FIX: hide internal endpoints

src/modules/auth/auth.controller.ts

@@ -51,6 +51,7 @@ import ErrorCodes, { OauthErrors } from 'src/utils/errorCodes';
 import jwt from 'jsonwebtoken';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { Language } from 'src/decorators/language.decorator';
+import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 
 @ApiTags('Auth')
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
@@ -90,21 +91,6 @@ export class AuthController {
     return this.authClient.signIn({ username, password, totp }, metadata);
   }
 
-  @Post('/sso/snowflake')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.SNOWFLAKE.permissions.OPEN)
-  @HttpCode(HttpStatus.OK)
-  async snowflakeSignIn(
-    @User() user: RequestUser,
-    @Body('RelayState') relayState: string,
-  ) {
-    this.logger.info('/auth - snowflakeSignIn');
-
-    return this.authClient.snowflakeSignIn({
-      userId: user.user_id,
-      relayState,
-    });
-  }
-
   @Post('refresh-access-token')
   @HttpCode(HttpStatus.OK)
   @ApiOkResponse({ type: AuthRefreshAccessTokenRes })
@@ -123,6 +109,23 @@ export class AuthController {
     return this.authClient.refreshAccessToken({ refreshToken }, metadata);
   }
 
+  @ApiInternalOnlyEndpoint()
+  @Post('/sso/snowflake')
+  @RequireAllPermissions(PERMISSIONS_GROUPS.SNOWFLAKE.permissions.OPEN)
+  @HttpCode(HttpStatus.OK)
+  async snowflakeSignIn(
+    @User() user: RequestUser,
+    @Body('RelayState') relayState: string,
+  ) {
+    this.logger.info('/auth - snowflakeSignIn');
+
+    return this.authClient.snowflakeSignIn({
+      userId: user.user_id,
+      relayState,
+    });
+  }
+
+  @ApiInternalOnlyEndpoint()
   @Post('change-password')
   @HttpCode(HttpStatus.OK)
   async changePassword(
@@ -141,6 +144,7 @@ export class AuthController {
     });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('reset-password')
   @HttpCode(HttpStatus.OK)
   async resetPassword(
@@ -157,6 +161,7 @@ export class AuthController {
     return this.authClient.resetPassword({ username }, metadata);
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('verify-reset-password-code')
   @HttpCode(HttpStatus.OK)
   async verifyResetPasswordCode(
@@ -169,6 +174,7 @@ export class AuthController {
     return this.authClient.verifyResetPasswordCode({ username, code });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('confirm-reset-password')
   @HttpCode(HttpStatus.OK)
   async confirmResetPassword(@Body() body: AuthConfirmResetPasswordRequest) {
@@ -183,6 +189,7 @@ export class AuthController {
     });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('enable-totp')
   @HttpCode(HttpStatus.OK)
   async enableTotpMFA(
@@ -197,6 +204,7 @@ export class AuthController {
     return this.authClient.enableTotpMFA({ accessToken, password });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('disable-totp')
   @HttpCode(HttpStatus.OK)
   async disableTotpMFA(
@@ -211,6 +219,7 @@ export class AuthController {
     return this.authClient.disableTotpMFA({ accessToken, password });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('dismiss-totp')
   @HttpCode(HttpStatus.OK)
   async dismissTotpMFA(@Headers() headers) {
@@ -221,6 +230,7 @@ export class AuthController {
     return this.authClient.dismissTotpMFA({ accessToken });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Post('verify-totp')
   @HttpCode(HttpStatus.OK)
   async verifyTotp(@Body() body: AuthVerifyTotpMfaRequest, @Headers() headers) {
@@ -232,6 +242,7 @@ export class AuthController {
     return this.authClient.verifyTotp({ accessToken, totp });
   }
 
+  @ApiInternalOnlyEndpoint()
   @Authenticated()
   @ApiSecurity('access-token')
   @Get('verify-access-token')
@@ -239,11 +250,13 @@ export class AuthController {
     return { access_token_status: 'valid' };
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('session/:session')
   getSession(@Param('session') session: string) {
     return this.authClient.getSession(session);
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('oauth/google')
   @UseGuards(AuthGuard('google-login'))
   googleOauth() {
@@ -251,6 +264,7 @@ export class AuthController {
     return true;
   }
 
+  @ApiInternalOnlyEndpoint()
   @Get('oauth/google/callback')
   @UseGuards(AuthGuard('google-login'))
   @Redirect()