Merge pull request #431 from dadosfera/feature/mgc-keycloak-migration

Feature/mgc keycloak migration

.dockerignore

@@ -0,0 +1,12 @@
+node_modules
+dist
+.git
+*.log
+npm-debug.log*
+.DS_Store
+.env
+.env.*
+coverage
+.nyc_output
+*.tgz
+!protospack.tgz

Dockerfile.local

@@ -1,4 +1,4 @@
-FROM node:20-alpine AS base_image
+FROM node:22-alpine AS base_image
 RUN npm install -g npm@latest
 
 FROM base_image AS build_base

deploy/helm-chart/templates/deployment.yaml

@@ -48,6 +48,9 @@ spec:
             {{- toYaml .Values.resources | nindent 12 }}
           {{- end }}
           env:
+            # Auth Provider Configuration (cognito or keycloak)
+            - name: AUTH_PROVIDER
+              value: {{ .Values.maestro.auth_provider | default "cognito" | quote }}
             - name: AWS_IDENTITY_POOL_ID
               value: {{ .Values.maestro.aws_identity_pool_id }}
             - name: AWS_REGION

deploy/helm-chart/values.yaml

@@ -27,6 +27,9 @@ resources:
     cpu: 2000m
     memory: 2Gi
 maestro:
+  # Auth provider: "cognito" (default) or "keycloak"
+  # Note: maestro doesn't connect to Keycloak directly, only duc does
+  auth_provider: "cognito"
   aws_identity_pool_id: "us-east-1_Mrezsw9Sn"
   duc_url: duc.dadosfera.ai
   in_factory_url: in-factory.dadosfera.ai

docsfera.json

@@ -213,14 +213,7 @@
           ],
           "responses": {
             "200": {
-              "description": "",
-              "content": {
-                "application/json": {
-                  "schema": {
-                    "type": "object"
-                  }
-                }
-              }
+              "description": ""
             }
           },
           "tags": [
@@ -8252,6 +8245,9 @@
               "items": {
                 "type": "string"
               }
+            },
+            "authProvider": {
+              "type": "string"
             }
           },
           "required": [

package-lock.json

@@ -17,7 +17,7 @@
         "@aws-sdk/signature-v4": "^3.370.0",
         "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
         "@dadosfera/protospack": "2.5.3",
-        "@dadosfera/protospack-v2": "^3.38.0-beta.25",
+        "@dadosfera/protospack-v2": "^3.38.0-beta.26",
         "@grpc/grpc-js": "^1.9.3",
         "@grpc/proto-loader": "^0.7.9",
         "@nestjs/cli": "^9.5.0",
@@ -1744,9 +1744,10 @@
       }
     },
     "node_modules/@dadosfera/protospack-v2": {
-      "version": "3.38.0-beta.25",
-      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.38.0-beta.25.tgz",
-      "integrity": "sha512-OsOl9hJezmtWlVy+2vl3qbWP5yHmLktJ01r5aL475lcfKJtzFPZieUT9ES87C1Emrqe21E6IM/BkJK2rm/aUiA==",
+      "version": "3.38.0-beta.26",
+      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.38.0-beta.26.tgz",
+      "integrity": "sha512-N8NS7+djLGy0wJXk00+4oupqd/wBIQ1f+YBBhK2y9x4guFXYK1KWIrPZhPj+gaU8g2KNkqKoT7SnE9PXNxlLSQ==",
+      "license": "ISC",
       "dependencies": {
         "@grpc/grpc-js": "^1.9.3",
         "rxjs": "^7.5.5"

package.json

@@ -35,7 +35,7 @@
     "@aws-sdk/signature-v4": "^3.370.0",
     "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
     "@dadosfera/protospack": "2.5.3",
-    "@dadosfera/protospack-v2": "^3.38.0-beta.25",
+    "@dadosfera/protospack-v2": "^3.38.0-beta.26",
     "@grpc/grpc-js": "^1.9.3",
     "@grpc/proto-loader": "^0.7.9",
     "@nestjs/cli": "^9.5.0",

src/modules/auth/auth.controller.ts

@@ -190,13 +190,14 @@ export class AuthController {
   ) {
     this.logger.info('/auth - change-password');
 
-    const { oldPassword, newPassword } = body;
+    const { oldPassword, newPassword, totpCode } = body;
     const { authorization: accessToken } = headers;
 
     return this.authClient.changePassword({
       accessToken,
       oldPassword,
       newPassword,
+      totpCode,
     });
   }
 
@@ -214,7 +215,8 @@ export class AuthController {
 
     const { username } = body;
 
-    return this.authClient.resetPassword({ username }, metadata);
+    await this.authClient.resetPassword({ username }, metadata);
+    return { authProvider: process.env.AUTH_PROVIDER || 'cognito' };
   }
 
   @ApiInternalOnlyEndpoint()

src/modules/auth/auth.service.ts

@@ -143,6 +143,7 @@ export class AuthClientService implements OnModuleInit {
     accessToken,
     oldPassword,
     newPassword,
+    totpCode,
   }: AuthChangePasswordRequest) {
     this.logger.info('ChangePassword');
 
@@ -151,6 +152,7 @@ export class AuthClientService implements OnModuleInit {
         accessToken,
         oldPassword,
         newPassword,
+        totpCode,
       }),
     );
   }

src/modules/users/dtos/entities.ts

@@ -64,6 +64,8 @@ export class UserNoRolesAndCustomer extends OmitType(UserNoRoles, [
 export class IUserByCustomer extends OmitType(User, ['customer']) {
   @ApiPropertyOptional()
   permissions?: string[];
+  @ApiPropertyOptional()
+  authProvider?: string;
 }
 
 export class CreateUserReq {

src/modules/users/users.service.ts

@@ -125,6 +125,7 @@ export class UsersService implements OnModuleInit {
       return { permissions };
     });
     res.user.permissions = permissions;
+    res.user.authProvider = process.env.AUTH_PROVIDER || 'cognito';
     return res;
   }