@medicus.ai/medicus-report-pdf-generator 1.3.8 → 1.3.10

package/index.js

@@ -7,10 +7,18 @@ const {
 } = require("./lib/wellbeing_report_generator");
 const { generateSanusXReport, generateHTMLSanusXReport } = require("./lib/sanusx_report_generator");
 const fs = require('fs');
+const os = require('os');
+const crypto = require('crypto');
 const { sendNascoEmail, sendEmailNotification } = require('./lib/sendEmail')
 const path = require('path');
 const { generatePDFCorporateReport, generateHTMLCorporateReport } = require('./lib/corporate_report_generator')
 
+// Best-effort fire-and-forget cleanup for per-call temp files. Never throws.
+const safeUnlink = (filePath) => {
+    if (!filePath) return Promise.resolve();
+    return fs.promises.unlink(filePath).catch(() => { });
+};
+
 module.exports = {
 
     generateHTMLStaging,
@@ -187,10 +195,19 @@ module.exports = {
         let reportData = JSON.parse(data);
         let base64Object = reportData.data;
 
+        // Per-call unique identifiers so concurrent callers never share a path.
+        // Even when two requests overlap, each one owns its own input/output
+        // files and email attachment, eliminating cross-user PDF swapping.
+        const callId = crypto.randomUUID();
+        const tmpDir = os.tmpdir();
+        const tmpInputPath = path.join(tmpDir, `wb-${callId}-in.pdf`);
+        const tmpEncryptedPath = path.join(tmpDir, `wb-${callId}-enc.pdf`);
+        let tmpEmailAttachmentPath = null;
+
         let LOGS = '';
-        const LOGS_FILE_PATH = path.join(__dirname, 'output', 'LOGS.txt');
-        const PDF_FILE_PATH = path.join(__dirname, 'output', 'nasco-sample.pdf');
-        const ENCRYPTED_PDF_PATH = path.join(__dirname, 'output', 'nasco-sample-encrypted.pdf');
+        const LOGS_FILE_PATH = isDebugging
+            ? path.join(__dirname, 'output', `LOGS-${callId}.txt`)
+            : null;
 
         const mailConfig = {
             host: reportData.host,
@@ -201,12 +218,6 @@ module.exports = {
             secure: reportData.secure,
         };
 
-        if (isDebugging) {
-            if (fs.existsSync(LOGS_FILE_PATH)) fs.unlinkSync(LOGS_FILE_PATH);
-            if (fs.existsSync(PDF_FILE_PATH)) fs.unlinkSync(PDF_FILE_PATH);
-            if (fs.existsSync(ENCRYPTED_PDF_PATH)) fs.unlinkSync(ENCRYPTED_PDF_PATH);
-        }
-
         if (isDebugging) {
             console.log('2: save json string');
             LOGS += '2: save json string\n===============\n' + base64Object + '\n\n\n';
@@ -242,45 +253,64 @@ module.exports = {
             LOGS += '3: save PDF buffer\n===============\n' + '[binary content omitted]' + '\n\n\n';
         }
 
-        // Write original PDF (unencrypted)
-        fs.writeFileSync(PDF_FILE_PATH, fileBuffer);
-
+        try {
+            // Write the unencrypted PDF to a per-call temp file.
+            // qpdf needs a real input path; using a uuid-suffixed file in
+            // os.tmpdir() guarantees no concurrent caller can overwrite it.
+            await fs.promises.writeFile(tmpInputPath, fileBuffer);
 
-        return await (async () => {
             const qpdf = await import('node-qpdf2');
 
+            // Encrypt to a per-call output file. We can't use qpdf's stdout
+            // mode (output omitted) because node-qpdf2's spawn helper joins
+            // stdout chunks as strings, which corrupts binary PDF bytes.
             await qpdf.encrypt({
-                input: PDF_FILE_PATH,
-                output: ENCRYPTED_PDF_PATH,
+                input: tmpInputPath,
+                output: tmpEncryptedPath,
                 keyLength: 256,
                 password: reportData.pdfPassword,
-            })
-            const encryptedBuffer = fs.readFileSync(ENCRYPTED_PDF_PATH);
+            });
+
+            const encryptedBuffer = await fs.promises.readFile(tmpEncryptedPath);
 
-            // Save encoded base64 (of encrypted)
-            const base64data = Buffer.from(encryptedBuffer).toString('base64');
+            const base64data = encryptedBuffer.toString('base64');
             if (isDebugging) {
                 console.log('4: save encoded base64');
                 LOGS += '4: save encoded base64\n===============\n' + base64data + '\n\n\n';
             }
 
-            // Write logs
-            fs.writeFileSync(LOGS_FILE_PATH, LOGS, 'utf8');
-            if (isDebugging) console.log('5: save logs to file');
+            if (isDebugging && LOGS_FILE_PATH) {
+                await fs.promises.writeFile(LOGS_FILE_PATH, LOGS, 'utf8');
+                console.log('5: save logs to file');
+            }
 
             if (isDownloadable) {
                 return encryptedBuffer;
-            } else {
-                if (shouldSendEmail) {
-                    return await sendNascoEmail(decodedJSON.wellbeing, ENCRYPTED_PDF_PATH, mailConfig, reportData.client);
-                } else {
-                    return base64data;
-                }
             }
 
-        })();
-
+            if (shouldSendEmail) {
+                // Write the encrypted buffer to a dedicated per-call file just
+                // for the email attachment. sendNascoEmail expects a path
+                // (nodemailer reads it from disk), so we materialize it once,
+                // pass it in, then unlink in the finally block.
+                tmpEmailAttachmentPath = path.join(tmpDir, `wb-${callId}-mail.pdf`);
+                await fs.promises.writeFile(tmpEmailAttachmentPath, encryptedBuffer);
+                return await sendNascoEmail(
+                    decodedJSON.wellbeing,
+                    tmpEmailAttachmentPath,
+                    mailConfig,
+                    reportData.client
+                );
+            }
 
+            return base64data;
+        } finally {
+            await Promise.all([
+                safeUnlink(tmpInputPath),
+                safeUnlink(tmpEncryptedPath),
+                safeUnlink(tmpEmailAttachmentPath),
+            ]);
+        }
     },
 
     generateSanuxPDF: async (data, isDebugging, isDownloadable, shouldSendEmail) => {

package/lib/wellbeing_report_generator.js

@@ -1,5 +1,6 @@
 "use strict";
 const fs = require("fs");
+const crypto = require("crypto");
 const { promisify } = require('util');
 const { JSDOM } = require("jsdom");
 const path = require("path");
@@ -1001,8 +1002,12 @@ let generateHTMLWellbeingReport = async (data, isDebugging, clientName, language
     // Setup
     debug = isDebugging;
     const client = clientName || 'default';
-    OUT_FILE = path.resolve(__dirname + `/../output/${client}-pdf-` + Date.now() + '.html');
-    Pdf_file = `/output/${client}-pdf-` + Date.now() + '.html';
+    // Per-call unique paths so concurrent callers never share a file on disk.
+    // The puppeteer `goto(file:///…)` step is what previously read another
+    // user's HTML when two requests overlapped, producing a swapped PDF body.
+    const callId = crypto.randomUUID();
+    const callOutFile = path.resolve(__dirname + `/../output/${client}-pdf-${callId}.html`);
+    const callPdfFile = `/output/${client}-pdf-${callId}.html`;
 
     // Language configuration
     language = empty(language) ? 'en' : language;
@@ -1113,11 +1118,12 @@ let generateHTMLWellbeingReport = async (data, isDebugging, clientName, language
     }
 
     // Write file
-    await promisify(fs.writeFile)(OUT_FILE, finalHtml);
+    await promisify(fs.writeFile)(callOutFile, finalHtml);
 
     return {
         html: finalHtml,
-        outputFile: OUT_FILE,
+        outputFile: callOutFile,
+        pdfFile: callPdfFile,
         header: renderedHeader,
         footer: footerHtml,
         historyData
@@ -1138,8 +1144,12 @@ let generateHTMLWellbeingReportWithSmartReport = async (data, isDebugging, clien
     // Setup
     debug = isDebugging;
     const client = clientName || 'default';
-    OUT_FILE = path.resolve(__dirname + `/../output/${client}-pdf-` + Date.now() + '.html');
-    Pdf_file = `/output/${client}-pdf-` + Date.now() + '.html';
+    // Per-call unique paths so concurrent callers never share a file on disk.
+    // The puppeteer `goto(file:///…)` step is what previously read another
+    // user's HTML when two requests overlapped, producing a swapped PDF body.
+    const callId = crypto.randomUUID();
+    const callOutFile = path.resolve(__dirname + `/../output/${client}-pdf-${callId}.html`);
+    const callPdfFile = `/output/${client}-pdf-${callId}.html`;
 
     // Extract data
     const wellbeingData = data.wellbeing || {};
@@ -1485,11 +1495,12 @@ let generateHTMLWellbeingReportWithSmartReport = async (data, isDebugging, clien
     }
 
     // Write file
-    await promisify(fs.writeFile)(OUT_FILE, finalHtml);
+    await promisify(fs.writeFile)(callOutFile, finalHtml);
 
     return {
         html: finalHtml,
-        outputFile: OUT_FILE,
+        outputFile: callOutFile,
+        pdfFile: callPdfFile,
         header: renderedHeader,
         footer: templates.footer,
         historyData,
@@ -1545,15 +1556,16 @@ const setupPageContent = async (page, contentHtml, filePath) => {
 let generatePDFWellbeingReport = async (data) => {
     try {
         const contentHtml = data.html;
-        OUT_FILE = data.outputFile;
 
         // Launch browser and setup page
         const browser = await launchBrowser();
         const page = await browser.newPage();
         debugLog("page launched!");
 
-        // Setup content
-        await setupPageContent(page, contentHtml, Pdf_file);
+        // Use the per-call relative path produced by generateHTMLWellbeingReport.
+        // Reading module-level state here was the root cause of cross-user PDF
+        // body swapping under concurrent requests.
+        await setupPageContent(page, contentHtml, data.pdfFile);
         debugLog("page opened!");
 
         // Generate PDF
@@ -1789,15 +1801,17 @@ const setupExtendedPageContent = async (page, contentHtml, filePath) => {
 const generatePDFReport = async (data, hideWellbeingUI = false) => {
     try {
         const contentHtml = data.html;
-        const OUT_FILE = data.outputFile;
         const footerTemplate = getPdfFooterTemplate(data.client, data.selectedLabs, data.footer);
 
         // Launch browser and setup page
         const browser = await launchExtendedBrowser();
         const page = await browser.newPage();
 
-        // Setup content
-        await setupExtendedPageContent(page, contentHtml, Pdf_file);
+        // Use the per-call relative path produced by
+        // generateHTMLWellbeingReportWithSmartReport. Reading module-level
+        // state here was the root cause of cross-user PDF body swapping
+        // under concurrent requests.
+        await setupExtendedPageContent(page, contentHtml, data.pdfFile);
 
         // Generate PDF with header and footer (PHA needs larger bottom margin to prevent content overlapping footer)
         const bottomMargin = (data.client || '').toLowerCase() === 'pha' ? '60px' : '50px';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@medicus.ai/medicus-report-pdf-generator",
-  "version": "1.3.08",
+  "version": "1.3.10",
   "description": "Nasco corporate report - latest update in 12/10/2023 - Fix HRC for bionext",
   "main": "index.js",
   "scripts": {