PII issues fixes with backward compatibility [MOSIP-44379]

db_scripts/mosip_prereg/ddl.sql

@@ -17,6 +17,7 @@
 \ir ddl/reg_available_slot.sql
 \ir ddl/otp_transaction.sql
 \ir ddl/applications.sql
+\ir ddl/user_details.sql
 \ir ddl/fk.sql
 \ir ddl/batch-fk.sql
 \ir ddl/anonymous_profile.sql

db_scripts/mosip_prereg/ddl/user_details.sql

@@ -0,0 +1,31 @@
+-- ================================================================================================
+-- MOSIP Pre-Registration PII Security: Canonical User Registry Table
+-- Purpose: Centralized surrogate user ID mapping for cr_by/upd_by/cr_appuser_id
+-- ================================================================================================
+-- This table eliminates plaintext PII replication across the tables
+-- Stores: hash(authUserId) -> UUID surrogate mapping + encrypted original for notifications/audit
+-- Usage:
+--   1. Resolve: hash(authUserId) -> user_id (fast lookup)
+--   2. Store: user_id in cr_by/upd_by/cr_appuser_id/contact_info fields(instead of plaintext)
+--   3. Recover: decrypt from user_details for notifications/audit
+
+-- ========== CREATE TABLE: Canonical User Registry ==========
+
+CREATE TABLE IF NOT EXISTS prereg.user_details (
+    user_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    identifier_hash VARCHAR(128) NOT NULL UNIQUE,
+    identifier_encrypted TEXT NOT NULL,
+    cr_dtimes TIMESTAMP NOT NULL,
+    encrypted_dtimes TIMESTAMP NOT NULL
+);
+
+
+-- ========== CREATE INDEXES ==========
+
+CREATE INDEX IF NOT EXISTS idx_user_details_cr_dtimes
+  ON prereg.user_details (cr_dtimes);
+
+CREATE INDEX IF NOT EXISTS idx_user_details_encrypted_dtimes
+  ON prereg.user_details (encrypted_dtimes);
+
+-- ================================================================================================

db_upgrade_scripts/mosip_prereg/sql/1.3.0_to_1.3.1_rollback.sql

@@ -0,0 +1,25 @@
+\c mosip_prereg
+-- Rollback script from 1.3.1 to 1.3.0
+-- ------------------------------------------------------------------------------------------
+-- Removes the canonical user registry table (prereg.user_details) introduced in 1.3.1.
+--
+-- !! ONE-WAY MIGRATION — READ BEFORE RUNNING !!
+-- The 1.3.1 identity migration rewrites cr_by / upd_by / cr_appuser_id / contact_info across
+-- applications, applicant_demographic, applicant_document and reg_appointment from the raw
+-- identifier to a surrogate UUID. The ONLY reverse mapping (UUID -> encrypted original identifier)
+-- lives in prereg.user_details. Dropping this table therefore ORPHANS every migrated UUID: the
+-- raw identifier can no longer be recovered, and an older (pre-1.3.1) application build — which
+-- compares the raw auth userId directly against these columns — will fail all ownership checks,
+-- silently hiding applicants' own records from them.
+--
+-- Safe to run ONLY if the identity migration has not yet populated any ownership column with a
+-- UUID (i.e. immediately after upgrade, before any login/create/book/update traffic). If migrated
+-- data exists, do NOT roll back with this script alone — the UUID columns must first be reverted
+-- to their raw values (requires decrypting identifier_encrypted from user_details BEFORE this drop).
+-- WARNING: This will permanently delete all surrogate UUID mappings stored in this table.
+-- ------------------------------------------------------------------------------------------
+
+DROP INDEX IF EXISTS prereg.idx_user_details_encrypted_dtimes;
+DROP INDEX IF EXISTS prereg.idx_user_details_cr_dtimes;
+
+DROP TABLE IF EXISTS prereg.user_details;

db_upgrade_scripts/mosip_prereg/sql/1.3.0_to_1.3.1_upgrade.sql

@@ -0,0 +1,27 @@
+\c mosip_prereg
+-- Upgrade script from 1.3.0 to 1.3.1
+-- ------------------------------------------------------------------------------------------
+-- Introduces canonical user registry table (prereg.user_details) for PII security.
+-- Eliminates plaintext PII replication across cr_by/upd_by/cr_appuser_id fields by
+-- storing a hash->UUID surrogate mapping with encrypted original for audit/notifications.
+--
+-- NOTE: This is a ONE-WAY migration. Once ownership columns are rewritten to surrogate UUIDs,
+-- prereg.user_details holds the only reverse mapping back to the raw identifier. See
+-- 1.3.0_to_1.3.1_rollback.sql for the constraints on rolling this back safely.
+-- ------------------------------------------------------------------------------------------
+
+CREATE TABLE IF NOT EXISTS prereg.user_details (
+    user_id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    identifier_hash VARCHAR(128) NOT NULL UNIQUE,
+    identifier_encrypted TEXT NOT NULL,
+    cr_dtimes TIMESTAMP NOT NULL,
+    encrypted_dtimes TIMESTAMP NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_user_details_cr_dtimes
+  ON prereg.user_details (cr_dtimes);
+
+CREATE INDEX IF NOT EXISTS idx_user_details_encrypted_dtimes
+  ON prereg.user_details (encrypted_dtimes);
+
+GRANT SELECT, INSERT, UPDATE, DELETE, REFERENCES ON prereg.user_details TO prereguser;

pre-registration/pre-registration-application-service/pom.xml

@@ -346,4 +346,4 @@
 			</build>
 		</profile>
 	</profiles>
-</project>
+</project>

pre-registration/pre-registration-application-service/src/main/java/io/mosip/preregistration/application/controller/LoginController.java

@@ -39,6 +39,7 @@
 import io.mosip.preregistration.core.common.dto.MainResponseDTO;
 import io.mosip.preregistration.core.config.LoggerConfiguration;
 import io.mosip.preregistration.core.util.DataValidationUtil;
+import io.mosip.preregistration.core.util.GenericUtil;
 import io.mosip.preregistration.core.util.RequestValidator;
 import io.swagger.annotations.ApiParam;
 import io.swagger.v3.oas.annotations.Operation;
@@ -180,7 +181,8 @@ public ResponseEntity<MainResponseDTO<AuthNResponse>> validateWithUserIdOtp(
 			@Validated @RequestBody MainRequestDTO<User> userIdOtpRequest, @ApiParam(hidden = true) Errors errors,
 			HttpServletResponse res, HttpServletRequest req) {
 
-		log.debug(LOGGER_SESSIONID, LOGGER_IDTYPE, LOGGER_ID, "User ID: "+ userIdOtpRequest.getRequest().getUserId());
+		log.debug(LOGGER_SESSIONID, LOGGER_IDTYPE, LOGGER_ID,
+				"User ID: " + GenericUtil.maskIdentifier(userIdOtpRequest.getRequest().getUserId()));
 		loginValidator.validateId(VALIDATEOTP, userIdOtpRequest.getId(), errors);
 		DataValidationUtil.validate(errors, VALIDATEOTP);
 		MainResponseDTO<AuthNResponse> responseBody = loginService.validateWithUserIdOtp(userIdOtpRequest);
@@ -263,4 +265,4 @@ public ResponseEntity<MainResponseDTO<?>> sendOtpWithCaptcha(
 		}
 		return new ResponseEntity<>(response, HttpStatus.OK);
 	}
-}
+}

pre-registration/pre-registration-application-service/src/main/java/io/mosip/preregistration/application/errorcodes/AppointmentErrorCodes.java

@@ -16,7 +16,9 @@ public enum AppointmentErrorCodes {
 
 	FAILED_TO_UPDATE_APPLICATIONS("PRG_APP_BCK_07","Failed to update Appointment for the %s"),
 
-	INVALID_APP_ID_FOR_USER("PRG_APP_BCK_08", "Requested application id does not belong to the user");
+	INVALID_APP_ID_FOR_USER("PRG_APP_BCK_08", "Requested application id does not belong to the user"),
+
+	FAILED_TO_RESOLVE_USER_IDENTITY("PRG_APP_BCK_09", "Failed to resolve the canonical user identity");
 
 	private String code;
 	private String message;

pre-registration/pre-registration-application-service/src/main/java/io/mosip/preregistration/application/errorcodes/DocumentErrorCodes.java

@@ -114,6 +114,10 @@ public enum DocumentErrorCodes {
 	/**
 	 * ErrorCode for Password Protection files
 	 */
-	PRG_PAM_DOC_025;
+	PRG_PAM_DOC_025,
+	/**
+	 * ErrorCode for IDENTITY_RESOLUTION_FAILED
+	 */
+	PRG_PAM_DOC_026;
 
 }

pre-registration/pre-registration-application-service/src/main/java/io/mosip/preregistration/application/errorcodes/DocumentErrorMessages.java

@@ -137,7 +137,11 @@ public enum DocumentErrorMessages {
 	/**
 	 * ErrorMessage for Password Protection files
 	 */
-	PASSWORD_PROTECTION_ERROR("Password-protected file is not allowed for upload");
+	PASSWORD_PROTECTION_ERROR("Password-protected file is not allowed for upload"),
+	/**
+	 * ErrorMessage for IDENTITY_RESOLUTION_FAILED
+	 */
+	IDENTITY_RESOLUTION_FAILED ("Failed to resolve effective user identity");
 
 	private DocumentErrorMessages(String message) {
 		this.message = message;

pre-registration/pre-registration-application-service/src/main/java/io/mosip/preregistration/application/repository/ApplicationRepostiory.java

@@ -37,5 +37,11 @@ public List<ApplicationEntity> findByRegistrationCenterIdAndBetweenDate(String r
 
 	@Query("SELECT e FROM ApplicationEntity e  WHERE e.crBy= ?1 and e.bookingType= ?2 order by e.crDtime desc")
 	public List<ApplicationEntity> findByCreatedByBookingType(String userId, String bookingType);
+
+	@Query("SELECT e FROM ApplicationEntity e WHERE e.crBy IN ?1 order by e.crDtime desc")
+	public List<ApplicationEntity> findByCreatedByIn(List<String> userIds);
+
+	@Query("SELECT e FROM ApplicationEntity e WHERE e.crBy IN ?1 and e.bookingType= ?2 order by e.crDtime desc")
+	public List<ApplicationEntity> findByCreatedByInBookingType(List<String> userIds, String bookingType);
 
 }

pre-registration/pre-registration-application-service/src/main/java/io/mosip/preregistration/application/repository/DemographicRepository.java

@@ -43,6 +43,9 @@ public interface DemographicRepository extends BaseRepository<DemographicEntity,
 	public List<DemographicEntity> findByCreatedBy(@Param("userId") String userId,
 			@Param("statusCode") String statusCode);
 
+	public List<DemographicEntity> findByCreatedByInAndStatusCode(@Param("userIds") List<String> userIds,
+			@Param("statusCode") String statusCode);
+
 	/**
 	 * @param userId
 	 *            pass userId
@@ -55,6 +58,9 @@ public List<DemographicEntity> findByCreatedBy(@Param("userId") String userId,
 	public Page<DemographicEntity> findByCreatedByOrderByCreateDateTime(@Param("userId") String userId,
 			@Param("statusCode") String statusCode, Pageable pageable);
 
+	public Page<DemographicEntity> findByCreatedByInAndStatusCodeOrderByCreateDateTime(
+			@Param("userIds") List<String> userIds, @Param("statusCode") String statusCode, Pageable pageable);
+
 	/**
 	 * @param preRegId
 	 *            pass preRegId

pre-registration/pre-registration-application-service/src/main/java/io/mosip/preregistration/application/repository/RegAppointmentRepository.java

@@ -0,0 +1,15 @@
+package io.mosip.preregistration.application.repository;
+
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+
+import io.mosip.kernel.core.dataaccess.spi.repository.BaseRepository;
+import io.mosip.preregistration.core.common.entity.RegistrationBookingEntity;
+
+@Repository("regAppointmentRepository")
+public interface RegAppointmentRepository extends BaseRepository<RegistrationBookingEntity, String> {
+
+	@Query("SELECT e FROM RegistrationBookingEntity e WHERE e.preregistrationId = ?1")
+	RegistrationBookingEntity getRegistrationAppointmentByPreRegistrationId(@Param("preRegId") String preRegId);
+}