Merge pull request #385 from dadosfera/hotfix/import-files

FIX: permissions

.github/workflows/deploy-manually.yml

@@ -146,7 +146,7 @@ jobs:
     needs: [extract_environment, semantic_release, build_ecr_image]
     uses: ./.github/workflows/k8s-deploy.yml
     with:
-      cloud: ${{ (needs.extract_environment.outputs.environment == 'prd' && 'azure' ) || 'oracle' }}
+      cloud: 'oracle'
       environment: ${{ needs.extract_environment.outputs.environment }}
       image: ${{ needs.semantic_release.outputs.new_release_version }}
     secrets: inherit

deploy/helm-chart/templates/deployment.yaml

@@ -74,6 +74,8 @@ spec:
               value: "logstash-pipelines.dadosfera.ai"
             - name: LOGGER_GELF_PORT
               value: "{{ .Values.maestro.logger_gelf_port }}"
+            - name: LOGGER_CONSOLE_EXTRA
+              value: "true"
             - name: NIMBUS_BASE_URL
               value: "http://nimbus-api"
             - name: NPM_TOKEN

deploy/helm-chart/values-stg.yaml

@@ -7,17 +7,10 @@ maestro:
   open_customer_id: b3e3dfe5-b992-4586-a73c-c0b0c00f615d
   open_group_id: e3f98a2f-7748-4981-8505-7695c8ca8218
   cookie_secret: "ff7bc13823edb2ae50d248e5780bddc9d4b31c36"
+  redis_database: "1"
 
 hostname: maestro.stg.dadosfera.ai
 
 replicaCount: 1
 
-affinity:
-  nodeAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: name
-              operator: In
-              values:
-                - general
+affinity: null

deploy/helm-chart/values.yaml

@@ -45,7 +45,7 @@ maestro:
   open_group_id: 401573bb-334f-44b2-b30e-88d4cea31ae9
   dedicated_proxy: ""
   restricted_ip: ""
-  redis_host: "product-redis-prd.z4xvqj.0001.use1.cache.amazonaws.com"
+  redis_host: "aaapzppmlyamkocqwstpo7zvopczyyiyuy6xzm2g6c5k4mq3a66be4a-0.redis.sa-saopaulo-1.oci.oraclecloud.com"
   redis_port: "6379"
   redis_database: "0"
   cookie_secret: "13cc5e136d3074bcc05bec8697092ec1f5f376bf"
@@ -61,7 +61,7 @@ affinity:
     requiredDuringSchedulingIgnoredDuringExecution:
       nodeSelectorTerms:
         - matchExpressions:
-            - key: applications
+            - key: name
               operator: In
               values:
-                - general
+                - product

deploy/helmfiles/prd.yaml

@@ -1,4 +1,4 @@
-charts:
+releases:
   - name: maestro
     chart: ../helm-chart
     values:
@@ -49,5 +49,8 @@ charts:
         value: dea2c27f-0973-4588-a2e0-9e31b64c7ffd
       - name: replicaCount
         value: 1
+        # 10.70.0.0/16 internal network
+        # 137.131.167.254/32 loadbalancer
+        # 159.112.184.81/32 cluster ip for the uptime request ingest
       - name: maestro.restricted_ip
-        value: "177.52.172.0/24,189.84.160.157/32,186.237.171.146/32,57.151.113.140/30"
+        value: "177.52.172.0/24, 189.84.160.157/32, 186.237.171.146/32, 137.131.167.254/32, 10.70.0.0/16, 159.112.184.81/32, 10.244.0.0/16"

deploy/helmfiles/stg.yaml

@@ -7,37 +7,24 @@ charts:
       
   
     # Environment to test Network Policies
-  # - name: private-maestro
-  #   chart: ../helm-chart
-  #   values:
-  #   - ../helm-chart/values.yaml
-  #   set:
-  #     - name: app_name
-  #       value: maestro-private
-  #     - name: maestro.env
-  #       value: stg
-  #     - name: maestro.duc_url
-  #       value: duc.stg.dadosfera.ai
-  #     - name: hostname
-  #       value: private-maestro.stg.dadosfera.ai
-  #     - name: maestro.pi_factory_url
-  #       value: pi-factory.dadosfera.ai
-  #     - name: maestro.in_factory_url
-  #       value: in-factory.stg.dadosfera.ai
-  #     - name: maestro.tr_factory_url
-  #       value: in-factory.dadosfera.ai
-  #     - name: maestro.open_customer_id
-  #       value: b3e3dfe5-b992-4586-a73c-c0b0c00f615d
-  #     - name: maestro.open_group_id
-  #       value: e3f98a2f-7748-4981-8505-7695c8ca8218
-  #     # Customer id
-  #     - name: maestro.dedicated_proxy
-  #       value: 14d52fd4-d83d-4cdd-be34-bf11cc28b3bd
-  #     - name: replicaCount
-  #       value: 1
-  #     - name: affinity
-  #       value: null
-  #     - name: resources
-  #       value: null
-  #     - name: maestro.restricted_ip
-  #       value: "57.151.113.140/30"
+  - name: private-maestro
+    chart: ../helm-chart
+    values:
+    - ../helm-chart/values.yaml
+    - ../helm-chart/values-stg.yaml
+    set:
+      - name: app_name
+        value: maestro-private
+      - name: hostname
+        value: private-maestro.stg.dadosfera.ai
+      # Customer id
+      - name: maestro.dedicated_proxy
+        value: 14d52fd4-d83d-4cdd-be34-bf11cc28b3bd
+      - name: replicaCount
+        value: 1
+      - name: affinity
+        value: null
+      - name: resources
+        value: null
+      - name: maestro.restricted_ip
+        value: "137.131.167.254/32, 10.70.0.0/16, 159.112.184.81/32, 10.244.0.0/16"

src/authentication/permissions.enum.ts

@@ -116,6 +116,44 @@ export const PERMISSIONS_GROUPS = {
       },
     },
   },
+  IMPORT_FILES: {
+    title: {
+      'pt-br': 'Coletar | Importar arquivos',
+      'en-us': 'Collect | Import files',
+      'es-es': 'Colecta | Importar archivos',
+    },
+    permissions: {
+      VIEW: {
+        seqid: 48,
+        claim: 'import-file:view',
+        usage: PermissionUsages.PUBLIC,
+        name: {
+          'pt-br': 'Importar arquivos',
+          'en-us': 'Import files',
+          'es-es': 'Importar archivos',
+        },
+      },
+    },
+  },
+   AI_CHAT: {
+    title: {
+      'pt-br': 'AutodriveDDF',
+      'en-us': 'AutodriveDDF',
+      'es-es': 'AutodriveDDF',
+    },
+    permissions: {
+      VIEW: {
+        seqid: 49,
+        claim: 'ai-chat:view',
+        usage: PermissionUsages.PUBLIC,
+        name: {
+          'pt-br': 'AutodriveDDF',
+          'en-us': 'AutodriveDDF',
+          'es-es': 'AutodriveDDF',
+        },
+      },
+    },
+  },
   CONNECTION: {
     title: {
       'pt-br': 'Coletar | Fontes de dados',

src/main.ts

@@ -21,18 +21,27 @@ async function bootstrap() {
   const app = await NestFactory.create(AppModule, {
     logger,
     cors: {
-      origin: '*',
+      origin: [
+        'https://app.stg.dadosfera.ai',
+        'https://app.dadosfera.ai',
+        'https://unimed.dadosfera.ai',
+        'https://boston-scientific.dadosfera.ai',
+        'https://plataforma.dadosfera.ai'
+      ],
       methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
       preflightContinue: false,
       optionsSuccessStatus: 204,
-      credentials: true
+      credentials: true,
     },
   });
   app.use(helmet());
   app.use(cookieParser(process.env.COOKIE_SECRET));
   if (process.env.ENV === 'prd') {
     app.use('/catalog/register-dataset', json({ limit: '10mb' }));
-    app.use('/catalog/register-dataset', urlencoded({ extended: true, limit: '10mb' }));
+    app.use(
+      '/catalog/register-dataset',
+      urlencoded({ extended: true, limit: '10mb' }),
+    );
   }
 
   configureSwagger(app);

src/modules/auth/auth.controller.ts

@@ -114,6 +114,7 @@ export class AuthController {
       return res.send(data);
     } catch (error) {
       this.logger.error('/auth - SignIn - ERROR', error);
+      throw error;
     }
 
   }
@@ -572,7 +573,7 @@ export class AuthController {
 
       this.logger.info('Set Cookie ddf-auth')
       res.cookie('ddf-auth', data.accessToken, {
-        domain: 'stg.dadosfera.ai',
+        domain: '.dadosfera.ai',
         maxAge: exp,
         httpOnly: true,
         secure: true,
@@ -583,7 +584,7 @@ export class AuthController {
     if (data.refreshToken) {
       this.logger.info('Set Cookie ddf-refresh-auth')
       res.cookie('ddf-refresh-auth', data.refreshToken, {
-        domain: 'stg.dadosfera.ai',
+        domain: '.dadosfera.ai',
         maxAge: exp,
         httpOnly: true,
         secure: true,
@@ -594,7 +595,7 @@ export class AuthController {
     if (data.userId) {
       this.logger.info('Set Cookie ddf-refresh-auth')
       res.cookie('ddf-user-id', data.userId, {
-        domain: 'stg.dadosfera.ai',
+        domain: '.dadosfera.ai',
         maxAge: exp,
         httpOnly: true,
         secure: true,

src/modules/catalog/catalog.service.ts

@@ -406,11 +406,14 @@ class CatalogService implements OnModuleInit {
 
       const roles = [];
       const users = [];
-      for (const role_id of data_asset.roles) {
+      const data_asset_roles = data_asset?.roles || []
+      for (const role_id of data_asset_roles) {
         const role = customer_roles.find((r) => r.id === role_id);
         if (role) roles.push({ id: role.id, name: role.name });
       }
-      for (const user_id of data_asset.users) {
+
+      const data_asset_users = data_asset?.users || []
+      for (const user_id of data_asset_users) {
         const user = customer_users.find((r) => r.id === user_id);
         if (user) users.push({ id: user.id, username: user.username });
       }

src/modules/pipelines/pipelines.controller.ts

@@ -3,6 +3,7 @@ import { ApiOperation, ApiTags } from '@nestjs/swagger';
 import {
   AuthenticateCondition,
   Authenticated,
+  RequireSomePermission,
 } from 'src/decorators/authentication.decorator';
 import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { PipelinesService } from './pipelines.service';
@@ -13,26 +14,6 @@ import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 @ApiTags('Pipelines')
 @Controller('pipelines')
 @Authenticated()
-@AuthenticateCondition((req, user) => {
-  let action;
-
-  switch (req.method) {
-    case 'POST':
-      action = 'CREATE';
-      break;
-
-    case 'PUT':
-      action = 'UPDATE';
-      break;
-
-    default:
-      action = req.method;
-  }
-
-  return user.permissions.includes(
-    PERMISSIONS_GROUPS.PIPELINE.permissions[action].seqid,
-  );
-})
 export class PipelinesController {
   logger: DadosferaLogger;
   constructor(
@@ -44,6 +25,7 @@ export class PipelinesController {
   }
 
   @Post('start/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   @ApiOperation({
     deprecated: true,
     description:
@@ -71,6 +53,7 @@ export class PipelinesController {
     description:
       'This method is deprecated. Please use route /pipelinesV2/:id/status instead',
   })
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineStatus(@Body() body, @Param('id') id: string) {
     body.id = id;
 

src/modules/pipelinesV2/pipelines.controller.ts

@@ -26,6 +26,7 @@ import {
 import {
   AuthenticateCondition,
   RequireAllPermissions,
+  RequireSomePermission,
 } from 'src/decorators/authentication.decorator';
 import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { PipelinesService } from './pipelines.service';
@@ -52,30 +53,6 @@ import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
 @UseFilters(new GrpcToHttpExceptionFilter())
 @Controller('pipelinesV2')
-@AuthenticateCondition((req, user) => {
-  let action;
-
-  switch (req.method) {
-    case 'POST':
-      action = 'CREATE';
-      break;
-
-    case 'PUT':
-      action = 'UPDATE';
-      break;
-
-    case 'PATCH':
-      action = 'UPDATE';
-      break;
-
-    default:
-      action = req.method;
-  }
-
-  return user.permissions.includes(
-    PERMISSIONS_GROUPS.PIPELINE.permissions[action].seqid,
-  );
-})
 export class PipelinesController {
   logger: DadosferaLogger;
   constructor(
@@ -88,6 +65,7 @@ export class PipelinesController {
   }
 
   @Get('monitoring-dashboard')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getMonitoringDashboard(@User() user: RequestUser) {
     this.logger.info('PipelinesController - getMonitoringDashboard', { user });
 
@@ -100,6 +78,7 @@ export class PipelinesController {
   }
 
   @Post()
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   @ApiCreatedResponse({ type: IPipelineV2 })
   async create(
     @Language() language: LanguageEnum,
@@ -126,6 +105,7 @@ export class PipelinesController {
   }
 
   @Get()
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async findAll(
     @User() user: RequestUser,
     @Language() language: LanguageEnum,
@@ -150,6 +130,7 @@ export class PipelinesController {
   }
 
   @Get('/download-logs')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async downloadLogs(
     @User() user: RequestUser,
     @Language() language: LanguageEnum,
@@ -180,6 +161,7 @@ export class PipelinesController {
   }
 
   @Get(':id/config')
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW,PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineproperties(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
@@ -191,6 +173,7 @@ export class PipelinesController {
   }
 
   @Get(':id/objects')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineObjects(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
@@ -202,16 +185,14 @@ export class PipelinesController {
   }
 
   @Get(':id/status')
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineStatus(@Body() body, @Param('id') id: string) {
     body.id = id;
 
-    this.logger.info(
-      process.env.DEV_URL + `/pipeline/${id} - ON GET PIPELINE STATUS ROUTE`,
-      {
-        user: body.info.user_id,
-        customer: body.info.customer,
-      },
-    );
+    this.logger.info(`/pipeline/${id} - ON GET PIPELINE STATUS ROUTE`, {
+      user: body.info.user_id,
+      customer: body.info.customer,
+    });
 
     const response = await this.oldPipelinesService.getPipelineStatus(body);
 
@@ -219,6 +200,7 @@ export class PipelinesController {
   }
 
   @Get('/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async findOne(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
@@ -256,10 +238,12 @@ export class PipelinesController {
         });
         return res;
       });
+
     return result;
   }
 
   @Patch('/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async update(
     @Language() language: LanguageEnum,
     @Body() updatePipelineDto,
@@ -299,6 +283,7 @@ export class PipelinesController {
     deprecated: true,
     description: 'This method is deprecated. Please use PATCH instead',
   })
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async updateDeprecated(
     @Language() language: LanguageEnum,
     @Body() updatePipelineDto,
@@ -314,6 +299,7 @@ export class PipelinesController {
   @Delete(':id')
   @ApiNoContentResponse()
   @HttpCode(HttpStatus.NO_CONTENT)
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.DELETE)
   async delete(@Param('id') id: string, @User() user: RequestUser) {
     this.logger.info('PipelinesController - delete', { user });
     const metadata = PackTheMetadata({
@@ -327,7 +313,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('/init-upload')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
+  @RequireAllPermissions(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW)
   async initUploadFile(
     @User() user: RequestUser,
     @Body() body: IInitUploadCSVFile,
@@ -359,7 +345,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('/complete-upload')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
+  @RequireAllPermissions(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW)
   async completeUploadFile(
     @User() user: RequestUser,
     @Body() body: ICompleteUploadCSVFile,
@@ -377,7 +363,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('/file')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
+  @RequireAllPermissions(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW)
   async uploadedFile(
     @User() user: RequestUser,
     @Body() body: ICreatePipelineCSVFile,
@@ -427,6 +413,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('start/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   async activate(@Param('id') id: string, @Body() body) {
     const { info } = body;
 

src/services/service.module.ts

@@ -5,15 +5,25 @@ import { redisStore } from 'cache-manager-ioredis-yet';
 @Module({
   imports: [
     CacheModule.registerAsync({
-      useFactory: async () => ({
-        store: await redisStore({
+      useFactory: async () => {
+        const baseRedisConfig = {
           ttl: 5 * 1000 * 60, // 5 minute
           host: process.env.REDIS_HOST,
           port: process.env.REDIS_PORT && Number(process.env.REDIS_PORT),
           db: process.env.REDIS_DATABASE && Number(process.env.REDIS_DATABASE),
           keyPrefix: 'maestro:sso',
-        }),
-      }),
+        }
+
+        if (process.env.ENV !== 'local') {  
+          baseRedisConfig['tls'] = {
+            servername: process.env.REDIS_HOST,
+          }
+        }
+
+        return {
+          store: await redisStore(baseRedisConfig),
+        }
+      },
     }),
   ],
   providers: [CacheService],