Skip to content

Case Study: genAI assisted validations

Jump to bottom
Yureshwar Ravuri edited this page Jun 27, 2025 · 4 revisions

Enhancing Security and Reliability through AI-Assisted Validations.

Executive Summary

By leveraging AI-driven code analysis and recommendations, the development team was able to enhance the security, reliability, and maintainability of the service, leading to improved user experience and reduced operational costs.

Initial State

The initial implementation of the generate_aadhar_otp method lacked comprehensive validations for input parameters and response formats. The error handling and logging mechanisms were basic, providing limited information about the nature and cause of errors. The absence of proper validations and detailed error messages made it challenging to diagnose and debug issues, leading to potential security vulnerabilities and a suboptimal user experience. File in Appendix here.

AI-Driven Transformation

The development team adopted genAI tool to improve validations. The AI tool identified areas where validations were missing and suggested appropriate validation techniques, such as the VerhoeffValidator for Aadhaar number validation.

The AI-driven recommendations guided the team in implementing enhanced validations for input parameters, including checking for the presence and validity of the Aadhaar number. The tool also suggested improvements to the error handling mechanism, introducing more detailed error messages and standardized error response formats. File in Appendix here.

Benefits

The AI-assisted code transformation brought several benefits to the Aadhaar OTP generation service:

  • Enhanced Security: The implementation of comprehensive validations, especially the VerhoeffValidator for Aadhaar numbers, significantly reduced the risk of processing invalid or malicious inputs. This helped prevent potential security vulnerabilities and unauthorized access attempts.

  • Improved Reliability: The enhanced error handling mechanism, with detailed error messages and standardized response formats, made the service more reliable and easier to troubleshoot. The improved logging and error reporting facilitated faster issue resolution and reduced downtime.

  • Better User Experience: The comprehensive validations and informative error messages provided a better user experience by clearly communicating the nature of the issues and guiding users to resolve them. This led to increased user satisfaction and reduced support queries.

  • Maintainability and Scalability: The AI-driven code improvements made the codebase more maintainable and scalable. The standardized error handling and logging mechanisms simplified the debugging process and made it easier for developers to understand and modify the code.

  • Full technical details here

Quantitative Impact

The AI-assisted code transformation led to measurable improvements in the Aadhaar OTP generation service:

  • Reduced Security Vulnerabilities:

  • Faster Issue Resolution:

  • Increased User Satisfaction:

Operational Improvements

The AI-driven code transformation streamlined the development and operations processes:

  • Reduced Development Time: The AI-assisted recommendations and automated code analysis saved developers significant time in identifying and implementing necessary validations and error handling. This accelerated the development cycle and allowed for faster feature delivery.

  • Simplified Debugging and Maintenance: The standardized error handling and logging mechanisms made it easier for developers to debug and maintain the codebase. This reduced the effort required for troubleshooting and code modifications, enabling the team to focus on delivering new features and improvements.

Conclusion

The integration of AI-assisted tools into the development workflow of the Aadhaar OTP generation service demonstrated the immense potential of AI-driven code transformation. By leveraging AI recommendations and automated code analysis, the development team was able to enhance the security, reliability, and maintainability of the service, resulting in improved user experience, reduced operational costs, and increased productivity.

Prompt that can be used for Validation

Assume the role of a seasoned software architect specializing in React+Typescript. Analyze the provided file with an exclusive focus on input validation, sanitization, and type checking.

Ensure that all user inputs and external data sources undergo proper validation, type checking, and sanitization to prevent malformed or incorrect data from entering the system. Identify missing or inadequate validation rules, improper sanitization techniques, and potential risks related to data integrity. Verify that type validation is consistently enforced to prevent unintended behaviors caused by incorrect data types.

Review how validation, type checking, and sanitization errors are integrated into the existing error-handling framework. Ensure that all related errors are properly classified, propagated, and logged in a structured manner.

Limit your analysis strictly to validation, input sanitization, type checking, and their integration with error handling. Do not provide recommendations related to security hardening, performance optimization, or documentation.

Provide a detailed report outlining the identified issues and suggested improvements. At the end of the analysis, combine all recommended changes into a single, structured final output, presenting the updated code or modifications in a clear, easy-to-implement format.

Appendix

Differences and Improvements

  1. Input Validation
  • In the "after" version, additional validations are added to check the presence and validity of the Aadhaar number using the VerhoeffValidator.validate_aadhaar method.
  • These validations ensure that the Aadhaar number is provided and is a valid 12-digit number, enhancing the robustness of the input handling.
  • The "before" version lacks these explicit validations, potentially leading to processing invalid or missing Aadhaar numbers.
  1. Error Handling and Messages
  • The "after" version includes more detailed and user-friendly error messages in the response when validation fails or when specific error conditions occur.
  • The error messages provide clear information about the issue, such as missing Aadhaar number or invalid Aadhaar number format.
  • The "before" version has generic error messages that may not provide sufficient information to the user about the specific problem.
  1. Response Format Validation
  • The "after" version includes a validation check to ensure that the otp_response is a Hash and contains the resp_status key.
  • This validation helps catch any unexpected response formats from the ABHA service and raises an appropriate error.
  • The "before" version does not have this explicit response format validation, potentially leading to unhandled exceptions if the response format deviates from the expected structure.
  1. Error Response Structure
  • The "after" version includes additional fields in the error responses, such as code and error, providing more detailed information about the error.
  • The code field indicates the specific HTTP status code associated with the error, enhancing the ability to handle and interpret the error response.
  • The "before" version does not include these additional fields, limiting the granularity of error information available to the consuming code.

Security Aspects

  1. Aadhaar Number Validation
  • The "after" version includes a validation step using the VerhoeffValidator.validate_aadhaar method to ensure the integrity and validity of the provided Aadhaar number.
  • This validation helps prevent processing of invalid or potentially malicious Aadhaar numbers, reducing the risk of exploits or unauthorized access attempts.
  1. Encrypted Aadhaar Number
  • Both versions use the RsaEncryption.oaep_mgf1_padding method to encrypt the Aadhaar number before sending it to the ABHA service.
  • Encrypting sensitive data like Aadhaar numbers adds a layer of security and protects the information during transmission.
  1. Authentication Token Validation
  • The "after" version includes a validation check for the presence and non-emptiness of the auth_token received from the ABHA service.
  • This validation ensures that the authentication token is valid and prevents unauthorized access to the ABHA service.
  • The "before" version does not have this explicit validation, potentially allowing requests with invalid or missing authentication tokens.

Actual files

File "Before" genAI Validations

def generate_aadhar_otp
        begin
            encrypted_aadhar = RsaEncryption.oaep_mgf1_padding(params["aadhar"])
            auth_token = AbhaWebService.authenticate_abha
            otp_response = AbhaWebService.generate_aadhar_otp(encrypted_aadhar, auth_token)
            
            case otp_response[:resp_status]
            when "200"
                # @otp_txn_id = JSON.parse(otp_response[:resp_body])["txnId"]
                  @response =  { status: "success", txn_id: @otp_txn_id }
            when "400"
                Rails.logger.error("Bad Request: #{otp_response[:resp_body]}")
                @response = { status: "error", message: "Invalid request parameters", error: otp_response[:resp_body] }#, status: :bad_request
            when "401"
                Rails.logger.error("Unauthorized: #{otp_response[:resp_body]}")
                @response = { status: "error", message: "Authentication failed", error: otp_response[:resp_body] }#, status: :unauthorized
            when "404"
                Rails.logger.error("Not Found: #{otp_response[:resp_body]}")
                @response = { status: "error", message: "Resource not found", error: otp_response[:resp_body] }#, status: :not_found
            when "429"
                Rails.logger.error("Rate Limited: #{otp_response[:resp_body]}")
                @response = { status: "error", message: "Too many requests, please try again later", error: otp_response[:resp_body] }#, status: :too_many_requests
            when "500"
                Rails.logger.error("ABHA Service Error: #{otp_response[:resp_body]}")
                @response = { status: "error", message: "ABHA service is currently unavailable", error: otp_response[:resp_body] }#, status: :service_unavailable
            else
                Rails.logger.error("Unexpected Response: #{otp_response[:resp_body]}")
                @response = { status: "error", message: "Unexpected response from ABHA service", error: otp_response[:resp_body] }#, status: :unprocessable_entity
            end
        rescue JSON::ParserError => e
            Rails.logger.error("JSON parsing error: #{e.message}")
            @response = { status: "error", message: "Invalid response format" }#, status: :internal_server_error
        rescue StandardError => e
            Rails.logger.error("Error generating Aadhar OTP: #{e.message}")
            Rails.logger.error(e.backtrace.join("\n"))
            @response = { status: "error", message: "Something went wrong" }#, status: :internal_server_error
        end
    end

File "After" genAI assisted Validations

def generate_aadhar_otp
        begin
            # Enhanced validation with detailed error message
            unless params["aadhar"].present?
                return @response = { 
                status: "error", 
                message: "Aadhaar number is required"
                }
            end
        
            unless VerhoeffValidator.validate_aadhaar(params["aadhar"])
                return @response = { 
                status: "error", 
                message: "Invalid Aadhaar number. Please provide a valid 12-digit Aadhaar number."
                }
            end
      
          auth_token = AbhaWebService.authenticate_abha
          
          # Validate auth token
          if auth_token.nil? || auth_token.empty?
            return @response = { 
              status: "error", 
              message: "Authentication failed - invalid token" 
            }
          end
          encrypted_aadhar = RsaEncryption.oaep_mgf1_padding(params["aadhar"])
          otp_response = AbhaWebService.generate_aadhar_otp(encrypted_aadhar, auth_token)
          
          # Validate response format
          unless otp_response.is_a?(Hash) && otp_response[:resp_status].present?
            raise StandardError, "Invalid response format from ABHA service"
          end
      
          case otp_response[:resp_status]
          when "200"
            @otp_txn_id = JSON.parse(otp_response[:resp_body])["txnId"]
            raise StandardError, "Transaction ID missing in response" if @otp_txn_id.nil?
            @response = { status: "success", txn_id: @otp_txn_id }
          when "400"
            Rails.logger.error("Bad Request: #{otp_response[:resp_body]}")
            @response = { 
              status: "error", 
              code: 400,
              message: "Invalid request parameters", 
              error: otp_response[:resp_body] 
            }
          when "401"
            Rails.logger.error("Unauthorized: #{otp_response[:resp_body]}")
            @response = { 
              status: "error",
              code: 401, 
              message: "Authentication failed", 
              error: otp_response[:resp_body] 
            }
          when "404"
            Rails.logger.error("Not Found: #{otp_response[:resp_body]}")
            @response = { 
              status: "error",
              code: 404, 
              message: "Resource not found", 
              error: otp_response[:resp_body] 
            }
          when "429"
            Rails.logger.error("Rate Limited: #{otp_response[:resp_body]}")
            @response = { 
              status: "error",
              code: 429, 
              message: "Too many requests, please try again later", 
              error: otp_response[:resp_body] 
            }
          when "500"
            Rails.logger.error("ABHA Service Error: #{otp_response[:resp_body]}")
            @response = { 
              status: "error",
              code: 500, 
              message: "ABHA service is currently unavailable", 
              error: otp_response[:resp_body] 
            }
          else
            Rails.logger.error("Unexpected Response: #{otp_response[:resp_body]}")
            @response = { 
              status: "error",
              code: 422, 
              message: "Unexpected response from ABHA service", 
              error: otp_response[:resp_body] 
            }
          end
        rescue JSON::ParserError => e
          Rails.logger.error("JSON parsing error: #{e.message}")
          @response = { 
            status: "error",
            code: 500, 
            message: "Invalid response format",
            error: e.message 
          }
        rescue StandardError => e
            Rails.logger.error("Error generating Aadhar OTP: #{e.message}")
            Rails.logger.error(e.backtrace.join("\n"))
            @response = { 
                status: "error",
                code: 500, 
                message: "Something went wrong",
                error: e.message 
            }
        end
    end
Clone this wiki locally