FIX: sending access token to role function to evaluate editing permissions

package-lock.json

@@ -36,7 +36,7 @@
         "passport-hubspot-oauth2": "^1.0.3",
         "passport-mailchimp": "^1.1.0",
         "protospack": "2.5.2",
-        "protospack-v2": "3.9.0-beta.7",
+        "protospack-v2": "3.9.6",
         "reflect-metadata": "^0.1.13",
         "rimraf": "^3.0.2",
         "rxjs": "^7.5.5",
@@ -9015,9 +9015,9 @@
       }
     },
     "node_modules/protospack-v2": {
-      "version": "3.9.0-beta.7",
-      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/protospack-v2/-/protospack-v2-3.9.0-beta.7.tgz",
-      "integrity": "sha512-QZqFz0Kc5pgcHOhNs4O6JG2kMZKDvY+7RwEdniRfb75ZSy/7BRJXLJUzB7Kjj1poIUM12n+gUg3kj3n00Gwegg==",
+      "version": "3.9.6",
+      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/protospack-v2/-/protospack-v2-3.9.6.tgz",
+      "integrity": "sha512-7aSYhzxlly6GPGmCH2JsNDB3Z6rOPhmY5iK5n1Ich3WLLgsOmGAXJH2zWD9IUfjhKKwBZGvitdewpBVyCvAg0A==",
       "dependencies": {
         "@grpc/grpc-js": "^1.6.7",
         "rxjs": "^7.5.5",
@@ -17245,9 +17245,9 @@
       }
     },
     "protospack-v2": {
-      "version": "3.9.0-beta.7",
-      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/protospack-v2/-/protospack-v2-3.9.0-beta.7.tgz",
-      "integrity": "sha512-QZqFz0Kc5pgcHOhNs4O6JG2kMZKDvY+7RwEdniRfb75ZSy/7BRJXLJUzB7Kjj1poIUM12n+gUg3kj3n00Gwegg==",
+      "version": "3.9.6",
+      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/protospack-v2/-/protospack-v2-3.9.6.tgz",
+      "integrity": "sha512-7aSYhzxlly6GPGmCH2JsNDB3Z6rOPhmY5iK5n1Ich3WLLgsOmGAXJH2zWD9IUfjhKKwBZGvitdewpBVyCvAg0A==",
       "requires": {
         "@grpc/grpc-js": "^1.6.7",
         "rxjs": "^7.5.5",

package.json

@@ -51,7 +51,7 @@
     "passport-hubspot-oauth2": "^1.0.3",
     "passport-mailchimp": "^1.1.0",
     "protospack": "2.5.2",
-    "protospack-v2": "3.9.0-beta.7",
+    "protospack-v2": "3.9.6",
     "reflect-metadata": "^0.1.13",
     "rimraf": "^3.0.2",
     "rxjs": "^7.5.5",

src/authentication/authentication.guard.ts

@@ -121,6 +121,7 @@ export class AuthenticationGuard
       customer_id: accessTokenPayload.customer_id,
       customer_name: accessTokenPayload.customer_name,
       customer_tier: accessTokenPayload.customer_tier,
+      access_token: accessToken,
     };
     // TODO: for backwards compatibility. remove in the future
     request.body.info = {

src/authentication/user.decorator.ts

@@ -10,6 +10,7 @@ export interface RequestUser {
   customer_id: string;
   customer_name: string;
   customer_tier: string;
+  access_token: string;
 }
 
 export const User: (options?: { required?: boolean }) => ParameterDecorator =

src/modules/roles/dto/entities.ts

@@ -19,6 +19,8 @@ export class RoleDto {
   createdAt: string;
   @ApiProperty()
   updatedAt: string;
+  @ApiProperty()
+  isPublic: boolean;
   @ApiProperty({ type: () => Customer })
   customer?: Customer;
 }

src/modules/roles/roles.controller.ts

@@ -77,7 +77,7 @@ export class RolesController {
   ) {
     this.logger.info('searchRoles', { user });
     this.rolesService.setLanguage(language);
-    return await this.rolesService.roleSearch(filters, user.customer_id);
+    return await this.rolesService.roleSearch(filters, user);
   }
 
   @Post()
@@ -90,7 +90,7 @@ export class RolesController {
   ) {
     this.logger.info('createRole', { user });
     this.rolesService.setLanguage(language);
-    return await this.rolesService.createRole(body, user.customer_id);
+    return await this.rolesService.createRole(body, user);
   }
 
   @Put('permissions')
@@ -103,7 +103,7 @@ export class RolesController {
   ) {
     this.logger.info('grantPermissionsToRole', { user });
     this.rolesService.setLanguage(language);
-    return await this.rolesService.grantPermissionsToRole(body);
+    return await this.rolesService.grantPermissionsToRole(body, user);
   }
 
   @Delete('permissions')
@@ -116,7 +116,7 @@ export class RolesController {
   ) {
     this.logger.info('revokePermissionsToRole', { user });
     this.rolesService.setLanguage(language);
-    return await this.rolesService.revokePermissionFromRole(body);
+    return await this.rolesService.revokePermissionFromRole(body, user);
   }
 
   @Patch('permissions')
@@ -129,7 +129,7 @@ export class RolesController {
   ) {
     this.logger.info('setRolePermissions', { user });
     this.rolesService.setLanguage(language);
-    return this.rolesService.setRolePermissions(body);
+    return this.rolesService.setRolePermissions(body, user);
   }
 
   @Patch('users')
@@ -142,7 +142,7 @@ export class RolesController {
   ) {
     this.logger.info('setRoleUsers', { user });
     this.rolesService.setLanguage(language);
-    return this.rolesService.setRoleUsers(body);
+    return this.rolesService.setRoleUsers(body, user);
   }
 
   @Get(':id')
@@ -155,7 +155,7 @@ export class RolesController {
   ) {
     this.logger.info('getRoleById', { user });
     this.rolesService.setLanguage(language);
-    return await this.rolesService.getRolesById(id);
+    return await this.rolesService.getRolesById(id, user);
   }
 
   @Delete(':id')
@@ -167,7 +167,7 @@ export class RolesController {
   ) {
     this.logger.info('deleteRole', { user });
     this.rolesService.setLanguage(language);
-    return await this.rolesService.removeRole(id);
+    return await this.rolesService.removeRole(id, user);
   }
 
   @Patch(':id')
@@ -181,6 +181,6 @@ export class RolesController {
   ) {
     this.logger.info('updateRole', { user });
     this.rolesService.setLanguage(language);
-    return this.rolesService.updateRole(id, body);
+    return this.rolesService.updateRole(id, body, user);
   }
 }

src/modules/roles/roles.service.ts

@@ -12,12 +12,23 @@ import {
   UpdateRoleReq,
 } from './dto/entities';
 import { DadosferaLogger } from 'dadosfera-logs';
+import { Metadata } from '@grpc/grpc-js';
 import { ClientGrpc } from '@nestjs/microservices';
+import { Permission } from 'protospack-v2/dist/lib/Duc/interfaces/entities';
 import { lastValueFrom } from 'rxjs';
 import { PermissionsService } from '../permissions/permissions.service';
-import { UserRole } from 'protospack-v2/dist/lib/Duc/interfaces/entities';
 import { LanguageEnum } from 'src/utils/languages.enum';
+import { RequestUser } from 'src/authentication/user.decorator';
 
+interface GetRolesPermissionsName {
+  id: string;
+  name: string;
+  description: string;
+  permissions: Permission[];
+  isPublic?: boolean;
+  createdAt: string;
+  updatedAt: string;
+}
 @Injectable()
 export class RolesService {
   logger: any;
@@ -41,16 +52,28 @@ export class RolesService {
       ProtoServices.RolesProtoService,
     );
   }
-  async getRolesById(id: string) {
+
+  async getRolesById(id: string, { access_token }: RequestUser) {
+    const meta = new Metadata();
+    meta.add('access_token', access_token);
     const role = await lastValueFrom(
-      this.rolesClientService.RoleFindOneById({
-        id,
-      }),
+      this.rolesClientService.RoleFindOneById(
+        {
+          id,
+        },
+        meta,
+      ),
     );
     const [roleTreated] = this.getRolesPermissionsName([role.role]);
     return { role: roleTreated };
   }
-  async roleSearch(filters: GetRolesByCustomerReq, customerId: string) {
+
+  async roleSearch(
+    filters: GetRolesByCustomerReq,
+    { customer_id, access_token }: RequestUser,
+  ) {
+    const meta = new Metadata();
+    meta.add('access_token', access_token);
     let { permissionId: permissionIds } = filters;
     if (permissionIds && !Array.isArray(permissionIds))
       permissionIds = [permissionIds];
@@ -64,109 +87,154 @@ export class RolesService {
         return seqId;
       }) || [];
     const roles = await lastValueFrom(
-      this.rolesClientService.RoleSearch({
-        customerId,
-        getUsers: isGetUsers,
-        permissionIds: [],
-        permissionSeqIds,
-      }),
+      this.rolesClientService.RoleSearch(
+        {
+          customerId: customer_id,
+          getUsers: isGetUsers,
+          permissionIds: [],
+          permissionSeqIds,
+        },
+        meta,
+      ),
     );
     const rolesTreated = this.getRolesPermissionsName(roles.roles);
     return { roles: rolesTreated };
   }
 
-  async createRole(data: CreateRoleReq, customerId: string) {
+  async createRole(
+    data: CreateRoleReq,
+    { customer_id, access_token }: RequestUser,
+  ) {
+    const meta = new Metadata();
+    meta.add('access_token', access_token);
     const { description, name, permissionIds, userIds } = data;
     const role = await lastValueFrom(
-      this.rolesClientService.RoleCreate({
-        customerId,
-        name,
-        permissionIds: [],
-        permissionSeqIds: permissionIds,
-        description,
-        userIds,
-      }),
+      this.rolesClientService.RoleCreate(
+        {
+          customerId: customer_id,
+          name,
+          permissionIds: [],
+          permissionSeqIds: permissionIds,
+          description,
+          userIds,
+        },
+        meta,
+      ),
     );
     const [roleTreated] = this.getRolesPermissionsName([role.role]);
     return { role: roleTreated };
   }
 
-  async removeRole(id: string) {
-    return lastValueFrom(this.rolesClientService.RoleRemove({ id }));
+  async removeRole(id: string, { access_token }: RequestUser) {
+    const meta = new Metadata();
+    meta.add('access_token', access_token);
+    return lastValueFrom(this.rolesClientService.RoleRemove({ id }, meta));
   }
-  async grantPermissionsToRole({
-    roleId,
-    permissionIds,
-  }: GrantPermissionsToRoleReq) {
+  async grantPermissionsToRole(
+    { roleId, permissionIds }: GrantPermissionsToRoleReq,
+    { access_token }: RequestUser,
+  ) {
+    const meta = new Metadata();
+    meta.add('access_token', access_token);
     const role = await lastValueFrom(
-      this.rolesClientService.GrantPermissionsToRole({
-        permissionIds: [],
-        roleId,
-        permissionSeqIds: permissionIds,
-      }),
+      this.rolesClientService.GrantPermissionsToRole(
+        {
+          permissionIds: [],
+          roleId,
+          permissionSeqIds: permissionIds,
+        },
+        meta,
+      ),
     );
 
     const [roleTreated] = this.getRolesPermissionsName([role.role]);
     return { role: roleTreated };
   }
 
-  async revokePermissionFromRole({
-    roleId,
-    permissionIds,
-  }: RevokePermissionsFromRoleReq) {
+  async revokePermissionFromRole(
+    { roleId, permissionIds }: RevokePermissionsFromRoleReq,
+    { access_token }: RequestUser,
+  ) {
+    const meta = new Metadata();
+    meta.add('access_token', access_token);
     const role = await lastValueFrom(
-      this.rolesClientService.RevokePermissionsFromRole({
-        permissionIds: [],
-        roleId,
-        permissionSeqIds: permissionIds,
-      }),
+      this.rolesClientService.RevokePermissionsFromRole(
+        {
+          permissionIds: [],
+          roleId,
+          permissionSeqIds: permissionIds,
+        },
+        meta,
+      ),
     );
     const [roleTreated] = this.getRolesPermissionsName([role.role]);
     return { role: roleTreated };
   }
 
-  async updateRole(id: string, req: UpdateRoleReq) {
+  async updateRole(
+    id: string,
+    req: UpdateRoleReq,
+    { access_token }: RequestUser,
+  ) {
+    const meta = new Metadata();
+    meta.add('access_token', access_token);
     const { description, name } = req;
     const role = await lastValueFrom(
-      this.rolesClientService.RoleUpdate({
-        id,
-        description,
-        name,
-      }),
+      this.rolesClientService.RoleUpdate(
+        {
+          id,
+          description,
+          name,
+        },
+        meta,
+      ),
     );
     const [roleTreated] = this.getRolesPermissionsName([role.role]);
     return { role: roleTreated };
   }
 
-  async setRolePermissions(req: SetRolePermissionsReq) {
+  async setRolePermissions(
+    req: SetRolePermissionsReq,
+    { access_token }: RequestUser,
+  ) {
+    const meta = new Metadata();
+    meta.add('access_token', access_token);
     const { roleId: id, permissionIds } = req;
     const clearPermissions =
       Array.isArray(permissionIds) && permissionIds.length === 0;
     const role = await lastValueFrom(
-      this.rolesClientService.RoleSetPermissions({
-        id,
-        permissionSeqIds: permissionIds,
-        clearPermissions,
-      }),
+      this.rolesClientService.RoleSetPermissions(
+        {
+          id,
+          permissionSeqIds: permissionIds,
+          clearPermissions,
+        },
+        meta,
+      ),
     );
     const [roleTreated] = this.getRolesPermissionsName([role.role]);
     return { role: roleTreated };
   }
 
-  async setRoleUsers(req: SetRoleUsersReq) {
+  async setRoleUsers(req: SetRoleUsersReq, { access_token }: RequestUser) {
+    const meta = new Metadata();
+    meta.add('access_token', access_token);
     const { roleId: id, userIds } = req;
     const clearUsers = Array.isArray(userIds) && userIds.length === 0;
     const role = await lastValueFrom(
-      this.rolesClientService.RoleSetUsers({
-        id,
-        userIds,
-        clearUsers,
-      }),
+      this.rolesClientService.RoleSetUsers(
+        {
+          id,
+          userIds,
+          clearUsers,
+        },
+        meta,
+      ),
     );
     const [roleTreated] = this.getRolesPermissionsName([role.role]);
     return { role: roleTreated };
   }
-  getRolesPermissionsName(roles: UserRole[]): RoleDto[] {
+  getRolesPermissionsName(roles: GetRolesPermissionsName[]): RoleDto[] {
     const newRoles: RoleDto[] = [];
     for (const role of roles) {
       const allPermissions = this.permissionsService.getAllPermissions(
@@ -180,7 +248,11 @@ export class RolesService {
           id: p.seqid,
         };
       });
-      const newRole: RoleDto = { ...role, permissions: newPermissions };
+      const newRole: RoleDto = {
+        ...role,
+        permissions: newPermissions,
+        isPublic: role.isPublic,
+      };
       newRoles.push(newRole);
     }
     return newRoles;

src/utils/ErrorBuilder.ts

@@ -136,10 +136,18 @@ export function EnrichErrorCode(code: string) {
         code,
       };
     case ErrorCodes.ROLE.NOT_FOUND:
+    case ErrorCodes.ROLE.FROM_ANOTHER_CUSTOMER:
       return {
         statusCode: HttpStatus.NOT_FOUND,
         error: 'Grupo não encontrado',
         message: 'Grupo solicitado não encontrado',
+        code: ErrorCodes.ROLE.NOT_FOUND,
+      };
+    case ErrorCodes.ROLE.CANNOT_EDIT_PUBLIC_ROLE:
+      return {
+        statusCode: HttpStatus.FORBIDDEN,
+        error: 'Grupo público',
+        message: 'Você não tem permissão para editar esse grupo',
         code,
       };
     case ErrorCodes.USER.NOT_FOUND:

src/utils/errorCodes.ts

@@ -16,6 +16,8 @@ export const AUTH = {
 export const ROLE = {
   ALREADY_EXIST: 'ROLE.ALREADY_EXISTS',
   NOT_FOUND: 'ROLE.NOT_FOUND',
+  FROM_ANOTHER_CUSTOMER: 'ROLE.FROM_ANOTHER_CUSTOMER',
+  CANNOT_EDIT_PUBLIC_ROLE: 'ROLE.CANNOT_EDIT_PUBLIC_ROLE',
 };
 
 export const USER = {