Merge branch 'beta' into feature/auth-session

src/modules/assign/assign.controller.ts

@@ -15,7 +15,7 @@ export class AssignController {
   @RequireSomePermission(
     PERMISSIONS_GROUPS.USERS.permissions.ADMIN
   )
-  @RequireModule(DADOSFERA_MODULES_KEYS.PUBLIC_ASSIGN_EMBED)
+  @RequireModule(DADOSFERA_MODULES_KEYS.EMBED_ASSIGNED)
   create(@Body() createAssignDto: CreateAssignDto, @User() user: RequestUser) {
     const metadata = PackTheMetadata(user);
     return this.assignService.create(createAssignDto, metadata);
@@ -25,7 +25,7 @@ export class AssignController {
   @RequireSomePermission(
     PERMISSIONS_GROUPS.USERS.permissions.ADMIN
   )
-  @RequireModule(DADOSFERA_MODULES_KEYS.PUBLIC_ASSIGN_EMBED)
+  @RequireModule(DADOSFERA_MODULES_KEYS.EMBED_ASSIGNED)
   async get(@User() user: RequestUser) {
     const metadata = PackTheMetadata(user);
     return await this.assignService.get(metadata);

src/modules/assign/assign.service.ts

@@ -33,6 +33,6 @@ export class AssignService implements OnModuleInit {
   }
 
   async get(metadata: Metadata) {
-    return await lastValueFrom(this.ducService.GetAssignPublicKey(metadata))
+    return await lastValueFrom(this.ducService.GetAssignPublicKey({}, metadata))
   }
 }

src/modules/auth/auth.controller.ts

@@ -27,7 +27,7 @@ import {
   AuthConfirmResetPasswordRequest,
   AuthEnableTotpMfaRequest,
   AuthDisableTotpMfaRequest,
-  AuthVerifyTotpMfaRequest,
+  AuthVerifyTotpMfaRequest
 } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/messages';
 
 import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
@@ -54,6 +54,13 @@ import jwt, { JwtPayload } from 'jsonwebtoken';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { Language } from 'src/decorators/language.decorator';
 import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
+import { Cookie } from 'express-session';
+
+type CookiesValues = {
+  accessToken?: string;
+  refreshToken?: string;
+  userId?: string
+}
 
 @ApiTags('Auth')
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
@@ -94,7 +101,11 @@ export class AuthController {
       const metadata = PackTheMetadata({ language });
       this.logger.info('metadata: ' + JSON.stringify(metadata.toJSON()));
       const data = await this.authClient.signIn({ username, password, totp }, metadata);
-      this.addTokenInCookie(res, data.tokens);
+      this.addTokenInCookie(res, {
+        accessToken: data.tokens.accessToken,
+        refreshToken: data.tokens.refreshToken,
+        userId: data.user.id
+      });
 
       return res.send(data);
     } catch (error) {
@@ -150,17 +161,19 @@ export class AuthController {
     @Res() res: Response,
   ) {
     this.logger.info('/auth - RefreshAccessToken');
-    const { refreshToken, customerName: customer_name } = body;
+    const frontHost = origin.replace(/^https?:\/\//, '');
+    const { refreshToken, userId } = body;
 
     const metadata = PackTheMetadata({
       language,
-      customer_name,
+      custom_host: frontHost,
     });
 
-    const data = await this.authClient.refreshAccessToken({ refreshToken }, metadata);
+    const data = await this.authClient.refreshAccessToken({ refreshToken, userId }, metadata);
 
     this.addTokenInCookie(res, {
       accessToken: data.accessToken,
+      userId
     });
 
     return res.send(data);
@@ -477,7 +490,7 @@ export class AuthController {
     this.logger.info('GET /auth/me ')
     // Lê cookies
     const accessToken = req.cookies['ddf-auth'];
-    let customerName = '';
+    const userId = req.cookies['ddf-user-id'];
 
     this.logger.info('Has cookie: ' + Boolean(accessToken))
     let payload: any;
@@ -487,7 +500,6 @@ export class AuthController {
       const decoded: any = accessToken && jwt.decode(accessToken, { complete: true });
       if (!decoded) throw new Error('Invalid token')
       const { kid } = decoded.header;
-      customerName = decoded.payload.customer_name;
       // Busca a chave pública
       const { keys } = await this.authClient.getPublicKeys();
       const pemValue = keys.find((k) => k.kid === kid)?.pem;
@@ -511,21 +523,21 @@ export class AuthController {
       this.logger.info('Token is invalid')
       this.logger.info('Has Refresh Token: '+ Boolean(refreshToken))
       // Se access token inválido, tenta refresh
-      if (!refreshToken || !customerName) {
+      if (!refreshToken || !userId) {
         this.logger.error('Invalid refresh token or customer name');
         return res.status(401).json({ error: 'Not authenticated' });
       }
       try {
         // Chama refreshAccessToken
         const metadata = PackTheMetadata({
-          customer_name: customerName
         });
         this.logger.info('Call Refresh Token')
-        const data = await this.authClient.refreshAccessToken({ refreshToken }, metadata);
+        const data = await this.authClient.refreshAccessToken({ refreshToken, userId }, metadata);
         this.logger.info('Finish Refresh Token')
         // Retorna novo access token e dados mínimos
         this.addTokenInCookie(res, {
           accessToken: data.accessToken,
+          userId
         });
         // Decodifica novo token
         const decoded: any = jwt.decode(data.accessToken, { complete: true });
@@ -547,16 +559,16 @@ export class AuthController {
     }
   }
 
-  private addTokenInCookie(res: Response, tokens: { accessToken?: string, refreshToken?: string }) {
+  private addTokenInCookie(res: Response, data: CookiesValues) {
     let exp = 1000 * 60 * 5; // 5 minutes
 
-    if (tokens.accessToken) {
-      const { exp: expiration } = jwt.decode(tokens.accessToken) as JwtPayload;
+    if (data.accessToken) {
+      const { exp: expiration } = jwt.decode(data.accessToken) as JwtPayload;
       exp = (expiration - 30) * 1000; // exp em segundos, maxAge em ms
 
       this.logger.info('Set Cookie ddf-auth')
-      res.cookie('ddf-auth', tokens.accessToken, {
-        domain: 'dadosfera.local',
+      res.cookie('ddf-auth', data.accessToken, {
+        domain: 'dadosfera.ai',
         maxAge: exp,
         httpOnly: true,
         secure: true,
@@ -564,10 +576,21 @@ export class AuthController {
       });
     }
 
-    if (tokens.refreshToken) {
+    if (data.refreshToken) {
       this.logger.info('Set Cookie ddf-refresh-auth')
-      res.cookie('ddf-refresh-auth', tokens.refreshToken, {
-        domain: 'dadosfera.local',
+      res.cookie('ddf-refresh-auth', data.refreshToken, {
+        domain: 'dadosfera.ai',
+        maxAge: exp,
+        httpOnly: true,
+        secure: true,
+        sameSite: 'none', // Necessário para cookies em requisições cross-site
+      });
+    }
+
+    if (data.userId) {
+      this.logger.info('Set Cookie ddf-refresh-auth')
+      res.cookie('ddf-user-id', data.userId, {
+        domain: 'dadosfera.ai',
         maxAge: exp,
         httpOnly: true,
         secure: true,

src/modules/auth/auth.service.ts

@@ -4,7 +4,7 @@ import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { lastValueFrom } from 'rxjs';
 
 import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
-import { AuthProtoService as AuthServiceInterface } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+import { AuthProtoService as AuthServiceInterface, IdentityProviderProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
 import {
   AuthSnowflakeSignInRequest,
   AuthSignInRequest,
@@ -23,11 +23,16 @@ import { DucClient } from '../duc/client.config';
 import { Metadata } from '@grpc/grpc-js';
 import { BulkEditResponse } from './dtos/login';
 
+
 @Injectable()
 export class AuthClientService implements OnModuleInit {
+
+
   logger: DadosferaLogger;
 
+
   private authService: AuthServiceInterface;
+  private identityProviderService: IdentityProviderProtoService;
   constructor(
     @Inject(DadosferaLogger)
     dadosferaLogger: DadosferaLogger,
@@ -40,6 +45,10 @@ export class AuthClientService implements OnModuleInit {
     this.authService = this.grpcClient.getService<AuthServiceInterface>(
       ProtoServices.AuthProtoService,
     );
+
+    this.identityProviderService = this.grpcClient.getService<IdentityProviderProtoService>(
+      ProtoServices.IdentityProviderProtoService,
+    );
   }
 
   async getPublicKeys() {
@@ -100,13 +109,13 @@ export class AuthClientService implements OnModuleInit {
   }
 
   async refreshAccessToken(
-    { refreshToken }: AuthRefreshAccessTokenRequest,
+    { refreshToken, userId }: AuthRefreshAccessTokenRequest,
     metadata: Metadata,
   ) {
     this.logger.info('RefreshAccessToken');
 
     return lastValueFrom(
-      this.authService.AuthRefreshAccessToken({ refreshToken }, metadata),
+      this.authService.AuthRefreshAccessToken({ refreshToken, userId }, metadata),
     );
   }
 

src/modules/auth/dtos/login.ts

@@ -122,7 +122,7 @@ export class AuthRefreshAccessTokenReq {
   @ApiProperty()
   refreshToken: string;
   @ApiProperty()
-  customerName: string;
+  userId: string;
 }
 export class AuthRefreshAccessTokenRes {
   @ApiProperty()

src/modules/auth/passport-strategies/google-strategy.ts

@@ -26,6 +26,7 @@ export class GoogleLoginStrategy extends PassportStrategy(
       callbackURL: oauthSecrets['google-login'].redirect_uri,
       scope: ['email', 'profile', 'openid'],
     };
+    console.log("GoogleLoginStrategy", options.clientID, options.callbackURL);
     const verify = (
       accessToken: string,
       refreshToken: string,

src/modules/catalog/catalog.controller.ts

@@ -117,6 +117,52 @@ export class CatalogController {
     return res;
   }
 
+  @Get('/download')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
+  async dowloadAsserts(
+    @User() user: RequestUser,
+    @Query() query: ICatalogAllRequest,
+    @Res() res: Response
+  ) {
+    const { user_id, customer_name, customer_id, username, permissions } = user;
+    this.logger.info(`/catalog/download - searchCatalog`, {
+      user_id,
+      customer_name,
+    });
+
+    const is_data_manager = permissions.includes(
+      PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER.seqid,
+    );
+
+    const roles = await this.catalogService.getUserRolesIds(user_id);
+
+    const metadata = PackTheMetadata({
+      user_id,
+      customer_id,
+      customer_name,
+      username,
+      roles,
+      is_data_manager,
+    });
+
+    const {
+      file,
+      filename
+    } = await this.catalogService.downloadAssets(
+      query,
+      metadata,
+      customer_id,
+    );
+
+    res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+    res.setHeader('Content-Type', 'text/csv');
+
+    res.end(file);
+  }
+
   @ApiInternalOnlyEndpoint()
   @Get('data-asset')
   async findByPipelineAndObject(@User() user: RequestUser, @Query() query) {

src/modules/catalog/catalog.service.ts

@@ -25,6 +25,7 @@ import { UsersService } from '../users/users.service';
 import { RolesService } from '../roles/roles.service';
 import { Metadata } from '@grpc/grpc-js';
 import {
+  AssetReporter,
   BatchRemoveRlsRulesRequest,
   IUpdateDataRequest,
   TriggerCatalogReq,
@@ -234,6 +235,34 @@ class CatalogService implements OnModuleInit {
     return { data_assets: response, total };
   }
 
+  async downloadAssets(
+    query: Record<string, any>,
+    metadata: Metadata,
+    customer_id: string,
+  ) {
+    const data = await this.searchDataAssets(query, metadata, customer_id);
+
+    const formatData = data.data_assets.map(asset => ({
+      id: asset.id,
+      display_name: asset.display_name,
+      data_asset_type: asset.data_asset_type,
+      created_at: asset.created_at,
+      tags: '[' + asset.tags.join(', ') + ']'
+    }))
+
+    const parser = ParserBuilder.build<AssetReporter>('csv');
+
+    const file = await parser.parse(formatData);
+
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const filename = `dadosfera_assets_${timestamp}.csv`;
+
+    return {
+      file,
+      filename
+    }
+  }
+
   async getOneDataAsset(data: {
     id: string;
     customer_id: string;

src/modules/catalog/dtos/index.ts

@@ -320,3 +320,11 @@ export class BatchRemoveRlsRulesRequest {
   @ApiPropertyOptional()
   id_rls?: string;
 }
+
+export type AssetReporter = {
+  id: string;
+  display_name: string;
+  data_asset_type: string;
+  created_at: string;
+  tags: string;
+}

src/modules/catalog/share/share.controller.ts

@@ -41,23 +41,22 @@ export class ShareController {
   @Get('/:id')
   async getShareDataAsset(
     @Param('id') id: string,
-    @User() user: RequestUser,
     @Req() request: Request
   ) {
     this.logger.info(`GET //:id`);
-    return await this.catalogShareService.getOneDataAssetPublic(id, user, request);
+    return await this.catalogShareService.getOneDataAssetPublic(id, request);
   }
 
   @Get('/:id/columns-metadata')
   async getShareDataAssetColumnsMetadata(
     @Language() language: LanguageEnum,
     @Param('id') id: string,
-    @User() user: RequestUser
+    @Req() request: Request
   ): Promise<IColumnsMetadataResponse> {
     this.logger.info(`GET /:id/columns-metadata`);
 
     const columns_metadata =
-      await this.catalogShareService.getDatasetColumnsMetadata(id, user);
+      await this.catalogShareService.getDatasetColumnsMetadata(id, request);
 
 
     return { columns_metadata };
@@ -67,10 +66,10 @@ export class ShareController {
   async getShareDataAssetPreview(
     @Language() language: LanguageEnum,
     @Param('id') id: string,
-    @User() user: RequestUser
+    @Req() request: Request
   ): Promise<IPreviewResponse> {
     this.logger.info(`GET /:id/preview`);
-    const preview = await this.catalogShareService.getDatasetPreview(id, user);
+    const preview = await this.catalogShareService.getDatasetPreview(id, request);
 
     return { preview };
   }
@@ -79,10 +78,10 @@ export class ShareController {
   async getShareDataAssetDocs(
     @Language() language: LanguageEnum,
     @Param('id') id: string,
-    @User() user: RequestUser
+    @Req() request: Request
   ): Promise<IDocsResponse> {
     this.logger.info(`GET /:id/docs`);
-    const docs = await this.catalogShareService.getDataDocs(id, user);
+    const docs = await this.catalogShareService.getDataDocs(id, request);
 
     return { docs };
   }

src/modules/catalog/share/share.module.ts

@@ -9,6 +9,7 @@ import { ShareController } from "./share.controller";
 import DadosferaLogger from "@dadosfera/dadosfera-logs";
 import { ShareService } from "./share.service";
 import { MixpanelModule } from "src/modules/mixpanel/mixpanel.module";
+import { AuthModule } from "src/modules/auth/auth.module";
 
 const client = new CatalogClientConfiguration();
 
@@ -19,7 +20,8 @@ const client = new CatalogClientConfiguration();
     RolesModule,
     CustomersModule,
     ShareMetadataModule,
-    MixpanelModule
+    MixpanelModule,
+    AuthModule
   ],
   controllers: [ShareController],
   providers: [ShareService, DadosferaLogger],

src/modules/catalog/share/share.service.ts

@@ -22,6 +22,9 @@ import { ShareMetadataService } from 'src/modules/share-metadata/share-metadata.
 import { isJWT } from 'class-validator';
 import { MixpanelService } from 'src/modules/mixpanel/mixpanel.service';
 import { Request } from 'express';
+import jwt from 'jsonwebtoken';
+import { AuthClientService } from 'src/modules/auth/auth.service';
+
 
 export class ShareService implements OnModuleInit {
   catalogReadService: ReadService.CatalogReadServices;
@@ -36,6 +39,7 @@ export class ShareService implements OnModuleInit {
     private readonly roleService: RolesService,
     private readonly shareMetadataService: ShareMetadataService,
     private readonly mixpanelService: MixpanelService,
+    private authClient: AuthClientService,
   ) {
     this.logger = dadosferaLogger.logger;
   }
@@ -47,8 +51,8 @@ export class ShareService implements OnModuleInit {
       );
   }
 
-  async getDatasetColumnsMetadata(id: string, user: RequestUser) {
-    const shareMetadata = await this.getShareMetadata(id, user);
+  async getDatasetColumnsMetadata(id: string, request: Request) {
+    const shareMetadata = await this.getShareMetadata(id, request);
     const metadata = PackTheMetadata({
       customer_id: shareMetadata.customerId,
       customer_name: shareMetadata.customerName,
@@ -63,8 +67,8 @@ export class ShareService implements OnModuleInit {
     return result;
   }
 
-  async getDatasetPreview(id: string, user: RequestUser) {
-    const shareMetadata = await this.getShareMetadata(id, user);
+  async getDatasetPreview(id: string, request: Request) {
+    const shareMetadata = await this.getShareMetadata(id, request);
     const metadata = PackTheMetadata({
       customer_id: shareMetadata.customerId,
       customer_name: shareMetadata.customerName,
@@ -79,14 +83,14 @@ export class ShareService implements OnModuleInit {
     return result;
   }
 
-  async getOneDataAssetPublic(id: string, user: RequestUser, request: Request) {
+  async getOneDataAssetPublic(id: string, request: Request) {
     this.logger.info("getOneDataAssetPublic: " + JSON.stringify({
-      id,
-      userId: user?.user_id,
-      customerId: user?.customer_id
+      id
     }))
     try {
-      const shareMetadata = await this.getShareMetadata(id, user);
+    const user = await this.getUserFromRequest(request);
+
+      const shareMetadata = await this.getShareMetadata(id, request);
 
       const mixpanelTracker = {
         asset: shareMetadata.assetId,
@@ -148,8 +152,8 @@ export class ShareService implements OnModuleInit {
     return { data_asset: asset[0] };
   }
 
-  async getDataDocs(id: string, user: RequestUser) {
-    const shareMetadata = await this.getShareMetadata(id, user);
+  async getDataDocs(id: string, request: Request) {
+    const shareMetadata = await this.getShareMetadata(id, request);
     const metadata = PackTheMetadata({
       customer_id: shareMetadata.customerId,
       customer_name: shareMetadata.customerName,
@@ -197,21 +201,8 @@ export class ShareService implements OnModuleInit {
     });
   }
 
-  // private async validateShareAssign(token: string) {
-  //   const tokenDecoded = jwt.decode(token, {
-  //     complete: true,
-  //   });
 
-  //   jwt.verify(token, this.pemValue, {
-  //     algorithms: ['RS256'],
-  //   });
-
-  //   const shareId = (tokenDecoded.payload as JwtPayload).sub;
-  //   const metadata = PackTheMetadata({});
-  //   return await this.shareMetadataService.get(shareId, metadata);
-  // }
-
-  private async getShareMetadata(id: string, user: RequestUser) {
+  private async getShareMetadata(id: string, request: Request) {
     const metadata = PackTheMetadata({});
     this.logger.info('GET share metadata')
     const info = await this.shareMetadataService.get(id, metadata);
@@ -219,6 +210,8 @@ export class ShareService implements OnModuleInit {
       return info;
     }
 
+    const user = await this.getUserFromRequest(request);
+
     if (info.type === 'private') {
       if (!user) {
         throw new ForbiddenException(
@@ -244,4 +237,39 @@ export class ShareService implements OnModuleInit {
     }
     return info;
   }
+
+   private async getUserFromRequest(request: Request): Promise<RequestUser | null> {
+    const accessToken = request.get('Authorization');
+    if (accessToken) {
+      const accessTokenDecoded: any = jwt.decode(accessToken, {
+        complete: true,
+      });
+
+      const { kid } = accessTokenDecoded.header;
+
+      const { keys } = await this.authClient.getPublicKeys();
+
+      const pemValue = keys.find((key) => key.kid === kid);
+
+      if (!pemValue) {
+        return null;
+      }
+
+      jwt.verify(accessToken, pemValue.pem);
+      const accessTokenPayload = accessTokenDecoded.payload;
+
+      return {
+        user_id: accessTokenPayload.user_id,
+        username: accessTokenPayload.username,
+        permissions: accessTokenPayload.permissions,
+        customer_id: accessTokenPayload.customer_id,
+        customer_name: accessTokenPayload.customer_name,
+        customer_tier: accessTokenPayload.customer_tier,
+        customer_modules: accessTokenPayload.customer_modules,
+        access_token: accessToken,
+      };
+    }
+
+    return null;
+  }
 }

src/modules/identity-provider/dto/identity-provider.dto.ts

@@ -0,0 +1,47 @@
+import { ApiProperty } from "@nestjs/swagger";
+
+export class CreateIdentityProvider {
+
+  @ApiProperty()
+  name: string;
+
+  @ApiProperty()
+  clientId: string;
+
+  @ApiProperty()
+  clientSecret: string;
+
+  @ApiProperty()
+  issuerUrl: string;
+
+  @ApiProperty()
+  permissions: number[];
+}
+
+
+export class IdentityProviderResponse {
+
+  @ApiProperty()
+  id: string;
+
+  @ApiProperty()
+  name: string;
+
+  @ApiProperty()
+  clientId: string;
+
+  @ApiProperty()
+  issueUrl: string;
+
+  @ApiProperty()
+  permissions: {
+    id: number;
+    name: string;
+  }[];
+}
+
+export class IdentityProviderListResponse {
+
+  @ApiProperty()
+  providers: IdentityProviderResponse[]
+}

src/modules/identity-provider/dto/sso-signin.dto.ts

@@ -0,0 +1,10 @@
+export class SsoSignInDto {
+    readonly nonce: string;
+    readonly codeVerifier: string;
+    readonly state: string;
+    readonly id: string;
+    readonly clientId: string;
+    readonly clientSecret: string;
+    readonly issuerUrl: string;
+    readonly redirectUrls: string[];
+}

src/modules/identity-provider/identity-provider.controller.ts

@@ -0,0 +1,246 @@
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  HttpCode,
+  HttpStatus,
+  Inject,
+  Param,
+  Post,
+  Put,
+  Redirect,
+  Req,
+} from '@nestjs/common';
+import { IdentityProviderService } from './identity-provider.service';
+import { RequestUser, User } from 'src/decorators/user.decorator';
+import { Language } from 'src/decorators/language.decorator';
+import { LanguageEnum } from 'src/utils/languages.enum';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
+import { ApiOkResponse } from '@nestjs/swagger';
+import {
+  CreateIdentityProvider,
+  IdentityProviderListResponse,
+  IdentityProviderResponse,
+} from './dto/identity-provider.dto';
+import { Request } from 'express';
+import ErrorCodes from 'src/utils/errorCodes';
+import {
+  Authenticated,
+  RequireModule,
+  RequireSomePermission,
+} from 'src/decorators/authentication.decorator';
+import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+
+@Controller('identity-providers')
+export class IdentityProviderController {
+  logger: DadosferaLogger;
+
+  constructor(
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+    private identityProviderService: IdentityProviderService,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  @Post()
+  @HttpCode(HttpStatus.OK)
+  @ApiOkResponse({ type: IdentityProviderResponse })
+  @Authenticated()
+  @RequireModule('sso')
+  @RequireSomePermission(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  async addIdentityProvider(
+    @User() user: RequestUser,
+    @Body() body: CreateIdentityProvider,
+    @Language() language: LanguageEnum,
+  ) {
+    this.logger.info('POST /identity-providers');
+
+    const metadata = PackTheMetadata({
+      ...user,
+      language,
+    });
+
+    return await this.identityProviderService.create(body, metadata);
+  }
+
+  @Get()
+  @HttpCode(HttpStatus.OK)
+  @ApiOkResponse({ type: IdentityProviderListResponse })
+  @Authenticated()
+  @RequireModule('sso')
+  @RequireSomePermission(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  async getProviders(
+    @User() user: RequestUser,
+    @Language() language: LanguageEnum,
+  ) {
+    this.logger.info('GET identity-providers');
+    const metadata = PackTheMetadata({
+      ...user,
+      language,
+    });
+
+    const result = await this.identityProviderService.getList(metadata);
+    return result;
+  }
+
+  @Delete(':id')
+  @HttpCode(HttpStatus.NO_CONTENT)
+  @RequireModule('sso')
+  @RequireSomePermission(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  async deleteIdentityProvider(
+    @Param('id') id: string,
+    @User() user: RequestUser,
+  ) {
+    this.logger.info('DELETE /identity-providers');
+
+    const metadata = PackTheMetadata({
+      ...user,
+    });
+
+    return await this.identityProviderService.deleteIdentityProvider(
+      id,
+      metadata,
+    );
+  }
+
+  @Put(':id')
+  @HttpCode(HttpStatus.OK)
+  @Authenticated()
+  @RequireModule('sso')
+  @RequireSomePermission(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  async updateIdentityProviders(
+    @Param('id') id: string,
+    @Body() body: CreateIdentityProvider,
+    @User() user: RequestUser,
+  ) {
+    this.logger.info('PUT /identity-providers');
+
+    const metadata = PackTheMetadata({
+      ...user,
+    });
+
+    return await this.identityProviderService.updateIdentityProviders(
+      id,
+      body,
+      metadata,
+    );
+  }
+
+  @Post('/callback')
+  @HttpCode(HttpStatus.OK)
+  async callbackIdp(
+    @Req() req: Request,
+    @Language() language: LanguageEnum,
+    @Body()
+    body: {
+      state: string;
+      code: string;
+    },
+  ) {
+    this.logger.info('GET /identity-providers/callback');
+    const { code, state } = body;
+
+    if (!code) {
+      this.logger.error('No code received from IDP');
+      throw new Error(ErrorCodes.IDENTITY_PROVIDER.INVALID_RESPONSE);
+    }
+
+    if (!state) {
+      this.logger.error('No state received from IDP');
+      throw new Error(ErrorCodes.IDENTITY_PROVIDER.INVALID_RESPONSE);
+    }
+
+    try {
+      const origin = req.headers['origin'] as string;
+      this.logger.info('Header Origin: ' + origin);
+
+      const lang =
+        language.substring(0, 2) + language.substring(2).toUpperCase();
+      const callbackUrl =
+        process.env.ENV !== 'prd'
+          ? `${origin}/auth/callback`
+          : `${origin}/${lang}/auth/callback`;
+
+      this.logger.info('Callback URL: ' + callbackUrl);
+      return await this.identityProviderService.getTokenByIdp(
+        code,
+        state,
+        callbackUrl,
+      );
+    } catch (error) {
+      this.logger.error(error);
+      throw error;
+    }
+  }
+
+  @Get('/links')
+  @HttpCode(HttpStatus.OK)
+  async providerLinks(@Req() req: Request) {
+    this.logger.info('GET /identity-providers/links');
+
+    try {
+      const frontDomain = req.headers['origin'] as string;
+      this.logger.info('Header Origin: ' + frontDomain);
+
+      if (!frontDomain) {
+        this.logger.info('Not found front domain');
+        throw new Error(ErrorCodes.IDENTITY_PROVIDER.INVALID_HEADER);
+      }
+
+      const result =
+        await this.identityProviderService.identityProvidersLinksPerDomain(
+          frontDomain,
+        );
+      return result;
+    } catch (error) {
+      this.logger.error(error);
+      throw error;
+    }
+  }
+
+  @Get(':id')
+  @HttpCode(HttpStatus.OK)
+  @Redirect()
+  async loginIdp(
+    @Param('id') id: string,
+    @Req() req: Request,
+    @Language() language: LanguageEnum,
+  ) {
+    this.logger.info('GET /identity-providers/:id');
+
+    try {
+      const frontDomain =
+        (req.headers['origin'] as string) || (req.headers['referer'] as string);
+      this.logger.info(`Front domain: ${frontDomain}`);
+      const host =
+        frontDomain.lastIndexOf('/') !== -1
+          ? frontDomain.substring(0, frontDomain.lastIndexOf('/'))
+          : frontDomain;
+
+      const lang =
+        language.substring(0, 2) + language.substring(2).toUpperCase();
+      const callbackUrl =
+        process.env.ENV !== 'prd'
+          ? `${host}/auth/callback`
+          : `${host}/${lang}/auth/callback`;
+
+      this.logger.info('Callback URL: ' + callbackUrl);
+      const redirectUrl =
+        await this.identityProviderService.loginIdentityProvider(
+          id,
+          callbackUrl,
+        );
+
+      this.logger.info(`Redirecting to: ${redirectUrl}`);
+      return {
+        url: redirectUrl,
+      };
+    } catch (error) {
+      this.logger.error(error);
+      throw error;
+    }
+  }
+}

src/modules/identity-provider/identity-provider.module.ts

@@ -0,0 +1,16 @@
+import { Module } from '@nestjs/common';
+import { IdentityProviderController } from './identity-provider.controller';
+import { IdentityProviderService  } from './identity-provider.service';
+import { ClientsModule } from '@nestjs/microservices';
+import { DucClient } from '../duc/client.config';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+import { ServicesModule } from 'src/services/service.module';
+
+const client = new DucClient();
+
+@Module({
+  imports: [ClientsModule.register([client.providerOptions]), ServicesModule],
+  controllers: [IdentityProviderController],
+  providers: [IdentityProviderService, DadosferaLogger],
+})
+export class IdentityProviderModule {}

src/modules/identity-provider/identity-provider.service.ts

@@ -0,0 +1,185 @@
+import {
+  BadRequestException,
+  Inject,
+  Injectable,
+  OnModuleInit,
+} from '@nestjs/common';
+import { DucClient } from '../duc/client.config';
+import { ClientGrpc } from '@nestjs/microservices';
+import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
+import { IdentityProviderProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+import { lastValueFrom } from 'rxjs';
+import { IdentityProviderRequest } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/messages';
+import { Metadata } from '@grpc/grpc-js';
+import { Issuer, generators } from 'openid-client';
+import { SsoSignInDto } from './dto/sso-signin.dto';
+import { CacheService } from 'src/services/cache.service';
+import { CreateIdentityProvider } from './dto/identity-provider.dto';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+
+@Injectable()
+export class IdentityProviderService implements OnModuleInit {
+  private logger: DadosferaLogger;
+  private identityProviderService: IdentityProviderProtoService;
+  constructor(
+    @Inject(DucClient.name) private readonly grpcClient: ClientGrpc,
+    private readonly cacheService: CacheService<SsoSignInDto>,
+    @Inject(DadosferaLogger)
+    private dadosferaLoggger: DadosferaLogger
+  ) {
+    this.logger = dadosferaLoggger.logger;
+  }
+
+  onModuleInit() {
+    this.identityProviderService =
+      this.grpcClient.getService<IdentityProviderProtoService>(
+        ProtoServices.IdentityProviderProtoService,
+      );
+  }
+
+  async create(body: IdentityProviderRequest, metadata: Metadata) {
+    this.logger.info("Call IdentityProvider GRPC Create")
+    return await lastValueFrom(
+      this.identityProviderService.Create(body, metadata),
+    );
+  }
+
+  async getList(metadata: Metadata) {
+    this.logger.info("Call IdentityProvider GRPC GetList")
+    return await lastValueFrom(
+      this.identityProviderService.GetList({}, metadata),
+    );
+  }
+
+  async loginIdentityProvider(id: string, callbackUrl: string) {
+    this.logger.info("Call IdentityProvider GRPC FindIdentityProvider with: " + id);
+    const idp = await lastValueFrom(
+      this.identityProviderService.FindIdentityProvider({ id }),
+    );
+
+    this.logger.info("Discovery issueURL: " + idp.issuerUrl)
+    const issuer = await Issuer.discover(idp.issuerUrl);
+    const client = new issuer.Client({
+      client_id: idp.clientId,
+      client_secret: idp.clientSecret,
+      redirect_uris: idp.redirectUrls,
+      response_types: ['code'],
+    });
+
+    this.logger.info("Generate Challenge")
+    const code_verifier: string = generators.codeVerifier();
+    const code_challenge: string = generators.codeChallenge(code_verifier);
+
+    this.logger.info("Generate State")
+    const state = generators.state();
+
+    this.logger.info("Generate Nonce")
+    const nonce = generators.nonce();
+
+    // Using state because it is returned in the callback
+    // and we can use it to retrieve the code_verifier and nonce
+    this.logger.info("Save Login parameters in redis")
+    await this.cacheService.set(state, {
+      codeVerifier: code_verifier,
+      nonce,
+      id: idp.id,
+      state,
+      clientId: idp.clientId,
+      clientSecret: idp.clientSecret,
+      issuerUrl: idp.issuerUrl,
+      redirectUrls: idp.redirectUrls,
+    });
+
+    this.logger.info("Generate Authorization URL")
+    const url = client.authorizationUrl({
+      scope: 'openid email',
+      response_type: 'code',
+      code_challenge,
+      code_challenge_method: 'S256',
+      state,
+      nonce,
+      redirect_uri: callbackUrl,
+    });
+    const idpUrl = url + '&identity_provider=' + idp.name;
+    this.logger.info(idpUrl)
+    return idpUrl;
+  }
+
+  async getTokenByIdp(code: string, state: string, callbackUrl: string) {
+    this.logger.info("Get login parameters in redis")
+    const ssoSign = await this.cacheService.get(state);
+
+    if (!ssoSign) {
+      this.logger.info("Login Parameters Not Found")
+      throw new BadRequestException('SSO sign-in is expired or not found');
+    }
+
+    this.logger.info("Discovery Issue URL: " + ssoSign.issuerUrl)
+    const issuer = await Issuer.discover(ssoSign.issuerUrl);
+    const client = new issuer.Client({
+      client_id: ssoSign.clientId,
+      client_secret: ssoSign.clientSecret,
+      redirect_uris: ssoSign.redirectUrls,
+    });
+
+    const params = client.callbackParams(
+      `${callbackUrl}?code=${code}&state=${state}`,
+    );
+    try {
+
+      this.logger.info("Get Token Set");
+      const tokenSet = await client.callback(callbackUrl, params, {
+        nonce: ssoSign.nonce,
+        code_verifier: ssoSign.codeVerifier,
+        state: ssoSign.state
+      });
+
+      this.logger.info("Delete parameters in redis");
+      await this.cacheService.delete(ssoSign.state);
+
+      this.logger.info("Call IdentityProvider GRPC SignInUser");
+      return await lastValueFrom(
+        this.identityProviderService.SignInUser({
+          accessToken: tokenSet.access_token,
+          idToken: tokenSet.id_token,
+          refreshToken: tokenSet.refresh_token,
+          id: ssoSign.id,
+        }),
+      );
+    } catch (error) {
+      this.logger.error(error);
+      throw error;
+    }
+  }
+
+  async deleteIdentityProvider(id: string, metadata: Metadata) {
+    this.logger.info("Call IdentityProvider GRPC Delete with: " + id)
+    return await lastValueFrom(
+      this.identityProviderService.DeleteIdentityProvider({ id }, metadata),
+    );
+  }
+
+  async updateIdentityProviders(
+    id: string,
+    body: CreateIdentityProvider,
+    metadata: Metadata,
+  ) {
+    this.logger.info("Call IdentityProvider GRPC Update with: " + id)
+    return await lastValueFrom(
+      this.identityProviderService.UpdateIdentityProvider(
+        {
+          id,
+          ...body,
+        },
+        metadata,
+      ),
+    );
+  }
+
+  async identityProvidersLinksPerDomain(frontDomain: string) {
+    this.logger.info("Call IdentityProvider GRPC LinksPerDomain with: " + frontDomain)
+    return await lastValueFrom(
+      this.identityProviderService.GetProviderLinksFromDomain({ frontDomain }),
+    );
+  }
+}

src/modules/users/dtos/entities.ts

@@ -174,3 +174,14 @@ export class GetAllDepartmentsRes {
   @ApiProperty()
   departments: string[];
 }
+
+
+export interface UserReporter {
+  name: string;
+  email: string;
+  mfaStatus: string;
+  status: string;
+  lastLogin: string;
+  createdAt: string;
+  updatedAt: string;
+}

src/modules/users/users.controller.spec.ts

@@ -8,6 +8,17 @@ import { RolesModule } from '../roles/roles.module';
 import { PermissionsModule } from '../permissions/permissions.module';
 
 // const client = new DucClient();
+jest.mock('puppeteer', () => ({
+  launch: jest.fn().mockResolvedValue({
+    newPage: jest.fn().mockResolvedValue({
+      goto: jest.fn(),
+      evaluate: jest.fn(),
+      close: jest.fn()
+    }),
+    close: jest.fn()
+  })
+}));
+
 
 const logger = {
   info: (...args) => args,

src/modules/users/users.controller.ts

@@ -12,6 +12,7 @@ import {
   Post,
   Put,
   Query,
+  Res,
   UseFilters,
 } from '@nestjs/common';
 import {
@@ -24,6 +25,7 @@ import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
 import {
   Authenticated,
   RequireAllPermissions,
+  RequireSomePermission,
 } from 'src/decorators/authentication.decorator';
 import { Language } from 'src/decorators/language.decorator';
 import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
@@ -52,6 +54,7 @@ import {
   UpdateUserRes,
 } from './dtos/entities';
 import { UsersService } from './users.service';
+import { Response } from 'express';
 
 @ApiInternalOnlyController()
 @ApiTags('Users')
@@ -80,6 +83,26 @@ export class UsersController {
     return await this.userService.findAllUsersByCustomerId(user.customer_id);
   }
 
+  @Get('/download')
+  @RequireSomePermission(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  async downloadUsersInCsv(
+    @User() user: RequestUser,
+    @Language() language: LanguageEnum,
+    @Res() res: Response
+  ) {
+    this.logger.info('downloadUsersInCsv');
+    this.userService.setLanguage(language);
+    const {
+      file,
+      filename
+    } = await this.userService.downloadUsersInCsv(user.customer_id);
+
+    res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+    res.setHeader('Content-Type', 'text/csv');
+
+    res.end(file);
+  }
+
   @Get('hierarchies')
   @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   @ApiOkResponse({ type: GetAllHierarchiesRes })

src/modules/users/users.service.spec.ts

@@ -9,6 +9,17 @@ import { PermissionsModule } from '../permissions/permissions.module';
 
 // const client = new DucClient();
 
+jest.mock('puppeteer', () => ({
+  launch: jest.fn().mockResolvedValue({
+    newPage: jest.fn().mockResolvedValue({
+      goto: jest.fn(),
+      evaluate: jest.fn(),
+      close: jest.fn()
+    }),
+    close: jest.fn()
+  })
+}));
+
 const logger = {
   info: (...args) => args,
   error: (...args) => args,

src/modules/users/users.service.ts

@@ -21,6 +21,7 @@ import {
   IUserByCustomer,
   SetUserRolesReq,
   UpdateUserReq,
+  UserReporter,
 } from './dtos/entities';
 import { RolesService } from '../roles/roles.service';
 import { HIERARCHIES } from './hierarchies';
@@ -29,6 +30,7 @@ import { UserByCustomer } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces
 import { EnrichErrorCode } from 'src/utils/ErrorBuilder';
 import { DucClient } from '../duc/client.config';
 import { Metadata } from '@grpc/grpc-js';
+import { ParserBuilder } from 'src/utils/FileParser/parser.builder';
 
 @Injectable()
 export class UsersService implements OnModuleInit {
@@ -78,6 +80,34 @@ export class UsersService implements OnModuleInit {
     };
   }
 
+  async downloadUsersInCsv(customerId: string) {
+    const { users } = await lastValueFrom(
+      this.usersClientService.UserFindAllByCustomerId({ customerId }),
+    );
+
+    const formatUsers: UserReporter[] = users.map(user => ({
+      createdAt: user.createdAt,
+      email: user.email,
+      lastLogin: user.lastLogin,
+      mfaStatus: user.mfaStatus,
+      name: user.name,
+      status: user.status,
+      updatedAt: user.updatedAt
+    }))
+
+    const parser = ParserBuilder.build<UserReporter>('csv');
+
+    const file = await parser.parse(formatUsers);
+
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const filename = `dadosfera_users_${timestamp}.csv`;
+
+    return {
+      file,
+      filename
+    }
+  }
+
   async findOneById(id: string): Promise<{ user: IUserByCustomer }> {
     const { user } = await lastValueFrom(
       this.usersClientService.UserFindOneById({ id }),