Merge branch 'dev' into snyk-upgrade-226ddc85a5cfe7b7cb05070b8304f980

Author: seanmcilvenna

.github/workflows/pr-title-check.yml

@@ -30,8 +30,8 @@ jobs:
           } else {
             core.setFailed('Cannot determine PR title for validation.')
           }
-          const prTitleExpectedPattern = /(^LNK-\d+:\s)|(^TECH_DEBT:\s)|(^DOCS:\s)/g
-          const prTitleMismatchError = 'Invalid PR title "' + prTitle + '"! Must begin with LNK-nnnn:<space> or TECH_DEBT:<space> or DOCS:<space>, e.g. LNK-1234: My PR title, or TECH_DEBT: My PR title or DOCS: My PR title'
+          const prTitleExpectedPattern = /(^LNK-\d+:\s)|(^TECH_DEBT:\s)|(^DOCS:\s)|(^SNYK:\s)/g
+          const prTitleMismatchError = 'Invalid PR title "' + prTitle + '"! Must begin with LNK-nnnn:<space> or TECH_DEBT:<space> or DOCS:<space> or SNYK:<space>, e.g. LNK-1234: My PR title, or TECH_DEBT: My PR title or DOCS: My PR title or [Snyk] My PR title'
           if (!prTitleExpectedPattern.test(prTitle)) {
             // Fail the workflow
             console.log(prTitleMismatchError)

.github/workflows/snyk_pull_request_template.yaml

@@ -0,0 +1,13 @@
+title: "SNYK: {{ snyk_pull_request_type }} for {{ package_name }}"
+description: |
+  {{ #is_upgrade_pr }}
+  This PR has been opened by Snyk to make sure our repositories are kept up-to-date.
+  It updates **{{ package_name }}** from version {{ package_from }} to version {{ package_to }}.
+  Review relevant docs for possible breaking changes.
+  {{ /is_upgrade_pr }}
+  
+  {{ #is_fix_pr }}
+  This PR applies a fix for a vulnerability in **{{ package_name }}**.
+  {{ /is_fix_pr }}
+
+  **Issues Fixed:** {{ issue_count }}

DotNet/Admin.BFF/Application/Commands/Integration/KafkaConsumerService.cs

@@ -41,30 +41,21 @@ public void StartConsumer(string groupId, List<string> topics, string reportTrac
                         string traceId = string.Empty;
                         string errorMessage = null;
 
-                        if (consumeResult.Message.Headers.TryGetLastBytes("X-Correlation-Id",
-                                out var correlationHeader))
+                        if (consumeResult.Message.Headers.TryGetLastBytes("X-Correlation-Id", out var correlationHeader))
                         {
                             correlationId = System.Text.Encoding.UTF8.GetString(correlationHeader);
 
                             // read the exceptions
-                            if (consumeResult.Message.Headers.TryGetLastBytes("X-Exception-Message",
-                                    out var exceptionMessage))
-                            {
-                                errorMessage = System.Text.Encoding.UTF8.GetString(exceptionMessage);
-                            }
-
-                            else if (consumeResult.Message.Headers.TryGetLastBytes("X-Retry-Exception-Message",
-                                         out var retryExceptionMessage))
-                            {
-                                errorMessage = System.Text.Encoding.UTF8.GetString(retryExceptionMessage);
-                            }
-
-                            else if (consumeResult.Message.Headers.TryGetLastBytes("kafka_exception-message",
-                                         out var kafkaErrorBytes))
+                            
+                            if (TryReadHeader(consumeResult.Message.Headers, out var errorBytes,
+                                    "X-Exception-Message",
+                                    "X-Retry-Exception-Message",
+                                    "kafka_exception-message",
+                                    "kafka_dlt-exception-message"))
                             {
-                                errorMessage = System.Text.Encoding.UTF8.GetString(kafkaErrorBytes);
+                                errorMessage =  System.Text.Encoding.UTF8.GetString(errorBytes);
                             }
-
+                            
                             // Extract traceId from traceparent header
                             if (consumeResult.Message.Headers.TryGetLastBytes("traceparent", out var traceParentBytes))
                             {
@@ -155,6 +146,23 @@ public void StartConsumer(string groupId, List<string> topics, string reportTrac
             }
         }
 
+        private static bool TryReadHeader(
+            Headers headers,
+            out byte[] value,
+            params string[] keys)
+        {
+            foreach (var key in keys)
+            {
+                if (headers.TryGetLastBytes(key, out value))
+                {
+                    return true;
+                }
+            }
+
+            value = null!;
+            return false;
+        }
+        
         private bool checkReportTrackingId(string input, string reportTrackingId)
         {
             if (string.IsNullOrEmpty(input)) return false;

DotNet/Report/Domain/MongoIndexCreationService.cs

@@ -7,7 +7,7 @@ public class MongoIndexCreationService : BackgroundService
     {
         private readonly ILogger<MongoIndexCreationService> _logger;
         private readonly IServiceScopeFactory _serviceScopeFactory;
-        public MongoIndexCreationService(ILogger<MongoIndexCreationService> logger, IServiceScopeFactory factory) 
+        public MongoIndexCreationService(ILogger<MongoIndexCreationService> logger, IServiceScopeFactory factory)
         {
             _logger = logger;
             _serviceScopeFactory = factory;

DotNet/Report/Domain/Queries/SubmissionEntryQueries.cs

@@ -246,9 +246,11 @@ public async Task<bool> PatientAllReadyForValidation(
         string patientId,
         CancellationToken cancellationToken = default)
     {
-        return await (from entry in _context.PatientSubmissionEntries
-                      where entry.ReportScheduleId == reportScheduleId && entry.FacilityId == facilityId && entry.PatientId == patientId 
-                      select entry.Status).AllAsync(s => s == PatientSubmissionStatus.ReadyForValidation || s == PatientSubmissionStatus.NotReportable);
+        List<PatientSubmissionStatus> statuses = await (from entry in _context.PatientSubmissionEntries
+                                                        where entry.ReportScheduleId == reportScheduleId && entry.FacilityId == facilityId && entry.PatientId == patientId
+                                                        select entry.Status).ToListAsync(cancellationToken);
+        return statuses.All(s => s == PatientSubmissionStatus.ReadyForValidation || s == PatientSubmissionStatus.NotReportable) &&
+            statuses.Any(s => s == PatientSubmissionStatus.ReadyForValidation);
     }
 
     public async Task<PagedConfigModel<ResourceSummary>> GetResourceSummary(string facilityId, string reportScheduleId, ResourceType? resourceType, int pageSize, int pageNumber,

DotNet/Report/KafkaProducers/ReportManifestProducer.cs

@@ -235,7 +235,7 @@ private OperationOutcome CreateOperationOutcome(List<PatientSubmissionEntry> fai
                 // Assuming PatientSubmissionEntry has a ValidationMessage property; adjust as per actual model
                 operationOutcome.Issue.Add(new OperationOutcome.IssueComponent
                 {
-                    Severity = OperationOutcome.IssueSeverity.Fatal,
+                    Severity = OperationOutcome.IssueSeverity.Error,
                     Code = OperationOutcome.IssueType.Invalid,
                     Diagnostics = $"Validation failed for patient {entry.PatientId}"
                 });

DotNet/Report/Listeners/ValidationCompleteListener.cs

@@ -19,6 +19,7 @@
 using System.Text;
 using LantanaGroup.Link.Shared.Application.Services.Security;
 using Task = System.Threading.Tasks.Task;
+using Hl7.Fhir.Support;
 
 namespace LantanaGroup.Link.Report.Listeners
 {
@@ -190,18 +191,12 @@ public async Task ProcessMessageAsync(ConsumeResult<string, ValidationCompleteVa
                 throw new DeadLetterException($"No Patient Submission Entries were found for schedule ID {schedule.Id}, patient ID {value.PatientId}, in status {PatientSubmissionStatus.ValidationRequested}");
             }
 
+            var operationOutcome = GetOperationOutcome();
+
             foreach (var entry in submissionEntries)
             {
                 if (!value.IsValid)
                 {
-                    var operationOutcome = new OperationOutcome();
-                    var issue = new OperationOutcome.IssueComponent
-                    {
-                        Severity = OperationOutcome.IssueSeverity.Fatal,
-                        Code = OperationOutcome.IssueType.Invalid,
-                        Diagnostics = "Patient has failed Validation"
-                    };
-                    operationOutcome.Issue = new List<OperationOutcome.IssueComponent> { issue };
                     await submissionEntryManager.AddResourceAsync(entry, operationOutcome, ResourceCategoryType.Patient, cancellationToken);
                 }
 
@@ -269,6 +264,21 @@ await submissionEntryManager.UpdateAsync(new PatientSubmissionEntryUpdateModel
             await _reportManifestProducer.Produce(schedule, correlationIdStr);
         }
 
+        private static OperationOutcome GetOperationOutcome()
+        {
+            OperationOutcome operationOutcome = new()
+            {
+                Id = Guid.NewGuid().ToString()
+            };
+            operationOutcome.AddIssue(new OperationOutcome.IssueComponent
+            {
+                Severity = OperationOutcome.IssueSeverity.Error,
+                Code = OperationOutcome.IssueType.Invalid,
+                Diagnostics = "Patient has failed Validation"
+            });
+            return operationOutcome;
+        }
+
         private static string GetFacilityIdFromHeader(Headers headers)
         {
             string facilityId = string.Empty;

Java/measureeval/src/main/java/com/lantanagroup/link/measureeval/configs/SecurityConfig.java

@@ -3,6 +3,8 @@
 import com.lantanagroup.link.shared.auth.JwtAuthenticationEntryPoint;
 import com.lantanagroup.link.shared.auth.JwtAuthenticationFilter;
 import com.lantanagroup.link.shared.security.SecurityHelper;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.ComponentScan;
@@ -39,10 +41,20 @@ public SecurityFilterChain securityFilterChain (HttpSecurity http) throws Except
     }
   }
 
+    /**
+     * This class is necessary to support @PreAuthorize and @PostAuthorize when
+     * anonymous mode is enabled. The condition causes the Dummy class to get registered
+     * and for the @EnableMethodSecurity to be applied, which affects all classes, enabling @PreAuthorize/@PostAuthorize
+     */
   @ConditionalOnProperty(prefix = "authentication",
-          name = "enableAnonymousAccess",
+          name = "anonymous",
           havingValue = "false")
   @EnableMethodSecurity(prePostEnabled = true)
   static class Dummy {
+      private static final Logger logger = LoggerFactory.getLogger(Dummy.class);
+
+      public Dummy() {
+          logger.info("Anonymous authentication disabled - @EnableMethodSecurity is being applied (authentication.anonymous=false)");
+      }
   }
 }

Java/measureeval/src/main/java/com/lantanagroup/link/measureeval/controllers/MeasureDefinitionController.java

@@ -31,7 +31,7 @@
 
 @RestController
 @RequestMapping("/api/measureeval/measure-definition")
-@PreAuthorize("hasRole('LinkUser')")
+@PreAuthorize("hasAnyRole('LinkUser', 'LinkAdministrator')")
 public class MeasureDefinitionController {
 
     private final Logger _logger = LoggerFactory.getLogger(MeasureDefinitionController.class);

Java/measureeval/src/main/java/com/lantanagroup/link/measureeval/controllers/PatientController.java

@@ -13,7 +13,7 @@
 
 @RestController
 @RequestMapping("/api/measureeval/patient")
-@PreAuthorize("hasRole('LinkUser')")
+@PreAuthorize("hasAnyRole('LinkUser', 'LinkAdministrator')")
 public class PatientController {
     private final PatientReportingEvaluationStatusRepository patientReportingEvaluationStatusRepository;
     private final PatientStatusBundler patientStatusBundler;