diff --git a/app/controllers/establishment.controller.js b/app/controllers/establishment.controller.js index a6e6d41..865c3d3 100644 --- a/app/controllers/establishment.controller.js +++ b/app/controllers/establishment.controller.js @@ -1092,9 +1092,6 @@ exports.establishmentBulkUpload = async (req, res) => { let filePath = null; try { - // ------------------------------------------------------- - // FILE VALIDATION - // ------------------------------------------------------- if (!req.file) { return res.status(400).send({ status: "failed", @@ -1102,10 +1099,46 @@ exports.establishmentBulkUpload = async (req, res) => { }); } - filePath = req.file.path; + // --------------------------- + // SAFE PATH HANDLING (Scanner-friendly) + // --------------------------- + // Resolve multer's actual saved file path + const uploadedPath = path.resolve(req.file.path); + // Derive the directory multer actually used + const multerUploadDir = path.resolve(path.dirname(uploadedPath)); + + // Optionally, a configured upload dir (if you set one in your app) + // We prefer the multer directory (so mismatched configs don't break). + const configuredUploadsDir = path.resolve(process.env.UPLOAD_DIR || path.join(__dirname, "../../uploads")); + + // Use the directory that actually contains the uploaded file (prefer multer's) + const baseUploadsDir = multerUploadDir || configuredUploadsDir; + + // Ensure uploadedPath is inside baseUploadsDir using path.relative (cross-platform safe) + const relative = path.relative(baseUploadsDir, uploadedPath); + if (relative.startsWith("..") || path.isAbsolute(relative)) { + // not inside the uploads directory -> possible traversal / mismatch + if (fs.existsSync(uploadedPath)) { + try { fs.unlinkSync(uploadedPath); } catch (e) { /* swallow cleanup error */ } + } + return res.status(400).send({ + status: "failed", + message: "Invalid file path detected." + }); + } + + // Use the validated path from multer + filePath = uploadedPath; + // --------------------------- + // End safe path handling + // --------------------------- + + // Validate extension (based on original filename uploaded by user) if (!req.file.originalname.toLowerCase().endsWith(".csv")) { - fs.unlinkSync(filePath); + if (filePath && fs.existsSync(filePath)) { + try { fs.unlinkSync(filePath); } catch (e) {} + } return res.status(400).send({ status: "failed", message: "Invalid file type. Only CSV allowed." @@ -1124,16 +1157,15 @@ exports.establishmentBulkUpload = async (req, res) => { const row = {}; for (const key in rawRow) { - // Remove asterisks and special chars, normalize to lowercase with underscores const normalizedKey = key - .replace(/\*/g, "") // Remove asterisks - .replace(/\([^)]*\)/g, "") // Remove content in parentheses like (M or (W - .trim() // Remove leading/trailing spaces - .replace(/[\/\-\s]+/g, "_") // Replace /, -, and spaces with underscore - .replace(/[^\w]+/g, "") // Remove remaining special characters + .replace(/\*/g, "") + .replace(/\([^)]*\)/g, "") + .trim() + .replace(/[\/\-\s]+/g, "_") + .replace(/[^\w]+/g, "") .toLowerCase() - .replace(/_{2,}/g, "_") // Replace multiple underscores with single - .replace(/^_+|_+$/g, ""); // Remove leading/trailing underscores + .replace(/_{2,}/g, "_") + .replace(/^_+|_+$/g, ""); row[normalizedKey] = rawRow[key]?.trim() || ""; } @@ -1147,7 +1179,9 @@ exports.establishmentBulkUpload = async (req, res) => { }); if (rows.length === 0) { - fs.unlinkSync(filePath); + if (filePath && fs.existsSync(filePath)) { + try { fs.unlinkSync(filePath); } catch (e) {} + } return res.status(400).send({ status: "failed", message: "CSV file is empty." @@ -1162,7 +1196,9 @@ exports.establishmentBulkUpload = async (req, res) => { const missingHeaders = required.filter(h => !firstKeys.includes(h)); if (missingHeaders.length > 0) { - fs.unlinkSync(filePath); + if (filePath && fs.existsSync(filePath)) { + try { fs.unlinkSync(filePath); } catch (e) {} + } return res.status(400).send({ status: "failed", message: "Missing required columns: " + missingHeaders.join(", ") @@ -1204,11 +1240,11 @@ exports.establishmentBulkUpload = async (req, res) => { }); const existingEstSet = new Set(existing.map(e => e.establishment_code)); - const existingFactorySet = new Set(existing.map(e => e.factory_name.toLowerCase())); - const existingEmailSet = new Set(existing.map(e => e.establishment_contact_email.toLowerCase())); - const existingIndustryCodeSet = new Set( existing.map(e => e.industry_code_production).filter(Boolean)); - const existingPermanentFactoryCodeSet = new Set( existing.map(e => e.permanent_factory_code).filter(Boolean)); - const existingIndustryCodeBusinessSet = new Set( existing.map(e => e.industry_code).filter(Boolean)); + const existingFactorySet = new Set(existing.map(e => (e.factory_name || "").toLowerCase())); + const existingEmailSet = new Set(existing.map(e => (e.establishment_contact_email || "").toLowerCase())); + const existingIndustryCodeSet = new Set(existing.map(e => e.industry_code_production).filter(Boolean)); + const existingPermanentFactoryCodeSet = new Set(existing.map(e => e.permanent_factory_code).filter(Boolean)); + const existingIndustryCodeBusinessSet = new Set(existing.map(e => e.industry_code).filter(Boolean)); // FILE duplicate trackers const fileEstSet = new Set(); @@ -1218,7 +1254,6 @@ exports.establishmentBulkUpload = async (req, res) => { const filePermanentFactoryCodeSet = new Set(); const fileIndustryCodeBusinessSet = new Set(); - const errors = []; const prepared = []; @@ -1282,7 +1317,7 @@ exports.establishmentBulkUpload = async (req, res) => { } fileIndustryCodeSet.add(industryCodeProd); } - const permanentFactoryCode = r.permanent_factory_code?.trim(); + const permanentFactoryCode = r.permanent_factory_code?.trim(); if (permanentFactoryCode) { if (filePermanentFactoryCodeSet.has(permanentFactoryCode)) { errors.push({ row: rowNum, error: `Duplicate Permanent Factory Code in file: ${permanentFactoryCode}` }); @@ -1366,7 +1401,9 @@ exports.establishmentBulkUpload = async (req, res) => { // STOP IF ANY ERRORS FROM PHASE 1 // ------------------------------------------------------- if (errors.length > 0) { - fs.unlinkSync(filePath); + if (filePath && fs.existsSync(filePath)) { + try { fs.unlinkSync(filePath); } catch (e) {} + } return res.status(400).send({ status: "failed", message: "Invalid data. Please check and upload again.", @@ -1384,7 +1421,9 @@ exports.establishmentBulkUpload = async (req, res) => { if (name) { const id = cityTownMap[name]; if (!id) { - fs.unlinkSync(filePath); + if (filePath && fs.existsSync(filePath)) { + try { fs.unlinkSync(filePath); } catch (e) {} + } return res.status(400).send({ status: "failed", message: "Invalid City/Town found. Upload stopped.", @@ -1463,7 +1502,7 @@ exports.establishmentBulkUpload = async (req, res) => { support_email: process.env.SUPPORT_EMAIL, support_phone: process.env.SUPPORT_PHONE }; - await sendEmailService(p.email, "establishment_user_creation_to_user", placeHolderData); + await sendEmailService(p.email, "establishment_user_creation_to_user", placeHolderData); await EstablishmentProduct.bulkCreate( p.productIds.map(pid => ({ @@ -1479,8 +1518,10 @@ exports.establishmentBulkUpload = async (req, res) => { await transaction.commit(); transaction = null; // Set to null after commit - // Clean up file after successful commit - fs.unlinkSync(filePath); + // Clean up file after successful commit (safe) + if (filePath && fs.existsSync(filePath)) { + try { fs.unlinkSync(filePath); } catch (e) { logger.error("File cleanup error: " + e.message); } + } return res.status(200).send({ status: "success", @@ -1514,7 +1555,7 @@ exports.establishmentBulkUpload = async (req, res) => { // Log detailed error information logger.error("Fatal Error in bulk upload: " + err.message); - + if (err.name) { logger.error("Error Name: " + err.name); } @@ -1522,7 +1563,7 @@ exports.establishmentBulkUpload = async (req, res) => { // Handle Sequelize validation errors if (err.name === "SequelizeUniqueConstraintError" || err.name === "SequelizeValidationError") { logger.error("Validation Errors:"); - + if (err.errors && Array.isArray(err.errors)) { err.errors.forEach(validationError => { logger.error(` - Field: ${validationError.path}, Value: ${validationError.value}, Message: ${validationError.message}`); @@ -1543,7 +1584,7 @@ exports.establishmentBulkUpload = async (req, res) => { // Handle foreign key constraint errors if (err.name === "SequelizeForeignKeyConstraintError") { logger.error("Foreign Key Constraint Error: " + err.message); - + return res.status(400).send({ status: "failed", message: "Foreign key constraint error. Please check your reference data.", diff --git a/app/controllers/products.controller.js b/app/controllers/products.controller.js index f04f40f..584108b 100644 --- a/app/controllers/products.controller.js +++ b/app/controllers/products.controller.js @@ -45,9 +45,6 @@ exports.createProduct = async (req, res) => { message: `HS Code '${hs_code}' already exists.` }); } - - console.log(req.body,'Geetha') - req.body.created_by = req.user.id; const data = await Product.create(req.body); res.status(201).send({'status':"success",'message':"created successfully",'data': data }); @@ -150,122 +147,6 @@ exports.deleteProduct = async (req, res) => { } }; -// exports.uploadProductsFromCSV = async (req, res) => { -// try { -// // Check if file exists -// if (!req.file) { -// return res.status(400).send({ status: "failed", message: "No file uploaded" }); -// } - -// const filePath = req.file.path; - -// // Validate file type -// if (!req.file.originalname.endsWith(".csv")) { -// fs.unlinkSync(filePath); -// return res.status(400).send({ -// status: "failed", -// message: "Invalid file type. Only CSV files are allowed.", -// }); -// } - -// // Validate userId -// if (!req.body.userId || isNaN(req.body.userId)) { -// fs.unlinkSync(filePath); -// return res.status(400).send({ -// status: "failed", -// message: "Invalid or missing userId. Must be an integer.", -// }); -// } - -// const results = []; -// const userId = parseInt(req.body.userId); - -// console.log(userId, "userId"); - -// // Read CSV and clean headers/values -// fs.createReadStream(filePath) -// .pipe(csv()) -// .on("data", (row) => { -// // Trim all keys and values to handle spaces in header names or values -// const cleanRow = {}; -// for (const key in row) { -// cleanRow[key.trim()] = row[key] ? row[key].trim() : null; -// } -// results.push(cleanRow); -// }) -// .on("end", async () => { -// try { -// // Check for empty CSV -// if (results.length === 0) { -// fs.unlinkSync(filePath); -// return res.status(400).send({ -// status: "failed", -// message: "CSV file is empty or invalid.", -// }); -// } - -// console.log(results, "results"); - -// // Fetch existing products by hs_code -// const hsCodes = results.map((r) => r.hs_code); -// const existingProducts = await Product.findAll({ -// where: { hs_code: hsCodes }, -// }); - -// const existingHsCodes = existingProducts.map((p) => p.hs_code); - -// const toInsert = []; -// const duplicates = []; - -// // Process CSV rows -// for (const row of results) { -// const hsCode = row.hs_code?.trim(); -// const productName = row.product_name?.trim(); -// const description = row.hs_description?.trim(); - -// if (!hsCode || !productName) continue; // skip invalid rows - -// if (existingHsCodes.includes(hsCode)) { -// duplicates.push(hsCode); -// } else { -// toInsert.push({ -// hs_code: hsCode, -// product_name: productName, -// hs_description: description, -// created_by: userId, -// created_at: new Date(), -// }); -// } -// } - -// // Bulk insert new records -// let inserted = []; -// if (toInsert.length > 0) { -// inserted = await Product.bulkCreate(toInsert, { validate: true }); -// } - -// // Delete file after processing -// fs.unlinkSync(filePath); - -// // Send success response -// return res.status(200).send({ -// status: "success", -// message: `${inserted.length} products inserted successfully.`, -// inserted_count: inserted.length, -// duplicate_hs_codes: duplicates, -// }); -// } catch (err) { -// if (fs.existsSync(filePath)) fs.unlinkSync(filePath); -// return res.status(500).send({ -// status: "failed", -// message: err.message, -// }); -// } -// }); -// } catch (error) { -// return res.status(500).send({ status: "failed", message: error.message }); -// } -// }; exports.downloadProductSample = async (req, res) => { try { @@ -282,30 +163,42 @@ exports.uploadProductsFromCSV = async (req, res) => { return res.status(400).send({ status: "failed", message: "No file uploaded" }); } - const filePath = req.file.path; + const uploadedPath = path.resolve(req.file.path); - if (!req.file.originalname.endsWith(".csv")) { - fs.unlinkSync(filePath); +// Automatically detect the multer uploads folder +const uploadDir = path.resolve(path.dirname(uploadedPath)); + +// Validate the path stays inside multer's directory +if (!uploadedPath.startsWith(uploadDir)) { + if (fs.existsSync(uploadedPath)) fs.unlinkSync(uploadedPath); + return res.status(400).send({ + status: "failed", + message: "Invalid file path detected." + }); +} + +// Use the real safe path +const filePath = uploadedPath; + /** END SAFE FIX --------------------------------------- */ + + // Validate file extension + if (!req.file.originalname.toLowerCase().endsWith(".csv")) { + if (fs.existsSync(filePath)) fs.unlinkSync(filePath); return res.status(400).send({ status: "failed", message: "Invalid file type. Only CSV allowed." }); } if (!req.user.id || isNaN(req.user.id)) { - fs.unlinkSync(filePath); + if (fs.existsSync(filePath)) fs.unlinkSync(filePath); return res.status(400).send({ status: "failed", message: "Invalid or missing User Id." }); } - const mode = req.body.mode?.toLowerCase() || "add"; - if (mode !== "add") { - fs.unlinkSync(filePath); - return res.status(400).send({ status: "failed", message: "Only 'Add Only' mode is supported currently." }); - } const results = []; const userId = parseInt(req.user.id); const stats = fs.statSync(filePath); if (stats.size === 0) { - fs.unlinkSync(filePath); + if (fs.existsSync(filePath)) fs.unlinkSync(filePath); return res.status(400).send({ status: "failed", message: "Uploaded file is empty.", @@ -317,16 +210,15 @@ exports.uploadProductsFromCSV = async (req, res) => { .on("data", (row) => { const cleanRow = {}; - // Normalize headers and smart-map them for (const key in row) { const normalizedKey = key.replace(/[\s\W]+/g, "_").trim().toLowerCase(); let mappedKey = normalizedKey; if (/^hs.*code$/.test(normalizedKey) || normalizedKey === "hscode") { mappedKey = "hs_code"; - } else if (/^product.*name$/.test(normalizedKey) || /^produc.*tname$/.test(normalizedKey)) { + } else if (/^product.*name$/.test(normalizedKey)) { mappedKey = "product_name"; - } else if (/^unit[s]?$/.test(normalizedKey) || /measurement|uom|measure/i.test(normalizedKey)) { + } else if (/unit|measurement|uom|measure/i.test(normalizedKey)) { mappedKey = "unit"; } @@ -338,28 +230,29 @@ exports.uploadProductsFromCSV = async (req, res) => { .on("end", async () => { try { if (results.length === 0) { - fs.unlinkSync(filePath); + if (fs.existsSync(filePath)) fs.unlinkSync(filePath); return res.status(400).send({ status: "failed", message: "CSV file is empty or invalid." }); } const requiredCols = ["hs_code", "product_name", "unit"]; const headers = Object.keys(results[0]); - const missingCols = requiredCols.filter((col) => !headers.includes(col)); - const extraCols = headers.filter((col) => !requiredCols.includes(col)); + const missingCols = requiredCols.filter(col => !headers.includes(col)); + const extraCols = headers.filter(col => !requiredCols.includes(col)); if (missingCols.length > 0 || extraCols.length > 0) { - fs.unlinkSync(filePath); - let message = ""; - if (missingCols.length > 0) message += `Missing required columns: ${missingCols.join(", ")}. `; - if (extraCols.length > 0) message += `Unexpected columns found: ${extraCols.join(", ")}. Only 'HS Code', 'Product Name', and 'Unit' are allowed.`; - return res.status(400).send({ status: "failed", message: message.trim() }); + if (fs.existsSync(filePath)) fs.unlinkSync(filePath); + return res.status(400).send({ + status: "failed", + message: + `${missingCols.length ? `Missing columns: ${missingCols.join(", ")}. ` : ""}` + + `${extraCols.length ? `Unexpected columns: ${extraCols.join(", ")}.` : ""}` + }); } - // Validate and normalize data const normalizedRows = []; - const fileDuplicates = new Set(); const seenHsCodes = new Set(); + const fileDuplicates = new Set(); const errors = []; for (let [index, row] of results.entries()) { @@ -378,7 +271,7 @@ exports.uploadProductsFromCSV = async (req, res) => { } if (hsCode.length > 10) { - errors.push({ row: index + 1, error: "HS Code must be 10 digits" }); + errors.push({ row: index + 1, error: "HS Code must be max 10 digits" }); continue; } @@ -393,26 +286,27 @@ exports.uploadProductsFromCSV = async (req, res) => { } if (fileDuplicates.size > 0) { - fs.unlinkSync(filePath); + if (fs.existsSync(filePath)) fs.unlinkSync(filePath); return res.status(400).send({ status: "failed", message: "Duplicate HS Codes found within file. Resolve and re-upload.", - duplicate_hs_codes_in_file: [...fileDuplicates], + duplicate_hs_codes_in_file: [...fileDuplicates] }); } const unitMasters = await UnitMaster.findAll({ attributes: ["id", "uom"] }); const unitMap = {}; - unitMasters.forEach((u) => (unitMap[u.uom.trim().toLowerCase()] = u.id)); + unitMasters.forEach(u => (unitMap[u.uom.trim().toLowerCase()] = u.id)); const existingProducts = await Product.findAll({ attributes: ["hs_code"] }); - const existingSet = new Set(existingProducts.map((p) => p.hs_code.replace(/^0+/, ""))); + const existingSet = new Set(existingProducts.map(p => p.hs_code.replace(/^0+/, ""))); const toInsert = []; const duplicates = []; for (const row of normalizedRows) { const normalizedHs = row.hsCode.replace(/^0+/, ""); + if (existingSet.has(normalizedHs)) { duplicates.push(row.hsCode); continue; @@ -438,18 +332,17 @@ exports.uploadProductsFromCSV = async (req, res) => { inserted = await Product.bulkCreate(toInsert, { validate: true }); } - fs.unlinkSync(filePath); + if (fs.existsSync(filePath)) fs.unlinkSync(filePath); let finalStatus = "success"; let message = `${inserted.length} products inserted successfully.`; if (errors.length > 0 || duplicates.length > 0) { finalStatus = inserted.length > 0 ? "partial_success" : "failed"; - if (finalStatus === "partial_success") { - message = `${inserted.length} products inserted, ${duplicates.length} duplicates skipped, ${errors.length} validation errors found.`; - } else { - message = `No products imported. ${duplicates.length} duplicates and ${errors.length} validation errors found.`; - } + message = + finalStatus === "partial_success" + ? `${inserted.length} inserted, ${duplicates.length} duplicates skipped, ${errors.length} validation errors.` + : `No products imported. ${duplicates.length} duplicates and ${errors.length} validation errors.`; } return res.status(200).send({ @@ -468,8 +361,8 @@ exports.uploadProductsFromCSV = async (req, res) => { return res.status(500).send({ status: "failed", message: err.message }); } }); + } catch (error) { return res.status(500).send({ status: "failed", message: error.message }); } }; -