FIX: permissions

.github/workflows/k8s-deploy.yml

@@ -105,7 +105,7 @@ jobs:
 
       - name: Install Helmfile
         run: |
-          curl -fsSLO https://github.com/helmfile/helmfile/releases/download/v0.148.0/helmfile_0.148.0_linux_amd64.tar.gz
+          wget https://github.com/helmfile/helmfile/releases/download/v0.148.0/helmfile_0.148.0_linux_amd64.tar.gz
           tar -xzf helmfile_0.148.0_linux_amd64.tar.gz
           sudo mv helmfile /usr/local/bin/
           helmfile --version

src/authentication/permissions.enum.ts

@@ -390,25 +390,6 @@ export const PERMISSIONS_GROUPS = {
       },
     },
   },
-  LINEAGE: {
-    title: {
-      'pt-br': 'Explorar | Linhagem',
-      'en-us': 'Explore | Lineage',
-      'es-es': 'Explorar | Linaje',
-    },
-    permissions: {
-      VIEW: {
-        seqid: 50,
-        claim: 'lineage:view',
-        usage: PermissionUsages.PUBLIC,
-        name: {
-          'pt-br': 'Acessar ao módulo de Linhagem',
-          'en-us': 'Access to Lineage module',
-          'es-es': 'Acceda al módulo de Linaje',
-        },
-      }
-    },
-  },
   EMBED: {
     title: {
       'pt-br': 'Analisar | Incorporação',

src/main.ts

@@ -18,35 +18,25 @@ async function bootstrap() {
   });
   const logger = new DadosferaLogger();
 
-  const corsOrigins = [];
-
-  if (process.env.ENV === 'local') {
-    corsOrigins.push('http://localhost:4200');
-  } else {
-    corsOrigins.push( 
-      'https://app.stg.dadosfera.ai',
-      'https://app.dadosfera.ai',
-      'https://unimed.dadosfera.ai',
-      'https://boston-scientific.dadosfera.ai',
-      'https://plataforma.dadosfera.ai'
-    );
-  }
-
   const app = await NestFactory.create(AppModule, {
     logger,
     cors: {
-      origin: corsOrigins,
+      origin: [
+        'https://app.stg.dadosfera.ai',
+        'https://app.dadosfera.ai',
+        'https://unimed.dadosfera.ai',
+        'https://boston-scientific.dadosfera.ai',
+        'https://plataforma.dadosfera.ai'
+      ],
       methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
       preflightContinue: false,
       optionsSuccessStatus: 204,
       credentials: true,
     },
   });
-
   app.use(helmet());
   app.use(cookieParser(process.env.COOKIE_SECRET));
-
-  if (process.env.ENV !== 'local') {
+  if (process.env.ENV === 'prd') {
     app.use('/catalog/register-dataset', json({ limit: '10mb' }));
     app.use(
       '/catalog/register-dataset',

src/modules/pipelines/pipelines.controller.ts

@@ -3,6 +3,7 @@ import { ApiOperation, ApiTags } from '@nestjs/swagger';
 import {
   AuthenticateCondition,
   Authenticated,
+  RequireSomePermission,
 } from 'src/decorators/authentication.decorator';
 import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { PipelinesService } from './pipelines.service';
@@ -13,26 +14,6 @@ import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 @ApiTags('Pipelines')
 @Controller('pipelines')
 @Authenticated()
-@AuthenticateCondition((req, user) => {
-  let action;
-
-  switch (req.method) {
-    case 'POST':
-      action = 'CREATE';
-      break;
-
-    case 'PUT':
-      action = 'UPDATE';
-      break;
-
-    default:
-      action = req.method;
-  }
-
-  return user.permissions.includes(
-    PERMISSIONS_GROUPS.PIPELINE.permissions[action].seqid,
-  );
-})
 export class PipelinesController {
   logger: DadosferaLogger;
   constructor(
@@ -44,6 +25,7 @@ export class PipelinesController {
   }
 
   @Post('start/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   @ApiOperation({
     deprecated: true,
     description:
@@ -71,6 +53,7 @@ export class PipelinesController {
     description:
       'This method is deprecated. Please use route /pipelinesV2/:id/status instead',
   })
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineStatus(@Body() body, @Param('id') id: string) {
     body.id = id;
 

src/modules/pipelinesV2/pipelines.controller.ts

@@ -26,6 +26,7 @@ import {
 import {
   AuthenticateCondition,
   RequireAllPermissions,
+  RequireSomePermission,
 } from 'src/decorators/authentication.decorator';
 import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { PipelinesService } from './pipelines.service';
@@ -52,30 +53,6 @@ import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
 @UseFilters(new GrpcToHttpExceptionFilter())
 @Controller('pipelinesV2')
-@AuthenticateCondition((req, user) => {
-  let action;
-
-  switch (req.method) {
-    case 'POST':
-      action = 'CREATE';
-      break;
-
-    case 'PUT':
-      action = 'UPDATE';
-      break;
-
-    case 'PATCH':
-      action = 'UPDATE';
-      break;
-
-    default:
-      action = req.method;
-  }
-
-  return user.permissions.includes(
-    PERMISSIONS_GROUPS.PIPELINE.permissions[action].seqid,
-  );
-})
 export class PipelinesController {
   logger: DadosferaLogger;
   constructor(
@@ -88,6 +65,7 @@ export class PipelinesController {
   }
 
   @Get('monitoring-dashboard')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getMonitoringDashboard(@User() user: RequestUser) {
     this.logger.info('PipelinesController - getMonitoringDashboard', { user });
 
@@ -100,6 +78,7 @@ export class PipelinesController {
   }
 
   @Post()
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   @ApiCreatedResponse({ type: IPipelineV2 })
   async create(
     @Language() language: LanguageEnum,
@@ -126,6 +105,7 @@ export class PipelinesController {
   }
 
   @Get()
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async findAll(
     @User() user: RequestUser,
     @Language() language: LanguageEnum,
@@ -150,6 +130,7 @@ export class PipelinesController {
   }
 
   @Get('/download-logs')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async downloadLogs(
     @User() user: RequestUser,
     @Language() language: LanguageEnum,
@@ -180,6 +161,7 @@ export class PipelinesController {
   }
 
   @Get(':id/config')
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW,PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineproperties(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
@@ -191,6 +173,7 @@ export class PipelinesController {
   }
 
   @Get(':id/objects')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineObjects(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
@@ -202,6 +185,7 @@ export class PipelinesController {
   }
 
   @Get(':id/status')
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineStatus(@Body() body, @Param('id') id: string) {
     body.id = id;
 
@@ -216,6 +200,7 @@ export class PipelinesController {
   }
 
   @Get('/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async findOne(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
@@ -258,6 +243,7 @@ export class PipelinesController {
   }
 
   @Patch('/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async update(
     @Language() language: LanguageEnum,
     @Body() updatePipelineDto,
@@ -297,6 +283,7 @@ export class PipelinesController {
     deprecated: true,
     description: 'This method is deprecated. Please use PATCH instead',
   })
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async updateDeprecated(
     @Language() language: LanguageEnum,
     @Body() updatePipelineDto,
@@ -312,6 +299,7 @@ export class PipelinesController {
   @Delete(':id')
   @ApiNoContentResponse()
   @HttpCode(HttpStatus.NO_CONTENT)
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.DELETE)
   async delete(@Param('id') id: string, @User() user: RequestUser) {
     this.logger.info('PipelinesController - delete', { user });
     const metadata = PackTheMetadata({
@@ -325,7 +313,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('/init-upload')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
+  @RequireAllPermissions(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW)
   async initUploadFile(
     @User() user: RequestUser,
     @Body() body: IInitUploadCSVFile,
@@ -357,7 +345,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('/complete-upload')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
+  @RequireAllPermissions(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW)
   async completeUploadFile(
     @User() user: RequestUser,
     @Body() body: ICompleteUploadCSVFile,
@@ -375,7 +363,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('/file')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
+  @RequireAllPermissions(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW)
   async uploadedFile(
     @User() user: RequestUser,
     @Body() body: ICreatePipelineCSVFile,
@@ -425,6 +413,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('start/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   async activate(@Param('id') id: string, @Body() body) {
     const { info } = body;