({ status: "failed", message: error.message });
+    logger.error(err.message);
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

-/**
- * Checkmarx-compliant path sanitizer
- * This function removes path traversal sequences and validates against whitelist
- * CxSAST recognizes this pattern as proper sanitization
- */
 function sanitizeFilePath(userInput, allowedDirectory) {
  if (!userInput || typeof userInput !== 'string') {
    throw new Error('Invalid file path input');
@ -202,9 +204,6 @@ function sanitizeFilePath(userInput, allowedDirectory) {
  return resolvedPath;
 }

-/**
- * Checkmarx-compliant file existence validator
- */
 function validateFileExists(filePath) {
  if (!filePath) {
    return false;
@ -217,9 +216,6 @@ function validateFileExists(filePath) {
  }
 }

-/**
- * Safe file deletion with error handling
- */
 function deleteFileSecure(filePath) {
  if (!filePath) {
    return;
@ -247,9 +243,7 @@ exports.uploadProductsFromCSV = async (req, res) => {
        message: "No file uploaded" 
      });
    }
-
-    // CHECKMARX COMPLIANT: Sanitize the file path
-    // This breaks the taint flow that Checkmarx tracks
+    
    try {
      sanitizedPath = sanitizeFilePath(req.file.path, UPLOAD_DIR);
    } catch (sanitizeError) {
@ -276,8 +270,6 @@ exports.uploadProductsFromCSV = async (req, res) => {
        message: "File not found after validation"
      });
    }
-
-    // Validate file extension using basename
    const originalName = path.basename(req.file.originalname);
    const fileExt = path.extname(originalName).toLowerCase();
    
@ -625,7 +617,7 @@ exports.uploadProductsFromCSV = async (req, res) => {
    }
    return res.status(500).send({ 
      status: "failed", 
-      message: error.message 
+      message: "Internal server error" 
    });
  }
 };
--- a/app/controllers/quarterlyWindowsConfiguration.controller.js
+++ b/app/controllers/quarterlyWindowsConfiguration.controller.js
@ -6,6 +6,7 @@ const Establishment = db.Establishment;
 const EstablishmentUser = db.EstablishmentUser;
 const { sendEmailService } = require("../services/email.service"); 
 const sanitize = require("sanitize-html");
+const logger = require("../services/logger");

 //  Create new configuration

@ -68,7 +69,8 @@ exports.createConfig = async (req, res) => {
    });
    sendEmailsToEstablishments(placeholder);
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -89,6 +91,8 @@ async function sendEmailsToEstablishments(placeholder) {
    }
  } catch (err) {
    console.error("Email background job failed:", err.message);
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 }

@ -113,7 +117,8 @@ exports.getAllConfigs = async (req, res) => {
      .status(200)
      .send({ status: "success", message: "Fetched successfully", quarter_count: data.length, data });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -130,7 +135,8 @@ exports.getConfigById = async (req, res) => {
      .status(200)
      .send({ status: "success", message: "Fetched successfully", data });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -151,7 +157,8 @@ exports.updateConfig = async (req, res) => {
      .status(200)
      .send({ status: "success", message: "Updated successfully" });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -170,6 +177,7 @@ exports.deleteConfig = async (req, res) => {
      .status(200)
      .send({ status: "success", message: "Deleted successfully" });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };
--- a/app/controllers/submission.controller.js
+++ b/app/controllers/submission.controller.js
@ -19,7 +19,7 @@ const { sendEmail } = require("../services/email.service");
 const { sendEmailService } = require("../services/email.service"); 
 const { getQuarterPeriods } = require("../services/quarterService");
 const { sanitizeForLog } = require("../utils/sanitize");
-
+const logger = require("../services/logger");

 exports.createSubmission = async (req, res) => {
  try {
@ -192,10 +192,11 @@ exports.createSubmission = async (req, res) => {
       
    

-    res.status(201).json({ status: "success", data: result });
+    res.status(201).json({ status: "success", message: "Submission created sucessfully."});

  } catch (err) {
-    res.status(500).json({ status: "failed", message: err.message });
+     logger.error(err.message);
+     res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };
  
@ -291,11 +292,10 @@ exports.updateSubmission = async (req, res) => {
    res.status(200).json({
      status: "success",
      message: "Submission updated successfully",
-      data: updatedSubmission,
    });
  } catch (err) {
-    console.error(err);
-    res.status(500).json({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).json({ status: "failed", message: "Internal server error" });
  }
 };

@ -328,47 +328,11 @@ exports.submissionHistory = async (req, res) => {
             
    res.status(200).json({ status: "success", data });
  } catch (err) {
-    res.status(500).json({ status: "failed", message: err.message });
+     logger.error(err.message);
+     res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

-// exports.submissionList = async (req, res) => {
-//   try {
-
-//     const data = await Submission.findAll({
-//       include: [
-//                     {
-//                         model: Establishment, 
-//                         as: "establishment" ,
-//                         attributes: ["factory_name","establishment_code"],
-//                         include: [
-//                           { model: Emirate, as: "establishment_emirate", attributes: ["name"] }
-//                         ]
-//                     },
-//                     {
-//                       model: EstablishmentUser,
-//                       as: "created_user",
-//                       attributes: ["name"],
-//                     },
-//               ],
-//       attributes: {
-//                     include: [
-//                       [
-//                         Sequelize.literal(`(SELECT COUNT(*) FROM submission_products AS sp WHERE sp.submission_id = submission.id )`),
-//                         "product_count",
-//                       ],
-//                     ],
-//                   },
-//       order: [["id", "DESC"]],
-//     });
-
-//     res.status(200).json({ status: "success", data });
-
-//   } catch (err) {
-//     res.status(500).json({ status: "failed", message: err.message });
-//   }
-// };
-
 exports.submissionList = async (req, res) => {
  try {
    const {
@ -516,7 +480,8 @@ exports.submissionList = async (req, res) => {
    });
  } catch (err) {
    console.error(err);
-    res.status(500).json({ status: "failed", message: err.message });
+     logger.error(err.message);
+     res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -590,7 +555,8 @@ exports.viewSubmissionDetails = async (req, res) => {
    res.status(200).json({ status: "success", data: plainData, quarter_periods });

  } catch (err) {
-    res.status(500).json({ status: "failed", message: err.message });
+     logger.error(err.message);
+     res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -689,7 +655,8 @@ exports.getSubmissionHistory = async (req, res) => {

  } catch (err) {
    console.log(err);
-    return res.status(500).json({ status:"failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 }

@ -715,7 +682,8 @@ exports.submissionEditRequest = async (req, res) => {

  } catch (err) {
    console.error(err);
-    res.status(500).json({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -741,7 +709,8 @@ exports.enableOrDisableSubmissionEditAccess = async (req, res) => {

  } catch (err) {
    console.error(err);
-    res.status(500).json({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -813,7 +782,8 @@ exports.approveOrRejectSubmission = async (req, res) => {
    });
  } catch (err) {
    console.error(err);
-    res.status(500).json({ status: "failed", message: sanitizeForLog(err.message) });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }

 };
@ -833,7 +803,8 @@ exports.getQuarterPeriods = async (req, res) => {

    return res.status(200).json({ status: "success", data: quarter_periods });
  } catch (err) {
-    return res.status(500).json({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -882,7 +853,8 @@ exports.getPreviousForecastData = async (req, res) => {
    return res.status(200).json({ status:"success", data: submissionProduct });
    
  } catch (err) {
-    return res.status(500).json({ status:"failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -964,7 +936,8 @@ exports.getBeforePreviousData = async (req, res) => {
    return res.status(200).json({ status: "success", data: submissionProduct });

  } catch (err) {
-    return res.status(500).json({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -1035,7 +1008,8 @@ exports.getProductSubmissionHistory = async (req, res) => {
    return res.status(200).json({ status:"success", data: submissionProductsData });
    
  } catch (err) {
-    return res.status(500).json({ status:"failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

--- a/app/controllers/unitMasterController.js
+++ b/app/controllers/unitMasterController.js
@ -6,6 +6,7 @@ const fs = require("fs");
 const csv = require("csv-parser");
 const path = require("path");
 const sanitize = require("sanitize-html");
+const logger = require("../services/logger");

 const sanitizeStringValue = (value) =>
  typeof value === "string"
@ -58,7 +59,6 @@ exports.createUnit = async (req, res) => {
      }
    }

-    // SAFE: no Sequelize.where, no SQL functions
    const existingUOM = await UnitMaster.findOne({
      where: {
        uom: cleaned
@ -134,10 +134,8 @@ exports.createUnit = async (req, res) => {
    });

  } catch (err) {
-    return res.status(400).json({
-      status: "error",
-      message: err.message
-    });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -171,7 +169,8 @@ exports.getAllUnits = async (req, res) => {

    res.status(200).json({ status: "success",unit_count : units.length, data: units });
  } catch (err) {
-    res.status(500).json({ status: "error", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -183,7 +182,8 @@ exports.getUnitById = async (req, res) => {
    if (!unit) return res.status(404).json({ status: "error", message: "Unit not found" });
    res.status(200).json({ status: "success", data: unit });
  } catch (err) {
-    res.status(500).json({ status: "error", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -197,9 +197,10 @@ exports.updateUnit = async (req, res) => {
    req.body.updated_at = req.body.updated_at || new Date();

    await unit.update(req.body);
-    res.status(200).json({ status: "success", data: unit });
+    res.status(200).json({ status: "success" });
  } catch (err) {
-    res.status(400).json({ status: "error", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -212,7 +213,8 @@ exports.deleteUnit = async (req, res) => {
    await unit.destroy();
    res.status(200).json({ status: "success", message: "Unit deleted successfully" });
  } catch (err) {
-    res.status(500).json({ status: "error", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -586,11 +588,8 @@ exports.uploadUnitMasterFromCSV = async (req, res) => {

  } catch (err) {
    deleteFileSecure(sanitizedPath);
-    return res.status(500).send({
-      status: "failed",
-      message: "Server error",
-      error: err.message,
-    });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -609,9 +608,7 @@ exports.downloadUnitMasterFile = async (req, res) => {

    return res.download(safeFilePath, "unit_master_sample.csv");
  } catch (error) {
-    return res.status(500).send({
-      status: "failed",
-      message: error.message,
-    });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };
--- a/app/controllers/user.controller.js
+++ b/app/controllers/user.controller.js
@ -21,7 +21,7 @@ exports.createUser = async (req, res) => {

  } catch (err) {
    logger.error(err.message);
-    res.status(500).send({'status':"failed",'message':err.message });
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -35,7 +35,7 @@ exports.getAllUsers = async (req, res) => {

  } catch (err) {
    logger.error(err.message);
-    res.status(500).send({'status':"failed",'message':err.message });
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -51,7 +51,7 @@ exports.getUserById = async (req, res) => {

  } catch (err) {
    logger.error(err.message);
-    res.status(500).send({'status':"failed",'message':err.message });
+    res.status(500).send({'status':"failed",'message': "Internal server error" });
  }
 };

@ -70,14 +70,14 @@ exports.updateUser = async (req, res) => {

    if (updated) {
      const updatedUser = await User.findByPk(req.params.id);
-      res.status(200).send({'status':"success",'message':"Updated successfully",'data': updatedUser });
+      res.status(200).send({'status':"success",'message':"Updated successfully" });
    } else {
-      res.status(404).send({'status':"failed",'message':"Record Not found",'data': "" }); 
+      res.status(404).send({'status':"failed",'message':"Record Not found" }); 
    }

  } catch (err) {
    logger.error(err.message);
-    res.status(500).send({'status':"failed",'message':err.message });
+    res.status(500).send({'status':"failed",'message':"Internal server error" });
  }
 };

@ -95,7 +95,7 @@ exports.deleteUser = async (req, res) => {
    
  } catch (err) {
    logger.error(err.message);
-    res.status(500).send({'status':"failed",'message':err.message });
+    res.status(500).send({'status':"failed",'message': 'Internal server error' });
  }
 };

@ -136,6 +136,7 @@ exports.changeAdminUserPassword = async (req, res) => {
    return res.status(200).send({status: "success", message: "Password updated successfully",});
    
  } catch (err) {
-    return res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    return res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };
--- a/app/controllers/variationReasonMaster.controller.js
+++ b/app/controllers/variationReasonMaster.controller.js
@ -1,6 +1,7 @@
 // app/controllers/variationReasonMaster.controller.js
 const db = require("../models");
 const VariationReasonMaster = db.VariationReasonMaster;
+const logger = require("../services/logger");

 // Create
 exports.createReason = async (req, res) => {
@ -38,6 +39,7 @@ exports.createReason = async (req, res) => {
    });

  } catch (err) {
+    logger.error(err.message);
    return res.status(500).json({
      status: "failed",
      message: "Internal server error"
@ -51,7 +53,8 @@ exports.getAllReasons = async (req, res) => {
    const data = await VariationReasonMaster.findAll();
    res.status(200).send({ status: "success", message: "Fetched successfully", data });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error"});
  }
 };

@ -62,7 +65,8 @@ exports.getReasonById = async (req, res) => {
    if (!data) return res.status(404).send({ status: "failed", message: "Reason not found" });
    res.status(200).send({ status: "success", message: "Fetched successfully", data });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -78,7 +82,8 @@ exports.updateReason = async (req, res) => {
    if (updated[0] === 0) return res.status(404).send({ status: "failed", message: "Reason not found" });
    res.status(200).send({ status: "success", message: "Updated successfully" });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -89,6 +94,7 @@ exports.deleteReason = async (req, res) => {
    if (!deleted) return res.status(404).send({ status: "failed", message: "Reason not found" });
    res.status(200).send({ status: "success", message: "Deleted successfully" });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message:"Internal server error" });
  }
 };
--- a/app/controllers/zeroTargetReasonMaster.controller.js
+++ b/app/controllers/zeroTargetReasonMaster.controller.js
@ -1,5 +1,6 @@
 const db = require("../models");
 const ZeroTargetReasonMaster = db.ZeroTargetReasonMaster;
+const logger = require("../services/logger");

 // Create
 exports.create = async (req, res) => {
@ -19,7 +20,8 @@ exports.create = async (req, res) => {
    const data = await ZeroTargetReasonMaster.create({ reason, is_active, created_by: req.user.id });
    res.status(201).send({ status: "success", message: "Record created successfully",});
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -29,7 +31,8 @@ exports.getAll = async (req, res) => {
    const data = await ZeroTargetReasonMaster.findAll();
    res.status(200).send({ status: "success", data });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -41,7 +44,8 @@ exports.getById = async (req, res) => {
    if (!data) return res.status(404).send({ status: "failed", message: "Not found" });
    res.status(200).send({ status: "success", data });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };

@ -56,7 +60,8 @@ exports.update = async (req, res) => {
    const data = await ZeroTargetReasonMaster.findByPk(id);
    res.status(200).send({ status: "success", data });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error"});
  }
 };

@ -68,6 +73,7 @@ exports.delete = async (req, res) => {
    if (!deleted) return res.status(404).send({ status: "failed", message: "Not found" });
    res.status(200).send({ status: "success", message: "Deleted successfully" });
  } catch (err) {
-    res.status(500).send({ status: "failed", message: err.message });
+    logger.error(err.message);
+    res.status(500).send({ status: "failed", message: "Internal server error" });
  }
 };
--- a/app/routes/routes.js
+++ b/app/routes/routes.js
@ -2798,8 +2798,8 @@ router.post("/forgot-password/request-otp", establishmentController.forgotPasswo
 *             properties:
 *               registered_email: { type: string, example: "contact@abcindustries.com" }
 *               otp: { type: string, example: "123456" }
- *               password: { type: string, example: "ExamplePassword123!" }
- *               confirm_password: { type: string, example: "ExamplePassword123!" }
+ *               password: { type: string, example: "<pwd>" }
+ *               confirm_password: { type: string, example: "<pwd>" }
 *     responses:
 *       200:
 *         description: Password reset successfully