Ncpdp integration

[smalho01]

Describe your changes

Please include a summary of the changes and the related issue/task. Please also include relevant motivation and context. List any dependencies that are required for this change, including links to other pull requests/branches in other repositories if applicable.

Issue ticket number and Jira link

Please include the Jira Ticket Number and Link for this issue/task.

Checklist before requesting a review

• I have performed a self-review of my code
• Ensure the target / base branch for any feature PR is set to dev not main (the only exception to this is releases from dev and hotfix branches)

Checklist for conducting a review

• Review the code changes and make sure they all make sense and are necessary.
• Pull the PR branch locally and test by running through workflow and making sure everything works as it is supposed to.

Workflow

Owner of the Pull Request will be responsible for merge after all requirements are met, including approval from at least one reviewer. Additional changes made after a review will dismiss any approvals and require re-review of the additional updates. Auto merging can be enabled below if additional changes are likely not to be needed. The bot will auto assign reviewers to your Pull Request for you.

In general, to fix missing rate limiting for expensive handlers in an Express app, you add a rate-limiting middleware (for example from express-rate-limit) and apply it either globally or to specific sensitive routes. This middleware counts requests per client (typically by IP) within a time window and rejects or delays requests that exceed a configured threshold, mitigating DoS via request floods.

For this file, the least intrusive, functionality-preserving fix is to introduce a small, dedicated rate limiter and apply it to the /api/updateRx/:id route (and optionally to the other DB-heavy routes if desired). We'll import express-rate-limit, define a limiter instance near the top of doctorOrders.js, and then pass it as middleware to router.patch('/api/updateRx/:id', ...). This only affects how many times the endpoint can be hit per client in a given window; it does not change the DB logic, request/response shapes, or route signatures.

Concretely:

• At the top of backend/src/routes/doctorOrders.js, add import rateLimit from 'express-rate-limit';.
• Define a limiter, e.g. const updateRxLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }); (values can be tuned; we just need reasonable protection).
• Update the route definition on line 154 from router.patch('/api/updateRx/:id', async (req, res) => { ... to router.patch('/api/updateRx/:id', updateRxLimiter, async (req, res) => { ... so all accesses to this DB-intensive handler are throttled.

This single limiter instance addresses all three alert variants, since they all refer to DB calls within the same handler.

In general, the problem is fixed by adding a rate-limiting middleware to the route (or router) so that repeated requests from a client within a short time window are rejected or delayed. For Express, a common approach is to use the express-rate-limit package and apply a limiter specifically to sensitive routes that perform expensive DB operations or external HTTP calls.

The best fix here, without changing existing behavior beyond limiting abuse, is to import express-rate-limit, define a limiter tailored for doctor order–related operations, and apply it to the PATCH /api/updateRx/:id/pickedUp route. This keeps the current route logic intact while ensuring that a single client cannot flood this endpoint. Concretely, in backend/src/routes/doctorOrders.js we should: (1) add an import of express-rate-limit near the top, (2) define a limiter (e.g., window of 15 minutes and a reasonable max number of requests, such as 100) after the other middleware setup, and (3) modify the route definition on line 250 so that the limiter is passed as a middleware before the async handler: router.patch('/api/updateRx/:id/pickedUp', pickedUpLimiter, async (req, res) => { ... });. No other functionality inside the handler needs to change.