LNK-3039: Security Fixes (Dev)

DotNet/Account/Presentation/Endpoints/User/Handlers/CreateNewUser.cs

@@ -10,7 +10,7 @@ namespace LantanaGroup.Link.Account.Presentation.Endpoints.User.Handlers
 {
     public static class CreateNewUser
     {
-        public static async Task<IResult> Handle(HttpContext context, 
+        public static async Task<IResult> Handle(HttpContext context,
             LinkUserModel model, [FromServices] ILogger<UserEndpoints> logger, [FromServices] IGetUserByEmail queryUser, [FromServices] ICreateUser command)
         {
             try
@@ -22,22 +22,10 @@ public static async Task<IResult> Handle(HttpContext context,
 
                 //check if user with the same email exists
                 var existingUser = await queryUser.Execute(model.Email, context.RequestAborted);
+
                 if (existingUser is not null)
                 {
-                    var existingUriBuilder = new UriBuilder
-                    {
-                        Scheme = context.Request.Scheme,
-                        Host = context.Request.Host.Host,
-                        Path = $"api/account/user/{existingUser.Id}"
-                    };
-
-                    if (context.Request.Host.Port.HasValue)
-                    {
-                        existingUriBuilder.Port = context.Request.Host.Port.Value;
-                    }
-
-                    context.Response.Headers.Location = existingUriBuilder.ToString();
-                    return Results.Conflict("A user with the same email already exists.");
+                    return Results.Conflict("Invalid request.");
                 }
 
                 var requestor = context.User;
@@ -66,7 +54,7 @@ public static async Task<IResult> Handle(HttpContext context,
                 Activity.Current?.RecordException(ex);
                 logger.LogUserCreationException(ex.Message);
                 throw;
-            }            
-        }        
+            }
+        }
     }
-}
+}

DotNet/Census/Controllers/CensusConfigController.cs

@@ -2,7 +2,6 @@
 using LantanaGroup.Link.Census.Application.Models;
 using LantanaGroup.Link.Census.Application.Models.Exceptions;
 using LantanaGroup.Link.Census.Domain.Managers;
-using LantanaGroup.Link.Shared.Settings;
 using Link.Authorization.Policies;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
@@ -16,7 +15,7 @@ public class CensusConfigController : Controller
 {
     private readonly ILogger<CensusConfigController> _logger;
     private readonly ICensusConfigManager _censusConfigManager;
-    
+
     public CensusConfigController(ILogger<CensusConfigController> logger, ICensusConfigManager censusConfigManager)
     {
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
@@ -56,14 +55,15 @@ public async Task<IActionResult> Create([FromBody] CensusConfigModel censusConfi
         }
         catch (MissingTenantConfigurationException ex)
         {
-            _logger.LogError(ex.Message);
-
             return BadRequest(ex.Message);
         }
         catch (Exception ex)
         {
-            _logger.LogError(new EventId(LoggingIds.InsertItem, "Create Census Config"), ex, "An exception occurred while attempting to create an Census config with an id of {id}", censusConfig.FacilityId);
-            throw;
+            _logger.LogError(ex, "Exception encountered in CensusConfigController.Create");
+            return Problem(
+                detail: "An error occurred while processing your request.",
+                statusCode: StatusCodes.Status500InternalServerError
+            );
         }
     }
 
@@ -90,8 +90,11 @@ public async Task<ActionResult<CensusConfigModel>> Get(string facilityId)
         }
         catch (Exception ex)
         {
-            _logger.LogError(new EventId(LoggingIds.GetItem, "Get Census Config"), ex, "An exception occurred while attempting to get a Census config with an id of {id}", facilityId);
-            throw;
+            _logger.LogError(ex, "Exception encountered in CensusConfigController.Get");
+            return Problem(
+                detail: "An error occurred while processing your request.",
+                statusCode: StatusCodes.Status500InternalServerError
+            );
         }
     }
 
@@ -144,13 +147,15 @@ public async Task<ActionResult<CensusConfigModel>> Put([FromBody] CensusConfigMo
         }
         catch (MissingTenantConfigurationException ex)
         {
-            _logger.LogError(ex.Message);
             return BadRequest(ex.Message);
         }
         catch (Exception ex)
         {
-            _logger.LogError(new EventId(LoggingIds.UpdateItem, "Update Census Config"), ex, "An exception occurred while attempting to update a Census config with an id of {id}", facilityId);
-            throw;
+            _logger.LogError(ex, "Exception encountered in CensusConfigController.Put");
+            return Problem(
+                detail: "An error occurred while processing your request.",
+                statusCode: StatusCodes.Status500InternalServerError
+            );
         }
     }
 
@@ -175,8 +180,11 @@ public async Task<IActionResult> Delete(string facilityId)
         }
         catch (Exception ex)
         {
-            _logger.LogError(new EventId(LoggingIds.DeleteItem, "Delete Census Config"), ex, "An exception occurred while attempting to delete a Census config with an id of {id}", facilityId);
-            throw;
+            _logger.LogError(ex, "Exception encountered in CensusConfigController.Delete");
+            return Problem(
+                detail: "An error occurred while processing your request.",
+                statusCode: StatusCodes.Status500InternalServerError
+            );
         }
     }
-}
+}

DotNet/Census/Controllers/CensusController.cs

@@ -1,7 +1,6 @@
 using Hl7.Fhir.Model;
 using LantanaGroup.Link.Census.Domain.Entities;
 using LantanaGroup.Link.Census.Domain.Managers;
-using LantanaGroup.Link.Shared.Settings;
 using Link.Authorization.Policies;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
@@ -44,8 +43,8 @@ public async Task<ActionResult<IEnumerable<PatientCensusHistoricEntity>>> GetCen
         }
         catch (Exception ex)
         {
-            _logger.LogError(new EventId(LoggingIds.GetItem, "Get Census History"), ex, "An exception occurred while attempting to get census history with an id of {id}", facilityId);
-            throw;
+            _logger.LogError(ex, "Exception encountered in CensusController.GetCensusHistory");
+            return Problem(detail: ex.Message, statusCode: StatusCodes.Status500InternalServerError);
         }
     }
 
@@ -98,8 +97,10 @@ public async Task<ActionResult<IEnumerable<PatientCensusHistoricEntity>>> GetCen
         }
         catch (Exception ex)
         {
-            _logger.LogError(new EventId(LoggingIds.GetItem, "Get Admitted Patients"), ex, "An exception occurred while attempting to get admitted patients with an id of {id}", facilityId);
-            throw;
+            _logger.LogError(ex, "Exception encountered in CensusController.GetAdmittedPatients");
+            return Problem(
+                detail: "An error occurred while retrieving admitted patients.",
+                statusCode: StatusCodes.Status500InternalServerError);
         }
     }
 
@@ -129,8 +130,8 @@ public async Task<ActionResult<List<CensusPatientListEntity>>> GetCurrentCensus(
         }
         catch (Exception ex)
         {
-            _logger.LogError(new EventId(LoggingIds.GetItem, "Get Current Census"), ex, "An exception occurred while attempting to get current census with an id of {id}", facilityId);
-            throw;
+            _logger.LogError(ex, "Exception encountered in CensusController.GetCurrentCensus");
+            return Problem(detail: ex.Message, statusCode: StatusCodes.Status500InternalServerError);
         }
     }
 
@@ -155,8 +156,8 @@ public async Task<ActionResult<List<CensusPatientListEntity>>> GetAllPatientsFor
         }
         catch (Exception ex)
         {
-            _logger.LogError(new EventId(LoggingIds.GetItem, "Get All Patients For Facility"), ex, "An exception occurred while attempting to get All Patients For Facility with an id of {id}", facilityId);
-            throw;
+            _logger.LogError(ex, "Exception encountered in CensusController.GetAllPatientsForFacility");
+            return Problem(detail: ex.Message, statusCode: StatusCodes.Status500InternalServerError);
         }
     }
 }

DotNet/Census/Domain/Managers/CensusConfigManager.cs

@@ -4,7 +4,6 @@
 using LantanaGroup.Link.Census.Application.Models.Exceptions;
 using LantanaGroup.Link.Shared.Application.Repositories.Interfaces;
 using LantanaGroup.Link.Shared.Application.Services;
-using Microsoft.EntityFrameworkCore;
 using Quartz;
 
 namespace LantanaGroup.Link.Census.Domain.Managers;
@@ -70,26 +69,14 @@ await _censusConfigRepository.SingleOrDefaultAsync(c => c.FacilityID == entity.F
 
             try
             {
+                await _censusConfigRepository.UpdateAsync(existingEntity, cancellationToken);
+
                 await _censusSchedulingRepo.UpdateJobsForFacility(existingEntity,
                     await _schedulerFactory.GetScheduler(cancellationToken));
             }
             catch (Exception ex)
             {
-                var message =
-                    $"Error re-scheduling job for facility {existingEntity.FacilityID} {ex.Message}\n{ex.InnerException}\n{ex.Source}\n{ex.StackTrace}";
-                _logger.LogError(message, ex);
-                throw;
-            }
-
-            try
-            {
-                await _censusConfigRepository.UpdateAsync(existingEntity, cancellationToken);
-            }
-            catch (Exception ex)
-            {
-                var message =
-                    $"Error saving config for facility {existingEntity.FacilityID} {ex.Message}\n{ex.InnerException}\n{ex.Source}\n{ex.StackTrace}";
-                _logger.LogError(message, ex);
+                _logger.LogError(ex, "Exception in CensusConfigManager.AddOrUpdateCensusConfig");
                 throw;
             }
         }
@@ -106,26 +93,14 @@ await _censusSchedulingRepo.UpdateJobsForFacility(existingEntity,
 
             try
             {
+                await _censusConfigRepository.AddAsync(existingEntity, cancellationToken);
+
                 await _censusSchedulingRepo.AddJobForFacility(existingEntity,
                     await _schedulerFactory.GetScheduler(cancellationToken));
             }
             catch (Exception ex)
             {
-                var message =
-                    $"Error scheduling job for facility {existingEntity.FacilityID}\n{ex.Message}\n{ex.InnerException}\n{ex.Source}\n{ex.StackTrace}";
-                _logger.LogError(message, ex);
-                throw;
-            }
-
-            try
-            {
-                await _censusConfigRepository.AddAsync(existingEntity, cancellationToken);
-            }
-            catch (Exception ex)
-            {
-                //TODO: Daniel - doesn't do anything with the message
-                var message =
-                    $"Error saving config for facility {existingEntity.FacilityID} {ex.Message}\n{ex.InnerException}\n{ex.Source}\n{ex.StackTrace}";
+                _logger.LogError(ex, "Exception in CensusConfigManager.AddOrUpdateCensusConfig");
                 throw;
             }
         }

DotNet/Normalization/Application/Managers/NormalizationConfigManager.cs

@@ -68,7 +68,7 @@ public async Task<NormalizationConfig> SaveConfigEntity(SaveConfigEntityCommand
             }
             catch (Exception ex)
             {
-                _logger.LogError(ex, $"Error checking if facility ({request.FacilityId}) exists in Tenant Service.");
+                _logger.LogError(ex, "Exception in NormalizationConfigManager.SaveConfigEntity");
                 throw;
             }
 

DotNet/Normalization/Controllers/NormalizationController.cs

@@ -56,18 +56,19 @@ await _configManager.SaveConfigEntity(new SaveConfigEntityCommand
             }
             catch (ConfigOperationNullException ex) 
             {
-                _logger.LogError(ex.Message, ex);
                 return BadRequest(ex.Message);
             }
             catch(EntityAlreadyExistsException ex) 
             {
-                _logger.LogError(ex.Message, ex);
                 return BadRequest($"Entity for {config?.FacilityId} already exists. Please use PUT request to update.");
             }
             catch(Exception ex) 
             {
-                _logger.LogError(ex.Message, ex);
-                return StatusCode(StatusCodes.Status500InternalServerError);
+                _logger.LogError(ex, "Exception encountered in NormalizationController.StoreTenant");
+                return Problem(
+                    detail: "An error occurred while processing your request.",
+                    statusCode: StatusCodes.Status500InternalServerError
+                );
             }
 
             //await CreateAuditEvent(configModel, AuditEventType.Create);
@@ -96,13 +97,12 @@ public async Task<ActionResult<NormalizationConfig>> GetConfig(string facilityId
             }
             catch(NoEntityFoundException ex)
             {
-                _logger.LogError(ex.Message, ex);
                 return NotFound();
             }
             catch(Exception ex)
             {
-                var message = $"Internal Error for GET facility {facilityId}.";
-                _logger.LogError(message, ex);
+                _logger.LogError(ex, "Exception encountered in NormalizationController.GetConfig");
+                return Problem(detail: ex.Message, statusCode: StatusCodes.Status500InternalServerError);
             }
 
             return Ok(config);
@@ -146,17 +146,15 @@ await _configManager.SaveConfigEntity(new SaveConfigEntityCommand
             }
             catch (ConfigOperationNullException ex)
             {
-                _logger.LogError(ex.Message, ex);
                 return BadRequest(ex.Message);
             }
             catch (EntityAlreadyExistsException ex)
             {
-                _logger.LogError(ex.Message, ex);
                 return BadRequest($"Entity for {config?.FacilityId} already exists. Please use PUT request to update.");
             }
             catch (Exception ex)
             {
-                _logger.LogError(ex.Message, ex);
+                _logger.LogError(ex, "Exception encountered in NormalizationController.UpdateTenantNormalization");
                 return Problem(detail: ex.Message, statusCode: StatusCodes.Status500InternalServerError);
             }
 
@@ -186,17 +184,15 @@ public async Task<IActionResult> DeleteTenantNormalization(string facilityId)
             }
             catch (ConfigOperationNullException ex)
             {
-                _logger.LogError(ex.Message, ex);
                 return BadRequest(ex.Message);
             }
             catch (NoEntityFoundException ex)
             {
-                _logger.LogError(ex.Message, ex);
                 return NotFound(ex.Message);
             }
             catch(Exception ex)
             {
-                _logger.LogError(ex.Message, ex);
+                _logger.LogError(ex, "Exception encountered in NormalizationController.DeleteTenantNormalization");
                 return Problem(detail: ex.Message, statusCode: StatusCodes.Status500InternalServerError);
             }