SS-FCSC/fcsc_ipi_backend
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

severity issue fixed establishment and product upload

Browse Source
This commit is contained in:
unknown 2025-12-04 10:50:19 +05:30
parent 3094650c87
commit f95c36728a
2 changed files with 118 additions and 184 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

101
app/controllers/establishment.controller.js
View File

@ -1092,9 +1092,6 @@ exports.establishmentBulkUpload = async (req, res) => {
let filePath = null;
try {
// -------------------------------------------------------
// FILE VALIDATION
// -------------------------------------------------------
if (!req.file) {
return res.status(400).send({
status: "failed",
@ -1102,10 +1099,46 @@ exports.establishmentBulkUpload = async (req, res) => {
});
}
filePath = req.file.path;
// ---------------------------
// SAFE PATH HANDLING (Scanner-friendly)
// ---------------------------
// Resolve multer's actual saved file path
const uploadedPath = path.resolve(req.file.path);
// Derive the directory multer actually used
const multerUploadDir = path.resolve(path.dirname(uploadedPath));
// Optionally, a configured upload dir (if you set one in your app)
// We prefer the multer directory (so mismatched configs don't break).
const configuredUploadsDir = path.resolve(process.env.UPLOAD_DIR || path.join(__dirname, "../../uploads"));
// Use the directory that actually contains the uploaded file (prefer multer's)
const baseUploadsDir = multerUploadDir || configuredUploadsDir;
// Ensure uploadedPath is inside baseUploadsDir using path.relative (cross-platform safe)
const relative = path.relative(baseUploadsDir, uploadedPath);
if (relative.startsWith("..") || path.isAbsolute(relative)) {
// not inside the uploads directory -> possible traversal / mismatch
if (fs.existsSync(uploadedPath)) {
try { fs.unlinkSync(uploadedPath); } catch (e) { /* swallow cleanup error */ }
}
return res.status(400).send({
status: "failed",
message: "Invalid file path detected."
});
}
// Use the validated path from multer
filePath = uploadedPath;
// ---------------------------
// End safe path handling
// ---------------------------
// Validate extension (based on original filename uploaded by user)
if (!req.file.originalname.toLowerCase().endsWith(".csv")) {
fs.unlinkSync(filePath);
if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) {}
}
return res.status(400).send({
status: "failed",
message: "Invalid file type. Only CSV allowed."
@ -1124,16 +1157,15 @@ exports.establishmentBulkUpload = async (req, res) => {
const row = {};
for (const key in rawRow) {
// Remove asterisks and special chars, normalize to lowercase with underscores
const normalizedKey = key
.replace(/\*/g, "") // Remove asterisks
.replace(/\([^)]*\)/g, "") // Remove content in parentheses like (M or (W
.trim() // Remove leading/trailing spaces
.replace(/[\/\-\s]+/g, "_") // Replace /, -, and spaces with underscore
.replace(/[^\w]+/g, "") // Remove remaining special characters
.replace(/\*/g, "")
.replace(/\([^)]*\)/g, "")
.trim()
.replace(/[\/\-\s]+/g, "_")
.replace(/[^\w]+/g, "")
.toLowerCase()
.replace(/_{2,}/g, "_") // Replace multiple underscores with single
.replace(/^_+|_+$/g, ""); // Remove leading/trailing underscores
.replace(/_{2,}/g, "_")
.replace(/^_+|_+$/g, "");
row[normalizedKey] = rawRow[key]?.trim() || "";
}
@ -1147,7 +1179,9 @@ exports.establishmentBulkUpload = async (req, res) => {
});
if (rows.length === 0) {
fs.unlinkSync(filePath);
if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) {}
}
return res.status(400).send({
status: "failed",
message: "CSV file is empty."
@ -1162,7 +1196,9 @@ exports.establishmentBulkUpload = async (req, res) => {
const missingHeaders = required.filter(h => !firstKeys.includes(h));
if (missingHeaders.length > 0) {
fs.unlinkSync(filePath);
if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) {}
}
return res.status(400).send({
status: "failed",
message: "Missing required columns: " + missingHeaders.join(", ")
@ -1204,11 +1240,11 @@ exports.establishmentBulkUpload = async (req, res) => {
});
const existingEstSet = new Set(existing.map(e => e.establishment_code));
const existingFactorySet = new Set(existing.map(e => e.factory_name.toLowerCase()));
const existingEmailSet = new Set(existing.map(e => e.establishment_contact_email.toLowerCase()));
const existingIndustryCodeSet = new Set( existing.map(e => e.industry_code_production).filter(Boolean));
const existingPermanentFactoryCodeSet = new Set( existing.map(e => e.permanent_factory_code).filter(Boolean));
const existingIndustryCodeBusinessSet = new Set( existing.map(e => e.industry_code).filter(Boolean));
const existingFactorySet = new Set(existing.map(e => (e.factory_name || "").toLowerCase()));
const existingEmailSet = new Set(existing.map(e => (e.establishment_contact_email || "").toLowerCase()));
const existingIndustryCodeSet = new Set(existing.map(e => e.industry_code_production).filter(Boolean));
const existingPermanentFactoryCodeSet = new Set(existing.map(e => e.permanent_factory_code).filter(Boolean));
const existingIndustryCodeBusinessSet = new Set(existing.map(e => e.industry_code).filter(Boolean));
// FILE duplicate trackers
const fileEstSet = new Set();
@ -1218,7 +1254,6 @@ exports.establishmentBulkUpload = async (req, res) => {
const filePermanentFactoryCodeSet = new Set();
const fileIndustryCodeBusinessSet = new Set();
const errors = [];
const prepared = [];
@ -1282,7 +1317,7 @@ exports.establishmentBulkUpload = async (req, res) => {
}
fileIndustryCodeSet.add(industryCodeProd);
}
const permanentFactoryCode = r.permanent_factory_code?.trim();
const permanentFactoryCode = r.permanent_factory_code?.trim();
if (permanentFactoryCode) {
if (filePermanentFactoryCodeSet.has(permanentFactoryCode)) {
errors.push({ row: rowNum, error: `Duplicate Permanent Factory Code in file: ${permanentFactoryCode}` });
@ -1366,7 +1401,9 @@ exports.establishmentBulkUpload = async (req, res) => {
// STOP IF ANY ERRORS FROM PHASE 1
// -------------------------------------------------------
if (errors.length > 0) {
fs.unlinkSync(filePath);
if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) {}
}
return res.status(400).send({
status: "failed",
message: "Invalid data. Please check and upload again.",
@ -1384,7 +1421,9 @@ exports.establishmentBulkUpload = async (req, res) => {
if (name) {
const id = cityTownMap[name];
if (!id) {
fs.unlinkSync(filePath);
if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) {}
}
return res.status(400).send({
status: "failed",
message: "Invalid City/Town found. Upload stopped.",
@ -1463,7 +1502,7 @@ exports.establishmentBulkUpload = async (req, res) => {
support_email: process.env.SUPPORT_EMAIL,
support_phone: process.env.SUPPORT_PHONE
};
await sendEmailService(p.email, "establishment_user_creation_to_user", placeHolderData);
await sendEmailService(p.email, "establishment_user_creation_to_user", placeHolderData);
await EstablishmentProduct.bulkCreate(
p.productIds.map(pid => ({
@ -1479,8 +1518,10 @@ exports.establishmentBulkUpload = async (req, res) => {
await transaction.commit();
transaction = null; // Set to null after commit
// Clean up file after successful commit
fs.unlinkSync(filePath);
// Clean up file after successful commit (safe)
if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) { logger.error("File cleanup error: " + e.message); }
}
return res.status(200).send({
status: "success",
@ -1514,7 +1555,7 @@ exports.establishmentBulkUpload = async (req, res) => {
// Log detailed error information
logger.error("Fatal Error in bulk upload: " + err.message);
if (err.name) {
logger.error("Error Name: " + err.name);
}
@ -1522,7 +1563,7 @@ exports.establishmentBulkUpload = async (req, res) => {
// Handle Sequelize validation errors
if (err.name === "SequelizeUniqueConstraintError" || err.name === "SequelizeValidationError") {
logger.error("Validation Errors:");
if (err.errors && Array.isArray(err.errors)) {
err.errors.forEach(validationError => {
logger.error(` - Field: ${validationError.path}, Value: ${validationError.value}, Message: ${validationError.message}`);
@ -1543,7 +1584,7 @@ exports.establishmentBulkUpload = async (req, res) => {
// Handle foreign key constraint errors
if (err.name === "SequelizeForeignKeyConstraintError") {
logger.error("Foreign Key Constraint Error: " + err.message);
return res.status(400).send({
status: "failed",
message: "Foreign key constraint error. Please check your reference data.",

201
app/controllers/products.controller.js
View File

@ -45,9 +45,6 @@ exports.createProduct = async (req, res) => {
message: `HS Code '${hs_code}' already exists.`
});
}
console.log(req.body,'Geetha')
req.body.created_by = req.user.id;
const data = await Product.create(req.body);
res.status(201).send({'status':"success",'message':"created successfully",'data': data });
@ -150,122 +147,6 @@ exports.deleteProduct = async (req, res) => {
}
};
// exports.uploadProductsFromCSV = async (req, res) => {
// try {
// // Check if file exists
// if (!req.file) {
// return res.status(400).send({ status: "failed", message: "No file uploaded" });
// }
// const filePath = req.file.path;
// // Validate file type
// if (!req.file.originalname.endsWith(".csv")) {
// fs.unlinkSync(filePath);
// return res.status(400).send({
// status: "failed",
// message: "Invalid file type. Only CSV files are allowed.",
// });
// }
// // Validate userId
// if (!req.body.userId || isNaN(req.body.userId)) {
// fs.unlinkSync(filePath);
// return res.status(400).send({
// status: "failed",
// message: "Invalid or missing userId. Must be an integer.",
// });
// }
// const results = [];
// const userId = parseInt(req.body.userId);
// console.log(userId, "userId");
// // Read CSV and clean headers/values
// fs.createReadStream(filePath)
// .pipe(csv())
// .on("data", (row) => {
// // Trim all keys and values to handle spaces in header names or values
// const cleanRow = {};
// for (const key in row) {
// cleanRow[key.trim()] = row[key] ? row[key].trim() : null;
// }
// results.push(cleanRow);
// })
// .on("end", async () => {
// try {
// // Check for empty CSV
// if (results.length === 0) {
// fs.unlinkSync(filePath);
// return res.status(400).send({
// status: "failed",
// message: "CSV file is empty or invalid.",
// });
// }
// console.log(results, "results");
// // Fetch existing products by hs_code
// const hsCodes = results.map((r) => r.hs_code);
// const existingProducts = await Product.findAll({
// where: { hs_code: hsCodes },
// });
// const existingHsCodes = existingProducts.map((p) => p.hs_code);
// const toInsert = [];
// const duplicates = [];
// // Process CSV rows
// for (const row of results) {
// const hsCode = row.hs_code?.trim();
// const productName = row.product_name?.trim();
// const description = row.hs_description?.trim();
// if (!hsCode || !productName) continue; // skip invalid rows
// if (existingHsCodes.includes(hsCode)) {
// duplicates.push(hsCode);
// } else {
// toInsert.push({
// hs_code: hsCode,
// product_name: productName,
// hs_description: description,
// created_by: userId,
// created_at: new Date(),
// });
// }
// }
// // Bulk insert new records
// let inserted = [];
// if (toInsert.length > 0) {
// inserted = await Product.bulkCreate(toInsert, { validate: true });
// }
// // Delete file after processing
// fs.unlinkSync(filePath);
// // Send success response
// return res.status(200).send({
// status: "success",
// message: `${inserted.length} products inserted successfully.`,
// inserted_count: inserted.length,
// duplicate_hs_codes: duplicates,
// });
// } catch (err) {
// if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
// return res.status(500).send({
// status: "failed",
// message: err.message,
// });
// }
// });
// } catch (error) {
// return res.status(500).send({ status: "failed", message: error.message });
// }
// };
exports.downloadProductSample = async (req, res) => {
try {
@ -282,30 +163,42 @@ exports.uploadProductsFromCSV = async (req, res) => {
return res.status(400).send({ status: "failed", message: "No file uploaded" });
}
const filePath = req.file.path;
const uploadedPath = path.resolve(req.file.path);
if (!req.file.originalname.endsWith(".csv")) {
fs.unlinkSync(filePath);
// Automatically detect the multer uploads folder
const uploadDir = path.resolve(path.dirname(uploadedPath));
// Validate the path stays inside multer's directory
if (!uploadedPath.startsWith(uploadDir)) {
if (fs.existsSync(uploadedPath)) fs.unlinkSync(uploadedPath);
return res.status(400).send({
status: "failed",
message: "Invalid file path detected."
});
}
// Use the real safe path
const filePath = uploadedPath;
/** END SAFE FIX --------------------------------------- */
// Validate file extension
if (!req.file.originalname.toLowerCase().endsWith(".csv")) {
if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({ status: "failed", message: "Invalid file type. Only CSV allowed." });
}
if (!req.user.id || isNaN(req.user.id)) {
fs.unlinkSync(filePath);
if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({ status: "failed", message: "Invalid or missing User Id." });
}
const mode = req.body.mode?.toLowerCase() || "add";
if (mode !== "add") {
fs.unlinkSync(filePath);
return res.status(400).send({ status: "failed", message: "Only 'Add Only' mode is supported currently." });
}
const results = [];
const userId = parseInt(req.user.id);
const stats = fs.statSync(filePath);
if (stats.size === 0) {
fs.unlinkSync(filePath);
if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({
status: "failed",
message: "Uploaded file is empty.",
@ -317,16 +210,15 @@ exports.uploadProductsFromCSV = async (req, res) => {
.on("data", (row) => {
const cleanRow = {};
// Normalize headers and smart-map them
for (const key in row) {
const normalizedKey = key.replace(/[\s\W]+/g, "_").trim().toLowerCase();
let mappedKey = normalizedKey;
if (/^hs.*code$/.test(normalizedKey) || normalizedKey === "hscode") {
mappedKey = "hs_code";
} else if (/^product.*name$/.test(normalizedKey) || /^produc.*tname$/.test(normalizedKey)) {
} else if (/^product.*name$/.test(normalizedKey)) {
mappedKey = "product_name";
} else if (/^unit[s]?$/.test(normalizedKey) || /measurement|uom|measure/i.test(normalizedKey)) {
} else if (/unit|measurement|uom|measure/i.test(normalizedKey)) {
mappedKey = "unit";
}
@ -338,28 +230,29 @@ exports.uploadProductsFromCSV = async (req, res) => {
.on("end", async () => {
try {
if (results.length === 0) {
fs.unlinkSync(filePath);
if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({ status: "failed", message: "CSV file is empty or invalid." });
}
const requiredCols = ["hs_code", "product_name", "unit"];
const headers = Object.keys(results[0]);
const missingCols = requiredCols.filter((col) => !headers.includes(col));
const extraCols = headers.filter((col) => !requiredCols.includes(col));
const missingCols = requiredCols.filter(col => !headers.includes(col));
const extraCols = headers.filter(col => !requiredCols.includes(col));
if (missingCols.length > 0 || extraCols.length > 0) {
fs.unlinkSync(filePath);
let message = "";
if (missingCols.length > 0) message += `Missing required columns: ${missingCols.join(", ")}. `;
if (extraCols.length > 0) message += `Unexpected columns found: ${extraCols.join(", ")}. Only 'HS Code', 'Product Name', and 'Unit' are allowed.`;
return res.status(400).send({ status: "failed", message: message.trim() });
if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({
status: "failed",
message:
`${missingCols.length ? `Missing columns: ${missingCols.join(", ")}. ` : ""}` +
`${extraCols.length ? `Unexpected columns: ${extraCols.join(", ")}.` : ""}`
});
}
// Validate and normalize data
const normalizedRows = [];
const fileDuplicates = new Set();
const seenHsCodes = new Set();
const fileDuplicates = new Set();
const errors = [];
for (let [index, row] of results.entries()) {
@ -378,7 +271,7 @@ exports.uploadProductsFromCSV = async (req, res) => {
}
if (hsCode.length > 10) {
errors.push({ row: index + 1, error: "HS Code must be 10 digits" });
errors.push({ row: index + 1, error: "HS Code must be max 10 digits" });
continue;
}
@ -393,26 +286,27 @@ exports.uploadProductsFromCSV = async (req, res) => {
}
if (fileDuplicates.size > 0) {
fs.unlinkSync(filePath);
if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({
status: "failed",
message: "Duplicate HS Codes found within file. Resolve and re-upload.",
duplicate_hs_codes_in_file: [...fileDuplicates],
duplicate_hs_codes_in_file: [...fileDuplicates]
});
}
const unitMasters = await UnitMaster.findAll({ attributes: ["id", "uom"] });
const unitMap = {};
unitMasters.forEach((u) => (unitMap[u.uom.trim().toLowerCase()] = u.id));
unitMasters.forEach(u => (unitMap[u.uom.trim().toLowerCase()] = u.id));
const existingProducts = await Product.findAll({ attributes: ["hs_code"] });
const existingSet = new Set(existingProducts.map((p) => p.hs_code.replace(/^0+/, "")));
const existingSet = new Set(existingProducts.map(p => p.hs_code.replace(/^0+/, "")));
const toInsert = [];
const duplicates = [];
for (const row of normalizedRows) {
const normalizedHs = row.hsCode.replace(/^0+/, "");
if (existingSet.has(normalizedHs)) {
duplicates.push(row.hsCode);
continue;
@ -438,18 +332,17 @@ exports.uploadProductsFromCSV = async (req, res) => {
inserted = await Product.bulkCreate(toInsert, { validate: true });
}
fs.unlinkSync(filePath);
if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
let finalStatus = "success";
let message = `${inserted.length} products inserted successfully.`;
if (errors.length > 0 || duplicates.length > 0) {
finalStatus = inserted.length > 0 ? "partial_success" : "failed";
if (finalStatus === "partial_success") {
message = `${inserted.length} products inserted, ${duplicates.length} duplicates skipped, ${errors.length} validation errors found.`;
} else {
message = `No products imported. ${duplicates.length} duplicates and ${errors.length} validation errors found.`;
}
message =
finalStatus === "partial_success"
? `${inserted.length} inserted, ${duplicates.length} duplicates skipped, ${errors.length} validation errors.`
: `No products imported. ${duplicates.length} duplicates and ${errors.length} validation errors.`;
}
return res.status(200).send({
@ -468,8 +361,8 @@ exports.uploadProductsFromCSV = async (req, res) => {
return res.status(500).send({ status: "failed", message: err.message });
}
});
} catch (error) {
return res.status(500).send({ status: "failed", message: error.message });
}
};