Sidebar adjustments by JinethBosilu · Pull Request #36 · arosha-w/CrimeLinkAnalyzer_backend

JinethBosilu · 2026-03-12T19:05:36Z

No description provided.

… include Investigator role

…urity roles for ML service endpoints

…d and embedding generation

…add default bucket configuration in application.properties

Copilot

Pull request overview

This PR adds criminal record CRUD functionality with Supabase photo storage, face embedding generation, and expanded criminal profile fields (crime history, address, contacts, DOB, gender, alias).

Changes:

New CriminalController and CriminalService for full CRUD on criminal records with photo upload to Supabase and ML embedding generation
New SupabaseStorageService for uploading/deleting files in Supabase Storage
Extended Criminal entity, FacialRecognitionService, and SecurityConfig with additional fields and role-based access

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
`CriminalController.java`	New REST controller for criminal CRUD endpoints
`CriminalService.java`	New service orchestrating DB ops, storage uploads, and embeddings
`SupabaseStorageService.java`	New service for Supabase Storage file upload/delete
`Criminal.java`	Added new profile fields (riskLevel, crimeHistory, photoUrl, DOB, gender, alias)
`CriminalRepository.java`	Added native query for IDs with face embeddings
`FacialRecognitionService.java`	Added `generateEmbedding` method; expanded `registerCriminal` params; renamed `photo` → `photos`
`FacialRecognitionController.java`	Extended registration endpoint with additional profile params
`SecurityConfig.java`	Added role-based access for new criminal and facial endpoints
`application.properties`	Added `supabase.bucket` config property

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-12T19:08:00Z

+                        .requestMatchers("/api/criminals/**").hasAnyRole("Investigator", "OIC")
+                        .requestMatchers("/api/criminals").hasAnyRole("Investigator", "OIC")


Security rule ordering issue: /api/criminals/** is matched before /api/criminals due to Spring Security's first-match-wins behavior with requestMatchers. However, the more significant problem is that /api/criminals/** won't match the bare /api/criminals path (no trailing slash). The rules should be reordered so /api/criminals comes before /api/criminals/**, though in practice both have the same role set here so the functional impact is limited. Still, swap the order for correctness and consistency.

Suggested change

.requestMatchers("/api/criminals/**").hasAnyRole("Investigator", "OIC")

.requestMatchers("/api/criminals").hasAnyRole("Investigator", "OIC")

.requestMatchers("/api/criminals").hasAnyRole("Investigator", "OIC")

.requestMatchers("/api/criminals/**").hasAnyRole("Investigator", "OIC")

Copilot · 2026-03-12T19:08:00Z

+    private final RestTemplate restTemplate = new RestTemplate();
+


This creates a new RestTemplate instance directly instead of using the Spring-managed RestTemplate bean (configured with timeouts in RestTemplateConfig). This means uploads will use default infinite timeouts, which could cause threads to hang indefinitely if Supabase is unresponsive. Inject the existing RestTemplate bean via constructor injection instead.

Suggested change

private final RestTemplate restTemplate = new RestTemplate();

private final RestTemplate restTemplate;

public SupabaseStorageService(RestTemplate restTemplate) {

this.restTemplate = restTemplate;

}

Copilot · 2026-03-12T19:08:00Z

+            listHeaders.set("apikey", supabaseServiceKey);
+            listHeaders.setContentType(MediaType.APPLICATION_JSON);
+
+            String listBody = "{\"prefix\":\"" + criminalId + "/\",\"limit\":100}";


The criminalId is concatenated directly into the JSON string without escaping. If criminalId contains characters like " or \, this will produce malformed JSON or could be exploited for JSON injection. Use the ObjectMapper to serialize the body safely, as is done later in the method for deleteBody.

Copilot · 2026-03-12T19:08:00Z

+        String storagePath = criminalId + "/" + safeFilename;
+
+        String uploadUrl = supabaseUrl + "/storage/v1/object/" + bucket + "/" + storagePath;


The criminalId is interpolated directly into URL paths without encoding. If the ID contains special characters (e.g., /, %, ?), it could break the URL or lead to path traversal. Although currently generated as a UUID substring (safe), the uploadPhoto method accepts an arbitrary String. Consider URL-encoding the path segments.

Copilot · 2026-03-12T19:08:01Z

+            String deleteUrl = supabaseUrl + "/storage/v1/object/" + bucket;
+
+            HttpHeaders deleteHeaders = new HttpHeaders();
+            deleteHeaders.set("Authorization", "Bearer " + supabaseServiceKey);
+            deleteHeaders.set("apikey", supabaseServiceKey);
+            deleteHeaders.setContentType(MediaType.APPLICATION_JSON);
+
+            String deleteBody = mapper.writeValueAsString(new java.util.LinkedHashMap<String, Object>() {{
+                put("prefixes", prefixes);
+            }});
+            HttpEntity<String> deleteRequest = new HttpEntity<>(deleteBody, deleteHeaders);
+
+            ResponseEntity<String> deleteResponse = restTemplate.exchange(
+                    deleteUrl, HttpMethod.DELETE, deleteRequest, String.class);


The Supabase bulk delete endpoint is POST /storage/v1/object/remove/{bucket}, not DELETE /storage/v1/object/{bucket}. The current URL and HTTP method appear incorrect — this will likely result in a 404 or 405 from Supabase. The URL should be supabaseUrl + "/storage/v1/object/remove/" + bucket and the method should be HttpMethod.POST (or HttpMethod.DELETE with the correct path, depending on the Supabase API version).

Copilot · 2026-03-12T19:08:01Z

+                        .requestMatchers("/api/facial/criminals").hasAnyRole("Investigator", "OIC")
                        .requestMatchers("/api/facial/**").hasRole("Investigator")
+
+                        // Criminal CRUD (direct DB, no Python)


The comment says "Criminal CRUD (direct DB, no Python)" but CriminalService.createCriminal and updateCriminal both call facialRecognitionService.generateEmbedding(), which forwards to the Python ML service. The comment is misleading.

Suggested change

// Criminal CRUD (direct DB, no Python)

// Criminal CRUD endpoints

JinethBosilu and others added 5 commits February 28, 2026 17:45

feat: Update role-based access for field-officers and admin routes to…

8efeb8b

… include Investigator role

feat: Enhance criminal management with CRUD operations and update sec…

6516fb7

…urity roles for ML service endpoints

feat: Implement CRUD operations for criminal records with photo uploa…

21f7fea

…d and embedding generation

Merge branch 'main' into sidebar-adjustments

fb0fb35

Sanitize log messages in CriminalService and SupabaseStorageService; …

562ed0a

…add default bucket configuration in application.properties

Copilot AI review requested due to automatic review settings March 12, 2026 19:05

Copilot started reviewing on behalf of JinethBosilu March 12, 2026 19:06 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

JinethBosilu assigned iSiRaH and LPK98 Mar 12, 2026

iSiRaH approved these changes Mar 12, 2026

View reviewed changes

iSiRaH merged commit 8bc5461 into main Mar 12, 2026
6 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sidebar adjustments - #36

Sidebar adjustments#36
iSiRaH merged 5 commits into
mainfrom
sidebar-adjustments

JinethBosilu commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		.requestMatchers("/api/criminals/**").hasAnyRole("Investigator", "OIC")
		.requestMatchers("/api/criminals").hasAnyRole("Investigator", "OIC")

		private final RestTemplate restTemplate = new RestTemplate();

-    private final RestTemplate restTemplate = new RestTemplate();
+    private final RestTemplate restTemplate;
+    public SupabaseStorageService(RestTemplate restTemplate) {
+        this.restTemplate = restTemplate;
+    }

		String storagePath = criminalId + "/" + safeFilename;

		String uploadUrl = supabaseUrl + "/storage/v1/object/" + bucket + "/" + storagePath;

	// Criminal CRUD (direct DB, no Python)
	// Criminal CRUD endpoints

Conversation

JinethBosilu commented Mar 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants