d_s_bisht/devsofttech_hms_ci4
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(abdm): stop ABHA flow after Aadhaar-created account

Browse Source 
ABDM v3 creates the ABHA inside aadhaar/verify-otp when an alternate mobile is supplied. HMS then ran a standalone mobile OTP login, which returned whichever ABHA owned that number (e.g. the parent's) and overwrote the child's record. Skip that step when an ABHA number is returned and show the operator an explicit alternate-mobile status instead.
This commit is contained in:
DevSoftTech Server 2026-08-18 02:31:44 +05:30
parent 841b15d27b
commit 8be64239d5
2 changed files with 38 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/Controllers/Abha.php
View File

@ -161,10 +161,15 @@ class Abha extends BaseController
$patientInfo = $this->tryAutoLinkByDirectMatch($abhaNum, $name, $mobile, $profileGender, $profileDob, $abhaMeta);
// ABDM v3 creates/returns the ABHA inside Aadhaar verify-otp when an alternate
// mobile is supplied, so no further mobile OTP step may run for this person.
$abhaCreated = strlen($aadhaarVerifiedAbha) === 14;
$responseBase = [
'ok' => 1,
'txn_id' => $newTxnId,
'skip_mobile' => true,
'abha_created' => $abhaCreated,
'card_base64' => $this->extractAbhaCardData($result),
'card_content_type' => $this->resolveAbhaCardContentType($result),
'card_source' => $this->resolveAbhaCardSource($result),

36
app/Views/partials/abha_create_modal.php
View File

@ -247,7 +247,12 @@ window.AbhaCreateModal = (function () {
}
function escapeHtml(value) { return $('<div>').text(value == null ? '' : String(value)).html(); }
function apiMessage(response, fallback) {
return response && (response.error_text || response.message) ? escapeHtml(response.error_text || response.message) : fallback;
var message = response && (response.error_text || response.message)
? escapeHtml(response.error_text || response.message)
: fallback;
return response && response.request_id
? message + ' <small class="d-block mt-1">Bridge Request ID: ' + escapeHtml(response.request_id) + '</small>'
: message;
}
function alertBox(type, message) {
$('#abhaCreateAlert').html(message ? '<div class="alert alert-' + type + ' py-2">' + message + '</div>' : '');
@ -374,17 +379,40 @@ window.AbhaCreateModal = (function () {
stopTimers();
createdProfile = response;
createTxnId = response.txn_id || createTxnId;
if (communicationMobile && digits(response.mobile).slice(-10) !== communicationMobile) {
// ABDM already created this ABHA with the alternate mobile; requesting another
// mobile OTP here would return whichever ABHA owns that number (e.g. the parent).
var alreadyCreated = response.abha_created == 1 || digits(response.abha_number).length === 14;
if (!alreadyCreated && communicationMobile && digits(response.mobile).slice(-10) !== communicationMobile) {
requestMobileOtp();
return;
}
renderProfile(response);
if (alreadyCreated) {
reportCommunicationMobileStatus(response);
}
}, 'json').fail(function (xhr) {
button.prop('disabled', false).html('<i class="bi bi-shield-check me-1"></i>Verify &amp; Create ABHA');
alertBox('danger', apiMessage(xhr.responseJSON, 'OTP verification failed.'));
});
}
// Explains the alternate-mobile outcome so the operator is never left guessing whether it was attached.
function reportCommunicationMobileStatus(response) {
var abhaText = formatAbha(response.abha_number) || 'the ABHA';
var created = 'ABHA <strong>' + escapeHtml(abhaText) + '</strong> created successfully by ABDM during Aadhaar OTP verification.';
if (!communicationMobile) {
alertBox('success', created);
return;
}
var maskedComm = escapeHtml(maskMobile(communicationMobile));
if (digits(response.mobile).slice(-10) === communicationMobile) {
alertBox('success', created + '<br>Alternate mobile <strong>' + maskedComm + '</strong> is attached to this ABHA as the communication number. No separate mobile OTP is needed.');
return;
}
alertBox('warning', created + '<br>The alternate mobile <strong>' + maskedComm + '</strong> was sent with the Aadhaar verification, but ABDM did not confirm it in the response, so treat it as <strong>not yet attached</strong>.'
+ '<br>HMS deliberately did not send a second mobile OTP: that check returns whichever ABHA already owns this number (for example a parent\'s ABHA) and would overwrite this record. Attach or change the number from the ABHA app/portal instead.');
}
function requestMobileOtp() {
alertBox('info', 'Aadhaar verified. Requesting OTP for the alternate communication mobile...');
$.post('<?= base_url('abha/create/communication') ?>', { mobile: communicationMobile, txn_id: createTxnId, '<?= csrf_token() ?>': csrf() }, function (response) {
@ -430,7 +458,9 @@ window.AbhaCreateModal = (function () {
$('#abhaCreateProfileId').text(profile.abha_address || '-');
$('#abhaCreateProfileDob').text(profile.dob || '-');
$('#abhaCreateProfileGender').text(genderText(profile.gender));
$('#abhaCreateProfileMobile').text(maskMobile(profile.mobile) || '-');
$('#abhaCreateProfileMobile').text(profile.mobile
? maskMobile(profile.mobile)
: (communicationMobile ? maskMobile(communicationMobile) + ' (sent at enrolment, unconfirmed)' : '-'));
$('#abhaCreateProfileFullAddress').text([profile.address, profile.district, profile.state, profile.zip].filter(Boolean).join(', ') || '-');
$('#abhaCreateStatusText').text(profile.abha_number ? 'ABHA Ready' : 'ABHA Verified');