Merge pull request #316 from dadosfera/feature/public-and-assign-embed

Feature/public and assign embed
FIX: import
2026-09-01 12:18:15 +00:00 · 2025-06-17 08:57:53 -03:00 · 2025-06-16 18:09:25 -03:00 · 2025-06-16 18:01:53 -03:00 · 2025-06-16 10:37:47 -03:00 · 2025-06-16 10:34:11 -03:00
75 changed files with 7144 additions and 2057 deletions
@@ -4,9 +4,19 @@ FROM base_image AS build_base
 WORKDIR /app
 RUN apk update
 # needed packages to build dependencies from source
-RUN apk add --no-cache aws-cli
+RUN apk add --no-cache \
+      aws-cli \
+      chromium \
+      nss \
+      freetype \
+      harfbuzz \
+      ca-certificates \
+      ttf-freefont
 COPY package*.json ./

+ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true \
+    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
+

 # run aws cli without mounting secret, because CI already has AWS credentials
 FROM build_base AS ci_image
@@ -40,4 +50,17 @@ WORKDIR /app
 COPY --from=prod_build /app/dist ./dist
 COPY --from=prod_build /app/node_modules ./node_modules
 COPY --from=prod_build /app/package*.json ./
+RUN apk update
+# needed packages to build dependencies from source
+RUN apk add --no-cache \
+      chromium \
+      nss \
+      freetype \
+      harfbuzz \
+      ca-certificates \
+      ttf-freefont
+
+ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true \
+    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
+  
 ENTRYPOINT npm run start:prod
@@ -14,6 +14,7 @@ declare global {
      AWS_REGION: string;
      OPEN_GROUP_ID: string;
      OPEN_CUSTOMER_ID: string;
+      DEDICATED_PROXY: string;
    }
  }
 }
@@ -15,6 +15,8 @@ charts:
      - name: maestro.tr_factory_url
        value: in-factory.dadosfera.ai
      - name: maestro.open_customer_id
-        value: f239718a-a271-4ef9-ae7e-02a2f0f3aa6e
+        value: b3e3dfe5-b992-4586-a73c-c0b0c00f615d
      - name: maestro.open_group_id
-        value: 401573bb-334f-44b2-b30e-88d4cea31ae9
+        value: c0afdcce-c5be-40d0-9d1d-2d271121f14a
+      - name: replicaCount
+        value: 2
@@ -9,14 +9,42 @@ charts:
      - name: hostname
        value: maestro.stg.dadosfera.ai
      - name: maestro.pi_factory_url
-        value: pi-factory.dadosfera.ai
+        value: pi-factory.stg.dadosfera.ai
      - name: maestro.in_factory_url
-        value: in-factory.dadosfera.ai
+        value: in-factory.stg.dadosfera.ai
      - name: maestro.tr_factory_url
-        value: in-factory.dadosfera.ai
+        value: in-factory.stg.dadosfera.ai
      - name: maestro.open_customer_id
        value: b3e3dfe5-b992-4586-a73c-c0b0c00f615d
      - name: maestro.open_group_id
        value: e3f98a2f-7748-4981-8505-7695c8ca8218
      - name: replicaCount
        value: 1
+  
+    # Environment to test Network Policies
+  - name: private-maestro
+    chart: ../maestro
+    values:
+    - ../maestro/values.yaml
+    set:
+      - name: app_name
+        value: maestro-private
+      - name: maestro.duc_url
+        value: duc.stg.dadosfera.ai
+      - name: hostname
+        value: private-maestro.stg.dadosfera.ai
+      - name: maestro.pi_factory_url
+        value: pi-factory.dadosfera.ai
+      - name: maestro.in_factory_url
+        value: in-factory.stg.dadosfera.ai
+      - name: maestro.tr_factory_url
+        value: in-factory.dadosfera.ai
+      - name: maestro.open_customer_id
+        value: b3e3dfe5-b992-4586-a73c-c0b0c00f615d
+      - name: maestro.open_group_id
+        value: e3f98a2f-7748-4981-8505-7695c8ca8218
+      # Customer id
+      - name: maestro.dedicated_proxy
+        value: 14d52fd4-d83d-4cdd-be34-bf11cc28b3bd
+      - name: replicaCount
+        value: 1
@@ -1,16 +1,16 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: maestro
+  name: {{ .Values.app_name }}
  namespace: applications
  labels:
-    app: maestro
+    app: {{ .Values.app_name }}

 spec:
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
-      app: maestro
+      app: {{ .Values.app_name }}
  
  strategy:
    rollingUpdate:
@@ -20,7 +20,7 @@ spec:
  template:
    metadata:
      labels:
-        app: maestro
+        app: {{ .Values.app_name }}
    
    spec:
      imagePullSecrets:
@@ -35,7 +35,8 @@ spec:
                  - key: application
                    operator: In
                    values:
-                      - backend
+                      - general
+
      tolerations:
      - key: "kubernetes.azure.com/scalesetpriority"
        operator: "Equal"
@@ -95,6 +96,12 @@ spec:
              value: {{ .Values.maestro.tr_factory_url }}
            - name: UPLOAD_FILE_AGENT_CONNECTION
              value: {{ .Values.maestro.upload_file_agent_connection }}
+            - name: OPEN_CUSTOMER_ID
+              value: {{ .Values.maestro.open_customer_id }}
+            - name: OPEN_GROUP_ID
+              value: {{ .Values.maestro.open_group_id }}
+            - name: DEDICATED_PROXY
+              value: {{ .Values.maestro.dedicated_proxy }}
            - name: JWT_PRIVATE_KEY
              valueFrom:
                secretKeyRef:
@@ -103,15 +110,15 @@ spec:
            - name: AWS_ACCESS_KEY_ID
              valueFrom:
                secretKeyRef:
-                  name: prd-maestro
+                  name: prd-{{ .Values.app_name }}
                  key: AWS_ACCESS_KEY_ID
            - name: AWS_SECRET_ACCESS_KEY
              valueFrom:
                secretKeyRef:
-                  name: prd-maestro
+                  name: prd-{{ .Values.app_name }}
                  key: AWS_SECRET_ACCESS_KEY
            - name: AWS_DEFAULT_REGION
              valueFrom:
                secretKeyRef:
-                  name: prd-maestro
+                  name: prd-{{ .Values.app_name }}
                  key: AWS_DEFAULT_REGION
@@ -0,0 +1,32 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/whitelist-source-range: "69.49.241.121/32" # hostgator ip 
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/server-snippet: |
+      underscores_in_headers on;
+      ignore_invalid_headers on;
+      
+  generation: 1
+  labels:
+    app: {{ .Values.app_name }}
+  {{- if .Values.maestro.dedicated_proxy}}
+  name: open-data-{{ .Values.app_name }}
+  {{- else }}
+  name: open-data
+  {{- end }}
+  namespace: applications
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: {{ .Values.hostname }}
+    http:
+      paths:
+      - backend:
+          service:
+            name: {{ .Values.app_name }}
+            port:
+              number: {{ .Values.ingress.port }}
+        path: /open-data/sharing-ocean-data
+        pathType: Prefix
@@ -9,8 +9,8 @@ metadata:
      
  generation: 1
  labels:
-    app: maestro
-  name: maestro
+    app: {{ .Values.app_name }}
+  name: {{ .Values.app_name }}
  namespace: applications
 spec:
  ingressClassName: nginx
@@ -20,7 +20,7 @@ spec:
      paths:
      - backend:
          service:
-            name: maestro
+            name: {{ .Values.app_name }}
            port:
              number: {{ .Values.ingress.port }}
        path: /
@@ -1,17 +1,17 @@
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
-  name: prd-maestro
+  name: prd-{{ .Values.app_name }}
  namespace: applications
  labels:
-    app: maestro
+    app: {{ .Values.app_name }}
 spec:
  refreshInterval: 1h
  secretStoreRef:
    name: secretsmanager-prd
    kind: SecretStore
  target:
-    name: prd-maestro
+    name: prd-{{ .Values.app_name }}
    creationPolicy: Owner
  data:
  - secretKey: AWS_ACCESS_KEY_ID
@@ -1,18 +1,18 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: maestro
+  name: {{ .Values.app_name }}
  namespace: applications
  labels:
-    app: maestro
+    app: {{ .Values.app_name }}

 spec:
  type: ClusterIP
  ports:
-  - name: maestro
+  - name: {{ .Values.app_name }}
    protocol: TCP
    port: {{ .Values.service.port }}
    targetPort: {{ .Values.service.targetPort }}
  selector:
-    app: maestro
+    app: {{ .Values.app_name }}

@@ -3,12 +3,13 @@
 # Declare variables to be passed into your templates.

 replicaCount: 3
-hostname: maestro-temp.dadosfera.ai
+hostname: maestro.dadosfera.ai
 image:
  repository: 611330257153.dkr.ecr.us-east-1.amazonaws.com/microservices/maestro_prd
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
  tag: 1.56.0
+app_name: maestro
 containerPort: 3333
 imagePullSecrets: "applications-secrets-ecr-auth-token-external-secret"
 service:
@@ -42,6 +43,7 @@ maestro:
  upload_file_agent_connection: cbc2f881-58c4-4d60-8003-0979b0b5b911
  open_customer_id: f239718a-a271-4ef9-ae7e-02a2f0f3aa6e
  open_group_id: 401573bb-334f-44b2-b30e-88d4cea31ae9
+  dedicated_proxy: ""
 autoscaling:
  enabled: false
  minReplicas: 1
@@ -4,6 +4,7 @@
  "compilerOptions": {
    "assets": [
      "**/*.proto",
+      "assets/**/*",
      {
        "include": "i18n/**/*",
        "watchAssets": true
@@ -30,7 +30,7 @@
    "@aws-sdk/client-secrets-manager": "^3.414.0",
    "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
    "@dadosfera/protospack": "2.5.3",
-    "@dadosfera/protospack-v2": "3.37.0-beta.3",
+    "@dadosfera/protospack-v2": "3.38.0-beta.1",
    "@grpc/grpc-js": "^1.9.3",
    "@grpc/proto-loader": "^0.7.9",
    "@nestjs/cli": "^9.5.0",
@@ -48,8 +48,10 @@
    "class-transformer": "^0.5.1",
    "class-validator": "^0.14.0",
    "cron-parser": "^4.9.0",
+    "csv": "^6.3.11",
    "dotenv": "^14.3.2",
    "elastic-apm-node": "^3.50.0",
+    "handlebars": "^4.7.8",
    "helmet": "^5.1.1",
    "jsonwebtoken": "^9.0.2",
    "jwk-to-pem": "^2.0.5",
@@ -61,6 +63,7 @@
    "passport-google-oauth20": "^2.0.0",
    "passport-hubspot-oauth2": "^1.0.3",
    "passport-mailchimp": "^1.1.0",
+    "puppeteer": "^24.7.2",
    "reflect-metadata": "^0.1.13",
    "rimraf": "^3.0.2",
    "rxjs": "^7.5.5",
@@ -28,6 +28,10 @@ import { MixpanelModule } from './modules/mixpanel/mixpanel.module';
 import { CustomersModule } from './modules/customers/customers.module';
 import { OpenDataModule } from './modules/open-data/open-data.module';
 import { ThemeModule } from './modules/theme/theme.module';
+import { NetworkPolicyModule } from './modules/network-policy/network-policy.module';
+import { AssignModule } from './modules/assign/assign.module';
+import { ShareMetadataModule } from './modules/share-metadata/share-metadata.module';
+import { ApiKeyModule } from './modules/api-key/api-key.module';

@Module({
  providers: [
@@ -61,8 +65,13 @@ import { ThemeModule } from './modules/theme/theme.module';
    CustomersModule,
    OpenDataModule,
    ThemeModule,
+    NetworkPolicyModule,
+    AssignModule,
+    ShareMetadataModule,
+    NetworkPolicyModule,
+    ApiKeyModule,
    //Always leave HealthModule last, so it is on the bottom of swagger
-    HealthModule
+    HealthModule,
  ],
 })
 export class AppModule {}
@@ -0,0 +1,130 @@
+<!DOCTYPE html>
+<html lang="pt-br">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Dadosfera Relatório de PII</title>
+    <link href="https://fonts.googleapis.com/css2?family=Quicksand:wght@400;500;700&display=swap" rel="stylesheet">
+    <style>
+        @page {
+            size: A4 landscape; /* Alterado para paisagem (landscape) */
+            margin: 15mm 10mm; /* Reduzido para proporcionar mais espaço */
+        }
+        body {
+            font-family: 'Quicksand', sans-serif;
+            color: #5c5c5c;
+            margin: 0;
+            padding: 10px;
+            font-size: 12px; /* Reduzindo o tamanho da fonte */
+        }
+        .container {
+            margin: 0;
+            width: 100%;
+        }
+        .header {
+            display: flex;
+            align-items: center;
+            margin-bottom: 20px;
+        }
+        .logo {
+            max-width: 150px; /* Reduzida para economizar espaço */
+            height: auto;
+        }
+        h1 {
+            color: #0d003b;
+            font-weight: 700;
+            margin-left: 20px;
+            font-size: 24px; /* Tamanho ajustado */
+        }
+        table {
+            width: 100%;
+            border-collapse: collapse;
+            margin-top: 15px;
+            table-layout: fixed; /* Importante: define larguras fixas */
+            box-shadow: 0 2px 8px rgba(0,0,0,0.1);
+            border: 1px solid #d0d0d0;
+        }
+        th {
+            background-color: #1700a2;
+            color: white;
+            font-weight: bold;
+            text-align: left;
+            padding: 8px 10px;
+            border: 1px solid #3a26b8;
+            font-size: 11px; /* Tamanho ajustado */
+            word-wrap: break-word; /* Permite quebra de palavras */
+            overflow-wrap: break-word;
+        }
+        td {
+            padding: 6px 10px;
+            border: 1px solid #d0d0d0;
+            font-size: 11px; /* Tamanho ajustado */
+            word-wrap: break-word; /* Permite quebra de palavras */
+            overflow-wrap: break-word;
+        }
+        /* Definindo larguras específicas para cada coluna */
+        th:nth-child(1), td:nth-child(1) { width: 14%; } /* Database */
+        th:nth-child(2), td:nth-child(2) { width: 14%; } /* Schema */
+        th:nth-child(3), td:nth-child(3) { width: 17%; } /* Tabela */
+        th:nth-child(4), td:nth-child(4) { width: 17%; } /* Coluna */
+        th:nth-child(5), td:nth-child(5) { width: 13%; } /* Tipo de Dado */
+        th:nth-child(6), td:nth-child(6) { width: 25%; } /* Regras PII */
+        
+        tr:nth-child(even) {
+            background-color: #f9f9f9;
+        }
+        tr:nth-child(odd) {
+            background-color: white;
+        }
+        .info-section {
+            margin-top: 20px;
+            color: #5c5c5c;
+        }
+        .timestamp {
+            font-style: italic;
+            text-align: right;
+            margin-top: 15px;
+            font-size: 0.9em;
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="header">
+            <img src="https://dadosfera.ai/wp-content/webp-express/webp-images/uploads/2022/06/Logo-Dadosfera1-1.png.webp" alt="Logo Dadosfera" class="logo">
+            <h1>Relatório de PII</h1>
+        </div>
+
+        <div class="info-section">
+            <p>Este relatório apresenta a estrutura de tabelas e suas as seguintes características de PII identificadas.</p>
+        </div>
+
+        <table>
+            <thead>
+                <tr>
+                    <th>Database</th>
+                    <th>Schema</th>
+                    <th>Tabela</th>
+                    <th>Coluna</th>
+                    <th>Tipo de Dado</th>
+                    <th>Regras PII</th>
+                </tr>
+            </thead>
+            <tbody>
+                {{#each dados}}
+                <tr>
+                    <td>{{database_name}}</td>
+                    <td>{{table_schema}}</td>
+                    <td>{{table_name}}</td>
+                    <td>{{column_name}}</td>
+                    <td>{{data_type}}</td>
+                    <td>{{pii_rules}}</td>
+                </tr>
+                {{/each}}
+            </tbody>
+        </table>
+
+        <p class="timestamp">Gerado em: {{dataGeracao}}</p>
+    </div>
+</body>
+</html>
@@ -4,6 +4,7 @@ import {
  OnApplicationBootstrap,
  ExecutionContext,
  Inject,
+  ForbiddenException,
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import assert from 'assert';
@@ -17,6 +18,7 @@ import {
 import { RequestUser } from '../decorators/user.decorator';
 import ErrorBuilder from '../utils/ErrorBuilder';
 import ErrorCodes from '../utils/errorCodes';
+import { ApiKeyService } from 'src/modules/api-key/api-key.service';

@Injectable()
 export class AuthenticationGuard
@@ -31,6 +33,7 @@ export class AuthenticationGuard
    dadosferaLogger: DadosferaLogger,
    private reflector: Reflector,
    private authClient: AuthClientService,
+    private apiKeyService: ApiKeyService
  ) {
    this.pems = new Map();
    this.logger = dadosferaLogger.logger;
@@ -48,20 +51,40 @@ export class AuthenticationGuard
    });
  }

-  canActivate(ctx: ExecutionContext): boolean {
+  async canActivate(ctx: ExecutionContext): Promise<boolean> {
    const authFunctions = this.reflector.getAllAndMerge<
      AuthenticationFunction[]
    >(AUTH_FUNCTION_KEY, [ctx.getClass(), ctx.getHandler()]);
    const mustBeAuthenticated = authFunctions.length > 0;

-    const request = ctx.switchToHttp().getRequest();
-    const accessToken = this.validateToken(request, mustBeAuthenticated);
-
    if (!mustBeAuthenticated) {
      // no need to be authenticated
      return true;
    }

+    const request = ctx.switchToHttp().getRequest();
+    const apiKey = request.get('X-api-key');
+    if (apiKey) {
+      const {
+        api_key
+      } = await this.apiKeyService.get(apiKey);
+
+      request.user = {
+        user_id: api_key.user_id,
+        username: api_key.username,
+        permissions: api_key.permissions,
+        customer_id: api_key.customer_id,
+        customer_name: api_key.customer_name,
+        customer_tier: api_key.customer_tier,
+        customer_modules: api_key.customer_modules,
+        access_token: apiKey,
+      };
+
+      return true;
+    }
+
+    const accessToken = this.validateToken(request, mustBeAuthenticated);
+
    if (!accessToken) {
      // couldn't load valid token
      throw new ErrorBuilder(ErrorCodes.AUTH.UNAUTHORIZED);
@@ -113,6 +136,18 @@ export class AuthenticationGuard
      return false;
    }

+    // Bloquear outros customer de usar o maestor dedicado
+    const DEDICATED_PROXY = process.env.DEDICATED_PROXY
+    if (DEDICATED_PROXY !== '' && DEDICATED_PROXY !== accessTokenPayload.customer_id) {
+      throw new ForbiddenException();
+    }
+
+    // Bloquear o customer de acesso o maestro publico
+    const hasNetworkPolicyModule = accessTokenPayload.customer_modules.includes('network-policy');
+    if (hasNetworkPolicyModule && DEDICATED_PROXY === '') {
+      throw new ForbiddenException();
+    }
+
    request.accessTokenPayload = accessTokenPayload;
    request.user = {
      user_id: accessTokenPayload.user_id,
@@ -121,6 +156,7 @@ export class AuthenticationGuard
      customer_id: accessTokenPayload.customer_id,
      customer_name: accessTokenPayload.customer_name,
      customer_tier: accessTokenPayload.customer_tier,
+      customer_modules: accessTokenPayload.customer_modules,
      access_token: accessToken,
    };
    // TODO: for backwards compatibility. remove in the future
@@ -609,6 +609,15 @@ export interface DadosferaModule {
  key: string;
  permissionSeqId: number;
 }
+
+export const DADOSFERA_MODULES_KEYS = {
+  LOG_DASHBOARD: 'logs-dashboard',
+  ACCESS_DASHBOARD: 'access-dashboard',
+  DANGER_ZONE: 'danger-zone',
+  PII: 'pii',
+  PUBLIC_ASSIGN_EMBED: 'public-assign-embed',
+}
+
 export const DADOSFERA_MODULES: Array<DadosferaModule> = [
  {
    name: 'Intelligence Module',
@@ -25,6 +25,14 @@ export function RequireSomePermission(
  );
 }

+export function RequireModule(
+  key: string
+) {
+  return createAuthenticatedDecorator((_, user: RequestUser) =>
+    user.customer_modules.some(module => module === key),
+  );
+}
+
 export function AuthenticateCondition(func: AuthenticationFunction) {
  return createAuthenticatedDecorator(func);
 }
@@ -1,32 +0,0 @@
-import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { SetMetadata } from '@nestjs/common';
-
-export const SetOrigin = (origin: string) => SetMetadata('allowedOrigin', origin);
-
-@Injectable()
-export class CORSGuard implements CanActivate {
-  constructor(private reflector: Reflector) {}
-
-  canActivate(context: ExecutionContext): boolean {
-    const response = context.switchToHttp().getResponse();
-    const request = context.switchToHttp().getRequest();
-    const origin = request.headers.origin;
-
-    // Obter a origem permitida através do decorador
-    const allowedOrigin = this.reflector.get<string>('allowedOrigin', context.getHandler());
-    if (process.env.ENV === "local") {
-        return true;
-    }
-
-    // Verifica se a origem da requisição é permitida   
-    if (allowedOrigin && origin !== allowedOrigin) {
-      throw new ForbiddenException('Acesso não permitido pela política CORS');
-    }
-
-    response.setHeader('Access-Control-Allow-Origin', allowedOrigin);
-
-    return true;
-  }
-}
-
@@ -11,6 +11,7 @@ export interface RequestUser {
  customer_name: string;
  customer_tier: string;
  access_token: string;
+  customer_modules: string[];
 }

 export const User: (options?: { required?: boolean }) => ParameterDecorator =
@@ -3,6 +3,7 @@ import { NestFactory } from '@nestjs/core';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import helmet from 'helmet';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
+import { json, urlencoded } from 'express';

 import { AppModule } from './app.module';
 import { writeFileSync } from 'fs';
@@ -25,6 +26,11 @@ async function bootstrap() {
    },
  });
  app.use(helmet());
+  if (process.env.ENV === 'prd') {
+    app.use('/catalog/register-dataset', json({ limit: '10mb' }));
+    app.use('/catalog/register-dataset', urlencoded({ extended: true, limit: '10mb' }));
+  }
+
  configureSwagger(app);
  await app.listen(3333);
  if (process.env.KILL_AFTER_START) await app.close();
@@ -0,0 +1,68 @@
+import { Controller, Get, Post, Body, Param, Delete, UseFilters, Inject } from '@nestjs/common';
+import { ApiKeyService } from './api-key.service';
+import { CreateApiKeyDto, CreateApiKeyResponseDto, ApiKeyBaseResponseDto } from './dto/api-key.dto';
+import { Authenticated } from 'src/decorators/authentication.decorator';
+import { ApiHeaders, ApiTags, ApiResponse } from '@nestjs/swagger';
+import { LanguageEnum } from 'src/utils/languages.enum';
+import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
+import { RequestUser, User } from 'src/decorators/user.decorator';
+import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
+
+@Controller('api-key')
+@Authenticated()
+@ApiTags('ApiKey')
+@ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
+@UseFilters(new GrpcToHttpExceptionFilter())
+export class ApiKeyController {
+  logger: DadosferaLogger;
+
+  constructor(
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+    private readonly apiKeyService: ApiKeyService,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  @Post()
+  @ApiResponse({ type: CreateApiKeyResponseDto })
+  async create(@Body() createApiKeyDto: CreateApiKeyDto, @User() user: RequestUser): Promise<CreateApiKeyResponseDto> {
+    this.logger.info('POST /api-key', {
+      permissions: createApiKeyDto.permissions,
+      method: 'create'
+    });
+    const result = await this.apiKeyService.create(createApiKeyDto, user);
+    this.logger.info('POST /api-key success', { 
+      id: result.id,
+      method: 'create'
+    });
+    return result;
+  }
+
+  @Get()
+  @ApiResponse({ type: [ApiKeyBaseResponseDto] })
+  async findAll(@User() user: RequestUser): Promise<ApiKeyBaseResponseDto[]> {
+    this.logger.info('GET /api-key', {
+      method: 'findAll'
+    });
+    const result = await this.apiKeyService.findAll(user);
+    this.logger.info('GET /api-key success', { 
+      count: result.length,
+      method: 'findAll'
+    });
+    return result;
+  }
+
+  @Delete(':id')
+  async remove(@Param('id') id: string, @User() user: RequestUser): Promise<void> {
+    this.logger.info('DELETE /api-key/:id', { 
+      id,
+      method: 'remove'
+    });
+    await this.apiKeyService.remove(id, user);
+    this.logger.info('DELETE /api-key/:id success', { 
+      id,
+      method: 'remove'
+    });
+  }
+}
@@ -0,0 +1,18 @@
+import { Module } from '@nestjs/common';
+import { ApiKeyService } from './api-key.service';
+import { ApiKeyController } from './api-key.controller';
+import { ClientsModule } from '@nestjs/microservices';
+import { DucClient } from '../duc/client.config';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+
+const ducClient = new DucClient();
+
+@Module({
+  imports: [
+    ClientsModule.register([ducClient.providerOptions])
+  ],
+  controllers: [ApiKeyController],
+  providers: [ApiKeyService, DadosferaLogger],
+  exports: [ApiKeyService]
+})
+export class ApiKeyModule {}
@@ -0,0 +1,50 @@
+import { Injectable, Inject, OnModuleInit } from '@nestjs/common';
+import { ClientGrpc } from '@nestjs/microservices';
+import { CreateApiKeyDto, CreateApiKeyResponseDto, ApiKeyBaseResponseDto } from './dto/api-key.dto';
+import { RequestUser } from 'src/decorators/user.decorator';
+import { DucClient } from '../duc/client.config';
+import { ApiKeyWriteProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+import { lastValueFrom } from 'rxjs';
+import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
+
+@Injectable()
+export class ApiKeyService implements OnModuleInit {
+  private apiKeyService: ApiKeyWriteProtoService;
+
+  constructor(
+    @Inject(DucClient.name) private readonly client: ClientGrpc,
+  ) {}
+
+  onModuleInit() {
+    this.apiKeyService = this.client.getService<ApiKeyWriteProtoService>(ProtoServices.ApiKeyWriteProtoService);
+  }
+
+  create(createApiKeyDto: CreateApiKeyDto, user: RequestUser): Promise<CreateApiKeyResponseDto> {
+    const metadata = PackTheMetadata(user);
+
+    return lastValueFrom(this.apiKeyService.CreateApiKey({
+      permissions: createApiKeyDto.permissions
+    }, metadata));
+  }
+
+  async findAll(user: RequestUser): Promise<ApiKeyBaseResponseDto[]> {
+    const metadata = PackTheMetadata(user);
+    console.log(metadata)
+
+    const data = await lastValueFrom(this.apiKeyService.ListApiKeys({}, metadata));
+    return data.api_keys;
+  }
+
+  async remove(id: string, user: RequestUser) {
+    const metadata = PackTheMetadata(user);
+
+    await lastValueFrom(this.apiKeyService.DeleteApiKey({ id }, metadata));
+  }
+
+  async get(key: string) {
+    const metadata = PackTheMetadata({});
+
+    return await lastValueFrom(this.apiKeyService.GetApiKey({ key }, metadata));
+  }
+}
@@ -0,0 +1,39 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsArray, IsNumber } from 'class-validator';
+
+export class PermissionDto {
+  @ApiProperty({ type: Number })
+  id: number;
+
+  @ApiProperty({ type: String })
+  name: string;
+}
+
+export class ApiKeyBaseResponseDto {
+  @ApiProperty({ type: String, format: 'uuid' })
+  id: string;
+
+  @ApiProperty({ type: String })
+  key_mask: string;
+
+  @ApiProperty({ type: [PermissionDto] })
+  permissions: PermissionDto[];
+
+  @ApiProperty({ type: String, format: 'date-time' })
+  created_at: string;
+
+  @ApiProperty({ type: String })
+  created_by: string;
+}
+
+export class CreateApiKeyResponseDto extends ApiKeyBaseResponseDto {
+  @ApiProperty({ type: String })
+  key: string;
+}
+
+export class CreateApiKeyDto {
+  @ApiProperty({ type: [Number], description: 'Array of permission IDs' })
+  @IsArray()
+  @IsNumber({}, { each: true })
+  permissions: number[];
+} 
@@ -0,0 +1,33 @@
+import { Controller, Post, Body, Put, Get} from '@nestjs/common';
+import { AssignService } from './assign.service';
+import { CreateAssignDto } from './dto/create-assign.dto';
+import { Authenticated, RequireModule, RequireSomePermission } from 'src/decorators/authentication.decorator';
+import { RequestUser, User } from 'src/decorators/user.decorator';
+import { DADOSFERA_MODULES_KEYS, PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
+
+@Controller('assign')
+@Authenticated()
+export class AssignController {
+  constructor(private readonly assignService: AssignService) {}
+
+  @Put('/public-key')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.USERS.permissions.ADMIN
+  )
+  @RequireModule(DADOSFERA_MODULES_KEYS.PUBLIC_ASSIGN_EMBED)
+  create(@Body() createAssignDto: CreateAssignDto, @User() user: RequestUser) {
+    const metadata = PackTheMetadata(user);
+    return this.assignService.create(createAssignDto, metadata);
+  }
+
+  @Get('/public-key')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.USERS.permissions.ADMIN
+  )
+  @RequireModule(DADOSFERA_MODULES_KEYS.PUBLIC_ASSIGN_EMBED)
+  async get(@User() user: RequestUser) {
+    const metadata = PackTheMetadata(user);
+    return await this.assignService.get(metadata);
+  }
+}
@@ -0,0 +1,15 @@
+import { Module } from '@nestjs/common';
+import { AssignService } from './assign.service';
+import { AssignController } from './assign.controller';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+import { ClientsModule } from '@nestjs/microservices';
+import { DucClient } from '../duc/client.config';
+
+const client = new DucClient();
+
+@Module({
+  imports: [ClientsModule.register([client.providerOptions])],
+  controllers: [AssignController],
+  providers: [AssignService, DadosferaLogger]
+})
+export class AssignModule {}
@@ -0,0 +1,38 @@
+import { Inject, Injectable, OnModuleInit } from '@nestjs/common';
+import { CreateAssignDto } from './dto/create-assign.dto';
+import { Metadata } from '@grpc/grpc-js';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+import { ClientGrpc } from '@nestjs/microservices';
+import { DucClient } from 'src/modules/duc/client.config';
+import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
+import { lastValueFrom } from 'rxjs';import { AssingProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+
+@Injectable()
+export class AssignService implements OnModuleInit {
+
+  ducService: AssingProtoService;
+  logger: DadosferaLogger;
+
+  constructor(
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+    @Inject(DucClient.name) private readonly grpcClient: ClientGrpc,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  onModuleInit() {
+    this.ducService =this.grpcClient.getService<AssingProtoService>(
+      ProtoServices.AssingProtoService,
+    );
+  }
+
+  async create(createAssignDto: CreateAssignDto, metadata: Metadata) {
+    const data = await lastValueFrom(this.ducService.CreateOrUpdateAssignPublicKey(createAssignDto, metadata))
+    return data;
+  }
+
+  async get(metadata: Metadata) {
+    return await lastValueFrom(this.ducService.GetAssignPublicKey(metadata))
+  }
+}
@@ -0,0 +1,3 @@
+export class CreateAssignDto {
+    publicKey: string;
+}
@@ -43,8 +43,9 @@ import {
  AuthRefreshAccessTokenRes,
  AuthSignInReq,
  AuthSignInRes,
+  BulkEditRequest,
 } from './dtos/login';
-import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
 import { AuthGuard } from '@nestjs/passport';
 import { Request } from 'express';
 import ErrorCodes, { OauthErrors } from 'src/utils/errorCodes';
@@ -88,6 +89,7 @@ export class AuthController {
  ): Promise<AuthSignInRes> {
    this.logger.info('/auth - SignIn');
    const metadata = PackTheMetadata({ language });
+    this.logger.info('metadata: ' + JSON.stringify(metadata.toJSON()));
    return this.authClient.signIn({ username, password, totp }, metadata);
  }

@@ -97,13 +99,15 @@ export class AuthController {
  async refreshAccessToken(
    @Body() body: AuthRefreshAccessTokenReq,
    @Language() language: LanguageEnum,
+    @Headers('origin') origin: string,
  ) {
    this.logger.info('/auth - RefreshAccessToken');
    const { refreshToken, customerName: customer_name } = body;
-
+    const frontHost = origin.replace(/^https?:\/\//, '');
    const metadata = PackTheMetadata({
-      customer_name,
      language,
+      customer_name,
+      custom_host: frontHost,
    });

    return this.authClient.refreshAccessToken({ refreshToken }, metadata);
@@ -177,16 +181,23 @@ export class AuthController {
  @ApiInternalOnlyEndpoint()
  @Post('confirm-reset-password')
  @HttpCode(HttpStatus.OK)
-  async confirmResetPassword(@Body() body: AuthConfirmResetPasswordRequest) {
+  async confirmResetPassword(
+    @Body() body: AuthConfirmResetPasswordRequest,
+    @Headers('origin') origin: string,
+  ) {
    this.logger.info('/auth - confirm-reset-password');
-
+    const frontHost = origin.replace(/^https?:\/\//, '');
+    const metadata = PackTheMetadata({ custom_host: frontHost });
    const { username, code, newPassword } = body;

-    return this.authClient.confirmResetPassword({
+    return this.authClient.confirmResetPassword(
+      {
        username,
        code,
        newPassword,
-    });
+      },
+      metadata,
+    );
  }

  @ApiInternalOnlyEndpoint()
@@ -344,4 +355,67 @@ export class AuthController {

    return { token, email, url, language };
  }
+
+  @ApiInternalOnlyEndpoint()
+  @Post('users/block')
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @HttpCode(HttpStatus.OK)
+  async blockUsers(
+    @Language() language: LanguageEnum,
+    @User() user: RequestUser,
+    @Body() body: BulkEditRequest,
+  ) {
+    this.logger.info('blockUsers - Starting request');
+
+    try {
+      const metadata = PackTheMetadata(user);
+
+      this.logger.debug('Calling blockUsers service', {
+        metadata: {
+          access_token: metadata.get('access_token'),
+          language: metadata.get('language'),
+        },
+      });
+
+      const result = await this.authClient.blockUsers(body.users, metadata);
+      this.logger.info('blockUsers - Success', { result });
+      return result;
+    } catch (error) {
+      this.logger.error('blockUsers - Error', {
+        error: error.message,
+        stack: error.stack,
+      });
+      throw error;
+    }
+  }
+
+  @ApiInternalOnlyEndpoint()
+  @Post('users/unblock')
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @HttpCode(HttpStatus.OK)
+  async unblockUsers(
+    @Language() language: LanguageEnum,
+    @User() user: RequestUser,
+    @Body() body: BulkEditRequest,
+  ) {
+    this.logger.info('unblockUsers');
+    const metadata = PackTheMetadata(user);
+
+    return this.authClient.unblockUsers(body.users, metadata);
+  }
+
+  @ApiInternalOnlyEndpoint()
+  @Post('users/reset')
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @HttpCode(HttpStatus.OK)
+  async resetUsers(
+    @Language() language: LanguageEnum,
+    @User() user: RequestUser,
+    @Body() body: BulkEditRequest,
+  ) {
+    this.logger.info('resetUsers');
+    const metadata = PackTheMetadata(user);
+
+    return this.authClient.resetUsers(body.users, metadata);
+  }
 }
@@ -1,4 +1,4 @@
-import { OnModuleInit, Inject, Injectable } from '@nestjs/common';
+import { OnModuleInit, Inject, Injectable, ForbiddenException } from '@nestjs/common';
 import { ClientGrpc } from '@nestjs/microservices';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { lastValueFrom } from 'rxjs';
@@ -17,9 +17,11 @@ import {
  AuthResetPasswordRequest,
  AuthVerifyResetPasswordCodeRequest,
  AuthConfirmResetPasswordRequest,
+  AuthSignInResponse,
 } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/messages';
 import { DucClient } from '../duc/client.config';
 import { Metadata } from '@grpc/grpc-js';
+import { BulkEditResponse } from './dtos/login';

@Injectable()
 export class AuthClientService implements OnModuleInit {
@@ -52,15 +54,49 @@ export class AuthClientService implements OnModuleInit {
    return lastValueFrom(this.authService.AuthSnowflakeSignIn(input));
  }

+  checkDedicatedProxy({
+    customer
+  }: AuthSignInResponse) {
+    const DEDICATED_PROXY = process.env.DEDICATED_PROXY || '';
+    this.logger.info('SignIn - Setting customer ID for dedicated proxy: ' + DEDICATED_PROXY);
+    this.logger.info('Customer ID: ' + customer.id);
+
+    if (DEDICATED_PROXY !== '' && DEDICATED_PROXY !== customer.id) {
+      throw new ForbiddenException();
+    }
+
+    // Bloquear o customer de acesso o maestro publico
+    this.logger.info('Check if customer have network policy: ' + customer.modules);
+    const hasNetworkPolicyModule = customer.modules.includes('network-policy');
+    if (hasNetworkPolicyModule && DEDICATED_PROXY === '') {
+      throw new ForbiddenException();
+    }
+  }
+
  async signIn(
    { username, password, totp }: AuthSignInRequest,
    metadata: Metadata,
  ) {
    this.logger.info('SignIn');

-    return lastValueFrom(
+    let result: AuthSignInResponse;
+
+    try {
+      result = await lastValueFrom(
        this.authService.AuthSignIn({ username, password, totp }, metadata),
      );
+
+    } catch (error) {
+      this.logger.error('SignIn - Error during sign-in');
+      this.logger.error(error);
+      throw error;
+    }
+
+    if (result.customer) {
+      this.checkDedicatedProxy(result);
+    }
+
+    return result
  }

  async refreshAccessToken(
@@ -112,19 +148,21 @@ export class AuthClientService implements OnModuleInit {
    );
  }

-  async confirmResetPassword({
-    username,
-    code,
-    newPassword,
-  }: AuthConfirmResetPasswordRequest) {
+  async confirmResetPassword(
+    { username, code, newPassword }: AuthConfirmResetPasswordRequest,
+    metadata: Metadata,
+  ) {
    this.logger.info('confirmResetPassword');

    return lastValueFrom(
-      this.authService.AuthConfirmResetPassword({
+      this.authService.AuthConfirmResetPassword(
+        {
          username,
          code,
          newPassword,
-      }),
+        },
+        metadata,
+      ),
    );
  }

@@ -168,4 +206,72 @@ export class AuthClientService implements OnModuleInit {
      this.authService.AuthOauthSignIn({ token, username, refreshToken: '' }),
    );
  }
+
+  async blockUsers(
+    users: string[],
+    metadata: Metadata,
+  ): Promise<BulkEditResponse> {
+    this.logger.info('blockUsers - Service starting');
+
+    try {
+      this.logger.debug('Calling BlockUser gRPC method', {
+        metadata: {
+          access_token: metadata.get('access_token'),
+          language: metadata.get('language'),
+        },
+      });
+
+      const response = await lastValueFrom<BulkEditResponse>(
+        this.authService.BlockUser({ users }, metadata),
+      );
+
+      this.logger.info('blockUsers - Service success', { response });
+      return response;
+    } catch (error) {
+      this.logger.error('blockUsers - Service error', {
+        error: error.message,
+        stack: error.stack,
+      });
+      throw error;
+    }
+  }
+
+  async unblockUsers(
+    users: string[],
+    metadata: Metadata,
+  ): Promise<BulkEditResponse> {
+    this.logger.info('unblockUsers');
+    return await lastValueFrom(
+      this.authService.UnblockUser({ users }, metadata),
+    );
+  }
+
+  async resetUsers(
+    users: string[],
+    metadata: Metadata,
+  ): Promise<BulkEditResponse> {
+    this.logger.info('resetUsers');
+
+    try {
+      this.logger.debug('Calling ResetUser gRPC method', {
+        metadata: {
+          access_token: metadata.get('access_token'),
+          language: metadata.get('language'),
+        },
+      });
+
+      const response = await lastValueFrom<BulkEditResponse>(
+        this.authService.ResetUser({ users }, metadata),
+      );
+
+      this.logger.info('resetUsers - Success', { response });
+      return response;
+    } catch (error) {
+      this.logger.error('resetUsers - Error', {
+        error: error.message,
+        stack: error.stack,
+      });
+      throw error;
+    }
+  }
 }
@@ -67,16 +67,28 @@ export class AuthUser {
 export class AuthCustomer {
  @ApiProperty()
  modules: string[];
+
  @ApiProperty()
  id: string;
+
  @ApiProperty()
  name: string;
+
+  @ApiProperty()
+  displayName: string;
  @ApiProperty()
  tier: string;
+
  @ApiProperty()
  scheduleLimit: string;
+
  @ApiProperty()
  links: Link[];
+
+  @ApiProperty()
+  themeEnabled: boolean;
+  @ApiProperty()
+  enforceMfa: boolean;
 }

 export class AuthSignInReq implements AuthSignInRequest {
@@ -118,3 +130,13 @@ export class AuthRefreshAccessTokenRes {
  @ApiProperty()
  accessToken: string;
 }
+
+export interface BulkEditRequest {
+  users: string[];
+}
+
+export interface BulkEditResponse {
+  message: string;
+  successfulUsers: string[];
+  failedUsers: string[];
+}
@@ -5,6 +5,7 @@ import {
 } from '@nestjs/microservices';
 import { credentials } from '@grpc/grpc-js';
 import { Catalog } from '@dadosfera/protospack-v2';
+import { PlatformInterfaces } from '@dadosfera/protospack-v2';

 const isLocalConnection =
  process.env.PIFACTORY_URL.startsWith('pi-factory:') ||
@@ -19,11 +20,13 @@ export class CatalogClientConfiguration {
      package: [
        Catalog.ProtoPackages.ReadPackage,
        Catalog.ProtoPackages.WritePackage,
+        PlatformInterfaces.ProtoPackages.WritePackage
      ],
      credentials: isLocalConnection ? undefined : credentials.createSsl(),
      protoPath: [
        Catalog.ProtoPaths.ReadFilePath,
        Catalog.ProtoPaths.WriteFilePath,
+        PlatformInterfaces.ProtoPaths.WriteFilePath
      ],
      loader: {
        keepCase: true,
@@ -13,6 +13,9 @@ import {
  Put,
  Query,
  UseFilters,
+  HttpException,
+  HttpStatus,
+  Res,
 } from '@nestjs/common';
 import {
  ApiCreatedResponse,
@@ -23,12 +26,13 @@ import {
 import {
  Authenticated,
  RequireAllPermissions,
+  RequireModule,
  RequireSomePermission,
 } from '../../decorators/authentication.decorator';
-import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
+import { DADOSFERA_MODULES_KEYS, PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { CatalogService } from './catalog.service';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
-import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
 import { RequestUser, User } from 'src/decorators/user.decorator';
 import {
  BatchRemoveRlsRulesRequest,
@@ -54,7 +58,10 @@ import {
  AddRlsRuleRequest,
  GetNimbusDashboardsRequest,
  GetRlsRulesRequest,
+  RegisterDatasetWithMetatadaRequest,
 } from '@dadosfera/protospack-v2/dist/lib/Catalog/interfaces/messages';
+import { Response } from 'express';
+import { TypeParser } from 'src/utils/FileParser/parser-types';

@ApiTags('Catalog')
@ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
@@ -340,7 +347,7 @@ export class CatalogController {
    @Language() language: LanguageEnum,
    @Param('id') id: string,
  ): Promise<IPreviewResponse> {
-    const { customer_name, customer_id, user_id, username } = user;
+    const { customer_name, customer_id, user_id, username, customer_modules } = user;

    this.logger.info(`/catalog - ON GET DATA DOCS ROUTE`, {
      user_id,
@@ -353,6 +360,7 @@ export class CatalogController {
      user_id,
      username,
      language,
+      is_mask: customer_modules.some(mod => mod === 'pii')
    });

    const preview = await this.catalogService.getDatasetPreview(id, metadata);
@@ -743,4 +751,138 @@ export class CatalogController {

    return JSON.parse(dashboards);
  }
+
+  @Post('register-dataset')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.CREATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
+  async registerDatasetWithMetadataRequest(
+    @Body() body: RegisterDatasetWithMetatadaRequest,
+    @User() user: RequestUser,
+  ) {
+    const { customer_id, customer_name, user_id, username } = user;
+    const logMetadata = {
+      customer_name: customer_name,
+      user_id: user_id,
+      method: 'POST',
+      path: '/catalog/register-dataset',
+    };
+    try {
+      const metadata = PackTheMetadata({
+        customer_id,
+        customer_name,
+        user_id,
+        username,
+      });
+
+      this.logger.log(
+        `Request from user ${user_id} for customer ${customer_name}`,
+        logMetadata,
+      );
+
+      // Create table metadata
+      const tableMetadataBody = {
+        table_metadata: body.table_metadata,
+        info: {
+          customer: customer_name,
+        },
+        logMetadata: logMetadata,
+      };
+
+      const table_metadata_id = await this.catalogService.createTableMetadata(
+        tableMetadataBody,
+      );
+      this.logger.info(`table_metadata_id: ${table_metadata_id}`, logMetadata);
+
+      // Create column metadata
+      const columnMetadataBody = {
+        column_metadata: body.column_metadata,
+        info: {
+          customer: customer_name,
+        },
+      };
+      this.logger.info(
+        `Creating column metadata for table ${table_metadata_id}`,
+        logMetadata,
+      );
+      const column_metadata_ids =
+        await this.catalogService.createColumnMetadata(columnMetadataBody);
+
+      // Create data preview
+      const dataPreviewBody = {
+        data_preview: body.data_preview,
+        info: {
+          customer: customer_name,
+        },
+      };
+      this.logger.debug(
+        `Creating data preview for table ${table_metadata_id}`,
+        logMetadata,
+      );
+      const data_preview_id = await this.catalogService.createDataPreview(
+        dataPreviewBody,
+      );
+
+      // Catalog dataset item
+      this.logger.info(
+        `Cataloging dataset item for table ${table_metadata_id}`,
+        logMetadata,
+      );
+      await this.catalogService.catalogDatasetItem(table_metadata_id, metadata);
+      this.logger.info(
+        `Dataset registration completed successfully for table ${table_metadata_id}`,
+        logMetadata,
+      );
+      return {
+        message: 'Dataset registered successfully',
+        table_metadata_id: table_metadata_id,
+        column_metadata_ids: column_metadata_ids,
+        data_preview_id: data_preview_id,
+      };
+    } catch (error) {
+      this.logger.error(
+        `Failed to register dataset. The following error occurred: ${error.response.data}`,
+        logMetadata,
+      );
+
+      throw new HttpException(
+        {
+          message: 'Ocorreu um erro ao registrar o dataset',
+          error: error.message,
+          code: 'REGISTRATION_FAILED',
+          details: error.message,
+        },
+        HttpStatus.INTERNAL_SERVER_ERROR,
+      );
+    }
+  }
+
+  @Get('pii-reporter')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.USERS.permissions.ADMIN
+  )
+  @RequireModule(
+    DADOSFERA_MODULES_KEYS.PII
+  )
+  async getPiiReporter(@User() user: RequestUser, @Res() res: Response, @Query('type') contentType: TypeParser = "pdf") {
+    this.logger.info('GET pii-reporter');
+    const metadata = PackTheMetadata(user);
+
+    try {
+      const {
+        file,
+        filename,
+        type
+      } = await this.catalogService.getPiiReporter(metadata, contentType);
+      res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+      res.setHeader('Content-Type', type);
+
+      // use res.end to send buffer
+      return res.end(file);
+    } catch (error) {
+      console.error(error)
+      this.logger.error(error.message);
+    }
+  }
 }
@@ -3,12 +3,15 @@ import { Module } from '@nestjs/common';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';

 import { CatalogController } from './catalog.controller';
-import { CatalogService } from './catalog.service';
 import { CatalogClientConfiguration } from './catalog-client';
 import { ClientsModule } from '@nestjs/microservices';
 import { PipelinesModule as OldPipelineModule } from 'src/modules/pipelines/pipelines.module';
 import { UsersModule } from '../users/users.module';
 import { RolesModule } from '../roles/roles.module';
+import { CustomersModule } from '../customers/customers.module';
+import { ShareModule } from './share/share.module';
+import { CatalogService } from './catalog.service';
+import { MixpanelModule } from '../mixpanel/mixpanel.module';

 const client = new CatalogClientConfiguration();

@@ -18,6 +21,8 @@ const client = new CatalogClientConfiguration();
    OldPipelineModule,
    UsersModule,
    RolesModule,
+    CustomersModule,
+    ShareModule,
  ],
  controllers: [CatalogController],
  providers: [CatalogService, DadosferaLogger],
@@ -5,6 +5,11 @@ import {
  ProtoServices,
  Messages,
 } from '@dadosfera/protospack-v2/dist/lib/Catalog';
+import {
+  Messages as PlatformInterfaceMessages,
+  WriteService as PlatformInterfaceWriteService,
+  ProtoServices as PlatformInterfacesProtoServices,
+} from '@dadosfera/protospack-v2/dist/lib/PlatformInterfaces';
 import {
  BadRequestException,
  HttpException,
@@ -28,11 +33,15 @@ import {
  AddRlsRuleRequest,
  GetNimbusDashboardsRequest,
  GetRlsRulesRequest,
+  PiiMetadata,
 } from '@dadosfera/protospack-v2/dist/lib/Catalog/interfaces/messages';
+import { TypeParser } from 'src/utils/FileParser/parser-types';
+import { ParserBuilder } from 'src/utils/FileParser/parser.builder';

 class CatalogService implements OnModuleInit {
  catalogReadService: ReadService.CatalogReadServices;
  catalogWriteService: WriteService.CatalogWriteServices;
+  platformWriteService: PlatformInterfaceWriteService.PlatformInterfacesWriteServices;
  logger: any;
  constructor(
    @Inject(DadosferaLogger)
@@ -54,9 +63,14 @@ class CatalogService implements OnModuleInit {
      this.grpcClient.getService<WriteService.CatalogWriteServices>(
        ProtoServices.CatalogWriteServices,
      );
+    this.platformWriteService =
+      this.grpcClient.getService<PlatformInterfaceWriteService.PlatformInterfacesWriteServices>(
+        PlatformInterfacesProtoServices.PlatformInterfacesWriteServices,
+      );
  }

  _getNimbusUrl(body) {
+    this.logger.debug(`Body: ${JSON.stringify(body)}`);
    const customer = body.info.customer.toLowerCase();

    if (process.env.ENV === 'prd') {
@@ -69,6 +83,42 @@ class CatalogService implements OnModuleInit {
    )}.dadosfera.ai`;
  }

+  async getPiiReporter(metadata: Metadata, type: TypeParser) {
+    this.logger.info('getPiiReporter: ' + type)
+    try {
+      const {
+        data
+      } = await lastValueFrom(
+        this.catalogWriteService.GetPiiReporter({}, metadata)
+      )
+      this.logger.info("Finish grpc call")
+
+      const parser = ParserBuilder.build<PiiMetadata>(type);
+
+      this.logger.info('parser file to: ' + type)
+      const file = await parser.parse(data)
+      this.logger.info('finish parser')
+      const mimeTypes: Record<TypeParser, string> = {
+        'csv': 'text/csv',
+        'html': 'text/html',
+        'pdf': 'application/pdf'
+      }
+
+      const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+      const filename = `relatorio-pii-${timestamp}.${type}`;
+
+      return {
+        file,
+        filename: filename,
+        type: mimeTypes[type]
+      }
+    } catch (error) {
+      this.logger.error(error.message);
+      throw error;
+    }
+
+  }
+
  async createDataAsset(data: Messages.CreateDataAssetRequest, metadata) {
    this.logger.info('CatalogService - Manage Data assets permissions');
    if (!data.embed) data.embed = undefined;
@@ -260,7 +310,7 @@ class CatalogService implements OnModuleInit {
    const { documentation } = await lastValueFrom(
      this.catalogReadService.GetDatasetDoc({ id, type: undefined }, metadata),
    );
-    console.log(documentation);
+ 
    const docs = JSON.parse(documentation);
    return docs;
  }
@@ -420,6 +470,112 @@ class CatalogService implements OnModuleInit {
    );
    return res.dashboards;
  }
+
+  async createTableMetadata(body: any): Promise<number> {
+    const nimbusUrl = this._getNimbusUrl(body);
+    this.logger.info(`Nimbus URL: ${nimbusUrl}`, {...body.logMetadata});
+
+    const endpoint = `${nimbusUrl}/api/catalog/table-metadata/`;
+
+    this.logger.info(`Creating table metadata for table ${body.table_metadata.table_name}`, {...body.logMetadata});
+    this.logger.info(`Using endpoint: ${endpoint}`, {...body.logMetadata});
+    this.logger.debug(`Payload: ${JSON.stringify(body.table_metadata)}`, {...body.logMetadata});  
+
+    try {
+      const { data, status } = await axios.post(endpoint, {...body.table_metadata});
+
+      this.logger.info(
+        `Table metadata created successfully with status ${status} for table ${body.table_metadata.table_name}`,
+        {...body.logMetadata},
+      );
+      return data.id;
+    } catch (error) {
+      this.logger.error(
+        `Failed to create table metadata for table ${body.table_metadata.table_name} failed with status ${
+          error.response?.status
+        } because of ${JSON.stringify(error.response?.data) || error.message}`, {...body.logMetadata});
+      throw new Error(error.response?.data?.message || error.message);
+    }
+  }
+
+  async createColumnMetadata(body: any): Promise<number[]> {
+    const nimbusUrl = this._getNimbusUrl(body);
+    this.logger.info(`Nimbus URL: ${nimbusUrl}`, body.logMetadata);
+    const endpoint = `${nimbusUrl}/api/catalog/column-metadata/`;
+
+ 
+
+    try {
+      this.logger.info(`Creating column metadata for table ${body.column_metadata.table_name}`, {...body.logMetadata});
+      this.logger.info(`Using endpoint: ${endpoint}`, {...body.logMetadata});
+      this.logger.debug(`Payload: ${JSON.stringify(body.column_metadata)}`, {...body.logMetadata});
+      const { data, status } = await axios.post(endpoint, body.column_metadata);
+
+      this.logger.info(
+        `Column metadata created successfully with status ${status} for table ${body.column_metadata.table_name}`,
+        {...body.logMetadata},
+      );
+      return data.map((column) => column.id);
+    } catch (error) {
+      this.logger.error(
+        `Failed to create column metadata failed with status for table ${body.column_metadata.table_name} ${
+          error.response?.status
+        } because of ${error.response?.data || error.message}`, {...body.logMetadata});
+      throw new Error(error.response?.data?.message || error.message);
+    }
+  }
+
+  async createDataPreview(body: any): Promise<number> {
+    const nimbusUrl = this._getNimbusUrl(body);
+    this.logger.info(`Nimbus URL: ${nimbusUrl}`, {...body.logMetadata});
+    const endpoint = `${nimbusUrl}/api/catalog/data-preview/`;
+
+    this.logger.info(`Creating data preview for table ${body.data_preview.table_name}`, {...body.logMetadata});
+    this.logger.info(`Using endpoint: ${endpoint}`, {...body.logMetadata});
+    this.logger.debug(`Payload: ${JSON.stringify(body.data_preview)}`, {...body.logMetadata});
+
+    try {
+      const { data, status } = await axios.post(endpoint, body.data_preview);
+
+      this.logger.info(
+        `Data preview created successfully with status ${status} for table ${body.data_preview.table_name}`,
+        {...body.logMetadata},
+      );
+      return data.id;
+    } catch (error) {
+      this.logger.error(
+        `Failed to create data preview for table ${body.data_preview.table_name} failed with status ${
+          error.response?.status
+        } because of ${error.response?.data || error.message}`,
+        {...body.logMetadata},
+      );
+      throw new Error(error.response?.data?.message || error.message);
+    }
+  }
+
+  async catalogDatasetItem(table_metadata_id: number, metadata: Metadata) {
+    const customer_name_raw = metadata.get('customer_name');
+
+    const customer_name = customer_name_raw?.[0]?.toString();
+    if (!customer_name) {
+      throw new BadRequestException('Customer name not found in metadata');
+    }
+    const res = await lastValueFrom(
+      this.platformWriteService.CatalogDataAssets(
+        {
+          data_assets: [
+            {
+              data_asset_id: table_metadata_id.toString(),
+              customer_name: customer_name,
+              data_asset_type: 'dataset',
+            },
+          ],
+        },
+        metadata,
+      ),
+    );
+    return res;
+  }
 }

 export { CatalogService };
@@ -0,0 +1,8 @@
+export class PiiDto {
+  database_name: string;
+  table_schema: string;
+  table_name: string;
+  column_name: string;
+  data_type: string;
+  pii_rules: string;
+}
@@ -0,0 +1,90 @@
+import {
+  Controller,
+  Get,
+  Inject,
+  Param,
+  Req,
+  UseFilters,
+} from '@nestjs/common';
+import {
+  ApiHeaders,
+  ApiTags,
+} from '@nestjs/swagger';
+import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
+import { RequestUser, User } from 'src/decorators/user.decorator';
+import {
+  IColumnsMetadataResponse,
+  IDocsResponse,
+  IPreviewResponse,
+
+} from '../dtos';
+import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
+import { Language } from 'src/decorators/language.decorator';
+import { LanguageEnum } from 'src/utils/languages.enum';
+import { ShareService } from './share.service';
+import { Request } from 'express';
+
+@ApiTags('Catalog')
+@ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
+@Controller('catalog/data-asset/share')
+@UseFilters(new GrpcToHttpExceptionFilter())
+export class ShareController {
+  logger: DadosferaLogger;
+  constructor(
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+    private catalogShareService: ShareService,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  @Get('/:id')
+  async getShareDataAsset(
+    @Param('id') id: string,
+    @User() user: RequestUser,
+    @Req() request: Request
+  ) {
+    this.logger.info(`GET //:id`);
+    return await this.catalogShareService.getOneDataAssetPublic(id, user, request);
+  }
+
+  @Get('/:id/columns-metadata')
+  async getShareDataAssetColumnsMetadata(
+    @Language() language: LanguageEnum,
+    @Param('id') id: string,
+    @User() user: RequestUser
+  ): Promise<IColumnsMetadataResponse> {
+    this.logger.info(`GET /:id/columns-metadata`);
+
+    const columns_metadata =
+      await this.catalogShareService.getDatasetColumnsMetadata(id, user);
+
+
+    return { columns_metadata };
+  }
+
+  @Get('/:id/preview')
+  async getShareDataAssetPreview(
+    @Language() language: LanguageEnum,
+    @Param('id') id: string,
+    @User() user: RequestUser
+  ): Promise<IPreviewResponse> {
+    this.logger.info(`GET /:id/preview`);
+    const preview = await this.catalogShareService.getDatasetPreview(id, user);
+
+    return { preview };
+  }
+
+  @Get('/:id/docs')
+  async getShareDataAssetDocs(
+    @Language() language: LanguageEnum,
+    @Param('id') id: string,
+    @User() user: RequestUser
+  ): Promise<IDocsResponse> {
+    this.logger.info(`GET /:id/docs`);
+    const docs = await this.catalogShareService.getDataDocs(id, user);
+
+    return { docs };
+  }
+
+}
@@ -0,0 +1,28 @@
+import { Module } from "@nestjs/common";
+import { CatalogClientConfiguration } from "../catalog-client";
+import { ClientsModule } from "@nestjs/microservices";
+import { RolesModule } from "src/modules/roles/roles.module";
+import { UsersModule } from "src/modules/users/users.module";
+import { CustomersModule } from "src/modules/customers/customers.module";
+import { ShareMetadataModule } from "src/modules/share-metadata/share-metadata.module";
+import { ShareController } from "./share.controller";
+import DadosferaLogger from "@dadosfera/dadosfera-logs";
+import { ShareService } from "./share.service";
+import { MixpanelModule } from "src/modules/mixpanel/mixpanel.module";
+
+const client = new CatalogClientConfiguration();
+
+@Module({
+  imports: [
+    ClientsModule.register([client.providerOptions]),
+    UsersModule,
+    RolesModule,
+    CustomersModule,
+    ShareMetadataModule,
+    MixpanelModule
+  ],
+  controllers: [ShareController],
+  providers: [ShareService, DadosferaLogger],
+  exports: [ShareModule],
+})
+export class ShareModule {}
@@ -0,0 +1,247 @@
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+import {
+  ProtoServices,
+  ReadService,
+} from '@dadosfera/protospack-v2/dist/lib/Catalog';
+import {
+  ForbiddenException,
+  Inject,
+  NotFoundException,
+  OnModuleInit,
+} from '@nestjs/common';
+import { CatalogClientConfiguration } from '../catalog-client';
+import { ClientGrpc } from '@nestjs/microservices';
+import { UsersService } from 'src/modules/users/users.service';
+import { RolesService } from 'src/modules/roles/roles.service';
+import { RequestUser } from 'src/decorators/user.decorator';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
+import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+import { Metadata } from '@grpc/grpc-js';
+import { lastValueFrom } from 'rxjs';
+import { ShareMetadataService } from 'src/modules/share-metadata/share-metadata.service';
+import { isJWT } from 'class-validator';
+import { MixpanelService } from 'src/modules/mixpanel/mixpanel.service';
+import { Request } from 'express';
+
+export class ShareService implements OnModuleInit {
+  catalogReadService: ReadService.CatalogReadServices;
+  logger: DadosferaLogger;
+
+  constructor(
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+    @Inject(CatalogClientConfiguration.name)
+    private readonly grpcClient: ClientGrpc,
+    private readonly userService: UsersService,
+    private readonly roleService: RolesService,
+    private readonly shareMetadataService: ShareMetadataService,
+    private readonly mixpanelService: MixpanelService,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  onModuleInit() {
+    this.catalogReadService =
+      this.grpcClient.getService<ReadService.CatalogReadServices>(
+        ProtoServices.CatalogReadServices,
+      );
+  }
+
+  async getDatasetColumnsMetadata(id: string, user: RequestUser) {
+    const shareMetadata = await this.getShareMetadata(id, user);
+    const metadata = PackTheMetadata({
+      customer_id: shareMetadata.customerId,
+      customer_name: shareMetadata.customerName,
+    });
+    const { columns_metadata } = await lastValueFrom(
+      this.catalogReadService.GetDatasetColumnsMetadata(
+        { id: shareMetadata.assetId, type: undefined },
+        metadata,
+      ),
+    );
+    const result = JSON.parse(columns_metadata);
+    return result;
+  }
+
+  async getDatasetPreview(id: string, user: RequestUser) {
+    const shareMetadata = await this.getShareMetadata(id, user);
+    const metadata = PackTheMetadata({
+      customer_id: shareMetadata.customerId,
+      customer_name: shareMetadata.customerName,
+    });
+    const { preview } = await lastValueFrom(
+      this.catalogReadService.GetDatasetPreview(
+        { id: shareMetadata.assetId, type: undefined },
+        metadata,
+      ),
+    );
+    const result = JSON.parse(preview);
+    return result;
+  }
+
+  async getOneDataAssetPublic(id: string, user: RequestUser, request: Request) {
+    this.logger.info("getOneDataAssetPublic: " + JSON.stringify({
+      id,
+      userId: user?.user_id,
+      customerId: user?.customer_id
+    }))
+    try {
+      const shareMetadata = await this.getShareMetadata(id, user);
+
+      const mixpanelTracker = {
+        asset: shareMetadata.assetId,
+        type: isJWT(id) ? 'assigned' : shareMetadata.type,
+        customer: shareMetadata.customerName
+      }
+
+      if (user) {
+        await this.mixpanelService.track("share_page", user, request, mixpanelTracker);
+      } else {
+        await this.mixpanelService.trackShare(request, mixpanelTracker);
+      }
+
+      this.logger.info("shareMetadata: " + JSON.stringify(shareMetadata))
+      const metadata = PackTheMetadata({
+        customer_id: shareMetadata.customerId,
+        customer_name: shareMetadata.customerName,
+      });
+  
+      const { data_asset } = await this.getOneDataAsset({
+        customer_id: shareMetadata.customerId,
+        id: shareMetadata.assetId,
+        metadata,
+      });
+      this.logger.info('found asset: ' + JSON.stringify(data_asset));
+      delete data_asset.p_roles;
+      delete data_asset.p_users;
+      data_asset.share_type = 'public';
+      if (data_asset.share_type !== 'public') throw new NotFoundException();
+  
+      return { data_asset };
+    } catch (error) {
+      this.logger.error(error);
+      throw error;
+    }
+
+  }
+
+  private async getOneDataAsset(data: {
+    id: string;
+    customer_id: string;
+    metadata: Metadata;
+  }) {
+    const { customer_id, id, metadata } = data;
+    const { data_asset } = await lastValueFrom(
+      this.catalogReadService.GetOneDataAsset(
+        { id, type: undefined },
+        metadata,
+      ),
+    );
+    let asset = JSON.parse(data_asset);
+    asset = {
+      ...asset,
+      p_roles: asset.roles,
+      p_users: asset.users,
+    };
+    asset = await this.getAssetsUsersAndRoles([asset], customer_id);
+
+    return { data_asset: asset[0] };
+  }
+
+  async getDataDocs(id: string, user: RequestUser) {
+    const shareMetadata = await this.getShareMetadata(id, user);
+    const metadata = PackTheMetadata({
+      customer_id: shareMetadata.customerId,
+      customer_name: shareMetadata.customerName,
+    });
+
+    const { documentation } = await lastValueFrom(
+      this.catalogReadService.GetDatasetDoc({ id, type: undefined }, metadata),
+    );
+    console.log(documentation);
+    const docs = JSON.parse(documentation);
+    return docs;
+  }
+
+  private async getAssetsUsersAndRoles(
+    data_assets: Array<any>,
+    customer_id: string,
+  ) {
+    const { users: customer_users } =
+      await this.userService.findAllUsersByCustomerId(customer_id);
+    const { roles: customer_roles } = await this.roleService.roleSearch(
+      {},
+      { customer_id },
+    );
+    return data_assets.map((data_asset) => {
+      const owner = customer_users.find(
+        (u) => u.id === data_asset.owner,
+      )?.username;
+
+      const roles = [];
+      const users = [];
+      for (const role_id of data_asset.roles) {
+        const role = customer_roles.find((r) => r.id === role_id);
+        if (role) roles.push({ id: role.id, name: role.name });
+      }
+      for (const user_id of data_asset.users) {
+        const user = customer_users.find((r) => r.id === user_id);
+        if (user) users.push({ id: user.id, username: user.username });
+      }
+      return {
+        ...data_asset,
+        roles,
+        users,
+        owner,
+      } as typeof data_asset;
+    });
+  }
+
+  // private async validateShareAssign(token: string) {
+  //   const tokenDecoded = jwt.decode(token, {
+  //     complete: true,
+  //   });
+
+  //   jwt.verify(token, this.pemValue, {
+  //     algorithms: ['RS256'],
+  //   });
+
+  //   const shareId = (tokenDecoded.payload as JwtPayload).sub;
+  //   const metadata = PackTheMetadata({});
+  //   return await this.shareMetadataService.get(shareId, metadata);
+  // }
+
+  private async getShareMetadata(id: string, user: RequestUser) {
+    const metadata = PackTheMetadata({});
+    this.logger.info('GET share metadata')
+    const info = await this.shareMetadataService.get(id, metadata);
+    if (isJWT(id) && info ){
+      return info;
+    }
+
+    if (info.type === 'private') {
+      if (!user) {
+        throw new ForbiddenException(
+          'You do not have permission to access this data asset.',
+        );
+      }
+
+      const is_data_manager = user.permissions.includes(
+        PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER.seqid,
+      );
+
+      const is_get = user.permissions.includes(
+        PERMISSIONS_GROUPS.CATALOG.permissions.GET.seqid,
+      );
+
+      if (is_data_manager || is_get) {
+        return info;
+      }
+
+      throw new ForbiddenException(
+        'You do not have permission to access this data asset.',
+      );
+    }
+    return info;
+  }
+}
@@ -20,7 +20,7 @@ import {
  DatabaseConnectionPropertiesDto,
 } from '../connection/dtos/connection';
 import { RequestUser } from 'src/decorators/user.decorator';
-import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';

@Injectable()
 export class ConnectionTestService {
@@ -28,7 +28,7 @@ import {
  UpdateConnectionDto,
 } from './dtos/connection';
 import { CreateConnectionDto } from './dtos/connection';
-import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
 import { Language } from 'src/decorators/language.decorator';
 import { LanguageEnum } from 'src/utils/languages.enum';
@@ -7,22 +7,26 @@ import {
  HttpStatus,
  Inject,
  Param,
+  Post,
  Put,
  Query,
  UseFilters,
 } from '@nestjs/common';
 import { ApiOkResponse, ApiProduces, ApiTags } from '@nestjs/swagger';
-import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+import { DADOSFERA_MODULES_KEYS, PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
 import {
  Authenticated,
  RequireAllPermissions,
+  RequireModule,
+  RequireSomePermission,
 } from 'src/decorators/authentication.decorator';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
 import { CustomersService } from './customers.service';
 import { CustomerLinkRequest, CustomerLinksResponse } from './dtos/customers';
 import { RequestUser, User } from 'src/decorators/user.decorator';
 import type { StringValue } from 'ms';
-import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
+import { EnforceMfa } from './dtos/enforce-mfa';

@ApiTags('Customers')
@Controller('customers')
@@ -38,6 +42,15 @@ export class CustomersController {
    this.logger = dadosferaLogger.logger;
  }

+  @Post(':id/mfa')
+  @Authenticated()
+  @RequireSomePermission(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @RequireModule(DADOSFERA_MODULES_KEYS.DANGER_ZONE)
+  async enableMfaEnforce(@Param('id') id: string, @Body() data: EnforceMfa) {
+    this.logger.info('enableMfaEnforce', { id });
+    return await this.customersService.enableEnforceMfa(id, data.enabled);
+  }
+
  @Get(':id/links')
  @Authenticated()
  @ApiOkResponse({ type: CustomerLinksResponse })
@@ -91,4 +104,36 @@ export class CustomersController {
    const metadata = PackTheMetadata(user);
    return this.customersService.getMonitoringDashboardUrl(metadata);
  }
+
+  @Get('logs-dashboard')
+  @Authenticated()
+  @RequireAllPermissions(
+    PERMISSIONS_GROUPS.USERS.permissions.ADMIN,
+  )
+  @RequireModule(DADOSFERA_MODULES_KEYS.LOG_DASHBOARD)
+  async getCustomerMixPanelLogsDashboard(
+    @User() user: RequestUser,
+  ): Promise<{ url: string }> {
+    this.logger.info('getLogsDashboardUrl');
+    const metadata = PackTheMetadata(user);
+  
+    const result = await this.customersService.getLogsDashboardUrl(metadata);
+    return result;
+  }
+
+  @Get('access-dashboard')
+  @Authenticated()
+  @RequireAllPermissions(
+    PERMISSIONS_GROUPS.USERS.permissions.ADMIN,
+  )
+  @RequireModule(DADOSFERA_MODULES_KEYS.ACCESS_DASHBOARD)
+  async getAccessDashboard(
+    @User() user: RequestUser,
+  ): Promise<{ url: string }> {
+    this.logger.info('getAccessDashboard');
+    const metadata = PackTheMetadata(user);
+  
+    const result = await this.customersService.getAccessDashboardUrl(user.customer_name, metadata);
+    return result;
+  }
 }
@@ -5,6 +5,7 @@ import {
  HttpException,
  HttpStatus,
  InternalServerErrorException,
+  ForbiddenException,
 } from '@nestjs/common';

 import { firstValueFrom, lastValueFrom } from 'rxjs';
@@ -33,6 +34,7 @@ import DadosferaLogger from '@dadosfera/dadosfera-logs';
 // This function will accept any string, which may result in a bug.
@Injectable()
 export class CustomersService implements OnModuleInit {
+
  private customerService: CustomersProtoService;
  private logger: DadosferaLogger;
  private pipelineReadService: ReadService.PipelineV2ReadService;
@@ -57,6 +59,14 @@ export class CustomersService implements OnModuleInit {
      );
  }

+  async getCustomer(customerId: string) {
+    return await lastValueFrom(
+      this.customerService.CustomerFindOneById({
+        id: customerId
+      })
+    )
+  }
+
  async getLinks(customerId: string) {
    try {
      const result = await lastValueFrom(
@@ -139,13 +149,14 @@ export class CustomersService implements OnModuleInit {
    // const decoded = jwt.decode(jwt_token, { complete: true });
    return jwt_token;
  }
+
  async getMonitoringDashboardUrl(metadata: Metadata) {
    logger.info('CustomersService - getMonitoringDashboardUrl');

    const res = await lastValueFrom(
      this.pipelineReadService.PipelineV2GetDashboardUrl(
        {
-          dashboard_id: '45',
+          dashboard_id: '98',
          exp: '15m',
          metabase_customer_name: 'dadosferatech',
        },
@@ -156,4 +167,60 @@ export class CustomersService implements OnModuleInit {

    return res;
  }
+
+  async getLogsDashboardUrl(metadata: Metadata) {
+    logger.info('CustomersService - getMixPanelLogsDashboardUrl');
+  
+    const res = await lastValueFrom(
+      this.pipelineReadService.PipelineV2GetDashboardUrl(
+        {
+          dashboard_id: '103',
+          exp: '15m',
+          metabase_customer_name: 'dadosferatech',
+        },
+        metadata,
+      ),
+    );
+    logger.info('Done');
+  
+    return res;
+  }
+
+  async getAccessDashboardUrl(customerName: string, metadata: Metadata) {
+    /*
+     * TODO(Refactor): dar um jeito de exibir o dash da sbm diferente dos outros customer
+     * pois o signicado de department para sbm significa as instituições do usuários
+     */
+    if (customerName !== 'sbmoffshorecom') {
+      throw new ForbiddenException();
+    }
+    logger.info('CustomersService - getAccessDashboardUrl');
+  
+    const res = await this.getDashboardUrl('105', metadata);
+    logger.info('Done');
+  
+    return res;
+  }
+
+  private async getDashboardUrl(dashboardId: string, metadata: Metadata) {
+    return await lastValueFrom(
+      this.pipelineReadService.PipelineV2GetDashboardUrl(
+        {
+          dashboard_id: dashboardId,
+          exp: '15m',
+          metabase_customer_name: 'dadosferatech',
+        },
+        metadata
+      )
+    );
+  }
+
+  async enableEnforceMfa(id: string, enabled: boolean) {
+    return await lastValueFrom(
+      this.customerService.CustomerUpdateEnforceMfa({
+        customerId: id,
+        enforceMfa: enabled
+      })
+    )
+  }
 }
@@ -0,0 +1,6 @@
+import { ApiProperty } from "@nestjs/swagger";
+
+export class EnforceMfa {
+    @ApiProperty()
+    enabled: boolean
+}
@@ -1,93 +1,29 @@
-import { Body, Controller, Inject, Param, Post } from '@nestjs/common';
+import { Body, Controller, Inject, Param, Post, Req } from '@nestjs/common';
 import { init } from 'mixpanel';
 import { Authenticated } from 'src/decorators/authentication.decorator';
 import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 import { RequestUser, User } from 'src/decorators/user.decorator';
+import { MixpanelService } from './mixpanel.service';

@ApiInternalOnlyController()
-@Authenticated()
@Controller('trackEvent')
 export class MixpanelController {
  constructor(
-    @Inject('MIXPANEL_TOKEN')
-    private readonly mixpanelToken: string,
+    private mixpanelService: MixpanelService
  ) {}
  @Post(':id')
-  async trackEvent(@Param('id') id, @Body() body, @User() user: RequestUser) {
+  async trackEvent(
+    @Param('id') id,
+    @Body() body,
+    @User() user: RequestUser,
+    @Req() request
+  ) {
    delete body.info;
-    const mixpanel = init(this.mixpanelToken);
 
-    const separator = user.username.includes('-') ? '-' : '.';
-    const removeValues = [
-      '.dadosferatech.dadosfera',
-      '.demo.dadosfera',
-      '.dadosferademo',
-      '.dadosferarh.dadosfera',
-      '.dadosferatech.dadosfera2',
-      '.dadosferatech.dadosfera',
-      '.dadosfera.fin',
-      '.dadosferafin.dadosfera',
-      '.praxio.dadosfera',
-      '.dadosfera.tech',
-      '.treinamentos@dadosfera.ai',
-      '.dadosfera2',
-      '.treinamentosfera',
-      '.dadosfera',
-    ];
-
-    let username = user.username;
-
-    removeValues.forEach((value) => {
-      username = username.replace(value, '');
-    });
-
-    username = username.split('@')?.[0];
-    username = username.split('+')?.[0];
-
-    let firstName = username
-      .substring(0, username.indexOf(separator))
-      .replace('dadosfera', '');
-    let lastName = username
-      .substring(username.lastIndexOf(separator) + 1)
-      .replace('dadosfera', '');
-
-    if (!firstName) {
-      firstName = lastName;
-      lastName = '';
-    }
-
-    firstName = this.capitalize(firstName);
-    lastName = this.capitalize(lastName);
-
-    await mixpanel.people.set(user.username, {
-      $first_name: firstName,
-      $last_name: lastName,
-      $name: this.getFullName(firstName, lastName),
-      $email: user.username.includes('@')
-        ? user.username
-        : user.username + '@dadosfera.ai',
-      customer_name: user.customer_name,
-    });
-
-    await mixpanel.track(id, {
-      distinct_id: user.username,
-      customer: user.customer_name,
-      env: process.env.ENV,
-      ...body,
-    });
+    await this.mixpanelService.track(id, user, request, body)

    return { id, body, user: user.username };
  }

-  capitalize(sentence: string): string {
-    if (!sentence) {
-      return '';
-    }

-    return sentence[0].toUpperCase() + sentence.substring(1);
-  }
-
-  getFullName(firstName: string, lastName: string) {
-    return `${firstName}${lastName ? ' ' + lastName : ''}`;
-  }
 }
@@ -1,6 +1,8 @@
 import { Module } from '@nestjs/common';
 import { getSecretFromSecretsManager } from 'src/utils/SecretManager';
 import { MixpanelController } from './mixpanel.controller';
+import { MixpanelService } from './mixpanel.service';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';

@Module({
  controllers: [MixpanelController],
@@ -8,9 +10,12 @@ import { MixpanelController } from './mixpanel.controller';
    {
      provide: 'MIXPANEL_TOKEN',
      useValue: getSecretFromSecretsManager(
-        `${process.env.ENV}/root/mixpanel_token`,
+        `prd/root/mixpanel_token`,
      ),
    },
+    MixpanelService,
+    DadosferaLogger
  ],
+  exports: [MixpanelService]
 })
 export class MixpanelModule {}
@@ -0,0 +1,118 @@
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+import { Inject } from '@nestjs/common';
+import { Request } from 'express';
+import mixpanel, { init } from 'mixpanel';
+import { RequestUser } from 'src/decorators/user.decorator';
+
+export class MixpanelService {
+    logger: DadosferaLogger;
+
+  constructor(
+    @Inject('MIXPANEL_TOKEN')
+    private readonly mixpanelToken: string,
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  async track(eventName: string, user: RequestUser, request: Request, body: any) {
+    this.logger.info("track: " + JSON.stringify({
+        eventName,
+        ...body
+    }))
+    const mixpanel = init(this.mixpanelToken);
+    await this.setPeople(user, mixpanel);
+
+    await mixpanel.track(eventName, {
+      distinct_id: user.username,
+      customer: user.customer_name,
+      env: process.env.ENV,
+      $ip: request.ip,
+      $os: request.headers['sec-ch-ua-platform'] || '',
+      $browser: request.headers['user-agent'],
+      ...body,
+    });
+    return;
+  }
+
+  async trackShare(request: Request,  body: any) {
+    this.logger.info("trackShare: " + JSON.stringify(body))
+    const mixpanel = init(this.mixpanelToken);
+
+    await mixpanel.track("share_page", {
+      env: process.env.ENV,
+      $ip: request.ip,
+      $os: request.headers['sec-ch-ua-platform'] || '',
+      $browser: request.headers['user-agent'],
+      ...body,
+    });
+    return;
+  }
+
+  private async setPeople(user: RequestUser, mixpanel: mixpanel.Mixpanel) {
+    const separator = user.username.includes('-') ? '-' : '.';
+    const removeValues = [
+      '.dadosferatech.dadosfera',
+      '.demo.dadosfera',
+      '.dadosferademo',
+      '.dadosferarh.dadosfera',
+      '.dadosferatech.dadosfera2',
+      '.dadosferatech.dadosfera',
+      '.dadosfera.fin',
+      '.dadosferafin.dadosfera',
+      '.praxio.dadosfera',
+      '.dadosfera.tech',
+      '.treinamentos@dadosfera.ai',
+      '.dadosfera2',
+      '.treinamentosfera',
+      '.dadosfera',
+    ];
+
+    let username = user.username;
+
+    removeValues.forEach((value) => {
+      username = username.replace(value, '');
+    });
+
+    username = username.split('@')?.[0];
+    username = username.split('+')?.[0];
+
+    let firstName = username
+      .substring(0, username.indexOf(separator))
+      .replace('dadosfera', '');
+    let lastName = username
+      .substring(username.lastIndexOf(separator) + 1)
+      .replace('dadosfera', '');
+
+    if (!firstName) {
+      firstName = lastName;
+      lastName = '';
+    }
+
+    firstName = this.capitalize(firstName);
+    lastName = this.capitalize(lastName);
+
+    await mixpanel.people.set(user.username, {
+      $first_name: firstName,
+      $last_name: lastName,
+      $name: this.getFullName(firstName, lastName),
+      $email: user.username.includes('@')
+        ? user.username
+        : user.username + '@dadosfera.ai',
+      customer_name: user.customer_name,
+    });
+  }
+
+  private capitalize(sentence: string): string {
+    if (!sentence) {
+      return '';
+    }
+
+    return sentence[0].toUpperCase() + sentence.substring(1);
+  }
+
+  private getFullName(firstName: string, lastName: string) {
+    return `${firstName}${lastName ? ' ' + lastName : ''}`;
+  }
+}
@@ -0,0 +1,6 @@
+import { ApiProperty } from "@nestjs/swagger";
+
+export class NetworkPoliciesDTO {
+    @ApiProperty()
+    policies: string []
+}
@@ -0,0 +1,64 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Post } from '@nestjs/common';
+import { ApiOkResponse } from '@nestjs/swagger';
+import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+import {
+  Authenticated,
+  RequireAllPermissions,
+} from 'src/decorators/authentication.decorator';
+import { NetworkPoliciesDTO } from './dto/network-policy.dto';
+import { RequestUser, User } from 'src/decorators/user.decorator';
+import { NetworkPolicyService } from './network-policy.service';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
+
+@Controller('network-policy')
+export class NetworkPolicyController {
+  constructor(private networkPolicyService: NetworkPolicyService) {}
+
+  @Get()
+  @Authenticated()
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @HttpCode(HttpStatus.OK)
+  async getNetworks(
+    @User() user: RequestUser,
+  ) {
+    return await this.networkPolicyService.getByCustomer(
+      user.customer_id
+    );
+  }
+
+  @Post()
+  @Authenticated()
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @ApiOkResponse()
+  @HttpCode(HttpStatus.CREATED)
+  async applyNetworkPolicies(
+    @User() user: RequestUser,
+    @Body() data: NetworkPoliciesDTO,
+  ) {
+    const metadata = PackTheMetadata(user);
+
+    return await this.networkPolicyService.apply(
+      data.policies,
+      user.customer_id,
+      metadata,
+    );
+  }
+
+  @Delete()
+  @Authenticated()
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @ApiOkResponse()
+  @HttpCode(HttpStatus.OK)
+  async removeNetworkPolicies(
+    @User() user: RequestUser,
+    @Body() data: NetworkPoliciesDTO,
+  ) {
+    const metadata = PackTheMetadata(user);
+
+    return await this.networkPolicyService.delete(
+      data.policies,
+      user.customer_id,
+      metadata,
+    );
+  }
+}
@@ -0,0 +1,19 @@
+import { Module } from '@nestjs/common';
+import { NetworkPolicyController } from './network-policy.controller';
+import { NetworkPolicyService } from './network-policy.service';
+import { ClientsModule } from '@nestjs/microservices';
+import { DucClient } from '../duc/client.config';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+
+const ducClient = new DucClient();
+
+@Module({
+  imports: [
+    ClientsModule.register([
+      ducClient.providerOptions
+    ]),
+  ],
+  controllers: [NetworkPolicyController],
+  providers: [NetworkPolicyService, DadosferaLogger]
+})
+export class NetworkPolicyModule {}
@@ -0,0 +1,74 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { DucClient } from '../duc/client.config';
+import { ClientGrpc } from '@nestjs/microservices';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+import { CustomersProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
+import { Metadata } from '@grpc/grpc-js';
+import { lastValueFrom } from 'rxjs';
+import { NetworkPoliciesDTO } from './dto/network-policy.dto';
+
+
+@Injectable()
+export class NetworkPolicyService {
+  private customerService: CustomersProtoService;
+  private logger: DadosferaLogger;
+
+  constructor(
+    @Inject(DucClient.name) private readonly grpcClient: ClientGrpc,
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  onModuleInit() {
+    this.customerService = this.grpcClient.getService<CustomersProtoService>(
+      ProtoServices.CustomersProtoService,
+    );
+  }
+
+  async getByCustomer(id: string): Promise<NetworkPoliciesDTO> {
+    const {
+      customer
+    } = await lastValueFrom(this.customerService.CustomerFindOneById({
+      id
+    }));
+
+    return {
+      policies: customer.networkPolicies
+    }
+  }
+
+  async apply(
+    networkPolicies: string[],
+    customerId: string,
+    metadata: Metadata,
+  ) {
+    return await lastValueFrom(
+      this.customerService.CustomerCreateNetworkPolicy(
+        {
+          customerId,
+          networkPolicies,
+        },
+        metadata,
+      ),
+    );
+  }
+
+  async delete(
+    networkPolicies: string[],
+    customerId: string,
+    metadata: Metadata,
+  ) {
+    return await lastValueFrom(
+      this.customerService.CustomerRemoveNetworkPolicy(
+        {
+          customerId,
+          networkPolicies,
+        },
+        metadata,
+      ),
+    );
+  }
+}
@@ -4,7 +4,7 @@ import { AuthGuard } from '@nestjs/passport';
 import { ConnectionClientService } from '../connection/client.service';
 import jwt from 'jsonwebtoken';
 import DadosferaLogger from '@dadosfera/dadosfera-logs/dist';
-import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
 import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
@ApiTags('oauth')
@Controller('oauth')
@@ -1,5 +1,5 @@
 import DadosferaLogger from '@dadosfera/dadosfera-logs';
-import { Body, Controller, Header, HttpCode, Inject, Param, Post, Query, Req, UseFilters, UseGuards } from '@nestjs/common';
+import { Body, Controller, ForbiddenException, Header, Headers, HttpCode, HttpException, Inject, Param, Post, Query, Req, Res, UseFilters, UseGuards, UseInterceptors } from '@nestjs/common';
 import { ApiCreatedResponse, ApiHeaders, ApiOkResponse, ApiTags } from '@nestjs/swagger';
 import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
@@ -8,9 +8,8 @@ import { UsersService } from '../users/users.service';
 import { Language } from 'src/decorators/language.decorator';
 import { OpenDataService } from './open-data.service';
 import { CreateUserOpenDataDTO, WordpressForm } from './dto/wordpres-form';
-import { CORSGuard, SetOrigin } from 'src/decorators/set-origin.decorator';
 import { Metadata } from '@grpc/grpc-js';
-import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
 import { request } from 'http';
 import { Request } from 'express';

@@ -31,8 +30,6 @@ export class OpenDataController {
  }

  @Post("/sharing-ocean-data")
-  // @SetOrigin('devsbm.dadosfera.io')
-  // @UseGuards(CORSGuard)
  @HttpCode(200)
  @Header('content-type', 'application/json')
  @ApiOkResponse()
@@ -43,23 +40,20 @@ export class OpenDataController {
    language: string,
    @Req()
    request: Request,
+    @Headers('origin')
+    origin: string
  ) {
-    this.logger.info('createUser for open data'
-        + JSON.stringify({
-          origin: request.headers.origin,
-          language,
-          body
-    }));
+    this.logger.info('createUser for open data' + JSON.stringify(request.headers));

-    // "401573bb-334f-44b2-b30e-88d4cea31ae9"
-    // const OPENDATA_PUBLIC_USERS_GROUP_ID = process.env.OPEN_GROUP_ID;
-    // ""f239718a-a271-4ef9-ae7e-02a2f0f3aa6e""
-    // const OPENDATA_CUSTOMER_ID =  process.env.OPEN_CUSTOMER_ID;
-    const OPENDATA_CUSTOMER_ID = "b3e3dfe5-b992-4586-a73c-c0b0c00f615d";
+    // const corslist = ["https://devsbm.dadosfera.io", "https://sharingoceandata.com"];
+    // if (!corslist.includes(origin)) {
+    //   this.logger.info('block request by cors list: '+ origin);
+    //   throw new ForbiddenException();
+    // }

-    this.logger.info("OPENDATA_CUSTOMER_ID: " + process.env.OPEN_CUSTOMER_ID)
-    this.logger.info("OPEN_GROUP_ID: " + process.env.OPEN_GROUP_ID)
-    const roles = ["e3f98a2f-7748-4981-8505-7695c8ca8218"];
+    const OPENDATA_CUSTOMER_ID = process.env.OPEN_CUSTOMER_ID;
+    const OPENDATA_GROUP_ID = process.env.OPEN_GROUP_ID;
+    const roles = [process.env.OPEN_GROUP_ID];
    const metadata = PackTheMetadata({
      language: language || 'en-us'
    }); 
@@ -77,7 +71,6 @@ export class OpenDataController {
      this.logger.error('user data ' + e.message);
    }

-
    const user: CreateUserOpenDataDTO = {
      email: data["email"],
      enquiryType: data["enquiry_type"],
@@ -85,11 +78,11 @@ export class OpenDataController {
      lastName: data["last_name"],
      organization: data["organization"]
    }
-    this.logger.info('user request' + JSON.stringify({ user, roles, customer: OPENDATA_CUSTOMER_ID }));
+    this.logger.info(`user request to group ${OPENDATA_CUSTOMER_ID} with role ${OPENDATA_GROUP_ID}`);

    try {
-      await this.openDataService.createUser(OPENDATA_CUSTOMER_ID, user, roles, metadata);
-      this.logger.info('user created with sucessfull data');
+      const id = await this.openDataService.createUser(OPENDATA_CUSTOMER_ID, user, roles, metadata);
+      this.logger.info('user created with id: '+ id);
      return {
        success: true,
        status: 'success',
@@ -40,10 +40,10 @@ export class OpenDataService implements OnModuleInit {
    }

    try {
-      await lastValueFrom(
+      const { user } = await lastValueFrom(
        this.usersClientService.SimpleUserCreate(body, metadata),
      );
-      return "User created";
+      return user.id;
    } catch(err) {
      return err;
    }
@@ -32,7 +32,7 @@ import { PipelinesService } from './pipelines.service';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { Messages } from '@dadosfera/protospack-v2/dist/lib/PipelineV2';
 import { RequestUser, User } from 'src/decorators/user.decorator';
-import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';

 import { PipelinesService as OldPipelineService } from 'src/modules/pipelines/pipelines.service';
 import {
@@ -328,7 +328,7 @@ export class PipelinesService implements OnModuleInit {
    const res = await lastValueFrom(
      this.pipelineReadService.PipelineV2GetDashboardUrl(
        {
-          dashboard_id: '83',
+          dashboard_id: '95',
          exp: '15m',
          metabase_customer_name: 'dadosferatech',
        },
@@ -0,0 +1,10 @@
+export class CreateShareMetadataDto {
+    assetId: string;
+    proposedId: string;
+    type: string;
+}
+
+export class UpdateShareMetadataDto {
+    shareId: string;
+    type: string;
+}
@@ -0,0 +1,31 @@
+import { Controller, Get, Body, Param, Put, Patch } from '@nestjs/common';
+import { ShareMetadataService } from './share-metadata.service';
+import { Authenticated } from 'src/decorators/authentication.decorator';
+import { RequestUser, User } from 'src/decorators/user.decorator';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
+import { CreateShareMetadataDto, UpdateShareMetadataDto } from './dto/create-share-metadata.dto';
+
+@Controller('share')
+@Authenticated()
+export class ShareMetadataController {
+  constructor(private readonly shareMetadataService: ShareMetadataService) {}
+
+  @Put('/')
+  findOrcreate(@Body() data: CreateShareMetadataDto, @User() user: RequestUser) {
+    const metadata = PackTheMetadata(user);
+    return this.shareMetadataService.create(data, metadata);
+  }
+
+  @Patch('/')
+  updateShareType(@Body() data: UpdateShareMetadataDto, @User() user: RequestUser) {
+    const metadata = PackTheMetadata(user);
+    return this.shareMetadataService.updateShare(data, metadata);
+  }
+
+
+  @Get('/:id')
+  get(@Param('id') id: string, @User() user: RequestUser) {
+    const metadata = PackTheMetadata(user);
+    return this.shareMetadataService.get(id, metadata);
+  }
+}
@@ -0,0 +1,16 @@
+import { Module } from '@nestjs/common';
+import { ShareMetadataService } from './share-metadata.service';
+import { ShareMetadataController } from './share-metadata.controller';
+import { DucClient } from '../duc/client.config';
+import { ClientsModule } from '@nestjs/microservices';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+
+const client = new DucClient();
+
+@Module({
+  imports: [ClientsModule.register([client.providerOptions])],
+  controllers: [ShareMetadataController],
+  providers: [ShareMetadataService, DadosferaLogger],
+  exports: [ShareMetadataService]
+})
+export class ShareMetadataModule {}
@@ -0,0 +1,62 @@
+import { Inject, Injectable, OnModuleInit } from '@nestjs/common';
+import { Metadata } from '@grpc/grpc-js';
+import { ClientGrpc } from '@nestjs/microservices';
+import { DucClient } from '../duc/client.config';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+import { ShareMetadataProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+import { lastValueFrom } from 'rxjs';
+import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
+import { CreateShareMetadataDto, UpdateShareMetadataDto } from './dto/create-share-metadata.dto';
+
+@Injectable()
+export class ShareMetadataService implements OnModuleInit {
+  ducService: ShareMetadataProtoService;
+  logger: DadosferaLogger;
+
+  constructor(
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+    @Inject(DucClient.name) private readonly grpcClient: ClientGrpc,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  onModuleInit() {
+    this.ducService =this.grpcClient.getService<ShareMetadataProtoService>(
+      ProtoServices.ShareMetadataProtoService,
+    );
+  }
+
+  create(createShareDto: CreateShareMetadataDto, metadata: Metadata) {
+    return lastValueFrom(
+      this.ducService.FindOrCreateShareMetadata(
+        {
+          assetId: createShareDto.assetId,
+          proposedId: createShareDto.proposedId,
+          type: createShareDto.type
+        },
+        metadata,
+      ),
+    );
+  }
+
+  updateShare(updateShare: UpdateShareMetadataDto, metadata: Metadata) {
+    return lastValueFrom(
+      this.ducService.ChangeShareMetadataType(
+        updateShare,
+        metadata,
+      ),
+    );
+  }
+
+  get(id: string, metadata: Metadata) {
+    return lastValueFrom(
+      this.ducService.GetShareMetadata(
+        {
+          id,
+        },
+        metadata,
+      ),
+    );
+  }
+}
@@ -27,9 +27,9 @@ export class CustomerTheme implements Theme {
  @ApiProperty()
  textColor: string;
  @ApiProperty()
-  logoWhite: string;
+  logo: string;
  @ApiProperty()
-  logoBlack: string;
+  logoLogin: string;
 }

 export class CustomerThemeResponse {
@@ -59,22 +59,22 @@ export class ThemeController {
      id, 
    }));

-    const logoWhite = files.find(file => file.fieldname === 'logoWhite');
-    const logoBlack = files.find(file => file.fieldname === 'logoBlack');
+    const logo = files.find(file => file.fieldname === 'logo');
+    const logoLogin = files.find(file => file.fieldname === 'logoLogin');

-    this.validFileSize(logoWhite);
-    this.validFileSize(logoBlack);
-    this.validMimeType(logoWhite);
-    this.validMimeType(logoBlack);
+    this.validFileSize(logo);
+    this.validFileSize(logoLogin);
+    this.validMimeType(logo);
+    this.validMimeType(logoLogin);

    try {
      const theme = await this.themeService.createThemeByCustomer(id, {
        ...data,
-        logoWhite,
-        logoBlack
+        logo,
+        logoLogin
      });
      this.logger.info('saveCustomertheme' + JSON.stringify(theme));
-      return { theme: theme };
+      return theme;
    } catch (err) {
      if (err.details === ErrorCodes.CUSTOMER.NOT_FOUND) {
        this.logger.error('Error - saveCustomertheme - Expect CUSTOMER.NOT_FOUND');
@@ -98,7 +98,7 @@ export class ThemeController {
    const mimeTypesValid = ['image/jpeg', 'image/jpg', 'image/png'];

    if (file && !mimeTypesValid.includes(file.mimetype)) {
-      throw new HttpException(`O Arquivo ${file.fieldname} deve ser jpeg, jpg ou png`, HttpStatus.BAD_REQUEST);
+      throw new HttpException(`O Arquivo ${file.fieldname} deve ser jpeg, jpg, ou png`, HttpStatus.BAD_REQUEST);
    }
  }

@@ -109,8 +109,10 @@ export class ThemeController {

    try {
      const data = await this.themeService.getThemeByCustomer(id);
-      this.logger.info('Success - getCustomerTheme with id'+ id);
-      return data;
+      this.logger.info('Success - getCustomerTheme'+ JSON.stringify(data));
+      if (data?.theme) return data;
+
+      return { theme: null };
    }catch (err) {
      if (err.details === ErrorCodes.CUSTOMER.NOT_FOUND) {
        this.logger.error('Error - getCustomerTheme - Expect CUSTOMER.NOT_FOUND');
@@ -21,11 +21,10 @@ import { resolve } from 'path';
 import { Readable } from 'stream';

 type Files = {
-  logoWhite: Express.Multer.File,
-  logoBlack: Express.Multer.File,
+  logo: Express.Multer.File,
+  logoLogin: Express.Multer.File,
 }

-// This function will accept any string, which may result in a bug.
@Injectable()
 export class ThemeService implements OnModuleInit {
  private themeService: ThemeProtoService;
@@ -63,12 +62,12 @@ export class ThemeService implements OnModuleInit {
      chunk: Buffer.alloc(0)
    })

-    if(theme.logoBlack) {
-      await this.sendFile(theme.logoBlack, customerThemeRequest$);
+    if(theme.logo) {
+      await this.sendFile(theme.logo, customerThemeRequest$);
    }

-    if(theme.logoWhite) {
-      await this.sendFile(theme.logoWhite, customerThemeRequest$);
+    if(theme.logoLogin) {
+      await this.sendFile(theme.logoLogin, customerThemeRequest$);
    }
    customerThemeRequest$.complete();

@@ -95,18 +94,20 @@ export class ThemeService implements OnModuleInit {
  }

   private async sendFile(file: Express.Multer.File, stream$: ReplaySubject<ThemeRequest>) {
-    const bufferStream = new Readable({
-      highWaterMark: 1024 * 1024, // 1 MB por chunk
-      read() {}
-    });
-    bufferStream.push(file.buffer);
-    bufferStream.push(null);
+    const chunkSize = 4 * 1024 * 1024;
+    const bufferStream = new CustomBufferStream(file.buffer, chunkSize);
+    const parseMimitypeForExtension = {
+      'image/jpeg': '.jpeg',
+      'image/jpg': '.jpg',
+      'image/png': '.png',
+      'image/svg+xml': '.svg',
+    }
+
+    const extension = parseMimitypeForExtension[file.mimetype];

    return new Promise((resolve, reject) => {
      bufferStream.on('data', (chunk) => {
-        console.log('enviando chunk', file.fieldname)
-        const mimetype = file.mimetype.split('/')[1]; // example image/jpeg
-        const filename = file.fieldname.concat(".", mimetype);
+        const filename = file.fieldname.concat(extension);
        stream$.next({
          customerId: '',
          displayName: '',
@@ -119,15 +120,39 @@ export class ThemeService implements OnModuleInit {
      });

      bufferStream.on('end', () => {
-        console.log('terminou de enviar')
        resolve(file.filename)
      });

      bufferStream.on('error', (err) => {
-        console.error('Erro no stream:', err);
        reject(err);
      });
    });
  }

 }
+
+class CustomBufferStream extends Readable {
+  buffer: Buffer;
+  offset: number;
+  chunkSize: number;
+
+  constructor(buffer: Buffer, chunkSize: number) {
+    super({ highWaterMark: chunkSize }); // Configura o tamanho do chunk
+    this.buffer = buffer;
+    this.offset = 0;
+    this.chunkSize = chunkSize;
+  }
+
+  _read() {
+    if (this.offset < this.buffer.length) {
+      const end = Math.min(this.offset + this.chunkSize, this.buffer.length);
+
+      const copiedBuf = Uint8Array.prototype.slice.call(this.buffer);
+      const chunk = copiedBuf.slice(this.offset, end);
+      this.offset = end;
+      this.push(chunk);
+    } else {
+      this.push(null);
+    }
+  }
+}
@@ -29,7 +29,7 @@ import { Language } from 'src/decorators/language.decorator';
 import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 import { RequestUser, User } from 'src/decorators/user.decorator';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
-import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
 import ErrorBuilder from 'src/utils/ErrorBuilder';
 import ErrorCodes from 'src/utils/errorCodes';
 import { LanguageEnum } from 'src/utils/languages.enum';
@@ -77,6 +77,13 @@ export function EnrichErrorCode(code: string) {
        message: 'Token para recuperar senha inválido',
        code,
      };
+    case ErrorCodes.AUTH.REQUIRED_PASSWORD_RESET:
+      return {
+        statusCode: HttpStatus.UNAUTHORIZED,
+        error: 'Não permitido',
+        message: 'Seu usuário foi resetado por um administrador, resete a senha pelo link "Esqueci a senha", para prosseguir',
+        code,
+      };

    case ErrorCodes.AUTH.WEAK_NEW_PASSWORD:
      return {
@@ -0,0 +1,14 @@
+import { stringify } from 'csv'
+import { Parser } from './parser.interface';
+
+export class CsvParser<T> implements Parser<T>{
+  async parse(data: T[]) {
+    return new Promise<string>((resolve, reject) => {
+      stringify(data, { header: true }, function (err, output) {
+        if (err) reject(err);
+  
+        resolve(output)
+      });
+    })
+  }
+}
@@ -0,0 +1,17 @@
+import { readFileSync } from 'fs';
+import Handlebars from 'handlebars';
+import { Parser } from './parser.interface';
+
+export class HtmlParser<T> implements Parser<T> {
+  constructor(private readonly templatePath: string) {}
+  async parse(data: T[]) {
+    const templateSource = readFileSync(this.templatePath, 'utf8');
+
+    const template = Handlebars.compile(templateSource);
+
+    return template({
+      dados: data,
+      dataGeracao: new Date().toLocaleString('pt-BR'),
+    });
+  }
+}
@@ -0,0 +1 @@
+export type TypeParser =  "html" | "csv" | "pdf"
@@ -0,0 +1,25 @@
+import { TypeParser } from './parser-types';
+import { HtmlParser } from './html-parser';
+import { CsvParser } from './csv-parser';
+import { PDFParser } from './pdf-parser';
+import { Parser } from './parser.interface';
+
+export class ParserBuilder {
+  static build<T>(type: TypeParser): Parser<T> {
+    const templatePath = '/app/dist/assets/template/pii-reporter.html';
+
+    if (type === 'html') {
+      const htmlParser = new HtmlParser<T>(templatePath);
+      return htmlParser;
+    } else if (type === 'csv') {
+      const csvParser = new CsvParser<T>();
+      return csvParser;
+    } else if (type === 'pdf') {
+      const htmlParser = new HtmlParser<T>(templatePath);
+      const pdfParser = new PDFParser(htmlParser);
+      return pdfParser;
+    }
+
+    throw new Error('Unsupported Type: ' + type);
+  }
+}
@@ -0,0 +1,3 @@
+export interface Parser<T> {
+    parse(data: T[]): Promise<string | Buffer>
+}
@@ -0,0 +1,57 @@
+import puppeteer from 'puppeteer';
+import { Parser } from './parser.interface';
+import { HtmlParser } from './html-parser';
+
+export class PDFParser<T> implements Parser<T> {
+  constructor(private htmlParser: HtmlParser<T>) {}
+
+  async parse(data: T[]) {
+    try {
+      const browser = await puppeteer.launch({
+        executablePath: process.env.PUPPETEER_EXECUTABLE_PATH,
+        args: [
+          '--no-sandbox',
+          '--disable-setuid-sandbox',
+          '--disable-dev-shm-usage',
+        ],
+      });
+
+      const page = await browser.newPage();
+      page.setDefaultNavigationTimeout(0);
+
+      const html = await this.htmlParser.parse(data);
+      await page.setContent(html, {
+        waitUntil: 'networkidle0',
+        timeout: 90000,
+      });
+
+      // Configurações adicionais para garantir um PDF válido
+      const pdf = await page.pdf({
+        format: 'A4',
+        printBackground: true,
+        margin: {
+          top: '20mm',
+          right: '15mm',
+          bottom: '20mm',
+          left: '15mm',
+        },
+        preferCSSPageSize: true,
+        displayHeaderFooter: false,
+        headerTemplate: '',
+        footerTemplate: '',
+        omitBackground: false,
+        pageRanges: '',
+        tagged: true,
+        outline: false,
+        timeout: 90000,
+      });
+
+      await browser.close();
+
+      return Buffer.from(pdf);
+    } catch (error) {
+      console.error('Error generating PDF:', error);
+      throw error;
+    }
+  }
+}
@@ -11,6 +11,10 @@ interface IMetadata {
  roles?: string[];
  is_data_manager?: boolean;
  access_token?: string;
+  host?: string;
+  origin?: string;
+  custom_host?: string;
+  is_mask?: boolean;
 }

 export function PackTheMetadata(info: IMetadata): Metadata {
@@ -13,6 +13,7 @@ export const AUTH = {
  RESET_PASSWORD_CODE_EXPIRED: 'AUTH.RESET_PASSWORD_CODE_EXPIRED',
  RESET_PASSWORD_CODE_INVALID: 'AUTH.RESET_PASSWORD_CODE_INVALID',
  WEAK_NEW_PASSWORD: 'AUTH.WEAK_NEW_PASSWORD',
+  REQUIRED_PASSWORD_RESET: 'AUTH.REQUIRED_PASSWORD_RESET'
 };
 export const ROLE = {
  INVALID_ID: 'ROLE.INVALID_ID',
				`@@ -0,0 +1 @@`
				`export type TypeParser = "html" \| "csv" \| "pdf"`