From fea587ad366e8081eaa328a381d0c85c9922cb2c Mon Sep 17 00:00:00 2001
From: marcos-silva-rodrigues <marcos.rodrigues.dev@gmail.com>
Date: Thu, 12 Jun 2025 11:51:56 -0300
Subject: [PATCH] FEAT: control login by dedicated customer id injected

---
 environment.d.ts                    |  1 +
 helmfiles/stg.yaml                  | 26 +++++++++++++++++++++
 src/modules/auth/auth.controller.ts |  4 +---
 src/modules/auth/auth.service.ts    | 35 +++++++++++++++++++++++++----
 4 files changed, 59 insertions(+), 7 deletions(-)

diff --git a/environment.d.ts b/environment.d.ts
index c910516..3558f26 100644
--- a/environment.d.ts
+++ b/environment.d.ts
@@ -14,6 +14,7 @@ declare global {
       AWS_REGION: string;
       OPEN_GROUP_ID: string;
       OPEN_CUSTOMER_ID: string;
+      DEDICATED_PROXY: string;
     }
   }
 }
diff --git a/helmfiles/stg.yaml b/helmfiles/stg.yaml
index 5782e36..616588e 100644
--- a/helmfiles/stg.yaml
+++ b/helmfiles/stg.yaml
@@ -18,5 +18,31 @@ charts:
         value: b3e3dfe5-b992-4586-a73c-c0b0c00f615d
       - name: maestro.open_group_id
         value: e3f98a2f-7748-4981-8505-7695c8ca8218
+      - name: replicaCount
+        value: 1
+  
+    # Environment to test Network Policies
+  - name: private
+    chart: ../maestro
+    values:
+    - ../maestro/values.yaml
+    set:
+      - name: maestro.duc_url
+        value: duc.stg.dadosfera.ai
+      - name: hostname
+        value: private.stg.dadosfera.ai
+      - name: maestro.pi_factory_url
+        value: pi-factory.dadosfera.ai
+      - name: maestro.in_factory_url
+        value: in-factory.stg.dadosfera.ai
+      - name: maestro.tr_factory_url
+        value: in-factory.dadosfera.ai
+      - name: maestro.open_customer_id
+        value: b3e3dfe5-b992-4586-a73c-c0b0c00f615d
+      - name: maestro.open_group_id
+        value: e3f98a2f-7748-4981-8505-7695c8ca8218
+      # Customer id
+      - name: maestro.dedicated_proxy
+        value: 14d52fd4-d83d-4cdd-be34-bf11cc28b3bd
       - name: replicaCount
         value: 1
\ No newline at end of file
diff --git a/src/modules/auth/auth.controller.ts b/src/modules/auth/auth.controller.ts
index 7f2f8f0..66870d5 100644
--- a/src/modules/auth/auth.controller.ts
+++ b/src/modules/auth/auth.controller.ts
@@ -86,11 +86,9 @@ export class AuthController {
   async signIn(
     @Body() { username, password, totp }: AuthSignInReq,
     @Language() language: LanguageEnum,
-    @Headers('origin') origin = '',
   ): Promise<AuthSignInRes> {
     this.logger.info('/auth - SignIn');
-    const frontHost = origin.replace(/^https?:\/\//, '');
-    const metadata = PackTheMetadata({ language, custom_host: frontHost });
+    const metadata = PackTheMetadata({ language });
     this.logger.info('metadata: ' + JSON.stringify(metadata.toJSON()));
     return this.authClient.signIn({ username, password, totp }, metadata);
   }
diff --git a/src/modules/auth/auth.service.ts b/src/modules/auth/auth.service.ts
index 5974954..be71d66 100644
--- a/src/modules/auth/auth.service.ts
+++ b/src/modules/auth/auth.service.ts
@@ -1,4 +1,4 @@
-import { OnModuleInit, Inject, Injectable } from '@nestjs/common';
+import { OnModuleInit, Inject, Injectable, ForbiddenException } from '@nestjs/common';
 import { ClientGrpc } from '@nestjs/microservices';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { lastValueFrom } from 'rxjs';
@@ -17,6 +17,7 @@ import {
   AuthResetPasswordRequest,
   AuthVerifyResetPasswordCodeRequest,
   AuthConfirmResetPasswordRequest,
+  AuthSignInResponse,
 } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/messages';
 import { DucClient } from '../duc/client.config';
 import { Metadata } from '@grpc/grpc-js';
@@ -53,15 +54,41 @@ export class AuthClientService implements OnModuleInit {
     return lastValueFrom(this.authService.AuthSnowflakeSignIn(input));
   }
 
+  checkDedicatedProxy(customerId: string) {
+    const DEDICATED_PROXY = process.env.DEDICATED_PROXY || '';
+    this.logger.info('SignIn - Setting customer ID for dedicated proxy: ' + DEDICATED_PROXY);
+    if (DEDICATED_PROXY !== '') {
+      this.logger.info('Customer ID: ' + customerId);
+      if (DEDICATED_PROXY !== customerId)  {
+        throw new ForbiddenException();
+      }
+    }
+  }
+
   async signIn(
     { username, password, totp }: AuthSignInRequest,
     metadata: Metadata,
   ) {
     this.logger.info('SignIn');
 
-    return lastValueFrom(
-      this.authService.AuthSignIn({ username, password, totp }, metadata),
-    );
+    let result: AuthSignInResponse;
+
+    try {
+      result = await lastValueFrom(
+        this.authService.AuthSignIn({ username, password, totp }, metadata),
+      );
+
+    } catch (error) {
+      this.logger.error('SignIn - Error during sign-in');
+      this.logger.error(error);
+      throw error;
+    }
+
+    if (result.customer) {
+      this.checkDedicatedProxy(result.customer.id);
+    }
+
+    return result
   }
 
   async refreshAccessToken(