FIX: hide internal endpoints

environment.d.ts

@@ -0,0 +1,18 @@
+declare global {
+  namespace NodeJS {
+    interface ProcessEnv {
+      NODE_ENV: 'test';
+      ENV: 'local' | 'stg' | 'prd' | 'test';
+      LOCAL_ENV: 'stg' | 'prd';
+
+      DUC_URL: string;
+      INFACTORY_URL: string;
+      PIFACTORY_URL: string;
+
+      INTERNAL_SWAGGER: 'true' | 'false';
+
+      AWS_REGION: string;
+    }
+  }
+}
+export {};

src/app.module.ts

@@ -40,24 +40,24 @@ import { MixpanelModule } from './modules/mixpanel/mixpanel.module';
       isGlobal: true,
     }),
     AuthModule,
+    ConnectionModule,
+    NetworkConfigModule,
+    InputsModule,
+    PipelinesV2Module,
+    CatalogModule,
     ConnectorModule,
     PermissionsModule,
     TermsOfUseModule,
-    ConnectionModule,
-    NetworkConfigModule,
     ConnectionTestModule,
     PipelinesModule,
-    PipelinesV2Module,
     TransformationsModule,
-    HealthModule,
-    CatalogModule,
     UsersModule,
     RolesModule,
-    InputsModule,
     OauthModule,
-    CatalogModule,
     ProductboardModule,
     MixpanelModule,
+    //Always leave HealthModule last, so it is on the bottom of swagger
+    HealthModule,
   ],
 })
 export class AppModule {}

src/decorators/swagger.decorator.ts

@@ -0,0 +1,13 @@
+import { applyDecorators } from '@nestjs/common';
+import { ApiExcludeController, ApiExcludeEndpoint } from '@nestjs/swagger';
+
+export function ApiInternalOnlyEndpoint() {
+  if (process.env.INTERNAL_SWAGGER !== 'true')
+    return applyDecorators(ApiExcludeEndpoint());
+  return () => null;
+}
+export function ApiInternalOnlyController() {
+  if (process.env.INTERNAL_SWAGGER !== 'true')
+    return applyDecorators(ApiExcludeController());
+  return () => null;
+}

src/main.ts

@@ -14,7 +14,7 @@ async function bootstrap() {
     serviceEnvironment: process.env.ENV,
   });
   const logger = new DadosferaLogger();
-
+  process.env.INTERNAL_SWAGGER = 'true';
   const app = await NestFactory.create(AppModule, {
     logger,
     cors: {
@@ -24,9 +24,20 @@ async function bootstrap() {
       optionsSuccessStatus: 204,
     },
   });
+  process.env.INTERNAL_SWAGGER = 'true';
+  const app2 = await NestFactory.create(AppModule, {
+    logger,
+    cors: {
+      origin: '*',
+      methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
+      preflightContinue: false,
+      optionsSuccessStatus: 204,
+    },
+  });
 
   app.use(helmet());
   configureSwagger(app);
+  // configureSwagger(app2);
 
   await app.listen(3333);
 }
@@ -56,9 +67,14 @@ function configureSwagger(app: INestApplication) {
 
   const document = SwaggerModule.createDocument(app, config);
 
+  let swaggerJsonFile = 'docsfera.external.json';
+  if (process.env.INTERNAL_SWAGGER === 'true') {
+    swaggerJsonFile = 'docsfera.json';
+  }
   if (process.env.ENV === 'local') SwaggerModule.setup('api', app, document);
+
   writeFileSync(
-    'docsfera.json',
+    swaggerJsonFile,
     JSON.stringify(
       {
         service: '${DOCS_API_TOKEN}',

src/modules/auth/auth.controller.ts

@@ -51,6 +51,7 @@ import ErrorCodes, { OauthErrors } from 'src/utils/errorCodes';
 import jwt from 'jsonwebtoken';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { Language } from 'src/decorators/language.decorator';
+import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 
 @ApiTags('Auth')
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
@@ -90,21 +91,6 @@ export class AuthController {
     return this.authClient.signIn({ username, password, totp }, metadata);
   }
 
-  @Post('/sso/snowflake')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.SNOWFLAKE.permissions.OPEN)
-  @HttpCode(HttpStatus.OK)
-  async snowflakeSignIn(
-    @User() user: RequestUser,
-    @Body('RelayState') relayState: string,
-  ) {
-    this.logger.info('/auth - snowflakeSignIn');
-
-    return this.authClient.snowflakeSignIn({
-      userId: user.user_id,
-      relayState,
-    });
-  }
-
   @Post('refresh-access-token')
   @HttpCode(HttpStatus.OK)
   @ApiOkResponse({ type: AuthRefreshAccessTokenRes })
@@ -123,6 +109,23 @@ export class AuthController {
     return this.authClient.refreshAccessToken({ refreshToken }, metadata);
   }
 
+  @ApiInternalOnlyEndpoint()
+  @Post('/sso/snowflake')
+  @RequireAllPermissions(PERMISSIONS_GROUPS.SNOWFLAKE.permissions.OPEN)
+  @HttpCode(HttpStatus.OK)
+  async snowflakeSignIn(
+    @User() user: RequestUser,
+    @Body('RelayState') relayState: string,
+  ) {
+    this.logger.info('/auth - snowflakeSignIn');
+
+    return this.authClient.snowflakeSignIn({
+      userId: user.user_id,
+      relayState,
+    });
+  }
+
+  @ApiInternalOnlyEndpoint()
   @Post('change-password')
   @HttpCode(HttpStatus.OK)
   async changePassword(
@@ -141,6 +144,7 @@ export class AuthController {
     });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('reset-password')
   @HttpCode(HttpStatus.OK)
   async resetPassword(
@@ -157,6 +161,7 @@ export class AuthController {
     return this.authClient.resetPassword({ username }, metadata);
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('verify-reset-password-code')
   @HttpCode(HttpStatus.OK)
   async verifyResetPasswordCode(
@@ -169,6 +174,7 @@ export class AuthController {
     return this.authClient.verifyResetPasswordCode({ username, code });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('confirm-reset-password')
   @HttpCode(HttpStatus.OK)
   async confirmResetPassword(@Body() body: AuthConfirmResetPasswordRequest) {
@@ -183,6 +189,7 @@ export class AuthController {
     });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('enable-totp')
   @HttpCode(HttpStatus.OK)
   async enableTotpMFA(
@@ -197,6 +204,7 @@ export class AuthController {
     return this.authClient.enableTotpMFA({ accessToken, password });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('disable-totp')
   @HttpCode(HttpStatus.OK)
   async disableTotpMFA(
@@ -211,6 +219,7 @@ export class AuthController {
     return this.authClient.disableTotpMFA({ accessToken, password });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('dismiss-totp')
   @HttpCode(HttpStatus.OK)
   async dismissTotpMFA(@Headers() headers) {
@@ -221,6 +230,7 @@ export class AuthController {
     return this.authClient.dismissTotpMFA({ accessToken });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('verify-totp')
   @HttpCode(HttpStatus.OK)
   async verifyTotp(@Body() body: AuthVerifyTotpMfaRequest, @Headers() headers) {
@@ -232,6 +242,7 @@ export class AuthController {
     return this.authClient.verifyTotp({ accessToken, totp });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Authenticated()
   @ApiSecurity('access-token')
   @Get('verify-access-token')
@@ -239,11 +250,13 @@ export class AuthController {
     return { access_token_status: 'valid' };
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('session/:session')
   getSession(@Param('session') session: string) {
     return this.authClient.getSession(session);
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('oauth/google')
   @UseGuards(AuthGuard('google-login'))
   googleOauth() {
@@ -251,6 +264,7 @@ export class AuthController {
     return true;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('oauth/google/callback')
   @UseGuards(AuthGuard('google-login'))
   @Redirect()

src/modules/catalog/catalog.controller.ts

@@ -39,6 +39,7 @@ import {
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
 import { Language } from 'src/decorators/language.decorator';
 import { LanguageEnum } from 'src/utils/languages.enum';
+import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 
 @ApiTags('Catalog')
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
@@ -94,6 +95,7 @@ export class CatalogController {
     return res;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('data-asset')
   async findByPipelineAndObject(@User() user: RequestUser, @Query() query) {
     const { username, user_id, customer_id, customer_name, permissions } = user;
@@ -147,6 +149,7 @@ export class CatalogController {
     );
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('tags')
   @RequireSomePermission(
     PERMISSIONS_GROUPS.CATALOG.permissions.GET,
@@ -225,6 +228,7 @@ export class CatalogController {
     return { data_asset };
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('data-asset/rls/:id')
   @RequireSomePermission(
     PERMISSIONS_GROUPS.CATALOG.permissions.GET,
@@ -433,6 +437,7 @@ export class CatalogController {
     return res;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Put('data-asset/:id/manage-permissions')
   async manageDataAssetPermissions(
     @Param('id') id: string,
@@ -454,6 +459,7 @@ export class CatalogController {
     return { data_asset: JSON.parse(response.data_asset) };
   }
 
+  @ApiInternalOnlyEndpoint()
   @Put('data-asset/:id/revoke-permissions')
   async revokeDataAssetPermissions(
     @Param('id') id: string,

src/modules/connection/connection.controller.ts

@@ -31,6 +31,7 @@ import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
 import { Language } from 'src/decorators/language.decorator';
 import { LanguageEnum } from 'src/utils/languages.enum';
+import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 
 const connectionPermissions = PERMISSIONS_GROUPS.CONNECTION.permissions;
 @UseFilters(new GrpcToHttpExceptionFilter())
@@ -47,6 +48,7 @@ export class ConnectionController {
     this.logger = dadosferaLogger.logger;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('connections-migration')
   @ApiExcludeEndpoint()
   @RequireAllPermissions(

src/modules/connector/connector.controller.ts

@@ -30,7 +30,9 @@ import {
 import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
 import { Language } from 'src/decorators/language.decorator';
 import { LanguageEnum } from 'src/utils/languages.enum';
+import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 
+@ApiInternalOnlyController()
 @ApiTags('connectors')
 @Authenticated()
 @Controller('connectors')

src/modules/inputs/inputs.controller.ts

@@ -24,6 +24,7 @@ import { UpdateInputRequest } from './dtos/old_interfaces';
 import { RequestUser, User } from 'src/decorators/user.decorator';
 import { Info } from '@dadosfera/protospack-v2/dist/lib/Input/interfaces/entities';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
+import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 
 @ApiTags('Inputs')
 @Controller('inputs')
@@ -66,6 +67,7 @@ export class InputsController {
     this.logger = dadosferaLogger.logger;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('available-entities/:plugin')
   @ApiOkResponse({ type: GetAvailableEntitiesRes })
   async getAvailableEntities(
@@ -102,6 +104,7 @@ export class InputsController {
     return response;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get()
   async findAll(@User() user: RequestUser) {
     const { user_id, customer_id, customer_name: customer } = user;
@@ -132,6 +135,7 @@ export class InputsController {
     return response;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Patch(':id')
   async update(@Body() updateInputDto: UpdateInputRequest, @Param() params) {
     const { id } = params;
@@ -147,6 +151,7 @@ export class InputsController {
     return response;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Delete(':id')
   async delete(@Body() data, @Param() params) {
     const { id } = params;

src/modules/mixpanel/mixpanel.controller.ts

@@ -1,8 +1,10 @@
 import { Body, Controller, Inject, Param, Post } from '@nestjs/common';
 import { init } from 'mixpanel';
 import { Authenticated } from 'src/decorators/authentication.decorator';
+import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 import { RequestUser, User } from 'src/decorators/user.decorator';
 
+@ApiInternalOnlyController()
 @Authenticated()
 @Controller('trackEvent')
 export class MixpanelController {

src/modules/network-config/network-config-client.config.ts

@@ -6,6 +6,8 @@ import {
 } from '@nestjs/microservices';
 import { NetworkConfig } from '@dadosfera/protospack-v2';
 
+const isLocalConnection = !!process.env.INFACTORY_URL?.includes('0.0.0.0');
+
 export class NetworkConfigGrpcClient {
   public name = 'NetworkConfigGrpcClient';
 
@@ -17,8 +19,7 @@ export class NetworkConfigGrpcClient {
         NetworkConfig.ProtoPackages.ReadPackage,
         NetworkConfig.ProtoPackages.WritePackage,
       ],
-      credentials:
-        process.env.ENV === 'local' ? undefined : credentials.createSsl(),
+      credentials: isLocalConnection ? undefined : credentials.createSsl(),
       protoPath: [
         NetworkConfig.ProtoPaths.ReadFilePath,
         NetworkConfig.ProtoPaths.WriteFilePath,

src/modules/network-config/network-config.controller.ts

@@ -39,6 +39,7 @@ export class NetworkConfigController {
   ) {
     this.logger = dadosferaLogger.logger;
   }
+
   @Get()
   @ApiOkResponse({ type: FindAllNetworkConfigsRes })
   async findAllNetworkConfigs(

src/modules/oauth/oauth.controller.ts

@@ -5,6 +5,7 @@ import { ConnectionClientService } from '../connection/client.service';
 import jwt from 'jsonwebtoken';
 import DadosferaLogger from '@dadosfera/dadosfera-logs/dist';
 import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 @ApiTags('oauth')
 @Controller('oauth')
 export class OauthController {
@@ -31,6 +32,7 @@ export class OauthController {
     return true;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('hubspot/callback')
   @UseGuards(AuthGuard('hubspot'))
   @Redirect()
@@ -44,6 +46,7 @@ export class OauthController {
     return true;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('googleads/callback')
   @UseGuards(AuthGuard('google'))
   @Redirect()
@@ -57,6 +60,7 @@ export class OauthController {
     return true;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('google-sheets/callback')
   @UseGuards(AuthGuard('google'))
   @Redirect()
@@ -70,6 +74,7 @@ export class OauthController {
     return true;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('facebook/callback')
   @UseGuards(AuthGuard('facebook'))
   @Redirect()
@@ -83,6 +88,7 @@ export class OauthController {
     return true;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('mailchimp/callback')
   @UseGuards(AuthGuard('mailchimp'))
   @Redirect()
@@ -96,6 +102,7 @@ export class OauthController {
     return true;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('salesforce/callback')
   @UseGuards(AuthGuard('salesforce'))
   @Redirect()

src/modules/permissions/permissions.controller.ts

@@ -8,7 +8,9 @@ import { LanguageEnum } from 'src/utils/languages.enum';
 import { GetPublicPermissionsRes } from './dto/entities';
 import { PermissionsService } from './permissions.service';
 import { Language } from 'src/decorators/language.decorator';
+import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 
+@ApiInternalOnlyController()
 @ApiTags('Permissions')
 @Authenticated()
 @Controller('permissions')

src/modules/permissions/permissions.service.ts

@@ -60,7 +60,7 @@ export class PermissionsService
     }).catch((err: ErrorBuilder) => {
       if (
         err.code === 'No connection established' &&
-        (process.env.LOCAL_ENV === 'true' || process.env.ENV === 'local')
+        process.env.ENV === 'local'
       ) {
         return this.logger.info(
           "couldn't connect to DUC. suppressing in local env",

src/modules/pipelines/pipelines.controller.ts

@@ -7,7 +7,9 @@ import {
 import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { PipelinesService } from './pipelines.service';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
+import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 
+@ApiInternalOnlyController()
 @ApiTags('Pipelines')
 @Controller('pipelines')
 @Authenticated()

src/modules/pipelinesV2/pipelines.controller.ts

@@ -44,6 +44,7 @@ import {
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { Language } from 'src/decorators/language.decorator';
+import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 
 @ApiTags('PipelinesV2')
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
@@ -279,6 +280,7 @@ export class PipelinesController {
     return response;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Put('/:id')
   @ApiOperation({
     deprecated: true,
@@ -290,9 +292,9 @@ export class PipelinesController {
     @Param('id') id,
     @User() user: RequestUser,
   ) {
-    this.logger.info('PipelinesController - patch', { user });
+    this.logger.info('PipelinesController - put', { user });
     const response = await this.update(language, updatePipelineDto, id, user);
-    this.logger.info('PipelinesController - patch: OK', { user });
+    this.logger.info('PipelinesController - put: OK', { user });
     return response;
   }
 
@@ -311,6 +313,7 @@ export class PipelinesController {
     this.logger.info('PipelinesController - delete: OK');
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('/init-upload')
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   async initUploadFile(
@@ -342,6 +345,7 @@ export class PipelinesController {
     return { urls: JSON.parse(urls), upload_id };
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('/complete-upload')
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   async completeUploadFile(
@@ -359,6 +363,7 @@ export class PipelinesController {
     );
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('/file')
   @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   async uploadedFile(
@@ -401,6 +406,7 @@ export class PipelinesController {
     return pipeline;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('start/:id')
   async activate(@Param() params, @Body() body) {
     const { id } = params;

src/modules/productboard/productboard.controller.ts

@@ -2,10 +2,12 @@ import { Body, Controller, HttpException, Post } from '@nestjs/common';
 import { ApiTags } from '@nestjs/swagger';
 import axios from 'axios';
 import { Authenticated } from 'src/decorators/authentication.decorator';
+import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 import { User, RequestUser } from 'src/decorators/user.decorator';
 import { getSecretFromSecretsManager } from 'src/utils/SecretManager';
 import { INote } from './dtos';
 
+@ApiInternalOnlyController()
 @ApiTags('Productboard')
 @Controller('productboard')
 @Authenticated()

src/modules/roles/roles.controller.ts

@@ -45,7 +45,9 @@ import {
 } from 'src/decorators/authentication.decorator';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { Language } from 'src/decorators/language.decorator';
+import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 
+@ApiInternalOnlyController()
 @ApiTags('Roles')
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
 @Authenticated()

src/modules/termsOfUse/termsOfUse.controller.ts

@@ -20,7 +20,9 @@ import { RequestUser, User } from '../../decorators/user.decorator';
 import { Metadata } from '@grpc/grpc-js';
 import { Language } from 'src/decorators/language.decorator';
 import { LanguageEnum } from 'src/utils/languages.enum';
+import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 
+@ApiInternalOnlyController()
 @ApiTags('TermsOfUse')
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
 @UseFilters(new GrpcToHttpExceptionFilter())

src/modules/transformations/transformations.controller.ts

@@ -19,7 +19,10 @@ import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { TransformationsService } from './transformations.service';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { RequestUser, User } from 'src/decorators/user.decorator';
+import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 const pipelinePermissions = PERMISSIONS_GROUPS.PIPELINE.permissions;
+
+@ApiInternalOnlyController()
 @ApiTags('Transformations')
 @Controller('transformations')
 @Authenticated()

src/modules/users/users.controller.ts

@@ -26,6 +26,7 @@ import {
   RequireAllPermissions,
 } from 'src/decorators/authentication.decorator';
 import { Language } from 'src/decorators/language.decorator';
+import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 import { RequestUser, User } from 'src/decorators/user.decorator';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
 import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
@@ -52,6 +53,7 @@ import {
 } from './dtos/entities';
 import { UsersService } from './users.service';
 
+@ApiInternalOnlyController()
 @ApiTags('Users')
 @Controller('users')
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])