Merge branch 'ENG-445-move-care-users-api-viewsets-change-password-py-to-pydantic' of https://github.com/ohcnetwork/care into ENG-445-move-care-users-api-viewsets-change-password-py-to-pydantic

Author: nandkishorr

.github/workflows/validate-pr-title.yml

@@ -0,0 +1,33 @@
+name: PR Title JIRA Validation
+
+on:
+  pull_request:
+    types: [opened, reopened, edited]
+
+jobs:
+  validate-jira-ticket:
+    runs-on: ubuntu-24.04-arm
+    if: github.event.pull_request.user.type != 'Bot'
+
+    steps:
+      - name: Validate JIRA Ticket in PR Title
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            // Configure JIRA project keys here
+            const jiraProjectKeys = ['ENG'];
+
+            const prTitle = context.payload.pull_request.title;
+
+            // Check that title starts with [ENG-456] format
+            const pattern = new RegExp(`^\\[(${jiraProjectKeys.join('|')})-\\d+\\]`, 'i');
+
+            if (!pattern.test(prTitle)) {
+              const examples = jiraProjectKeys.map(k => `[${k}-123]`).join(', ');
+              core.setFailed(
+                `PR title must start with a JIRA ticket in brackets.\n` +
+                `Expected format: [PROJECT-NUMBER] title\n` +
+                `Examples: ${examples}`
+              );
+            }

care/emr/api/otp_viewsets/login.py

@@ -12,20 +12,58 @@
 from rest_framework.response import Response
 
 from care.emr.api.viewsets.base import EMRBaseViewSet
-from care.facility.models.patient import PatientMobileOTP
+from care.facility.models.patient import MobileOTP
 from care.utils import sms
 from care.utils.models.validators import mobile_validator
-from care.utils.sms.utils import get_sms_content
 from config.patient_otp_token import PatientToken
 
 logger = logging.getLogger(__name__)
 
 
+class BaseOTPType:
+    def render_content(self, otp: str) -> str:
+        pass
+
+
+class LoginOTP(BaseOTPType):
+    @classmethod
+    def render_content(cls, otp: str) -> str:
+        return settings.OTP_SMS_LOGIN_CONTENT.format(otp=otp)
+
+
 def rand_pass(size):
     return "".join(secrets.choice(string.digits) for _ in range(size))
 
 
-class OTPLoginRequestSpec(BaseModel):
+def send_otp(phone_number, otp_type: BaseOTPType):
+    sent_otps = MobileOTP.objects.filter(
+        created_date__gte=(timezone.now() - timedelta(settings.OTP_REPEAT_WINDOW)),
+        is_used=False,
+        phone_number=phone_number,
+    )
+    if sent_otps.count() >= settings.OTP_MAX_REPEATS_WINDOW:
+        raise ValueError("Max Retries has exceeded")
+
+    random_otp = ""
+    if settings.USE_SMS:
+        random_otp = rand_pass(settings.OTP_LENGTH)
+        try:
+            content = otp_type.render_content(random_otp)
+            sms.send_text_message(
+                content=content,
+                recipients=[phone_number],
+            )
+        except Exception as e:
+            raise Exception("Error while sending OTP. Contact admin.") from e
+    elif settings.IS_PRODUCTION:
+        random_otp = rand_pass(settings.OTP_LENGTH)
+    else:
+        random_otp = "45612"
+
+    MobileOTP.objects.create(phone_number=phone_number, otp=random_otp)
+
+
+class OTPRequestBaseSpec(BaseModel):
     phone_number: str
 
     @field_validator("phone_number")
@@ -39,7 +77,7 @@ def validate_phone_number(cls, value):
         return value
 
 
-class OTPLoginSpec(OTPLoginRequestSpec):
+class OTPLoginSpec(OTPRequestBaseSpec):
     otp: str = Field(min_length=settings.OTP_LENGTH, max_length=settings.OTP_LENGTH)
 
 
@@ -48,41 +86,17 @@ class OTPLoginView(EMRBaseViewSet):
     permission_classes = []
 
     @extend_schema(
-        request=OTPLoginRequestSpec,
+        request=OTPRequestBaseSpec,
     )
     @action(detail=False, methods=["POST"])
     def send(self, request):
-        data = OTPLoginRequestSpec(**request.data)
-        sent_otps = PatientMobileOTP.objects.filter(
-            created_date__gte=(timezone.now() - timedelta(settings.OTP_REPEAT_WINDOW)),
-            is_used=False,
-            phone_number=data.phone_number,
-        )
-        if sent_otps.count() >= settings.OTP_MAX_REPEATS_WINDOW:
-            raise ValidationError({"phone_number": "Max Retries has exceeded"})
-        random_otp = ""
-        if settings.USE_SMS:
-            random_otp = rand_pass(settings.OTP_LENGTH)
-            try:
-                content = get_sms_content(
-                    settings.OTP_SMS_TEMPLATE_PATH, {"random_otp": random_otp}
-                )
-                sms.send_text_message(
-                    content=content,
-                    recipients=[data.phone_number],
-                )
-            except Exception as e:
-                logger.error(e)
-                return Response(
-                    {"error": "Error while sending OTP. Contact admin."}, status=400
-                )
-        elif settings.IS_PRODUCTION:
-            random_otp = rand_pass(settings.OTP_LENGTH)
-        else:
-            random_otp = "45612"
-
-        otp_obj = PatientMobileOTP(phone_number=data.phone_number, otp=random_otp)
-        otp_obj.save()
+        data = OTPRequestBaseSpec(**request.data)
+        try:
+            send_otp(data.phone_number, otp_type=LoginOTP)
+        except ValueError as e:
+            raise ValidationError({"phone_number": "Unable to send OTP"}) from e
+        except Exception:
+            return Response({"error": "Unable to send OTP"}, status=400)
         return Response({"otp": "generated"})
 
     @extend_schema(
@@ -91,7 +105,7 @@ def send(self, request):
     @action(detail=False, methods=["POST"])
     def login(self, request):
         data = OTPLoginSpec(**request.data)
-        otp_object = PatientMobileOTP.objects.filter(
+        otp_object = MobileOTP.objects.filter(
             phone_number=data.phone_number, otp=data.otp, is_used=False
         ).first()
         if not otp_object:

care/emr/api/viewsets/account.py

@@ -116,21 +116,19 @@ def authorize_update(self, request_obj, model_instance):
                 Encounter, external_id=request_obj.primary_encounter
             )
             if encounter.facility != model_instance.facility:
-                raise PermissionDenied(
-                    "Primary encounter is not associated with the facility"
+                raise ValidationError(
+                    "Primary encounter must belong to the same facility"
                 )
             if encounter.patient != model_instance.patient:
-                raise PermissionDenied(
-                    "Primary encounter is not associated with the patient"
+                raise ValidationError(
+                    "Primary encounter must belong to the same patient"
                 )
             if (
                 Account.objects.exclude(id=model_instance.id)
                 .filter(primary_encounter=encounter)
                 .exists()
             ):
-                raise PermissionDenied(
-                    "Encounter is already associated with an account"
-                )
+                raise ValidationError("Encounter is already associated with an account")
         if not AuthorizationController.call(
             "can_update_account_in_facility",
             self.request.user,

care/emr/api/viewsets/inventory/delivery_order.py

@@ -92,6 +92,17 @@ def authorize_location_write(self, location_obj, raise_error=True):
             return False
         return True
 
+    def authorize_location_external_write(self, location_obj, raise_error=True):
+        if not AuthorizationController.call(
+            "can_write_facility_external_supply_delivery",
+            self.request.user,
+            location_obj,
+        ):
+            if raise_error:
+                raise PermissionDenied("Cannot write supply requests")
+            return False
+        return True
+
     def perform_create(self, instance):
         if (
             instance.origin
@@ -102,6 +113,16 @@ def perform_create(self, instance):
             )
         return super().perform_create(instance)
 
+    def authorize_order_write(self, order):
+        if order.origin:
+            allowed = self.authorize_location_write(order.origin, raise_error=False)
+        else:
+            allowed = self.authorize_location_external_write(
+                order.destination, raise_error=False
+            )
+        if not allowed:
+            raise PermissionDenied("Cannot write supply requests")
+
     def perform_update(self, instance):
         with transaction.atomic():
             old_instance = DeliveryOrder.objects.get(id=instance.id)
@@ -150,18 +171,15 @@ def authorize_create(self, instance):
             destination_location = get_object_or_404(
                 FacilityLocation, external_id=instance.destination
             )
-            self.authorize_location_write(destination_location)
+            self.authorize_location_external_write(destination_location)
 
     def authorize_update(self, request_obj, model_instance):
         """
         If the order is an external order, then destination is the owner,
         else the owner is the origin.
         """
         # TODO: Order Destination permission to be figured out
-        if model_instance.origin:
-            self.authorize_location_write(model_instance.origin)
-        else:
-            self.authorize_location_write(model_instance.destination)
+        self.authorize_order_write(model_instance)
 
     def authorize_retrieve(self, model_instance):
         allowed = False

care/emr/api/viewsets/inventory/dispense_order.py

@@ -120,16 +120,18 @@ def perform_update(self, instance):
                     raise ValidationError(
                         "Dispense order already abandoned or entered in error"
                     )
-                if (
+                if instance.status in [
+                    MedicationDispenseOrderStatusOptions.abandoned.value,
+                    MedicationDispenseOrderStatusOptions.entered_in_error.value,
+                ]:
+                    cancel_dispense_order(instance, user)
+                elif (
                     old_object.status
                     == MedicationDispenseOrderStatusOptions.completed.value
                 ):
-                    if instance.status not in [
-                        MedicationDispenseOrderStatusOptions.abandoned.value,
-                        MedicationDispenseOrderStatusOptions.entered_in_error.value,
-                    ]:
-                        raise ValidationError("Dispense order can only be cancelled")
-                    cancel_dispense_order(instance, user)
+                    raise ValidationError(
+                        "Completed dispense order can only be cancelled"
+                    )
             return super().perform_update(instance)
 
     def perform_create(self, instance):

care/emr/api/viewsets/inventory/supply_delivery.py

@@ -170,6 +170,17 @@ def authorize_location_write(self, location_obj, raise_error=True):
             return False
         return True
 
+    def authorize_location_external_write(self, location_obj, raise_error=True):
+        if not AuthorizationController.call(
+            "can_write_facility_external_supply_delivery",
+            self.request.user,
+            location_obj,
+        ):
+            if raise_error:
+                raise PermissionDenied("Cannot write supply requests")
+            return False
+        return True
+
     def authorize_order_read(self, order):
         allowed = False
         if order.origin:
@@ -188,9 +199,13 @@ def authorize_order_write(self, order):
             allowed = allowed or self.authorize_location_write(
                 order.origin, raise_error=False
             )
-        allowed = allowed or self.authorize_location_write(
-            order.destination, raise_error=False
-        )
+            allowed = allowed or self.authorize_location_write(
+                order.destination, raise_error=False
+            )
+        else:
+            allowed = allowed or self.authorize_location_external_write(
+                order.destination, raise_error=False
+            )
         if not allowed:
             raise PermissionDenied("Cannot write supply requests")
 

care/emr/api/viewsets/medication_dispense.py

@@ -188,23 +188,19 @@ def perform_update(self, instance):
                 instance.charge_item.save()
             super().perform_update(instance)
             sync_inventory_item(instance.item.location, instance.item.product)
-            if instance.authorizing_request:
-                if instance._fully_dispensed is not None and instance._fully_dispensed:  # noqa
+            if instance.authorizing_request and instance._fully_dispensed is not None:  # noqa
+                if instance._fully_dispensed:  # noqa
                     instance.authorizing_request.dispense_status = (
                         MedicationRequestDispenseStatus.complete.value
                     )
-                    instance.authorizing_request.updated_by = self.request.user
-                    instance.authorizing_request.save(
-                        update_fields=["dispense_status", "updated_by", "modified_date"]
-                    )
-                elif instance.authorizing_request:
+                else:
                     instance.authorizing_request.dispense_status = (
                         MedicationRequestDispenseStatus.partial.value
                     )
-                    instance.authorizing_request.updated_by = self.request.user
-                    instance.authorizing_request.save(
-                        update_fields=["dispense_status", "updated_by", "modified_date"]
-                    )
+                instance.authorizing_request.updated_by = self.request.user
+                instance.authorizing_request.save(
+                    update_fields=["dispense_status", "updated_by", "modified_date"]
+                )
             return instance
 
     def authorize_location_read(self, location):

care/emr/api/viewsets/observation_definition.py

@@ -71,7 +71,8 @@ def validate_data(self, instance, model_obj=None):
         facility = None
         if model_obj:
             queryset = queryset.exclude(id=model_obj.id)
-            facility = str(model_obj.facility.external_id)
+            if model_obj.facility:
+                facility = str(model_obj.facility.external_id)
         else:
             facility = instance.facility