Code review — fluxos externos (dict2us-app)
D2U.NET · Legado: D2U · Roadmap: Roadmap
Auditoria no código Java em
C:\Projetos\D2U\dict2us-app.
Espelho repo:C:\Projetos\D2U.NET\D2U.NET\d2u.net\Docs_New\reviews\legacy-external-flows-code-review.md
Correcção 2026-08-19: workers Java vivos = 9 (3 Quartz + 6 executors).
JobAudioFileDownloaderestá comentado emTask.xml(dead).JobFileTransferExecutoré evento no approve, não cron. Contagem .NET e dual-run: Workers.
Resumo executivo
A auditoria confirma 14 categorias de entrada/saída externa (HTTP, servlet Spring, workers, FTP). Os flows docs_New 01–18 cobrem a maior parte; 4 lacunas foram fechadas em flows 19–22 (ver Roadmap).
| Estado | Quantidade |
|---|---|
Entry points HTTP (web.xml + dispatch-servlet.xml) |
12 |
Actions Struts públicas (struts.xml, namespace /) |
11 |
| Workers / Quartz activos | 10 (histórico 2026-06; live 2026-08-19 = 9, ver Workers) |
| Fluxos documentados (01–18 + FSM) | 19 docs |
| Gaps fechados (19–22) | 4 + BigHand ingress |
Verdict
| Pergunta | Resposta |
|---|---|
| Há mais fluxos externos além dos 18? | Sim — 19–22 + BigHand ingress |
| Documentação anterior errada? | Não — incompleta em egress FTP e callbacks legacy |
Dictate2UsHttpPostListener activo? |
Não — dead code |
| Prioridade rewrite | Stripe → SpeechLive SPS → HTTP/mobile → XML-RPC → Vendor FTP → Google postresult (sunset?) |
1. Mapa completo de entry points HTTP
1.1 web.xml — servlet dispatch (Spring MVC)
Ficheiros: dict2us-app/web/WEB-INF/web.xml, dispatch-servlet.xml
| URL pattern | Handler | Classe Java |
|---|---|---|
*.save |
dispatchController |
SaveDocumentController |
/LoginServlet |
loginServiceAction |
LoginServiceAction |
/FileUploadServlet |
fileUploadServiceAction |
FileUploadServiceAction |
/VerifyFileExistenc |
verifyFileExistenceServiceAction |
VerifyFileExistenceServiceAction |
/fileupload/ListOrganizationAndWorkTypeServlet |
listOrganizationAndWorkTypeServiceAction |
ListOrganizationAndWorkTypeServiceAction |
/dwr/* |
dwrController |
beans DWR.xml |
/xmlrpc/ |
xmlrpcController |
JobHandler (BlogTalk) |
/SPSUpload/* |
speechLiveUploadServiceAction |
SpeechLiveUploadServiceAction |
/SPSDownload/* |
speechLiveDownloadServiceAction |
SpeechLiveDownloadServiceAction |
/SPS/AccountCreditTransactions/* |
speechLiveDataCreditIncreaseServiceAction |
SpeechLiveDataCreditIncreaseServiceAction |
*.do |
Struts filter | ver 1.2–1.4 |
/webhook |
Stripe filter | StripeWebhookFilter |
Bug config: web.xml mapeia /VerifyFileExistenc (typo), mas dispatch-servlet.xml usa /VerifyFileExistence. Verify-file provavelmente nunca funciona no path typo.
1.2 Struts — namespace / (struts.xml)
| Action | Classe | Externo | Flow docs_New |
|---|---|---|---|
postjob.do |
HttpPostAction |
✅ | 16 |
chunkAssembler.do |
ChunkAssemblerAction |
✅ | 03 |
authenticateUser.do |
AuthenticateUserAction |
✅ | 16 |
codec.do |
AuthenticateUserAction |
✅ | 16 |
postresult.do |
CheckoutAction.postResult |
✅ Google Checkout legacy | 20 |
clientInformation.do |
IntegrationPointAction |
✅ Regus | 11 |
clientInformationWeb.do |
IntegrationPointAction |
✅ Regus | 11 |
regusTestButton.do |
IntegrationPointAction |
dev | fora scope |
testpaypal.do, testftp.do |
IndexAction |
dev | fora scope |
1.3 Struts — namespace empresa (struts-medtrans.xml)
| Action | Externo | Flow |
|---|---|---|
outside-report.do |
✅ portal relatório | 22 |
download-outside-document.do |
✅ download token | 17 |
sps-updatecreditrequest.do |
✅ SpeechLive cron | 21 |
account-confirmrealexpayment.do |
✅ RealEx callback | 20 |
account-confirmstripepayment.do |
✅ Stripe return | 05 |
iPhone-login.do |
✅ mobile | 16 |
1.4 Struts API (struts-api.xml)
| Action | Classe |
|---|---|
/api/audioReceiver.do |
APICreateJobAction.receive → flow 16 |
2. Workers e integrações não-HTTP
| Componente | Spring XML | Direcção | Flow |
|---|---|---|---|
MailReader |
MailReader.xml |
Entrada email → job | 09 |
AudioFilesScanner |
FileScanner.xml |
Entrada FTP scan | 09 |
FTPFileDownloader |
FTPFileDownloader.xml |
Entrada BigHand FTP | 21b |
LexacomDownloader |
LexacomDownloader.xml |
Entrada Lexacom | 10 |
LexacomChecker |
LexacomChecker.xml |
Poll Lexacom | 10 |
SpeechLiveRetrySender |
SpeechLiveRetrySender.xml |
Retry SpeechLive | 10 / 21 |
JobXMLFileTransfer |
Task.xml (Quartz) |
Saída FTP vendor | 19 |
JobFileTransferExecutor |
Beans.xml |
Saída async pós-aprovação | 19 |
JobAudioFileDownloader |
Task.xml |
Download URL BlogTalk — comentado / dead (2026-08-19) | 17 |
DeleteOldFileTask |
Task.xml |
Manutenção | background-workers |
DeleteOldLogsTask |
Task.xml |
Manutenção | background-workers |
3. Vendor FTP egress (flow 19) — detalhe código
Trigger: job JOB_APPROVED + JobUploadType.
| Upload type | Classe | Destino |
|---|---|---|
| Generic FTP | JobFileTransferRunnable |
client.getClientFTPFolder() |
| DialDictate | JobFileDialDictateTransferRunnable |
FTP /Submitted_dialdictate_files/ |
| MediaHawk | JobFileMediaHawkTransferRunnable |
path MediaHawk |
| Winscribe | JobFileWinscribeTransferRunnable |
audio + .txt Winscribe |
| BigHand | JobXMLFileTransfer (Quartz) |
ftp.bighand.dictate2us.com |
Ficheiros-chave:
com.ivant.cms.executor.JobFileTransferExecutorcom.ivant.cms.runnable.JobFile*TransferRunnablecom.ivant.cms.task.JobXMLFileTransfer
4. BigHand ingress (flow 21b) — detalhe código
| Componente | Função |
|---|---|
FTPFileDownloader.downloadBigHand() |
Poll FTP → download |
TaspScanner.createJobBigHand() |
Parse XML BigHandExportFile → job |
JobUploadType.BIG_HAND |
Marca canal |
Client flag: requiresPaymentForBigHand — intersecta fluxo 05.
5. Código morto / não portar
| Classe | Evidência | .NET |
|---|---|---|
Dictate2UsHttpPostListener |
Zero refs Spring/web.xml | Não portar — usar HttpPostAction / API |
SpeechLiveZipUploadServiceAction |
Ausente em dispatch-servlet.xml |
Confirmar prod; provavelmente skip |
TemplatesActionImpl / PaymentTransactionActionImpl |
JSP antigos, não em DWR.xml |
Confirmar negócio |
testpaypal, testftp, regusTestButton |
Dev only | Skip |
6. Achados de segurança
| Local | Problema | Severidade |
|---|---|---|
JobHandler.status/submit |
Credenciais hardcoded (bobcharish + API key) |
🔴 Alta |
JobXMLFileTransfer |
FTP user/password no source | 🔴 Alta |
JobHandler |
System.out.println de secrets |
🟠 Média |
| DWR | crossDomainSessionSecurity=false |
🟠 Média |
| XML-RPC | Sem rate limit documentado | 🟠 Média |
postresult.do |
Google Checkout legacy | 🟡 Avaliar sunset |
Rewrite .NET: Key Vault / env vars; API keys por integração; validação signature webhooks.
7. DWR — superfície AJAX
12 beans remotos em DWR.xml (~47 métodos expostos via dwr:include).
| Bean JS | Impl | Uso |
|---|---|---|
XMLTranscriptAction |
XMLTranscriptActionImpl |
Transcrição XML |
ClientAction |
ClientActionImpl |
Clientes / Winscribe folders |
AudioFileAction |
AudioFileActionImpl |
Tempo áudio, duplicados |
WorkTypeNameAction |
WorkTypeNameActionImpl |
CRUD work type names |
PatientInfoAction |
PatientInfoActionImpl |
MRN / pacientes |
OrganizationsAction |
OrganizationsActionImpl |
Orgs, clients, worktypes |
JobFilesAction |
JobFilesActionImpl |
Bulk download |
RulesAction |
RulesActionImpl |
Regras atribuição |
StaffAction |
StaffActionImpl |
Staff lookup |
DWRUserAction |
DWRUserActionImpl |
Upload state |
SpecializationsAction |
SpecializationsActionImpl |
Especializações |
SpeechLiveJobAction |
SpeechLiveJobActionImpl |
Credit/reject SL |
Sem gap funcional — migração mecânica para /api/dwr/*.
8. XML-RPC BlogTalk (JobHandler)
Métodos: status(Hashtable), submit(Hashtable).
- Auth hardcoded em source (crítico)
submitcria job +BlogTalkPost+ agenda download áudio (JobAudioFileDownloader)statusdevolve metadata + XML transcrito
Flow .NET: 17 + worker BlogTalk audio download.
9. Gaps fechados (flows 19–22)
| ID | Título | Repo |
|---|---|---|
| 19 | Saída FTP vendor | docs_New/flows/19-vendor-ftp-egress.md |
| 20 | Callbacks pagamento externos | docs_New/flows/20-pagamento-callbacks-externos.md |
| 21 | SpeechLive SPS + créditos | docs_New/flows/21-speechlive-sps-credit.md |
| 21b | Entrada BigHand FTP | docs_New/flows/21-bighand-ftp-ingress.md |
| 22 | Outside report portal | docs_New/flows/22-outside-relatorio.md |
Matriz: docs_New/flows/workflow-coverage-matrix.md
10. Ficheiros-fonte para re-auditoria
dict2us-app/web/WEB-INF/web.xml
dict2us-app/web/WEB-INF/dispatch-servlet.xml
dict2us-app/src/main/resources/conf/medtrans/struts/struts.xml
dict2us-app/src/main/resources/conf/medtrans/struts/struts-medtrans.xml
dict2us-app/src/main/resources/conf/medtrans/struts/struts-api.xml
dict2us-app/src/main/resources/conf/medtrans/spring/DWR.xml
dict2us-app/src/main/resources/conf/medtrans/spring/ApplicationContext.xml
dict2us-app/src/com/ivant/cms/executor/JobFileTransferExecutor.java
dict2us-app/src/com/ivant/cms/task/JobXMLFileTransfer.java
dict2us-app/src/com/ivant/cms/xmlrpc/JobHandler.java
dict2us-app/src/com/ivant/cms/action/medtrans/HttpPostAction.java
dict2us-app/src/com/ivant/cms/action/medtrans/IntegrationPointAction.java
dict2us-app/src/com/ivant/cms/action/medtrans/payment/CheckoutAction.java
Acções derivadas deste review
Ver checklist completo em Roadmap — secções Decisões de negócio, Segurança rewrite e Onda 6 Integrações.