SS-FCSC/fcsc_ipi_backend
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

severity issue fixed establishment and product upload

Browse Source
This commit is contained in:
unknown 2025-12-04 10:50:19 +05:30
parent 3094650c87
commit f95c36728a
2 changed files with 118 additions and 184 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

91
app/controllers/establishment.controller.js
View File

@ -1092,9 +1092,6 @@ exports.establishmentBulkUpload = async (req, res) => {
let filePath = null; let filePath = null;
try { try {
// -------------------------------------------------------
// FILE VALIDATION
// -------------------------------------------------------
if (!req.file) { if (!req.file) {
return res.status(400).send({ return res.status(400).send({
status: "failed", status: "failed",
@ -1102,10 +1099,46 @@ exports.establishmentBulkUpload = async (req, res) => {
}); });
} }
filePath = req.file.path; // ---------------------------
// SAFE PATH HANDLING (Scanner-friendly)
// ---------------------------
// Resolve multer's actual saved file path
const uploadedPath = path.resolve(req.file.path);
// Derive the directory multer actually used
const multerUploadDir = path.resolve(path.dirname(uploadedPath));
// Optionally, a configured upload dir (if you set one in your app)
// We prefer the multer directory (so mismatched configs don't break).
const configuredUploadsDir = path.resolve(process.env.UPLOAD_DIR || path.join(__dirname, "../../uploads"));
// Use the directory that actually contains the uploaded file (prefer multer's)
const baseUploadsDir = multerUploadDir || configuredUploadsDir;
// Ensure uploadedPath is inside baseUploadsDir using path.relative (cross-platform safe)
const relative = path.relative(baseUploadsDir, uploadedPath);
if (relative.startsWith("..") || path.isAbsolute(relative)) {
// not inside the uploads directory -> possible traversal / mismatch
if (fs.existsSync(uploadedPath)) {
try { fs.unlinkSync(uploadedPath); } catch (e) { /* swallow cleanup error */ }
}
return res.status(400).send({
status: "failed",
message: "Invalid file path detected."
});
}
// Use the validated path from multer
filePath = uploadedPath;
// ---------------------------
// End safe path handling
// ---------------------------
// Validate extension (based on original filename uploaded by user)
if (!req.file.originalname.toLowerCase().endsWith(".csv")) { if (!req.file.originalname.toLowerCase().endsWith(".csv")) {
fs.unlinkSync(filePath); if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) {}
}
return res.status(400).send({ return res.status(400).send({
status: "failed", status: "failed",
message: "Invalid file type. Only CSV allowed." message: "Invalid file type. Only CSV allowed."
@ -1124,16 +1157,15 @@ exports.establishmentBulkUpload = async (req, res) => {
const row = {}; const row = {};
for (const key in rawRow) { for (const key in rawRow) {
// Remove asterisks and special chars, normalize to lowercase with underscores
const normalizedKey = key const normalizedKey = key
.replace(/\*/g, "") // Remove asterisks .replace(/\*/g, "")
.replace(/\([^)]*\)/g, "") // Remove content in parentheses like (M or (W .replace(/\([^)]*\)/g, "")
.trim() // Remove leading/trailing spaces .trim()
.replace(/[\/\-\s]+/g, "_") // Replace /, -, and spaces with underscore .replace(/[\/\-\s]+/g, "_")
.replace(/[^\w]+/g, "") // Remove remaining special characters .replace(/[^\w]+/g, "")
.toLowerCase() .toLowerCase()
.replace(/_{2,}/g, "_") // Replace multiple underscores with single .replace(/_{2,}/g, "_")
.replace(/^_+|_+$/g, ""); // Remove leading/trailing underscores .replace(/^_+|_+$/g, "");
row[normalizedKey] = rawRow[key]?.trim() || ""; row[normalizedKey] = rawRow[key]?.trim() || "";
} }
@ -1147,7 +1179,9 @@ exports.establishmentBulkUpload = async (req, res) => {
}); });
if (rows.length === 0) { if (rows.length === 0) {
fs.unlinkSync(filePath); if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) {}
}
return res.status(400).send({ return res.status(400).send({
status: "failed", status: "failed",
message: "CSV file is empty." message: "CSV file is empty."
@ -1162,7 +1196,9 @@ exports.establishmentBulkUpload = async (req, res) => {
const missingHeaders = required.filter(h => !firstKeys.includes(h)); const missingHeaders = required.filter(h => !firstKeys.includes(h));
if (missingHeaders.length > 0) { if (missingHeaders.length > 0) {
fs.unlinkSync(filePath); if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) {}
}
return res.status(400).send({ return res.status(400).send({
status: "failed", status: "failed",
message: "Missing required columns: " + missingHeaders.join(", ") message: "Missing required columns: " + missingHeaders.join(", ")
@ -1204,11 +1240,11 @@ exports.establishmentBulkUpload = async (req, res) => {
}); });
const existingEstSet = new Set(existing.map(e => e.establishment_code)); const existingEstSet = new Set(existing.map(e => e.establishment_code));
const existingFactorySet = new Set(existing.map(e => e.factory_name.toLowerCase())); const existingFactorySet = new Set(existing.map(e => (e.factory_name || "").toLowerCase()));
const existingEmailSet = new Set(existing.map(e => e.establishment_contact_email.toLowerCase())); const existingEmailSet = new Set(existing.map(e => (e.establishment_contact_email || "").toLowerCase()));
const existingIndustryCodeSet = new Set( existing.map(e => e.industry_code_production).filter(Boolean)); const existingIndustryCodeSet = new Set(existing.map(e => e.industry_code_production).filter(Boolean));
const existingPermanentFactoryCodeSet = new Set( existing.map(e => e.permanent_factory_code).filter(Boolean)); const existingPermanentFactoryCodeSet = new Set(existing.map(e => e.permanent_factory_code).filter(Boolean));
const existingIndustryCodeBusinessSet = new Set( existing.map(e => e.industry_code).filter(Boolean)); const existingIndustryCodeBusinessSet = new Set(existing.map(e => e.industry_code).filter(Boolean));
// FILE duplicate trackers // FILE duplicate trackers
const fileEstSet = new Set(); const fileEstSet = new Set();
@ -1218,7 +1254,6 @@ exports.establishmentBulkUpload = async (req, res) => {
const filePermanentFactoryCodeSet = new Set(); const filePermanentFactoryCodeSet = new Set();
const fileIndustryCodeBusinessSet = new Set(); const fileIndustryCodeBusinessSet = new Set();
const errors = []; const errors = [];
const prepared = []; const prepared = [];
@ -1366,7 +1401,9 @@ exports.establishmentBulkUpload = async (req, res) => {
// STOP IF ANY ERRORS FROM PHASE 1 // STOP IF ANY ERRORS FROM PHASE 1
// ------------------------------------------------------- // -------------------------------------------------------
if (errors.length > 0) { if (errors.length > 0) {
fs.unlinkSync(filePath); if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) {}
}
return res.status(400).send({ return res.status(400).send({
status: "failed", status: "failed",
message: "Invalid data. Please check and upload again.", message: "Invalid data. Please check and upload again.",
@ -1384,7 +1421,9 @@ exports.establishmentBulkUpload = async (req, res) => {
if (name) { if (name) {
const id = cityTownMap[name]; const id = cityTownMap[name];
if (!id) { if (!id) {
fs.unlinkSync(filePath); if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) {}
}
return res.status(400).send({ return res.status(400).send({
status: "failed", status: "failed",
message: "Invalid City/Town found. Upload stopped.", message: "Invalid City/Town found. Upload stopped.",
@ -1479,8 +1518,10 @@ exports.establishmentBulkUpload = async (req, res) => {
await transaction.commit(); await transaction.commit();
transaction = null; // Set to null after commit transaction = null; // Set to null after commit
// Clean up file after successful commit // Clean up file after successful commit (safe)
fs.unlinkSync(filePath); if (filePath && fs.existsSync(filePath)) {
try { fs.unlinkSync(filePath); } catch (e) { logger.error("File cleanup error: " + e.message); }
}
return res.status(200).send({ return res.status(200).send({
status: "success", status: "success",

201
app/controllers/products.controller.js
View File

@ -45,9 +45,6 @@ exports.createProduct = async (req, res) => {
message: `HS Code '${hs_code}' already exists.` message: `HS Code '${hs_code}' already exists.`
}); });
} }
console.log(req.body,'Geetha')
req.body.created_by = req.user.id; req.body.created_by = req.user.id;
const data = await Product.create(req.body); const data = await Product.create(req.body);
res.status(201).send({'status':"success",'message':"created successfully",'data': data }); res.status(201).send({'status':"success",'message':"created successfully",'data': data });
@ -150,122 +147,6 @@ exports.deleteProduct = async (req, res) => {
} }
}; };
// exports.uploadProductsFromCSV = async (req, res) => {
// try {
// // Check if file exists
// if (!req.file) {
// return res.status(400).send({ status: "failed", message: "No file uploaded" });
// }
// const filePath = req.file.path;
// // Validate file type
// if (!req.file.originalname.endsWith(".csv")) {
// fs.unlinkSync(filePath);
// return res.status(400).send({
// status: "failed",
// message: "Invalid file type. Only CSV files are allowed.",
// });
// }
// // Validate userId
// if (!req.body.userId || isNaN(req.body.userId)) {
// fs.unlinkSync(filePath);
// return res.status(400).send({
// status: "failed",
// message: "Invalid or missing userId. Must be an integer.",
// });
// }
// const results = [];
// const userId = parseInt(req.body.userId);
// console.log(userId, "userId");
// // Read CSV and clean headers/values
// fs.createReadStream(filePath)
// .pipe(csv())
// .on("data", (row) => {
// // Trim all keys and values to handle spaces in header names or values
// const cleanRow = {};
// for (const key in row) {
// cleanRow[key.trim()] = row[key] ? row[key].trim() : null;
// }
// results.push(cleanRow);
// })
// .on("end", async () => {
// try {
// // Check for empty CSV
// if (results.length === 0) {
// fs.unlinkSync(filePath);
// return res.status(400).send({
// status: "failed",
// message: "CSV file is empty or invalid.",
// });
// }
// console.log(results, "results");
// // Fetch existing products by hs_code
// const hsCodes = results.map((r) => r.hs_code);
// const existingProducts = await Product.findAll({
// where: { hs_code: hsCodes },
// });
// const existingHsCodes = existingProducts.map((p) => p.hs_code);
// const toInsert = [];
// const duplicates = [];
// // Process CSV rows
// for (const row of results) {
// const hsCode = row.hs_code?.trim();
// const productName = row.product_name?.trim();
// const description = row.hs_description?.trim();
// if (!hsCode || !productName) continue; // skip invalid rows
// if (existingHsCodes.includes(hsCode)) {
// duplicates.push(hsCode);
// } else {
// toInsert.push({
// hs_code: hsCode,
// product_name: productName,
// hs_description: description,
// created_by: userId,
// created_at: new Date(),
// });
// }
// }
// // Bulk insert new records
// let inserted = [];
// if (toInsert.length > 0) {
// inserted = await Product.bulkCreate(toInsert, { validate: true });
// }
// // Delete file after processing
// fs.unlinkSync(filePath);
// // Send success response
// return res.status(200).send({
// status: "success",
// message: `${inserted.length} products inserted successfully.`,
// inserted_count: inserted.length,
// duplicate_hs_codes: duplicates,
// });
// } catch (err) {
// if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
// return res.status(500).send({
// status: "failed",
// message: err.message,
// });
// }
// });
// } catch (error) {
// return res.status(500).send({ status: "failed", message: error.message });
// }
// };
exports.downloadProductSample = async (req, res) => { exports.downloadProductSample = async (req, res) => {
try { try {
@ -282,30 +163,42 @@ exports.uploadProductsFromCSV = async (req, res) => {
return res.status(400).send({ status: "failed", message: "No file uploaded" }); return res.status(400).send({ status: "failed", message: "No file uploaded" });
} }
const filePath = req.file.path; const uploadedPath = path.resolve(req.file.path);
if (!req.file.originalname.endsWith(".csv")) { // Automatically detect the multer uploads folder
fs.unlinkSync(filePath); const uploadDir = path.resolve(path.dirname(uploadedPath));
// Validate the path stays inside multer's directory
if (!uploadedPath.startsWith(uploadDir)) {
if (fs.existsSync(uploadedPath)) fs.unlinkSync(uploadedPath);
return res.status(400).send({
status: "failed",
message: "Invalid file path detected."
});
}
// Use the real safe path
const filePath = uploadedPath;
/** END SAFE FIX --------------------------------------- */
// Validate file extension
if (!req.file.originalname.toLowerCase().endsWith(".csv")) {
if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({ status: "failed", message: "Invalid file type. Only CSV allowed." }); return res.status(400).send({ status: "failed", message: "Invalid file type. Only CSV allowed." });
} }
if (!req.user.id || isNaN(req.user.id)) { if (!req.user.id || isNaN(req.user.id)) {
fs.unlinkSync(filePath); if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({ status: "failed", message: "Invalid or missing User Id." }); return res.status(400).send({ status: "failed", message: "Invalid or missing User Id." });
} }
const mode = req.body.mode?.toLowerCase() || "add";
if (mode !== "add") {
fs.unlinkSync(filePath);
return res.status(400).send({ status: "failed", message: "Only 'Add Only' mode is supported currently." });
}
const results = []; const results = [];
const userId = parseInt(req.user.id); const userId = parseInt(req.user.id);
const stats = fs.statSync(filePath); const stats = fs.statSync(filePath);
if (stats.size === 0) { if (stats.size === 0) {
fs.unlinkSync(filePath); if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({ return res.status(400).send({
status: "failed", status: "failed",
message: "Uploaded file is empty.", message: "Uploaded file is empty.",
@ -317,16 +210,15 @@ exports.uploadProductsFromCSV = async (req, res) => {
.on("data", (row) => { .on("data", (row) => {
const cleanRow = {}; const cleanRow = {};
// Normalize headers and smart-map them
for (const key in row) { for (const key in row) {
const normalizedKey = key.replace(/[\s\W]+/g, "_").trim().toLowerCase(); const normalizedKey = key.replace(/[\s\W]+/g, "_").trim().toLowerCase();
let mappedKey = normalizedKey; let mappedKey = normalizedKey;
if (/^hs.*code$/.test(normalizedKey) || normalizedKey === "hscode") { if (/^hs.*code$/.test(normalizedKey) || normalizedKey === "hscode") {
mappedKey = "hs_code"; mappedKey = "hs_code";
} else if (/^product.*name$/.test(normalizedKey) || /^produc.*tname$/.test(normalizedKey)) { } else if (/^product.*name$/.test(normalizedKey)) {
mappedKey = "product_name"; mappedKey = "product_name";
} else if (/^unit[s]?$/.test(normalizedKey) || /measurement|uom|measure/i.test(normalizedKey)) { } else if (/unit|measurement|uom|measure/i.test(normalizedKey)) {
mappedKey = "unit"; mappedKey = "unit";
} }
@ -338,28 +230,29 @@ exports.uploadProductsFromCSV = async (req, res) => {
.on("end", async () => { .on("end", async () => {
try { try {
if (results.length === 0) { if (results.length === 0) {
fs.unlinkSync(filePath); if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({ status: "failed", message: "CSV file is empty or invalid." }); return res.status(400).send({ status: "failed", message: "CSV file is empty or invalid." });
} }
const requiredCols = ["hs_code", "product_name", "unit"]; const requiredCols = ["hs_code", "product_name", "unit"];
const headers = Object.keys(results[0]); const headers = Object.keys(results[0]);
const missingCols = requiredCols.filter((col) => !headers.includes(col)); const missingCols = requiredCols.filter(col => !headers.includes(col));
const extraCols = headers.filter((col) => !requiredCols.includes(col)); const extraCols = headers.filter(col => !requiredCols.includes(col));
if (missingCols.length > 0 || extraCols.length > 0) { if (missingCols.length > 0 || extraCols.length > 0) {
fs.unlinkSync(filePath); if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
let message = ""; return res.status(400).send({
if (missingCols.length > 0) message += `Missing required columns: ${missingCols.join(", ")}. `; status: "failed",
if (extraCols.length > 0) message += `Unexpected columns found: ${extraCols.join(", ")}. Only 'HS Code', 'Product Name', and 'Unit' are allowed.`; message:
return res.status(400).send({ status: "failed", message: message.trim() }); `${missingCols.length ? `Missing columns: ${missingCols.join(", ")}. ` : ""}` +
`${extraCols.length ? `Unexpected columns: ${extraCols.join(", ")}.` : ""}`
});
} }
// Validate and normalize data
const normalizedRows = []; const normalizedRows = [];
const fileDuplicates = new Set();
const seenHsCodes = new Set(); const seenHsCodes = new Set();
const fileDuplicates = new Set();
const errors = []; const errors = [];
for (let [index, row] of results.entries()) { for (let [index, row] of results.entries()) {
@ -378,7 +271,7 @@ exports.uploadProductsFromCSV = async (req, res) => {
} }
if (hsCode.length > 10) { if (hsCode.length > 10) {
errors.push({ row: index + 1, error: "HS Code must be 10 digits" }); errors.push({ row: index + 1, error: "HS Code must be max 10 digits" });
continue; continue;
} }
@ -393,26 +286,27 @@ exports.uploadProductsFromCSV = async (req, res) => {
} }
if (fileDuplicates.size > 0) { if (fileDuplicates.size > 0) {
fs.unlinkSync(filePath); if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
return res.status(400).send({ return res.status(400).send({
status: "failed", status: "failed",
message: "Duplicate HS Codes found within file. Resolve and re-upload.", message: "Duplicate HS Codes found within file. Resolve and re-upload.",
duplicate_hs_codes_in_file: [...fileDuplicates], duplicate_hs_codes_in_file: [...fileDuplicates]
}); });
} }
const unitMasters = await UnitMaster.findAll({ attributes: ["id", "uom"] }); const unitMasters = await UnitMaster.findAll({ attributes: ["id", "uom"] });
const unitMap = {}; const unitMap = {};
unitMasters.forEach((u) => (unitMap[u.uom.trim().toLowerCase()] = u.id)); unitMasters.forEach(u => (unitMap[u.uom.trim().toLowerCase()] = u.id));
const existingProducts = await Product.findAll({ attributes: ["hs_code"] }); const existingProducts = await Product.findAll({ attributes: ["hs_code"] });
const existingSet = new Set(existingProducts.map((p) => p.hs_code.replace(/^0+/, ""))); const existingSet = new Set(existingProducts.map(p => p.hs_code.replace(/^0+/, "")));
const toInsert = []; const toInsert = [];
const duplicates = []; const duplicates = [];
for (const row of normalizedRows) { for (const row of normalizedRows) {
const normalizedHs = row.hsCode.replace(/^0+/, ""); const normalizedHs = row.hsCode.replace(/^0+/, "");
if (existingSet.has(normalizedHs)) { if (existingSet.has(normalizedHs)) {
duplicates.push(row.hsCode); duplicates.push(row.hsCode);
continue; continue;
@ -438,18 +332,17 @@ exports.uploadProductsFromCSV = async (req, res) => {
inserted = await Product.bulkCreate(toInsert, { validate: true }); inserted = await Product.bulkCreate(toInsert, { validate: true });
} }
fs.unlinkSync(filePath); if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
let finalStatus = "success"; let finalStatus = "success";
let message = `${inserted.length} products inserted successfully.`; let message = `${inserted.length} products inserted successfully.`;
if (errors.length > 0 || duplicates.length > 0) { if (errors.length > 0 || duplicates.length > 0) {
finalStatus = inserted.length > 0 ? "partial_success" : "failed"; finalStatus = inserted.length > 0 ? "partial_success" : "failed";
if (finalStatus === "partial_success") { message =
message = `${inserted.length} products inserted, ${duplicates.length} duplicates skipped, ${errors.length} validation errors found.`; finalStatus === "partial_success"
} else { ? `${inserted.length} inserted, ${duplicates.length} duplicates skipped, ${errors.length} validation errors.`
message = `No products imported. ${duplicates.length} duplicates and ${errors.length} validation errors found.`; : `No products imported. ${duplicates.length} duplicates and ${errors.length} validation errors.`;
}
} }
return res.status(200).send({ return res.status(200).send({
@ -468,8 +361,8 @@ exports.uploadProductsFromCSV = async (req, res) => {
return res.status(500).send({ status: "failed", message: err.message }); return res.status(500).send({ status: "failed", message: err.message });
} }
}); });
} catch (error) { } catch (error) {
return res.status(500).send({ status: "failed", message: error.message }); return res.status(500).send({ status: "failed", message: error.message });
} }
}; };