Merge pull request #428 from dadosfera/hotfix/user-patch

Hotfix/user patch

Dockerfile

@@ -1,5 +1,4 @@
-FROM node:20-alpine AS base_image
-RUN npm install -g npm@latest
+FROM node:18.17-alpine AS base_image
 
 FROM base_image AS build_base
 WORKDIR /app

Dockerfile.local

@@ -1,47 +0,0 @@
-FROM node:20-alpine AS base_image
-RUN npm install -g npm@latest
-
-FROM base_image AS build_base
-WORKDIR /app
-RUN apk update
-RUN apk add --no-cache \
-      aws-cli \
-      chromium \
-      nss \
-      freetype \
-      harfbuzz \
-      ca-certificates \
-      ttf-freefont
-COPY package*.json ./
-
-ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true \
-    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
-
-
-# Local build with secrets
-FROM build_base AS build
-RUN --mount=type=secret,id=aws,target=/root/.aws/credentials \
-  aws codeartifact login --tool npm --namespace @dadosfera --repository dadosfera-npm --domain dadosfera --domain-owner 611330257153 --region us-east-1
-RUN npm ci
-COPY . .
-RUN npm run build
-
-
-FROM base_image
-WORKDIR /app
-COPY --from=build /app/dist ./dist
-COPY --from=build /app/node_modules ./node_modules
-COPY --from=build /app/package*.json ./
-RUN apk update
-RUN apk add --no-cache \
-      chromium \
-      nss \
-      freetype \
-      harfbuzz \
-      ca-certificates \
-      ttf-freefont
-
-ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true \
-    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
-
-ENTRYPOINT ["npm", "run", "start:prod"]

package.json

@@ -49,7 +49,7 @@
     "@nestjs/schematics": "^9.2.0",
     "@nestjs/swagger": "^6.3.0",
     "@nestjs/testing": "^9.4.3",
-    "axios": "^0.30.2",
+    "axios": "^0.27.2",
     "cache-manager": "^5.1.4",
     "cache-manager-ioredis-yet": "^1.1.0",
     "class-transformer": "^0.5.1",
@@ -80,13 +80,7 @@
     "swagger-ui-express": "^4.6.3"
   },
   "overrides": {
-    "multer": "2.0.2",
-    "form-data": "^4.0.4",
-    "body-parser": "^1.20.3",
-    "cross-spawn": "^7.0.5",
-    "glob": "^10.5.0",
-    "path-to-regexp": "^3.3.0",
-    "semver": "^7.5.2"
+    "multer": "1.4.5-lts.1"
   },
   "devDependencies": {
     "@types/cache-manager": "^4.0.6",

src/modules/users/users.controller.ts

@@ -274,9 +274,17 @@ export class UsersController {
     @Language() language: LanguageEnum,
   ) {
 
-    if (user.user_id !== id || !user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)) {
+    const isSameUser = user.user_id === id;
+    const isSuperAdmin = user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)
+    if (!isSameUser && !isSuperAdmin) {
       throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
     }
+
+    if (isSameUser && !isSuperAdmin && body.roleNames) {
+      // Prevent users from updating their own roles
+      delete body.roleNames;
+    }
+
     this.logger.info('updateUser', { user });
     this.userService.setLanguage(language);
     return await this.userService.updateUser(body, id, user.customer_id);