Getting changes from main

[iSiRaH]

No description provided.

General approach: Ensure that user-controlled input incorporated into values returned to clients is constrained to a safe character set and/or encoded so it cannot be interpreted as executable HTML/JavaScript, even if a client misuses it. For file names and URLs, this typically means either sanitizing the name portion or returning a fully encoded/signed URL obtained from a trusted API.

Best concrete fix here:

1. In SupabaseService.uploadFile, stop propagating raw file.getOriginalFilename() characters into the stored file name and ultimately to clients. Instead:

   • Extract the original file extension (if any).
   • Sanitize the base file name to a conservative character set (e.g., letters, digits, dots, underscores, hyphens), replacing anything else with _.
   • Keep the random UUID prefix to avoid collisions.
   • Optionally limit the overall length.

2. In CrimeReportController.uploadEvidence, don’t expose the raw storage key directly. Instead, use the existing SupabaseService.getFileUrl method to return a signed, absolute URL for that key. This also better matches the method’s name (fileUrl) and reduces the likelihood that clients will treat a storage key as arbitrary HTML.

These changes are local to the shown snippets:

• SupabaseService.java: add a private sanitizeFileName helper and use it in uploadFile when building fileName.
• CrimeReportController.java: after uploadFile, call supabaseService.getFileUrl(fileName) and return that result.

No changes to external APIs are required, and existing functionality (uploading and later retrieving evidence) is preserved, with added safety.

---

In general, to fix confusing overloading where one overload takes Object and another takes String, you should avoid having both overloads share the same name. Instead, keep the specific, type-safe method (sanitize(String)) as is and rename the broad-typed convenience method (sanitize(Object)) to a distinct name that clearly describes its behavior, then update its Javadoc accordingly.

In this file, the best fix with no functional change is:

• Keep public static String sanitize(String input) exactly as it is.
• Rename public static String sanitize(Object input) to a clearer, non-overloaded name such as sanitizeObject(Object input) (or similar).
• Update the Javadoc @link and description above that method to reference the new name and make clear it’s a convenience wrapper around toString() plus sanitize(String).
• Do not change the method body logic: still handle null by returning "null" and otherwise delegate to sanitize(input.toString()).

No additional imports or helper methods are required; all changes are local to LogSanitizer.java around the second method declaration and its Javadoc.

[Copilot]

Pull request overview

This PR pulls in changes that expand the Spring Boot backend with (1) ML microservice gateway endpoints (call analysis + facial recognition), (2) officer location tracking, and (3) Supabase-backed evidence upload/signed download support, alongside security and build/config updates.

Changes:

• Add new controllers/services for call analysis and facial recognition microservices, plus a shared RestTemplate config.
• Add officer location tracking persistence + APIs (DTO/entity/repo/service/controller).
• Add Supabase storage integration for evidence upload and signed download URLs; refresh-token rotation changes; SecurityConfig updates; CI/security automation files.

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 19 comments.

Show a summary per file

File	Description
src/main/resources/application.properties	Adds Supabase properties and multipart upload limits
src/main/java/com/crimeLink/analyzer/util/LogSanitizer.java	Adds log sanitization utility to mitigate log injection
src/main/java/com/crimeLink/analyzer/service/impl/LocationServiceImpl.java	Implements bulk location save and history/last-location queries
src/main/java/com/crimeLink/analyzer/service/SupabaseService.java	Implements Supabase storage upload + signed URL retrieval
src/main/java/com/crimeLink/analyzer/service/RefreshTokenService.java	Adds token rotation + “valid token” lookup behavior
src/main/java/com/crimeLink/analyzer/service/LocationService.java	Introduces location service interface
src/main/java/com/crimeLink/analyzer/service/FacialRecognitionService.java	Adds gateway service for facial recognition microservice
src/main/java/com/crimeLink/analyzer/service/DutyScheduleService.java	Adds distinct-duty-location retrieval w/ defaults
src/main/java/com/crimeLink/analyzer/service/CrimeReportService.java	Adds evidence persistence and signed URL enrichment
src/main/java/com/crimeLink/analyzer/service/CallAnalysisService.java	Refactors to JSON passthrough gateway for call analysis microservice
src/main/java/com/crimeLink/analyzer/repository/RefreshTokenRepository.java	Adds fetch-join query for refresh token + user
src/main/java/com/crimeLink/analyzer/repository/LocationPointRepository.java	Adds repository for location point queries
src/main/java/com/crimeLink/analyzer/repository/DutyScheduleRepository.java	Adds query for distinct duty locations
src/main/java/com/crimeLink/analyzer/repository/CallAnalysisRepository.java	Removes persisted call analysis record repository
src/main/java/com/crimeLink/analyzer/mapper/CrimeReportMapper.java	Adds evidence mapping into CrimeReportDTO
src/main/java/com/crimeLink/analyzer/entity/LocationPoint.java	Adds location_points entity with JSON meta
src/main/java/com/crimeLink/analyzer/entity/Evidence.java	Adds evidence entity linked to crime reports
src/main/java/com/crimeLink/analyzer/entity/CrimeReport.java	Adds @OneToMany evidences relationship
src/main/java/com/crimeLink/analyzer/entity/CallAnalysisRecord.java	Removes persisted call analysis record entity
src/main/java/com/crimeLink/analyzer/dto/LocationPointDTO.java	Adds DTO for incoming location points
src/main/java/com/crimeLink/analyzer/dto/EvidenceDTO.java	Adds DTO for evidence + download URL
src/main/java/com/crimeLink/analyzer/dto/CrimeReportDTO.java	Adds evidence list field
src/main/java/com/crimeLink/analyzer/dto/CallAnalysisResultDTO.java	Removes typed call analysis result DTO
src/main/java/com/crimeLink/analyzer/controller/LocationController.java	Adds endpoints for location uploads/history/debug
src/main/java/com/crimeLink/analyzer/controller/FacialRecognitionController.java	Adds REST API gateway endpoints for facial recognition
src/main/java/com/crimeLink/analyzer/controller/DutyScheduleController.java	Adds endpoint to fetch duty locations
src/main/java/com/crimeLink/analyzer/controller/CrimeReportController.java	Adds evidence upload + evidence download endpoints
src/main/java/com/crimeLink/analyzer/controller/CallAnalysisController.java	Refactors call analysis controller to new gateway endpoints
src/main/java/com/crimeLink/analyzer/controller/AuthController.java	Updates refresh-token handling to use rotation
src/main/java/com/crimeLink/analyzer/config/SecurityConfig.java	Updates route authorization rules + exception handling
src/main/java/com/crimeLink/analyzer/config/RestTemplateConfig.java	Adds configured RestTemplate bean (timeouts)
src/main/java/com/crimeLink/analyzer/config/JwtAuthenticationFilter.java	Modifies JWT filter behavior and adds debug logging
pom.xml	Adds dependencies/plugins and build-helper configuration
database/facial_recognition_tables.sql	Adds DB schema for facial recognition feature
.github/workflows/codeql.yml	Adds CodeQL analysis workflow
.github/dependabot.yml	Adds Dependabot configuration
.env.example	Adds example env vars for JWT + Supabase

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The /api/debug/whoami endpoint exposes user identity and authorities. Combined with permitAll on /api/debug/** in SecurityConfig, this can be used for reconnaissance; restrict this endpoint to admin roles or remove it before merging.

Suggested change

	@GetMapping("/debug/whoami")
	public Map<String, Object> whoAmI(@AuthenticationPrincipal User user) {
	Map<String, Object> info = new HashMap<>();
	if (user != null) {
	info.put("email", user.getEmail());
	info.put("name", user.getName());
	info.put("role", user.getRole());
	info.put("authorities", user.getAuthorities().stream()
	.map(auth -> auth.getAuthority())
	.toList());
	info.put("userId", user.getUserId());
	info.put("badgeNo", user.getBadgeNo());
	} else {
	info.put("error", "No authenticated user");
	}
	return info;
	}

[Copilot]

file.getOriginalFilename() is incorporated into the stored object key. If the original filename contains path separators or control characters, this can create unexpected object paths (or confusing keys). Normalize/sanitize the filename (e.g., strip directories and disallow //\\ and control chars) before building fileName/uploadUrl.

[Copilot]

This controller endpoint returns the value from uploadFile, but the variable is named fileUrl even though uploadFile returns a file name/key. This is confusing for API consumers; return a typed JSON object (e.g., {fileName, bucket} or a signed download URL) and rename the variable accordingly.

[Copilot]

The meta JSON conversion swallows all exceptions and silently drops the metadata. This makes failures hard to diagnose and can lead to unexpected data loss; at minimum, log the exception (sanitizing user-controlled values) and consider rejecting the point if metadata is malformed.

[Copilot]

These placeholders have no default values, so the app will fail to start if SUPABASE_URL / SUPABASE_SERVICE_KEY are not provided. If this is optional per environment, provide safe defaults (or use profile-specific properties) to avoid local/dev startup failures.

[Copilot]

SupabaseService creates its own RestTemplate and ObjectMapper instances, bypassing the shared configuration (timeouts, interceptors, custom Jackson config). Prefer constructor injection of the existing RestTemplate bean and a shared ObjectMapper bean.

[Copilot]

Adding src/main/java as a test source directory will cause main production sources to be compiled again in the test scope and can lead to duplicate-class/packaging issues and longer builds. Remove this build-helper configuration unless there is a very specific, documented reason for it.

Suggested change

	<plugin>
	<groupId>org.codehaus.mojo</groupId>
	<artifactId>build-helper-maven-plugin</artifactId>
	<version>3.5.0</version>
	<executions>
	<execution>
	<id>add-source</id>
	<phase>generate-test-sources</phase>
	<goals>
	<goal>add-test-source</goal>
	</goals>
	<configuration>
	<sources>
	<source>src/main/java</source>
	</sources>
	</configuration>
	</execution>
	</executions>
	</plugin>

[Copilot]

The matcher /api/vehicle** does not cover the existing vehicles endpoints (e.g., @RequestMapping("/api/vehicles")), so vehicle routes will no longer be permitted as intended. Update the matcher to target /api/vehicles/** (or the exact vehicle routes you want public).

Suggested change

	.requestMatchers("/api/vehicle**").permitAll()
	.requestMatchers("/api/vehicles/**").permitAll()

[Copilot]

Leftover System.out.println debug output should not be in a controller method (noise + potential data leakage). Replace with proper logger calls at DEBUG level or remove entirely.

[Copilot]

Throwing generic RuntimeException for auth/authorization failures will typically return HTTP 500. Use a Spring mechanism that maps to the correct status (401/403), such as ResponseStatusException or a dedicated exception annotated with @ResponseStatus.