FIX: add decorator to require danger zone module

Feature/logs dashboard

docsfera.json

@@ -20,6 +20,14 @@
                 ],
                 "type": "string"
               }
+            },
+            {
+              "name": "origin",
+              "required": true,
+              "in": "header",
+              "schema": {
+                "type": "string"
+              }
             }
           ],
           "requestBody": {
@@ -64,6 +72,14 @@
                 ],
                 "type": "string"
               }
+            },
+            {
+              "name": "origin",
+              "required": true,
+              "in": "header",
+              "schema": {
+                "type": "string"
+              }
             }
           ],
           "requestBody": {
@@ -249,6 +265,14 @@
                 ],
                 "type": "string"
               }
+            },
+            {
+              "name": "origin",
+              "required": true,
+              "in": "header",
+              "schema": {
+                "type": "string"
+              }
             }
           ],
           "responses": {
@@ -5449,6 +5473,57 @@
           ]
         }
       },
+      "/customers/{id}/mfa": {
+        "post": {
+          "operationId": "CustomersController_enableMfaEnforce",
+          "parameters": [
+            {
+              "name": "id",
+              "required": true,
+              "in": "path",
+              "schema": {
+                "type": "string"
+              }
+            }
+          ],
+          "requestBody": {
+            "required": true,
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EnforceMfa"
+                }
+              }
+            }
+          },
+          "responses": {
+            "201": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          },
+          "tags": [
+            "Customers"
+          ],
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
       "/customers/{id}/links": {
         "get": {
           "operationId": "CustomersController_getCustomerLinks",
@@ -5583,6 +5658,56 @@
           ]
         }
       },
+      "/customers/logs-dashboard": {
+        "get": {
+          "operationId": "CustomersController_getCustomerMixPanelLogsDashboard",
+          "parameters": [],
+          "responses": {
+            "200": {
+              "description": ""
+            }
+          },
+          "tags": [
+            "Customers"
+          ],
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
+      "/customers/access-dashboard": {
+        "get": {
+          "operationId": "CustomersController_getAccessDashboard",
+          "parameters": [],
+          "responses": {
+            "200": {
+              "description": ""
+            }
+          },
+          "tags": [
+            "Customers"
+          ],
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
       "/open-data/sharing-ocean-data": {
         "post": {
           "operationId": "OpenDataController_createUser",
@@ -5715,6 +5840,96 @@
             "Health"
           ]
         }
+      },
+      "/network-policy": {
+        "get": {
+          "operationId": "NetworkPolicyController_getNetworks",
+          "parameters": [],
+          "responses": {
+            "200": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "$ref": "#/components/schemas/NetworkPoliciesDTO"
+                  }
+                }
+              }
+            }
+          },
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        },
+        "post": {
+          "operationId": "NetworkPolicyController_applyNetworkPolicies",
+          "parameters": [],
+          "requestBody": {
+            "required": true,
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkPoliciesDTO"
+                }
+              }
+            }
+          },
+          "responses": {
+            "200": {
+              "description": ""
+            },
+            "201": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          },
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        },
+        "delete": {
+          "operationId": "NetworkPolicyController_removeNetworkPolicies",
+          "parameters": [],
+          "requestBody": {
+            "required": true,
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkPoliciesDTO"
+                }
+              }
+            }
+          },
+          "responses": {
+            "200": {
+              "description": ""
+            }
+          },
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
       }
     },
     "info": {
@@ -5785,6 +6000,9 @@
             },
             "themeEnabled": {
               "type": "boolean"
+            },
+            "enforceMfa": {
+              "type": "boolean"
             }
           },
           "required": [
@@ -5795,7 +6013,8 @@
             "tier",
             "scheduleLimit",
             "links",
-            "themeEnabled"
+            "themeEnabled",
+            "enforceMfa"
           ]
         },
         "AuthUser": {
@@ -8464,6 +8683,17 @@
             "tags"
           ]
         },
+        "EnforceMfa": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "enabled"
+          ]
+        },
         "CustomerLink": {
           "type": "object",
           "properties": {
@@ -8566,6 +8796,20 @@
           "required": [
             "theme"
           ]
+        },
+        "NetworkPoliciesDTO": {
+          "type": "object",
+          "properties": {
+            "policies": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          "required": [
+            "policies"
+          ]
         }
       }
     }

helmfiles/stg.yaml

@@ -9,11 +9,11 @@ charts:
       - name: hostname
         value: maestro.stg.dadosfera.ai
       - name: maestro.pi_factory_url
-        value: pi-factory.stg.dadosfera.ai
+        value: pi-factory.dadosfera.ai
       - name: maestro.in_factory_url
-        value: in-factory.stg.dadosfera.ai
+        value: in-factory.dadosfera.ai
       - name: maestro.tr_factory_url
-        value: in-factory.stg.dadosfera.ai
+        value: in-factory.dadosfera.ai
       - name: maestro.open_customer_id
         value: b3e3dfe5-b992-4586-a73c-c0b0c00f615d
       - name: maestro.open_group_id

package-lock.json

@@ -12,7 +12,7 @@
         "@aws-sdk/client-secrets-manager": "^3.414.0",
         "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
         "@dadosfera/protospack": "2.5.3",
-        "@dadosfera/protospack-v2": "3.37.0-alpha.19",
+        "@dadosfera/protospack-v2": "3.37.0-beta.22",
         "@grpc/grpc-js": "^1.9.3",
         "@grpc/proto-loader": "^0.7.9",
         "@nestjs/cli": "^9.5.0",
@@ -1397,9 +1397,9 @@
       }
     },
     "node_modules/@dadosfera/protospack-v2": {
-      "version": "3.37.0-alpha.19",
+      "version": "3.37.0-beta.22",
-      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.37.0-alpha.19.tgz",
+      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.37.0-beta.22.tgz",
-      "integrity": "sha512-+F2sMJszfXRqWuN5ae+v7MqHhJyg7TgVvnuFBKUOwHvBoWCfAUnIm9XGEA/YjPpRUa1gM0nnKL8SpBFf43Q1aA==",
+      "integrity": "sha512-SOu+Z5qc3ms6JjtWpHFYEgYq7Q8Y2GHBewDQj5/Evv4yxpzuANw9Eecd6zzCttV47ceM75A8rnomTj9gGkoTTg==",
       "license": "ISC",
       "dependencies": {
         "@grpc/grpc-js": "^1.9.3",

package.json

@@ -30,7 +30,7 @@
     "@aws-sdk/client-secrets-manager": "^3.414.0",
     "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
     "@dadosfera/protospack": "2.5.3",
-    "@dadosfera/protospack-v2": "3.37.0-alpha.19",
+    "@dadosfera/protospack-v2": "3.37.0-beta.22",
     "@grpc/grpc-js": "^1.9.3",
     "@grpc/proto-loader": "^0.7.9",
     "@nestjs/cli": "^9.5.0",

src/app.module.ts

@@ -28,6 +28,7 @@ import { MixpanelModule } from './modules/mixpanel/mixpanel.module';
 import { CustomersModule } from './modules/customers/customers.module';
 import { OpenDataModule } from './modules/open-data/open-data.module';
 import { ThemeModule } from './modules/theme/theme.module';
+import { NetworkPolicyModule } from './modules/network-policy/network-policy.module';
 
 @Module({
   providers: [
@@ -62,7 +63,8 @@ import { ThemeModule } from './modules/theme/theme.module';
     OpenDataModule,
     ThemeModule,
     //Always leave HealthModule last, so it is on the bottom of swagger
-    HealthModule
+    HealthModule,
+    NetworkPolicyModule
   ],
 })
 export class AppModule {}

src/authentication/authentication.guard.ts

@@ -121,6 +121,7 @@ export class AuthenticationGuard
       customer_id: accessTokenPayload.customer_id,
       customer_name: accessTokenPayload.customer_name,
       customer_tier: accessTokenPayload.customer_tier,
+      customer_modules: accessTokenPayload.customer_modules,
       access_token: accessToken,
     };
     // TODO: for backwards compatibility. remove in the future

src/authentication/permissions.enum.ts

@@ -609,6 +609,13 @@ export interface DadosferaModule {
   key: string;
   permissionSeqId: number;
 }
+
+export const DADOSFERA_MODULES_KEYS = {
+  LOG_DASHBOARD: 'logs-dashboard',
+  ACCESS_DASHBOARD: 'access-dashboard',
+  DANGER_ZONE: 'danger-zone'
+}
+
 export const DADOSFERA_MODULES: Array<DadosferaModule> = [
   {
     name: 'Intelligence Module',

src/decorators/authentication.decorator.ts

@@ -25,6 +25,14 @@ export function RequireSomePermission(
   );
 }
 
+export function RequireModule(
+  key: string
+) {
+  return createAuthenticatedDecorator((_, user: RequestUser) =>
+    user.customer_modules.some(module => module === key),
+  );
+}
+
 export function AuthenticateCondition(func: AuthenticationFunction) {
   return createAuthenticatedDecorator(func);
 }

src/decorators/user.decorator.ts

@@ -11,6 +11,7 @@ export interface RequestUser {
   customer_name: string;
   customer_tier: string;
   access_token: string;
+  customer_modules: string[];
 }
 
 export const User: (options?: { required?: boolean }) => ParameterDecorator =

src/modules/auth/auth.controller.ts

@@ -54,7 +54,6 @@ import { LanguageEnum } from 'src/utils/languages.enum';
 import { Language } from 'src/decorators/language.decorator';
 import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 
-
 @ApiTags('Auth')
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
 @UseFilters(new GrpcToHttpExceptionFilter())
@@ -63,7 +62,6 @@ export class AuthController {
   logger: DadosferaLogger;
   redirectUrl: string;
 
-
   constructor(
     @Inject(DadosferaLogger)
     dadosferaLogger: DadosferaLogger,
@@ -88,9 +86,12 @@ export class AuthController {
   async signIn(
     @Body() { username, password, totp }: AuthSignInReq,
     @Language() language: LanguageEnum,
+    @Headers('origin') origin: string,
   ): Promise<AuthSignInRes> {
     this.logger.info('/auth - SignIn');
-    const metadata = PackTheMetadata({ language });
+    const frontHost = origin.replace(/^https?:\/\//, '');
+    const metadata = PackTheMetadata({ language, custom_host: frontHost });
+    this.logger.info('metadata: ' + JSON.stringify(metadata.toJSON()));
     return this.authClient.signIn({ username, password, totp }, metadata);
   }
 
@@ -100,13 +101,15 @@ export class AuthController {
   async refreshAccessToken(
     @Body() body: AuthRefreshAccessTokenReq,
     @Language() language: LanguageEnum,
+    @Headers('origin') origin: string,
   ) {
     this.logger.info('/auth - RefreshAccessToken');
     const { refreshToken, customerName: customer_name } = body;
-
+    const frontHost = origin.replace(/^https?:\/\//, '');
     const metadata = PackTheMetadata({
-      customer_name,
       language,
+      customer_name,
+      custom_host: frontHost,
     });
 
     return this.authClient.refreshAccessToken({ refreshToken }, metadata);
@@ -180,16 +183,23 @@ export class AuthController {
   @ApiInternalOnlyEndpoint()
   @Post('confirm-reset-password')
   @HttpCode(HttpStatus.OK)
-  async confirmResetPassword(@Body() body: AuthConfirmResetPasswordRequest) {
+  async confirmResetPassword(
+    @Body() body: AuthConfirmResetPasswordRequest,
+    @Headers('origin') origin: string,
+  ) {
     this.logger.info('/auth - confirm-reset-password');
-
+    const frontHost = origin.replace(/^https?:\/\//, '');
+    const metadata = PackTheMetadata({ custom_host: frontHost });
     const { username, code, newPassword } = body;
 
-    return this.authClient.confirmResetPassword({
+    return this.authClient.confirmResetPassword(
-      username,
+      {
-      code,
+        username,
-      newPassword,
+        code,
-    });
+        newPassword,
+      },
+      metadata,
+    );
   }
 
   @ApiInternalOnlyEndpoint()
@@ -355,7 +365,7 @@ export class AuthController {
   async blockUsers(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
-    @Body() body: BulkEditRequest
+    @Body() body: BulkEditRequest,
   ) {
     this.logger.info('blockUsers - Starting request');
 
@@ -365,8 +375,8 @@ export class AuthController {
       this.logger.debug('Calling blockUsers service', {
         metadata: {
           access_token: metadata.get('access_token'),
-          language: metadata.get('language')
+          language: metadata.get('language'),
-        }
+        },
       });
 
       const result = await this.authClient.blockUsers(body.users, metadata);
@@ -375,7 +385,7 @@ export class AuthController {
     } catch (error) {
       this.logger.error('blockUsers - Error', {
         error: error.message,
-        stack: error.stack
+        stack: error.stack,
       });
       throw error;
     }
@@ -388,7 +398,7 @@ export class AuthController {
   async unblockUsers(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
-    @Body() body: BulkEditRequest
+    @Body() body: BulkEditRequest,
   ) {
     this.logger.info('unblockUsers');
     const metadata = PackTheMetadata(user);
@@ -403,11 +413,11 @@ export class AuthController {
   async resetUsers(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
-    @Body() body: BulkEditRequest
+    @Body() body: BulkEditRequest,
   ) {
     this.logger.info('resetUsers');
     const metadata = PackTheMetadata(user);
 
-    return this.authClient.resetUsers(body.users,  metadata);
+    return this.authClient.resetUsers(body.users, metadata);
   }
 }

src/modules/auth/auth.service.ts

@@ -113,19 +113,21 @@ export class AuthClientService implements OnModuleInit {
     );
   }
 
-  async confirmResetPassword({
+  async confirmResetPassword(
-    username,
+    { username, code, newPassword }: AuthConfirmResetPasswordRequest,
-    code,
+    metadata: Metadata,
-    newPassword,
+  ) {
-  }: AuthConfirmResetPasswordRequest) {
     this.logger.info('confirmResetPassword');
 
     return lastValueFrom(
-      this.authService.AuthConfirmResetPassword({
+      this.authService.AuthConfirmResetPassword(
-        username,
+        {
-        code,
+          username,
-        newPassword,
+          code,
-      }),
+          newPassword,
+        },
+        metadata,
+      ),
     );
   }
 
@@ -170,15 +172,18 @@ export class AuthClientService implements OnModuleInit {
     );
   }
 
-  async blockUsers(users: string[],metadata: Metadata): Promise<BulkEditResponse> {
+  async blockUsers(
+    users: string[],
+    metadata: Metadata,
+  ): Promise<BulkEditResponse> {
     this.logger.info('blockUsers - Service starting');
 
     try {
       this.logger.debug('Calling BlockUser gRPC method', {
         metadata: {
           access_token: metadata.get('access_token'),
-          language: metadata.get('language')
+          language: metadata.get('language'),
-        }
+        },
       });
 
       const response = await lastValueFrom<BulkEditResponse>(
@@ -196,26 +201,32 @@ export class AuthClientService implements OnModuleInit {
     }
   }
 
-  async unblockUsers(users: string[],metadata: Metadata): Promise<BulkEditResponse> {
+  async unblockUsers(
+    users: string[],
+    metadata: Metadata,
+  ): Promise<BulkEditResponse> {
     this.logger.info('unblockUsers');
     return await lastValueFrom(
       this.authService.UnblockUser({ users }, metadata),
     );
   }
 
-  async resetUsers(users: string[], metadata: Metadata): Promise<BulkEditResponse> {
+  async resetUsers(
+    users: string[],
+    metadata: Metadata,
+  ): Promise<BulkEditResponse> {
     this.logger.info('resetUsers');
 
     try {
       this.logger.debug('Calling ResetUser gRPC method', {
         metadata: {
           access_token: metadata.get('access_token'),
-          language: metadata.get('language')
+          language: metadata.get('language'),
-        }
+        },
       });
 
       const response = await lastValueFrom<BulkEditResponse>(
-        this.authService.ResetUser({ users }, metadata)
+        this.authService.ResetUser({ users }, metadata),
       );
 
       this.logger.info('resetUsers - Success', { response });
@@ -223,7 +234,7 @@ export class AuthClientService implements OnModuleInit {
     } catch (error) {
       this.logger.error('resetUsers - Error', {
         error: error.message,
-        stack: error.stack
+        stack: error.stack,
       });
       throw error;
     }

src/modules/auth/dtos/login.ts

@@ -87,6 +87,8 @@ export class AuthCustomer {
 
   @ApiProperty()
   themeEnabled: boolean;
+  @ApiProperty()
+  enforceMfa: boolean;
 }
 
 export class AuthSignInReq implements AuthSignInRequest {

src/modules/customers/customers.controller.ts

@@ -7,15 +7,18 @@ import {
   HttpStatus,
   Inject,
   Param,
+  Post,
   Put,
   Query,
   UseFilters,
 } from '@nestjs/common';
 import { ApiOkResponse, ApiProduces, ApiTags } from '@nestjs/swagger';
-import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+import { DADOSFERA_MODULES_KEYS, PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
 import {
   Authenticated,
   RequireAllPermissions,
+  RequireModule,
+  RequireSomePermission,
 } from 'src/decorators/authentication.decorator';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
 import { CustomersService } from './customers.service';
@@ -23,6 +26,7 @@ import { CustomerLinkRequest, CustomerLinksResponse } from './dtos/customers';
 import { RequestUser, User } from 'src/decorators/user.decorator';
 import type { StringValue } from 'ms';
 import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { EnforceMfa } from './dtos/enforce-mfa';
 
 @ApiTags('Customers')
 @Controller('customers')
@@ -38,6 +42,15 @@ export class CustomersController {
     this.logger = dadosferaLogger.logger;
   }
 
+  @Post(':id/mfa')
+  @Authenticated()
+  @RequireSomePermission(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @RequireModule(DADOSFERA_MODULES_KEYS.DANGER_ZONE)
+  async enableMfaEnforce(@Param('id') id: string, @Body() data: EnforceMfa) {
+    this.logger.info('enableMfaEnforce', { id });
+    return await this.customersService.enableEnforceMfa(id, data.enabled);
+  }
+
   @Get(':id/links')
   @Authenticated()
   @ApiOkResponse({ type: CustomerLinksResponse })
@@ -91,4 +104,36 @@ export class CustomersController {
     const metadata = PackTheMetadata(user);
     return this.customersService.getMonitoringDashboardUrl(metadata);
   }
+
+  @Get('logs-dashboard')
+  @Authenticated()
+  @RequireAllPermissions(
+    PERMISSIONS_GROUPS.USERS.permissions.ADMIN,
+  )
+  @RequireModule(DADOSFERA_MODULES_KEYS.LOG_DASHBOARD)
+  async getCustomerMixPanelLogsDashboard(
+    @User() user: RequestUser,
+  ): Promise<{ url: string }> {
+    this.logger.info('getLogsDashboardUrl');
+    const metadata = PackTheMetadata(user);
+  
+    const result = await this.customersService.getLogsDashboardUrl(metadata);
+    return result;
+  }
+
+  @Get('access-dashboard')
+  @Authenticated()
+  @RequireAllPermissions(
+    PERMISSIONS_GROUPS.USERS.permissions.ADMIN,
+  )
+  @RequireModule(DADOSFERA_MODULES_KEYS.ACCESS_DASHBOARD)
+  async getAccessDashboard(
+    @User() user: RequestUser,
+  ): Promise<{ url: string }> {
+    this.logger.info('getAccessDashboard');
+    const metadata = PackTheMetadata(user);
+  
+    const result = await this.customersService.getAccessDashboardUrl(user.customer_name, metadata);
+    return result;
+  }
 }

src/modules/customers/customers.service.ts

@@ -5,6 +5,7 @@ import {
   HttpException,
   HttpStatus,
   InternalServerErrorException,
+  ForbiddenException,
 } from '@nestjs/common';
 
 import { firstValueFrom, lastValueFrom } from 'rxjs';
@@ -33,6 +34,7 @@ import DadosferaLogger from '@dadosfera/dadosfera-logs';
 // This function will accept any string, which may result in a bug.
 @Injectable()
 export class CustomersService implements OnModuleInit {
+
   private customerService: CustomersProtoService;
   private logger: DadosferaLogger;
   private pipelineReadService: ReadService.PipelineV2ReadService;
@@ -156,4 +158,59 @@ export class CustomersService implements OnModuleInit {
 
     return res;
   }
+  async getLogsDashboardUrl(metadata: Metadata) {
+    logger.info('CustomersService - getMixPanelLogsDashboardUrl');
+  
+    const res = await lastValueFrom(
+      this.pipelineReadService.PipelineV2GetDashboardUrl(
+        {
+          dashboard_id: '103',
+          exp: '15m',
+          metabase_customer_name: 'dadosferatech',
+        },
+        metadata,
+      ),
+    );
+    logger.info('Done');
+  
+    return res;
+  }
+
+  async getAccessDashboardUrl(customerName: string, metadata: Metadata) {
+    /*
+     * TODO(Refactor): dar um jeito de exibir o dash da sbm diferente dos outros customer
+     * pois o signicado de department para sbm significa as instituições do usuários
+     */
+    if (customerName !== 'sbmoffshorecom') {
+      throw new ForbiddenException();
+    }
+    logger.info('CustomersService - getAccessDashboardUrl');
+  
+    const res = await this.getDashboardUrl('105', metadata);
+    logger.info('Done');
+  
+    return res;
+  }
+
+  private async getDashboardUrl(dashboardId: string, metadata: Metadata) {
+    return await lastValueFrom(
+      this.pipelineReadService.PipelineV2GetDashboardUrl(
+        {
+          dashboard_id: dashboardId,
+          exp: '15m',
+          metabase_customer_name: 'dadosferatech',
+        },
+        metadata
+      )
+    );
+  }
+
+  async enableEnforceMfa(id: string, enabled: boolean) {
+    return await lastValueFrom(
+      this.customerService.CustomerUpdateEnforceMfa({
+        customerId: id,
+        enforceMfa: enabled
+      })
+    )
+  }
 }

src/modules/customers/dtos/enforce-mfa.ts

@@ -0,0 +1,6 @@
+import { ApiProperty } from "@nestjs/swagger";
+
+export class EnforceMfa {
+    @ApiProperty()
+    enabled: boolean
+}

src/modules/network-policy/dto/network-policy.dto.ts

@@ -0,0 +1,6 @@
+import { ApiProperty } from "@nestjs/swagger";
+
+export class NetworkPoliciesDTO {
+    @ApiProperty()
+    policies: string []
+}

src/modules/network-policy/network-policy.controller.ts

@@ -0,0 +1,64 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Post } from '@nestjs/common';
+import { ApiOkResponse } from '@nestjs/swagger';
+import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+import {
+  Authenticated,
+  RequireAllPermissions,
+} from 'src/decorators/authentication.decorator';
+import { NetworkPoliciesDTO } from './dto/network-policy.dto';
+import { RequestUser, User } from 'src/decorators/user.decorator';
+import { NetworkPolicyService } from './network-policy.service';
+import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+
+@Controller('network-policy')
+export class NetworkPolicyController {
+  constructor(private networkPolicyService: NetworkPolicyService) {}
+
+  @Get()
+  @Authenticated()
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @HttpCode(HttpStatus.OK)
+  async getNetworks(
+    @User() user: RequestUser,
+  ) {
+    return await this.networkPolicyService.getByCustomer(
+      user.customer_id
+    );
+  }
+
+  @Post()
+  @Authenticated()
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @ApiOkResponse()
+  @HttpCode(HttpStatus.CREATED)
+  async applyNetworkPolicies(
+    @User() user: RequestUser,
+    @Body() data: NetworkPoliciesDTO,
+  ) {
+    const metadata = PackTheMetadata(user);
+
+    return await this.networkPolicyService.apply(
+      data.policies,
+      user.customer_id,
+      metadata,
+    );
+  }
+
+  @Delete()
+  @Authenticated()
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @ApiOkResponse()
+  @HttpCode(HttpStatus.OK)
+  async removeNetworkPolicies(
+    @User() user: RequestUser,
+    @Body() data: NetworkPoliciesDTO,
+  ) {
+    const metadata = PackTheMetadata(user);
+
+    return await this.networkPolicyService.delete(
+      data.policies,
+      user.customer_id,
+      metadata,
+    );
+  }
+}

src/modules/network-policy/network-policy.module.ts

@@ -0,0 +1,19 @@
+import { Module } from '@nestjs/common';
+import { NetworkPolicyController } from './network-policy.controller';
+import { NetworkPolicyService } from './network-policy.service';
+import { ClientsModule } from '@nestjs/microservices';
+import { DucClient } from '../duc/client.config';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+
+const ducClient = new DucClient();
+
+@Module({
+  imports: [
+    ClientsModule.register([
+      ducClient.providerOptions
+    ]),
+  ],
+  controllers: [NetworkPolicyController],
+  providers: [NetworkPolicyService, DadosferaLogger]
+})
+export class NetworkPolicyModule {}

src/modules/network-policy/network-policy.service.ts

@@ -0,0 +1,74 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { DucClient } from '../duc/client.config';
+import { ClientGrpc } from '@nestjs/microservices';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+import { CustomersProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
+import { Metadata } from '@grpc/grpc-js';
+import { lastValueFrom } from 'rxjs';
+import { NetworkPoliciesDTO } from './dto/network-policy.dto';
+
+
+@Injectable()
+export class NetworkPolicyService {
+  private customerService: CustomersProtoService;
+  private logger: DadosferaLogger;
+
+  constructor(
+    @Inject(DucClient.name) private readonly grpcClient: ClientGrpc,
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  onModuleInit() {
+    this.customerService = this.grpcClient.getService<CustomersProtoService>(
+      ProtoServices.CustomersProtoService,
+    );
+  }
+
+  async getByCustomer(id: string): Promise<NetworkPoliciesDTO> {
+    const {
+      customer
+    } = await lastValueFrom(this.customerService.CustomerFindOneById({
+      id
+    }));
+
+    return {
+      policies: customer.networkPolicies
+    }
+  }
+
+  async apply(
+    networkPolicies: string[],
+    customerId: string,
+    metadata: Metadata,
+  ) {
+    return await lastValueFrom(
+      this.customerService.CustomerCreateNetworkPolicy(
+        {
+          customerId,
+          networkPolicies,
+        },
+        metadata,
+      ),
+    );
+  }
+
+  async delete(
+    networkPolicies: string[],
+    customerId: string,
+    metadata: Metadata,
+  ) {
+    return await lastValueFrom(
+      this.customerService.CustomerRemoveNetworkPolicy(
+        {
+          customerId,
+          networkPolicies,
+        },
+        metadata,
+      ),
+    );
+  }
+}

src/utils/ PackTheMetadata.ts

@@ -11,6 +11,9 @@ interface IMetadata {
   roles?: string[];
   is_data_manager?: boolean;
   access_token?: string;
+  host?: string;
+  origin?: string;
+  custom_host?: string;
 }
 
 export function PackTheMetadata(info: IMetadata): Metadata {