From 7c0b87ffc38dc7ed6e181bcb0ae71027e4ba2312 Mon Sep 17 00:00:00 2001
From: marcos-silva-rodrigues <marcos.rodrigues.dev@gmail.com>
Date: Mon, 6 Jan 2025 15:25:28 -0300
Subject: [PATCH] FEAT: decorators to apply an origin in endpoint router

---
 src/decorators/set-origin.decorator.ts        | 32 +++++++++++++++++++
 src/modules/open-data/open-data.controller.ts |  5 ++-
 2 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 src/decorators/set-origin.decorator.ts

diff --git a/src/decorators/set-origin.decorator.ts b/src/decorators/set-origin.decorator.ts
new file mode 100644
index 0000000..c6d5338
--- /dev/null
+++ b/src/decorators/set-origin.decorator.ts
@@ -0,0 +1,32 @@
+import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { SetMetadata } from '@nestjs/common';
+
+export const SetOrigin = (origin: string) => SetMetadata('allowedOrigin', origin);
+
+@Injectable()
+export class CORSGuard implements CanActivate {
+  constructor(private reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const response = context.switchToHttp().getResponse();
+    const request = context.switchToHttp().getRequest();
+    const origin = request.headers.origin;
+
+    // Obter a origem permitida através do decorador
+    const allowedOrigin = this.reflector.get<string>('allowedOrigin', context.getHandler());
+    if (process.env.ENV === "local") {
+        return true;
+    }
+
+    // Verifica se a origem da requisição é permitida   
+    if (allowedOrigin && origin !== allowedOrigin) {
+      throw new ForbiddenException('Acesso não permitido pela política CORS');
+    }
+
+    response.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+
+    return true;
+  }
+}
+
diff --git a/src/modules/open-data/open-data.controller.ts b/src/modules/open-data/open-data.controller.ts
index 01f2c1a..86252a1 100644
--- a/src/modules/open-data/open-data.controller.ts
+++ b/src/modules/open-data/open-data.controller.ts
@@ -1,5 +1,5 @@
 import DadosferaLogger from '@dadosfera/dadosfera-logs';
-import { Body, Controller, Inject, Post, UseFilters } from '@nestjs/common';
+import { Body, Controller, Inject, Post, UseFilters, UseGuards } from '@nestjs/common';
 import { ApiCreatedResponse, ApiHeaders, ApiOkResponse, ApiTags } from '@nestjs/swagger';
 import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
@@ -8,6 +8,7 @@ import { UsersService } from '../users/users.service';
 import { Language } from 'src/decorators/language.decorator';
 import { OpenDataService } from './open-data.service';
 import { CreateUserOpenDataDTO, WordpressForm } from './dto/wordpres-form';
+import { CORSGuard, SetOrigin } from 'src/decorators/set-origin.decorator';
 
 @Controller('open-data')
 @ApiInternalOnlyController()
@@ -26,6 +27,8 @@ export class OpenDataController {
   }
 
   @Post("/sharing-ocean-data")
+  @SetOrigin('https://devsbm.dadosfera.io/')
+  @UseGuards(CORSGuard)
   @ApiOkResponse()
   async createUser(
     @Body()