Merge pull request #267 from dadosfera/fix/private-route

FIX: add ip range and domain list to route /open-data

docsfera.json

@@ -5489,14 +5489,6 @@
               "schema": {
                 "type": "string"
               }
-            },
-            {
-              "name": "origin",
-              "required": true,
-              "in": "header",
-              "schema": {
-                "type": "string"
-              }
             }
           ],
           "responses": {

maestro/templates/ingress-private.yaml

@@ -2,7 +2,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
-    nginx.ingress.kubernetes.io/whitelist-source-range: "69.49.241.121/32" # hostgator ip 
+    nginx.ingress.kubernetes.io/whitelist-source-range: "69.49.241.124/32" # hostgator ip 
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
     nginx.ingress.kubernetes.io/server-snippet: |
       underscores_in_headers on;
@@ -11,7 +11,7 @@ metadata:
   generation: 1
   labels:
     app: maestro
-  name: open-data
+  name: maestro
   namespace: applications
 spec:
   ingressClassName: nginx

src/modules/mixpanel/mixpanel.controller.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Inject, Param, Post, Req } from '@nestjs/common';
+import { Body, Controller, Inject, Param, Post } from '@nestjs/common';
 import { init } from 'mixpanel';
 import { Authenticated } from 'src/decorators/authentication.decorator';
 import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
@@ -13,12 +13,7 @@ export class MixpanelController {
     private readonly mixpanelToken: string,
   ) {}
   @Post(':id')
-  async trackEvent(
-    @Param('id') id,
-    @Body() body,
-    @User() user: RequestUser,
-    @Req() request
-  ) {
+  async trackEvent(@Param('id') id, @Body() body, @User() user: RequestUser) {
     delete body.info;
     const mixpanel = init(this.mixpanelToken);
 
@@ -71,16 +66,13 @@ export class MixpanelController {
       $email: user.username.includes('@')
         ? user.username
         : user.username + '@dadosfera.ai',
-      customer_name: user.customer_name
+      customer_name: user.customer_name,
     });
 
     await mixpanel.track(id, {
       distinct_id: user.username,
       customer: user.customer_name,
       env: process.env.ENV,
-      $ip: request.ip,
-      $os: request.headers['sec-ch-ua-platform'] || '',
-      $browser: request.headers['user-agent'],
       ...body,
     });
 

src/modules/open-data/open-data.controller.ts

@@ -1,5 +1,5 @@
 import DadosferaLogger from '@dadosfera/dadosfera-logs';
-import { Body, Controller, ForbiddenException, Header, Headers, HttpCode, HttpException, Inject, Param, Post, Query, Req, Res, UseFilters, UseGuards, UseInterceptors } from '@nestjs/common';
+import { Body, Controller, ForbiddenException, Header, HttpCode, HttpException, Inject, Param, Post, Query, Req, UseFilters, UseGuards, UseInterceptors } from '@nestjs/common';
 import { ApiCreatedResponse, ApiHeaders, ApiOkResponse, ApiTags } from '@nestjs/swagger';
 import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
@@ -40,14 +40,14 @@ export class OpenDataController {
     language: string,
     @Req()
     request: Request,
-    @Headers('origin')
-    origin: string
   ) {
-    this.logger.info('createUser for open data' + JSON.stringify(request.headers));
+    this.logger.info('createUser for open data');
 
+    this.logger.info('user-agent', request.headers);
+
+    const origin = request.headers['origin'];
     const corslist = ["https://devsbm.dadosfera.io", "https://sharingoceandata.com"];
     if (!corslist.includes(origin)) {
-      this.logger.info('block request by cors list: '+ origin);
       throw new ForbiddenException();
     }