d_s_bisht/devsofttech_hms_ci4
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(abdm): redact decrypted FHIR bundles from abdm_api_logs and increase memory limit in hiu-poll to prevent memory exhaustion

Browse Source
This commit is contained in:
DevSoftTech Server 2026-10-08 11:27:32 +05:30
parent 6b1cf04198
commit cb0a1967a4
2 changed files with 52 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/Commands/AbdmHiuPoll.php
View File

@ -19,6 +19,8 @@ class AbdmHiuPoll extends BaseCommand
public function run(array $params) public function run(array $params)
{ {
@ini_set('memory_limit', '512M');
$lockDir = WRITEPATH . 'locks'; $lockDir = WRITEPATH . 'locks';
if (! is_dir($lockDir)) { if (! is_dir($lockDir)) {
@mkdir($lockDir, 0755, true); @mkdir($lockDir, 0755, true);

79
app/Libraries/Abdm/M3HiuGatewayClient.php
View File

@ -676,36 +676,57 @@ class M3HiuGatewayClient
string $hospitalId, string $hospitalId,
string $httpMethod = 'POST' string $httpMethod = 'POST'
): void { ): void {
if (! $this->db->tableExists('abdm_api_logs')) { try {
return; if (! $this->db->tableExists('abdm_api_logs')) {
return;
}
$status = $ok === 1 ? 'success' : 'error';
$entityId = trim((string) (
$request['consent_id']
?? $request['consentId']
?? $request['consentRequestId']
?? $request['request_id']
?? $request['requestId']
?? $request['transaction_id']
?? $request['transactionId']
?? ''
));
// Redact bulky decrypted clinical data in API audit log to preserve memory and privacy
$logResponse = $response;
if (isset($logResponse['sessions']) && is_array($logResponse['sessions'])) {
foreach ($logResponse['sessions'] as &$sess) {
if (isset($sess['decrypted_data']) && is_array($sess['decrypted_data'])) {
$sess['decrypted_data_count'] = count($sess['decrypted_data']);
$sess['decrypted_data'] = '[REDACTED_CLINICAL_DATA: ' . count($sess['decrypted_data']) . ' items]';
}
}
unset($sess);
}
$respJson = json_encode($logResponse, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES);
if ($respJson !== false && strlen($respJson) > 65536) {
$respJson = substr($respJson, 0, 65536) . '...[TRUNCATED]';
}
$this->db->table('abdm_api_logs')->insert([
'channel' => 'eatria_bridge',
'event_type' => 'abdm.m3.hiu.' . $eventKey,
'endpoint' => $this->baseUrl . $path,
'http_method' => strtoupper(trim($httpMethod)) !== '' ? strtoupper(trim($httpMethod)) : 'POST',
'entity_type' => 'abdm_hiu',
'entity_id' => $entityId,
'request_json' => (string) json_encode($request, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES),
'response_code' => $httpCode,
'response_json' => (string) ($respJson ?: '{}'),
'status' => $status,
'error_message' => $errorText !== '' ? mb_substr($errorText, 0, 1000) : null,
'created_at' => date('Y-m-d H:i:s'),
]);
} catch (\Throwable $e) {
log_message('warning', '[M3HiuGatewayClient] logApi failed: ' . $e->getMessage());
} }
$status = $ok === 1 ? 'success' : 'error';
$entityId = trim((string) (
$request['consent_id']
?? $request['consentId']
?? $request['consentRequestId']
?? $request['request_id']
?? $request['requestId']
?? $request['transaction_id']
?? $request['transactionId']
?? ''
));
$this->db->table('abdm_api_logs')->insert([
'channel' => 'eatria_bridge',
'event_type' => 'abdm.m3.hiu.' . $eventKey,
'endpoint' => $this->baseUrl . $path,
'http_method' => strtoupper(trim($httpMethod)) !== '' ? strtoupper(trim($httpMethod)) : 'POST',
'entity_type' => 'abdm_hiu',
'entity_id' => $entityId,
'request_json' => (string) json_encode($request, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES),
'response_code' => $httpCode,
'response_json' => (string) json_encode($response, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES),
'status' => $status,
'error_message' => $errorText !== '' ? mb_substr($errorText, 0, 1000) : null,
'created_at' => date('Y-m-d H:i:s'),
]);
} }
private function extractErrorText($decoded, int $httpCode, bool $isJson): string private function extractErrorText($decoded, int $httpCode, bool $isJson): string