Implementing reCAPTCHA validation as part of the authentication service.

src/main/environment/common_ci.properties

@@ -174,5 +174,7 @@ grievanceAllocationRetryConfiguration=3
 start-grievancedatasync-scheduler=false
 cron-scheduler-grievancedatasync=0 0/2 * * * ?
 
-
+captcha.secret-key=@env.CAPTCHA_SECRET_KEY@
+captcha.verify-url=@env.CAPTCHA_VERIFY_URL@
+captcha.enable-captcha=@env.ENABLE_CAPTCHA@
 

src/main/environment/common_example.properties

@@ -198,3 +198,7 @@ grievanceAllocationRetryConfiguration=3
 logging.path=logs/
 logging.file.name=logs/common-api.log
 
+captcha.secret-key= <Enter Cloudflare Secret Key>
+captcha.verify-url= https://challenges.cloudflare.com/turnstile/v0/siteverify
+captcha.enable-captcha=true
+

src/main/java/com/iemr/common/controller/users/IEMRAdminController.java

@@ -55,6 +55,7 @@
 import com.iemr.common.model.user.ChangePasswordModel;
 import com.iemr.common.model.user.ForceLogoutRequestModel;
 import com.iemr.common.model.user.LoginRequestModel;
+import com.iemr.common.service.recaptcha.CaptchaValidationService;
 import com.iemr.common.service.users.IEMRAdminUserService;
 import com.iemr.common.utils.CookieUtil;
 import com.iemr.common.utils.JwtUtil;
@@ -79,6 +80,11 @@ public class IEMRAdminController {
 	private final Logger logger = LoggerFactory.getLogger(this.getClass().getName());
 	private InputMapper inputMapper = new InputMapper();
 
+	@Value("${captcha.enable-captcha}")
+	private boolean enableCaptcha;
+
+	@Autowired
+	private CaptchaValidationService captchaValidatorService;
 	private IEMRAdminUserService iemrAdminUserServiceImpl;
 	@Autowired
 	private JwtUtil jwtUtil;
@@ -135,6 +141,30 @@ public String userAuthenticate(
 		OutputResponse response = new OutputResponse();
 		logger.info("userAuthenticate request - " + m_User + " " + m_User.getUserName() + " " + m_User.getPassword());
 		try {
+
+			boolean isMobile = false;
+			String userAgent = request.getHeader("User-Agent");
+			isMobile = UserAgentUtil.isMobileDevice(userAgent);
+			logger.info("UserAgentUtil isMobile : " + isMobile);
+
+			String captchaToken = m_User.getCaptchaToken();
+			if (enableCaptcha && !isMobile) {
+				if (captchaToken != null && !captchaToken.trim().isEmpty()) {
+					if (!captchaValidatorService.validateCaptcha(captchaToken)) {
+						logger.warn("CAPTCHA validation failed for user: {}", m_User.getUserName());
+						response.setError(new IEMRException("CAPTCHA validation failed"));
+						return response.toString();
+					}
+					logger.info("CAPTCHA validated successfully for user: {}", m_User.getUserName());
+				} else {
+					logger.warn("CAPTCHA token missing for user: {}", m_User.getUserName());
+					response.setError(new IEMRException("CAPTCHA token is required"));
+					return response.toString();
+				}
+			} else {
+				logger.info("CAPTCHA validation skipped");
+			}
+
 			String decryptPassword = aesUtil.decrypt("Piramal12Piramal", m_User.getPassword());
 			List<User> mUser = iemrAdminUserServiceImpl.userAuthenticate(m_User.getUserName(), decryptPassword);
 			JSONObject resMap = new JSONObject();
@@ -157,16 +187,12 @@ public String userAuthenticate(
 
 			String jwtToken = null;
 			String refreshToken = null;
-			boolean isMobile = false;
 			if (mUser.size() == 1) {
 				jwtToken = jwtUtil.generateToken(m_User.getUserName(), mUser.get(0).getUserID().toString());
 
 				User user = new User(); // Assuming the Users class exists
-	            user.setUserID(mUser.get(0).getUserID());
-	            user.setUserName(mUser.get(0).getUserName());
-
-				String userAgent = request.getHeader("User-Agent");
-				isMobile = UserAgentUtil.isMobileDevice(userAgent);
+				user.setUserID(mUser.get(0).getUserID());
+				user.setUserName(mUser.get(0).getUserName());
 				logger.info("UserAgentUtil isMobile : " + isMobile);
 
 				if (isMobile) {

src/main/java/com/iemr/common/model/user/LoginRequestModel.java

@@ -31,6 +31,7 @@
 	private String authKey;
 	private Boolean doLogout;
 	private Boolean withCredentials;
+	private String captchaToken;
 
 	public LoginRequestModel() {
 

src/main/java/com/iemr/common/service/recaptcha/CaptchaValidationService.java

@@ -0,0 +1,56 @@
+package com.iemr.common.service.recaptcha;
+
+import java.util.Map;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Service;
+import org.springframework.util.LinkedMultiValueMap;
+import org.springframework.util.MultiValueMap;
+import org.springframework.web.client.RestTemplate;
+
+@Service
+public class CaptchaValidationService {
+	private static final Logger logger = LoggerFactory.getLogger(CaptchaValidationService.class);
+
+	@Value("${captcha.secret-key}")
+	private String secretKey;
+
+	@Value("${captcha.verify-url}")
+	private String captchaVerifyUrl;
+
+	public boolean validateCaptcha(String token) {
+		if (token == null || token.trim().isEmpty()) {
+			logger.info("CAPTCHA token missing or empty, skipping validation");
+			return true;
+		}
+
+		try {
+			RestTemplate restTemplate = new RestTemplate();
+
+			HttpHeaders headers = new HttpHeaders();
+			headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
+
+			MultiValueMap<String, String> body = new LinkedMultiValueMap<>();
+			body.add("secret", secretKey);
+			body.add("response", token);
+
+			HttpEntity<MultiValueMap<String, String>> request = new HttpEntity<>(body, headers);
+			ResponseEntity<Map> response = restTemplate.postForEntity(captchaVerifyUrl, request, Map.class);
+
+			logger.debug("CAPTCHA validation response: {}", response.getBody());
+
+			Object successObj = response.getBody().get("success");
+			return successObj instanceof Boolean && (Boolean) successObj;
+
+		} catch (Exception e) {
+			logger.error("Error validating CAPTCHA", e);
+			return false;
+		}
+	}
+}