FIX: validate if permission is public

Beta

Dockerfile

@@ -4,9 +4,19 @@ FROM base_image AS build_base
 WORKDIR /app
 RUN apk update
 # needed packages to build dependencies from source
-RUN apk add --no-cache aws-cli
+RUN apk add --no-cache \
+      aws-cli \
+      chromium \
+      nss \
+      freetype \
+      harfbuzz \
+      ca-certificates \
+      ttf-freefont
 COPY package*.json ./
 
+ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true \
+    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
+
 
 # run aws cli without mounting secret, because CI already has AWS credentials
 FROM build_base AS ci_image
@@ -40,4 +50,17 @@ WORKDIR /app
 COPY --from=prod_build /app/dist ./dist
 COPY --from=prod_build /app/node_modules ./node_modules
 COPY --from=prod_build /app/package*.json ./
+RUN apk update
+# needed packages to build dependencies from source
+RUN apk add --no-cache \
+      chromium \
+      nss \
+      freetype \
+      harfbuzz \
+      ca-certificates \
+      ttf-freefont
+
+ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true \
+    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium-browser
+  
 ENTRYPOINT npm run start:prod

docsfera.json

@@ -64,6 +64,14 @@
                 ],
                 "type": "string"
               }
+            },
+            {
+              "name": "origin",
+              "required": true,
+              "in": "header",
+              "schema": {
+                "type": "string"
+              }
             }
           ],
           "requestBody": {
@@ -249,6 +257,14 @@
                 ],
                 "type": "string"
               }
+            },
+            {
+              "name": "origin",
+              "required": true,
+              "in": "header",
+              "schema": {
+                "type": "string"
+              }
             }
           ],
           "responses": {
@@ -542,6 +558,123 @@
           ]
         }
       },
+      "/auth/users/block": {
+        "post": {
+          "operationId": "AuthController_blockUsers",
+          "parameters": [
+            {
+              "name": "dadosfera-lang",
+              "in": "header",
+              "required": false,
+              "schema": {
+                "enum": [
+                  "pt-br",
+                  "en-us"
+                ],
+                "type": "string"
+              }
+            }
+          ],
+          "responses": {
+            "200": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          },
+          "tags": [
+            "Auth"
+          ],
+          "security": [
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
+      "/auth/users/unblock": {
+        "post": {
+          "operationId": "AuthController_unblockUsers",
+          "parameters": [
+            {
+              "name": "dadosfera-lang",
+              "in": "header",
+              "required": false,
+              "schema": {
+                "enum": [
+                  "pt-br",
+                  "en-us"
+                ],
+                "type": "string"
+              }
+            }
+          ],
+          "responses": {
+            "200": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          },
+          "tags": [
+            "Auth"
+          ],
+          "security": [
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
+      "/auth/users/reset": {
+        "post": {
+          "operationId": "AuthController_resetUsers",
+          "parameters": [
+            {
+              "name": "dadosfera-lang",
+              "in": "header",
+              "required": false,
+              "schema": {
+                "enum": [
+                  "pt-br",
+                  "en-us"
+                ],
+                "type": "string"
+              }
+            }
+          ],
+          "responses": {
+            "200": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          },
+          "tags": [
+            "Auth"
+          ],
+          "security": [
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
       "/connections": {
         "post": {
           "operationId": "ConnectionController_createConnection",
@@ -4822,6 +4955,52 @@
           ]
         }
       },
+      "/catalog/pii-reporter": {
+        "get": {
+          "operationId": "CatalogController_getPiiReporter",
+          "parameters": [
+            {
+              "name": "dadosfera-lang",
+              "in": "header",
+              "required": false,
+              "schema": {
+                "enum": [
+                  "pt-br",
+                  "en-us"
+                ],
+                "type": "string"
+              }
+            },
+            {
+              "name": "type",
+              "required": true,
+              "in": "query",
+              "schema": {
+                "type": "string"
+              }
+            }
+          ],
+          "responses": {
+            "200": {
+              "description": ""
+            }
+          },
+          "tags": [
+            "Catalog"
+          ],
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
       "/terms-of-use/token": {
         "get": {
           "operationId": "TermsOfUseController_getToken",
@@ -5332,6 +5511,57 @@
           ]
         }
       },
+      "/customers/{id}/mfa": {
+        "post": {
+          "operationId": "CustomersController_enableMfaEnforce",
+          "parameters": [
+            {
+              "name": "id",
+              "required": true,
+              "in": "path",
+              "schema": {
+                "type": "string"
+              }
+            }
+          ],
+          "requestBody": {
+            "required": true,
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/EnforceMfa"
+                }
+              }
+            }
+          },
+          "responses": {
+            "201": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          },
+          "tags": [
+            "Customers"
+          ],
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
       "/customers/{id}/links": {
         "get": {
           "operationId": "CustomersController_getCustomerLinks",
@@ -5466,6 +5696,56 @@
           ]
         }
       },
+      "/customers/logs-dashboard": {
+        "get": {
+          "operationId": "CustomersController_getCustomerMixPanelLogsDashboard",
+          "parameters": [],
+          "responses": {
+            "200": {
+              "description": ""
+            }
+          },
+          "tags": [
+            "Customers"
+          ],
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
+      "/customers/access-dashboard": {
+        "get": {
+          "operationId": "CustomersController_getAccessDashboard",
+          "parameters": [],
+          "responses": {
+            "200": {
+              "description": ""
+            }
+          },
+          "tags": [
+            "Customers"
+          ],
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
       "/open-data/sharing-ocean-data": {
         "post": {
           "operationId": "OpenDataController_createUser",
@@ -5598,6 +5878,257 @@
             "Health"
           ]
         }
+      },
+      "/network-policy": {
+        "get": {
+          "operationId": "NetworkPolicyController_getNetworks",
+          "parameters": [],
+          "responses": {
+            "200": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "$ref": "#/components/schemas/NetworkPoliciesDTO"
+                  }
+                }
+              }
+            }
+          },
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        },
+        "post": {
+          "operationId": "NetworkPolicyController_applyNetworkPolicies",
+          "parameters": [],
+          "requestBody": {
+            "required": true,
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkPoliciesDTO"
+                }
+              }
+            }
+          },
+          "responses": {
+            "200": {
+              "description": ""
+            },
+            "201": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "type": "object"
+                  }
+                }
+              }
+            }
+          },
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        },
+        "delete": {
+          "operationId": "NetworkPolicyController_removeNetworkPolicies",
+          "parameters": [],
+          "requestBody": {
+            "required": true,
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NetworkPoliciesDTO"
+                }
+              }
+            }
+          },
+          "responses": {
+            "200": {
+              "description": ""
+            }
+          },
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
+      "/api-key": {
+        "post": {
+          "operationId": "ApiKeyController_create",
+          "parameters": [
+            {
+              "name": "dadosfera-lang",
+              "in": "header",
+              "required": false,
+              "schema": {
+                "enum": [
+                  "pt-br",
+                  "en-us"
+                ],
+                "type": "string"
+              }
+            }
+          ],
+          "requestBody": {
+            "required": true,
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CreateApiKeyDto"
+                }
+              }
+            }
+          },
+          "responses": {
+            "201": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "$ref": "#/components/schemas/CreateApiKeyResponseDto"
+                  }
+                }
+              }
+            },
+            "default": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "$ref": "#/components/schemas/CreateApiKeyResponseDto"
+                  }
+                }
+              }
+            }
+          },
+          "tags": [
+            "ApiKey"
+          ],
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        },
+        "get": {
+          "operationId": "ApiKeyController_findAll",
+          "parameters": [
+            {
+              "name": "dadosfera-lang",
+              "in": "header",
+              "required": false,
+              "schema": {
+                "enum": [
+                  "pt-br",
+                  "en-us"
+                ],
+                "type": "string"
+              }
+            }
+          ],
+          "responses": {
+            "200": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/ApiKeyBaseResponseDto"
+                    }
+                  }
+                }
+              }
+            },
+            "default": {
+              "description": "",
+              "content": {
+                "application/json": {
+                  "schema": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/ApiKeyBaseResponseDto"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "tags": [
+            "ApiKey"
+          ],
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
+      },
+      "/api-key/{id}": {
+        "delete": {
+          "operationId": "ApiKeyController_remove",
+          "parameters": [
+            {
+              "name": "dadosfera-lang",
+              "in": "header",
+              "required": false,
+              "schema": {
+                "enum": [
+                  "pt-br",
+                  "en-us"
+                ],
+                "type": "string"
+              }
+            },
+            {
+              "name": "id",
+              "required": true,
+              "in": "path",
+              "schema": {
+                "type": "string"
+              }
+            }
+          ],
+          "responses": {
+            "200": {
+              "description": ""
+            }
+          },
+          "tags": [
+            "ApiKey"
+          ],
+          "security": [
+            {
+              "access-token": []
+            },
+            {
+              "access-token": []
+            }
+          ]
+        }
       }
     },
     "info": {
@@ -5668,6 +6199,9 @@
             },
             "themeEnabled": {
               "type": "boolean"
+            },
+            "enforceMfa": {
+              "type": "boolean"
             }
           },
           "required": [
@@ -5678,7 +6212,8 @@
             "tier",
             "scheduleLimit",
             "links",
-            "themeEnabled"
+            "themeEnabled",
+            "enforceMfa"
           ]
         },
         "AuthUser": {
@@ -8347,6 +8882,17 @@
             "tags"
           ]
         },
+        "EnforceMfa": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean"
+            }
+          },
+          "required": [
+            "enabled"
+          ]
+        },
         "CustomerLink": {
           "type": "object",
           "properties": {
@@ -8449,6 +8995,103 @@
           "required": [
             "theme"
           ]
+        },
+        "NetworkPoliciesDTO": {
+          "type": "object",
+          "properties": {
+            "policies": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          },
+          "required": [
+            "policies"
+          ]
+        },
+        "CreateApiKeyDto": {
+          "type": "object",
+          "properties": {
+            "permissions": {
+              "description": "Array of permission IDs",
+              "type": "array",
+              "items": {
+                "type": "number"
+              }
+            }
+          },
+          "required": [
+            "permissions"
+          ]
+        },
+        "CreateApiKeyResponseDto": {
+          "type": "object",
+          "properties": {
+            "id": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "key_mask": {
+              "type": "string"
+            },
+            "permissions": {
+              "type": "array",
+              "items": {
+                "$ref": "#/components/schemas/PermissionDto"
+              }
+            },
+            "created_at": {
+              "type": "string",
+              "format": "date-time"
+            },
+            "created_by": {
+              "type": "string"
+            },
+            "key": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "id",
+            "key_mask",
+            "permissions",
+            "created_at",
+            "created_by",
+            "key"
+          ]
+        },
+        "ApiKeyBaseResponseDto": {
+          "type": "object",
+          "properties": {
+            "id": {
+              "type": "string",
+              "format": "uuid"
+            },
+            "key_mask": {
+              "type": "string"
+            },
+            "permissions": {
+              "type": "array",
+              "items": {
+                "$ref": "#/components/schemas/PermissionDto"
+              }
+            },
+            "created_at": {
+              "type": "string",
+              "format": "date-time"
+            },
+            "created_by": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "id",
+            "key_mask",
+            "permissions",
+            "created_at",
+            "created_by"
+          ]
         }
       }
     }

helmfiles/stg.yaml

@@ -11,7 +11,7 @@ charts:
       - name: maestro.pi_factory_url
         value: pi-factory.dadosfera.ai
       - name: maestro.in_factory_url
-        value: in-factory.dadosfera.ai
+        value: in-factory.stg.dadosfera.ai
       - name: maestro.tr_factory_url
         value: in-factory.dadosfera.ai
       - name: maestro.open_customer_id

nest-cli.json

@@ -4,6 +4,7 @@
   "compilerOptions": {
     "assets": [
       "**/*.proto",
+      "assets/**/*",
       {
         "include": "i18n/**/*",
         "watchAssets": true

package.json

@@ -30,7 +30,7 @@
     "@aws-sdk/client-secrets-manager": "^3.414.0",
     "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
     "@dadosfera/protospack": "2.5.3",
-    "@dadosfera/protospack-v2": "^3.37.0-beta.10 ",
+    "@dadosfera/protospack-v2": "3.38.0-beta.1",
     "@grpc/grpc-js": "^1.9.3",
     "@grpc/proto-loader": "^0.7.9",
     "@nestjs/cli": "^9.5.0",
@@ -48,8 +48,10 @@
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.0",
     "cron-parser": "^4.9.0",
+    "csv": "^6.3.11",
     "dotenv": "^14.3.2",
     "elastic-apm-node": "^3.50.0",
+    "handlebars": "^4.7.8",
     "helmet": "^5.1.1",
     "jsonwebtoken": "^9.0.2",
     "jwk-to-pem": "^2.0.5",
@@ -61,6 +63,7 @@
     "passport-google-oauth20": "^2.0.0",
     "passport-hubspot-oauth2": "^1.0.3",
     "passport-mailchimp": "^1.1.0",
+    "puppeteer": "^24.7.2",
     "reflect-metadata": "^0.1.13",
     "rimraf": "^3.0.2",
     "rxjs": "^7.5.5",

src/app.module.ts

@@ -28,6 +28,8 @@ import { MixpanelModule } from './modules/mixpanel/mixpanel.module';
 import { CustomersModule } from './modules/customers/customers.module';
 import { OpenDataModule } from './modules/open-data/open-data.module';
 import { ThemeModule } from './modules/theme/theme.module';
+import { NetworkPolicyModule } from './modules/network-policy/network-policy.module';
+import { ApiKeyModule } from './modules/api-key/api-key.module';
 
 @Module({
   providers: [
@@ -62,7 +64,9 @@ import { ThemeModule } from './modules/theme/theme.module';
     OpenDataModule,
     ThemeModule,
     //Always leave HealthModule last, so it is on the bottom of swagger
-    HealthModule
+    HealthModule,
+    NetworkPolicyModule,
+    ApiKeyModule
   ],
 })
 export class AppModule {}

src/assets/template/pii-reporter.html

@@ -0,0 +1,130 @@
+<!DOCTYPE html>
+<html lang="pt-br">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Dadosfera Relatório de PII</title>
+    <link href="https://fonts.googleapis.com/css2?family=Quicksand:wght@400;500;700&display=swap" rel="stylesheet">
+    <style>
+        @page {
+            size: A4 landscape; /* Alterado para paisagem (landscape) */
+            margin: 15mm 10mm; /* Reduzido para proporcionar mais espaço */
+        }
+        body {
+            font-family: 'Quicksand', sans-serif;
+            color: #5c5c5c;
+            margin: 0;
+            padding: 10px;
+            font-size: 12px; /* Reduzindo o tamanho da fonte */
+        }
+        .container {
+            margin: 0;
+            width: 100%;
+        }
+        .header {
+            display: flex;
+            align-items: center;
+            margin-bottom: 20px;
+        }
+        .logo {
+            max-width: 150px; /* Reduzida para economizar espaço */
+            height: auto;
+        }
+        h1 {
+            color: #0d003b;
+            font-weight: 700;
+            margin-left: 20px;
+            font-size: 24px; /* Tamanho ajustado */
+        }
+        table {
+            width: 100%;
+            border-collapse: collapse;
+            margin-top: 15px;
+            table-layout: fixed; /* Importante: define larguras fixas */
+            box-shadow: 0 2px 8px rgba(0,0,0,0.1);
+            border: 1px solid #d0d0d0;
+        }
+        th {
+            background-color: #1700a2;
+            color: white;
+            font-weight: bold;
+            text-align: left;
+            padding: 8px 10px;
+            border: 1px solid #3a26b8;
+            font-size: 11px; /* Tamanho ajustado */
+            word-wrap: break-word; /* Permite quebra de palavras */
+            overflow-wrap: break-word;
+        }
+        td {
+            padding: 6px 10px;
+            border: 1px solid #d0d0d0;
+            font-size: 11px; /* Tamanho ajustado */
+            word-wrap: break-word; /* Permite quebra de palavras */
+            overflow-wrap: break-word;
+        }
+        /* Definindo larguras específicas para cada coluna */
+        th:nth-child(1), td:nth-child(1) { width: 14%; } /* Database */
+        th:nth-child(2), td:nth-child(2) { width: 14%; } /* Schema */
+        th:nth-child(3), td:nth-child(3) { width: 17%; } /* Tabela */
+        th:nth-child(4), td:nth-child(4) { width: 17%; } /* Coluna */
+        th:nth-child(5), td:nth-child(5) { width: 13%; } /* Tipo de Dado */
+        th:nth-child(6), td:nth-child(6) { width: 25%; } /* Regras PII */
+        
+        tr:nth-child(even) {
+            background-color: #f9f9f9;
+        }
+        tr:nth-child(odd) {
+            background-color: white;
+        }
+        .info-section {
+            margin-top: 20px;
+            color: #5c5c5c;
+        }
+        .timestamp {
+            font-style: italic;
+            text-align: right;
+            margin-top: 15px;
+            font-size: 0.9em;
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="header">
+            <img src="https://dadosfera.ai/wp-content/webp-express/webp-images/uploads/2022/06/Logo-Dadosfera1-1.png.webp" alt="Logo Dadosfera" class="logo">
+            <h1>Relatório de PII</h1>
+        </div>
+
+        <div class="info-section">
+            <p>Este relatório apresenta a estrutura de tabelas e suas as seguintes características de PII identificadas.</p>
+        </div>
+
+        <table>
+            <thead>
+                <tr>
+                    <th>Database</th>
+                    <th>Schema</th>
+                    <th>Tabela</th>
+                    <th>Coluna</th>
+                    <th>Tipo de Dado</th>
+                    <th>Regras PII</th>
+                </tr>
+            </thead>
+            <tbody>
+                {{#each dados}}
+                <tr>
+                    <td>{{database_name}}</td>
+                    <td>{{table_schema}}</td>
+                    <td>{{table_name}}</td>
+                    <td>{{column_name}}</td>
+                    <td>{{data_type}}</td>
+                    <td>{{pii_rules}}</td>
+                </tr>
+                {{/each}}
+            </tbody>
+        </table>
+
+        <p class="timestamp">Gerado em: {{dataGeracao}}</p>
+    </div>
+</body>
+</html>

src/authentication/authentication.guard.ts

@@ -17,6 +17,7 @@ import {
 import { RequestUser } from '../decorators/user.decorator';
 import ErrorBuilder from '../utils/ErrorBuilder';
 import ErrorCodes from '../utils/errorCodes';
+import { ApiKeyService } from 'src/modules/api-key/api-key.service';
 
 @Injectable()
 export class AuthenticationGuard
@@ -31,6 +32,7 @@ export class AuthenticationGuard
     dadosferaLogger: DadosferaLogger,
     private reflector: Reflector,
     private authClient: AuthClientService,
+    private apiKeyService: ApiKeyService
   ) {
     this.pems = new Map();
     this.logger = dadosferaLogger.logger;
@@ -48,20 +50,40 @@ export class AuthenticationGuard
     });
   }
 
-  canActivate(ctx: ExecutionContext): boolean {
+  async canActivate(ctx: ExecutionContext): Promise<boolean> {
     const authFunctions = this.reflector.getAllAndMerge<
       AuthenticationFunction[]
     >(AUTH_FUNCTION_KEY, [ctx.getClass(), ctx.getHandler()]);
     const mustBeAuthenticated = authFunctions.length > 0;
 
-    const request = ctx.switchToHttp().getRequest();
-    const accessToken = this.validateToken(request, mustBeAuthenticated);
-
     if (!mustBeAuthenticated) {
       // no need to be authenticated
       return true;
     }
 
+    const request = ctx.switchToHttp().getRequest();
+    const apiKey = request.get('X-api-key');
+    if (apiKey) {
+      const {
+        api_key
+      } = await this.apiKeyService.get(apiKey);
+
+      request.user = {
+        user_id: api_key.user_id,
+        username: api_key.username,
+        permissions: api_key.permissions,
+        customer_id: api_key.customer_id,
+        customer_name: api_key.customer_name,
+        customer_tier: api_key.customer_tier,
+        customer_modules: api_key.customer_modules,
+        access_token: apiKey,
+      };
+
+      return true;
+    }
+
+    const accessToken = this.validateToken(request, mustBeAuthenticated);
+
     if (!accessToken) {
       // couldn't load valid token
       throw new ErrorBuilder(ErrorCodes.AUTH.UNAUTHORIZED);
@@ -121,6 +143,7 @@ export class AuthenticationGuard
       customer_id: accessTokenPayload.customer_id,
       customer_name: accessTokenPayload.customer_name,
       customer_tier: accessTokenPayload.customer_tier,
+      customer_modules: accessTokenPayload.customer_modules,
       access_token: accessToken,
     };
     // TODO: for backwards compatibility. remove in the future

src/authentication/permissions.enum.ts

@@ -603,12 +603,36 @@ export const PERMISSIONS_GROUPS = {
     },
   },
 };
+
+export const PUBLIC_PERMISSIONS_SEQID = [
+  46, // AUTH.GENERATE_TOKEN
+  23, 13, 29, 5, // PIPELINE
+  37, 38, // CONNECTION
+  35, // NETWORK_CONFIG
+  7, 19, 25, 1, // CATALOG
+  14, // SNOWFLAKE
+  11, // DATAVIZ
+  31, // INTELLIGENCE
+  34, // USERS
+  43, // PROCESS
+  47  // CUSTOMER
+];
+
+
 export interface DadosferaModule {
   name: string;
   description: string;
   key: string;
   permissionSeqId: number;
 }
+
+export const DADOSFERA_MODULES_KEYS = {
+  LOG_DASHBOARD: 'logs-dashboard',
+  ACCESS_DASHBOARD: 'access-dashboard',
+  DANGER_ZONE: 'danger-zone',
+  PII: 'pii'
+}
+
 export const DADOSFERA_MODULES: Array<DadosferaModule> = [
   {
     name: 'Intelligence Module',

src/decorators/authentication.decorator.ts

@@ -25,6 +25,14 @@ export function RequireSomePermission(
   );
 }
 
+export function RequireModule(
+  key: string
+) {
+  return createAuthenticatedDecorator((_, user: RequestUser) =>
+    user.customer_modules.some(module => module === key),
+  );
+}
+
 export function AuthenticateCondition(func: AuthenticationFunction) {
   return createAuthenticatedDecorator(func);
 }

src/decorators/user.decorator.ts

@@ -11,6 +11,7 @@ export interface RequestUser {
   customer_name: string;
   customer_tier: string;
   access_token: string;
+  customer_modules: string[];
 }
 
 export const User: (options?: { required?: boolean }) => ParameterDecorator =

src/main.ts

@@ -3,6 +3,7 @@ import { NestFactory } from '@nestjs/core';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import helmet from 'helmet';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
+import { json, urlencoded } from 'express';
 
 import { AppModule } from './app.module';
 import { writeFileSync } from 'fs';
@@ -25,6 +26,11 @@ async function bootstrap() {
     },
   });
   app.use(helmet());
+  if (process.env.ENV === 'prd') {
+    app.use('/catalog/register-dataset', json({ limit: '10mb' }));
+    app.use('/catalog/register-dataset', urlencoded({ extended: true, limit: '10mb' }));
+  }
+
   configureSwagger(app);
   await app.listen(3333);
   if (process.env.KILL_AFTER_START) await app.close();

src/modules/api-key/api-key.controller.ts

@@ -0,0 +1,72 @@
+import { Controller, Get, Post, Body, Param, Delete, UseFilters, Inject } from '@nestjs/common';
+import { ApiKeyService } from './api-key.service';
+import { CreateApiKeyDto, CreateApiKeyResponseDto, ApiKeyBaseResponseDto } from './dto/api-key.dto';
+import { Authenticated, RequireAllPermissions } from 'src/decorators/authentication.decorator';
+import { ApiHeaders, ApiTags, ApiResponse } from '@nestjs/swagger';
+import { LanguageEnum } from 'src/utils/languages.enum';
+import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
+import { RequestUser, User } from 'src/decorators/user.decorator';
+import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
+import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+
+@Controller('api-key')
+@Authenticated()
+@ApiTags('ApiKey')
+@ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
+@UseFilters(new GrpcToHttpExceptionFilter())
+export class ApiKeyController {
+  logger: DadosferaLogger;
+
+  constructor(
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+    private readonly apiKeyService: ApiKeyService,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  @Post()
+  @ApiResponse({ type: CreateApiKeyResponseDto })
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  async create(@Body() createApiKeyDto: CreateApiKeyDto, @User() user: RequestUser): Promise<CreateApiKeyResponseDto> {
+    this.logger.info('POST /api-key', {
+      permissions: createApiKeyDto.permissions,
+      method: 'create'
+    });
+    const result = await this.apiKeyService.create(createApiKeyDto, user);
+    this.logger.info('POST /api-key success', { 
+      id: result.id,
+      method: 'create'
+    });
+    return result;
+  }
+
+  @Get()
+  @ApiResponse({ type: [ApiKeyBaseResponseDto] })
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  async findAll(@User() user: RequestUser): Promise<ApiKeyBaseResponseDto[]> {
+    this.logger.info('GET /api-key', {
+      method: 'findAll'
+    });
+    const result = await this.apiKeyService.findAll(user);
+    this.logger.info('GET /api-key success', { 
+      count: result.length,
+      method: 'findAll'
+    });
+    return result;
+  }
+
+  @Delete(':id')
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  async remove(@Param('id') id: string, @User() user: RequestUser): Promise<void> {
+    this.logger.info('DELETE /api-key/:id', { 
+      id,
+      method: 'remove'
+    });
+    await this.apiKeyService.remove(id, user);
+    this.logger.info('DELETE /api-key/:id success', { 
+      id,
+      method: 'remove'
+    });
+  }
+}

src/modules/api-key/api-key.module.ts

@@ -0,0 +1,18 @@
+import { Module } from '@nestjs/common';
+import { ApiKeyService } from './api-key.service';
+import { ApiKeyController } from './api-key.controller';
+import { ClientsModule } from '@nestjs/microservices';
+import { DucClient } from '../duc/client.config';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+
+const ducClient = new DucClient();
+
+@Module({
+  imports: [
+    ClientsModule.register([ducClient.providerOptions])
+  ],
+  controllers: [ApiKeyController],
+  providers: [ApiKeyService, DadosferaLogger],
+  exports: [ApiKeyService]
+})
+export class ApiKeyModule {}

src/modules/api-key/api-key.service.ts

@@ -0,0 +1,85 @@
+import {
+  Injectable,
+  Inject,
+  OnModuleInit,
+  BadRequestException,
+} from '@nestjs/common';
+import { ClientGrpc } from '@nestjs/microservices';
+import {
+  CreateApiKeyDto,
+  CreateApiKeyResponseDto,
+  ApiKeyBaseResponseDto,
+} from './dto/api-key.dto';
+import { RequestUser } from 'src/decorators/user.decorator';
+import { DucClient } from '../duc/client.config';
+import { PackTheMetadata } from '../../utils/ PackTheMetadata';
+import { ApiKeyWriteProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+import { lastValueFrom } from 'rxjs';
+import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
+import { PUBLIC_PERMISSIONS_SEQID } from 'src/authentication/permissions.enum';
+
+@Injectable()
+export class ApiKeyService implements OnModuleInit {
+  private apiKeyService: ApiKeyWriteProtoService;
+
+  constructor(
+    @Inject(DucClient.name) private readonly client: ClientGrpc
+  ) {}
+
+  onModuleInit() {
+    this.apiKeyService = this.client.getService<ApiKeyWriteProtoService>(
+      ProtoServices.ApiKeyWriteProtoService,
+    );
+  }
+
+  create(
+    createApiKeyDto: CreateApiKeyDto,
+    user: RequestUser,
+  ): Promise<CreateApiKeyResponseDto> {
+    const metadata = PackTheMetadata(user);
+
+    const invalidPermissions = [];
+    for (const permission of createApiKeyDto.permissions) {
+      if (!PUBLIC_PERMISSIONS_SEQID.includes(permission)) {
+        invalidPermissions.push(permission);
+      }
+    }
+
+    if (invalidPermissions.length > 0) {
+      throw new BadRequestException(
+        `Invalid permissions: ${invalidPermissions.join(', ')}`,
+      );
+    }
+
+    return lastValueFrom(
+      this.apiKeyService.CreateApiKey(
+        {
+          permissions: createApiKeyDto.permissions,
+        },
+        metadata,
+      ),
+    );
+  }
+
+  async findAll(user: RequestUser): Promise<ApiKeyBaseResponseDto[]> {
+    const metadata = PackTheMetadata(user);
+    console.log(metadata);
+
+    const data = await lastValueFrom(
+      this.apiKeyService.ListApiKeys({}, metadata),
+    );
+    return data.api_keys;
+  }
+
+  async remove(id: string, user: RequestUser) {
+    const metadata = PackTheMetadata(user);
+
+    await lastValueFrom(this.apiKeyService.DeleteApiKey({ id }, metadata));
+  }
+
+  async get(key: string) {
+    const metadata = PackTheMetadata({});
+
+    return await lastValueFrom(this.apiKeyService.GetApiKey({ key }, metadata));
+  }
+}

src/modules/api-key/dto/api-key.dto.ts

@@ -0,0 +1,39 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsArray, IsNumber } from 'class-validator';
+
+export class PermissionDto {
+  @ApiProperty({ type: Number })
+  id: number;
+
+  @ApiProperty({ type: String })
+  name: string;
+}
+
+export class ApiKeyBaseResponseDto {
+  @ApiProperty({ type: String, format: 'uuid' })
+  id: string;
+
+  @ApiProperty({ type: String })
+  key_mask: string;
+
+  @ApiProperty({ type: [PermissionDto] })
+  permissions: PermissionDto[];
+
+  @ApiProperty({ type: String, format: 'date-time' })
+  created_at: string;
+
+  @ApiProperty({ type: String })
+  created_by: string;
+}
+
+export class CreateApiKeyResponseDto extends ApiKeyBaseResponseDto {
+  @ApiProperty({ type: String })
+  key: string;
+}
+
+export class CreateApiKeyDto {
+  @ApiProperty({ type: [Number], description: 'Array of permission IDs' })
+  @IsArray()
+  @IsNumber({}, { each: true })
+  permissions: number[];
+} 

src/modules/auth/auth.controller.ts

@@ -43,6 +43,7 @@ import {
   AuthRefreshAccessTokenRes,
   AuthSignInReq,
   AuthSignInRes,
+  BulkEditRequest,
 } from './dtos/login';
 import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
 import { AuthGuard } from '@nestjs/passport';
@@ -85,9 +86,12 @@ export class AuthController {
   async signIn(
     @Body() { username, password, totp }: AuthSignInReq,
     @Language() language: LanguageEnum,
+    @Headers('origin') origin = '',
   ): Promise<AuthSignInRes> {
     this.logger.info('/auth - SignIn');
-    const metadata = PackTheMetadata({ language });
+    const frontHost = origin.replace(/^https?:\/\//, '');
+    const metadata = PackTheMetadata({ language, custom_host: frontHost });
+    this.logger.info('metadata: ' + JSON.stringify(metadata.toJSON()));
     return this.authClient.signIn({ username, password, totp }, metadata);
   }
 
@@ -97,13 +101,15 @@ export class AuthController {
   async refreshAccessToken(
     @Body() body: AuthRefreshAccessTokenReq,
     @Language() language: LanguageEnum,
+    @Headers('origin') origin: string,
   ) {
     this.logger.info('/auth - RefreshAccessToken');
     const { refreshToken, customerName: customer_name } = body;
-
+    const frontHost = origin.replace(/^https?:\/\//, '');
     const metadata = PackTheMetadata({
-      customer_name,
       language,
+      customer_name,
+      custom_host: frontHost,
     });
 
     return this.authClient.refreshAccessToken({ refreshToken }, metadata);
@@ -177,16 +183,23 @@ export class AuthController {
   @ApiInternalOnlyEndpoint()
   @Post('confirm-reset-password')
   @HttpCode(HttpStatus.OK)
-  async confirmResetPassword(@Body() body: AuthConfirmResetPasswordRequest) {
+  async confirmResetPassword(
+    @Body() body: AuthConfirmResetPasswordRequest,
+    @Headers('origin') origin: string,
+  ) {
     this.logger.info('/auth - confirm-reset-password');
-
+    const frontHost = origin.replace(/^https?:\/\//, '');
+    const metadata = PackTheMetadata({ custom_host: frontHost });
     const { username, code, newPassword } = body;
 
-    return this.authClient.confirmResetPassword({
-      username,
-      code,
-      newPassword,
-    });
+    return this.authClient.confirmResetPassword(
+      {
+        username,
+        code,
+        newPassword,
+      },
+      metadata,
+    );
   }
 
   @ApiInternalOnlyEndpoint()
@@ -344,4 +357,67 @@ export class AuthController {
 
     return { token, email, url, language };
   }
+
+  @ApiInternalOnlyEndpoint()
+  @Post('users/block')
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @HttpCode(HttpStatus.OK)
+  async blockUsers(
+    @Language() language: LanguageEnum,
+    @User() user: RequestUser,
+    @Body() body: BulkEditRequest,
+  ) {
+    this.logger.info('blockUsers - Starting request');
+
+    try {
+      const metadata = PackTheMetadata(user);
+
+      this.logger.debug('Calling blockUsers service', {
+        metadata: {
+          access_token: metadata.get('access_token'),
+          language: metadata.get('language'),
+        },
+      });
+
+      const result = await this.authClient.blockUsers(body.users, metadata);
+      this.logger.info('blockUsers - Success', { result });
+      return result;
+    } catch (error) {
+      this.logger.error('blockUsers - Error', {
+        error: error.message,
+        stack: error.stack,
+      });
+      throw error;
+    }
+  }
+
+  @ApiInternalOnlyEndpoint()
+  @Post('users/unblock')
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @HttpCode(HttpStatus.OK)
+  async unblockUsers(
+    @Language() language: LanguageEnum,
+    @User() user: RequestUser,
+    @Body() body: BulkEditRequest,
+  ) {
+    this.logger.info('unblockUsers');
+    const metadata = PackTheMetadata(user);
+
+    return this.authClient.unblockUsers(body.users, metadata);
+  }
+
+  @ApiInternalOnlyEndpoint()
+  @Post('users/reset')
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @HttpCode(HttpStatus.OK)
+  async resetUsers(
+    @Language() language: LanguageEnum,
+    @User() user: RequestUser,
+    @Body() body: BulkEditRequest,
+  ) {
+    this.logger.info('resetUsers');
+    const metadata = PackTheMetadata(user);
+
+    return this.authClient.resetUsers(body.users, metadata);
+  }
 }

src/modules/auth/auth.service.ts

@@ -20,6 +20,7 @@ import {
 } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/messages';
 import { DucClient } from '../duc/client.config';
 import { Metadata } from '@grpc/grpc-js';
+import { BulkEditResponse } from './dtos/login';
 
 @Injectable()
 export class AuthClientService implements OnModuleInit {
@@ -112,19 +113,21 @@ export class AuthClientService implements OnModuleInit {
     );
   }
 
-  async confirmResetPassword({
-    username,
-    code,
-    newPassword,
-  }: AuthConfirmResetPasswordRequest) {
+  async confirmResetPassword(
+    { username, code, newPassword }: AuthConfirmResetPasswordRequest,
+    metadata: Metadata,
+  ) {
     this.logger.info('confirmResetPassword');
 
     return lastValueFrom(
-      this.authService.AuthConfirmResetPassword({
-        username,
-        code,
-        newPassword,
-      }),
+      this.authService.AuthConfirmResetPassword(
+        {
+          username,
+          code,
+          newPassword,
+        },
+        metadata,
+      ),
     );
   }
 
@@ -168,4 +171,72 @@ export class AuthClientService implements OnModuleInit {
       this.authService.AuthOauthSignIn({ token, username, refreshToken: '' }),
     );
   }
+
+  async blockUsers(
+    users: string[],
+    metadata: Metadata,
+  ): Promise<BulkEditResponse> {
+    this.logger.info('blockUsers - Service starting');
+
+    try {
+      this.logger.debug('Calling BlockUser gRPC method', {
+        metadata: {
+          access_token: metadata.get('access_token'),
+          language: metadata.get('language'),
+        },
+      });
+
+      const response = await lastValueFrom<BulkEditResponse>(
+        this.authService.BlockUser({ users }, metadata),
+      );
+
+      this.logger.info('blockUsers - Service success', { response });
+      return response;
+    } catch (error) {
+      this.logger.error('blockUsers - Service error', {
+        error: error.message,
+        stack: error.stack,
+      });
+      throw error;
+    }
+  }
+
+  async unblockUsers(
+    users: string[],
+    metadata: Metadata,
+  ): Promise<BulkEditResponse> {
+    this.logger.info('unblockUsers');
+    return await lastValueFrom(
+      this.authService.UnblockUser({ users }, metadata),
+    );
+  }
+
+  async resetUsers(
+    users: string[],
+    metadata: Metadata,
+  ): Promise<BulkEditResponse> {
+    this.logger.info('resetUsers');
+
+    try {
+      this.logger.debug('Calling ResetUser gRPC method', {
+        metadata: {
+          access_token: metadata.get('access_token'),
+          language: metadata.get('language'),
+        },
+      });
+
+      const response = await lastValueFrom<BulkEditResponse>(
+        this.authService.ResetUser({ users }, metadata),
+      );
+
+      this.logger.info('resetUsers - Success', { response });
+      return response;
+    } catch (error) {
+      this.logger.error('resetUsers - Error', {
+        error: error.message,
+        stack: error.stack,
+      });
+      throw error;
+    }
+  }
 }

src/modules/auth/dtos/login.ts

@@ -67,20 +67,28 @@ export class AuthUser {
 export class AuthCustomer {
   @ApiProperty()
   modules: string[];
+
   @ApiProperty()
   id: string;
+
   @ApiProperty()
   name: string;
+
   @ApiProperty()
   displayName: string;
   @ApiProperty()
   tier: string;
+
   @ApiProperty()
   scheduleLimit: string;
+
   @ApiProperty()
   links: Link[];
+
   @ApiProperty()
   themeEnabled: boolean;
+  @ApiProperty()
+  enforceMfa: boolean;
 }
 
 export class AuthSignInReq implements AuthSignInRequest {
@@ -122,3 +130,13 @@ export class AuthRefreshAccessTokenRes {
   @ApiProperty()
   accessToken: string;
 }
+
+export interface BulkEditRequest {
+  users: string[];
+}
+
+export interface BulkEditResponse {
+  message: string;
+  successfulUsers: string[];
+  failedUsers: string[];
+}

src/modules/catalog/catalog.controller.ts

@@ -15,6 +15,7 @@ import {
   UseFilters,
   HttpException,
   HttpStatus,
+  Res,
 } from '@nestjs/common';
 import {
   ApiCreatedResponse,
@@ -25,14 +26,14 @@ import {
 import {
   Authenticated,
   RequireAllPermissions,
+  RequireModule,
   RequireSomePermission,
 } from '../../decorators/authentication.decorator';
-import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
+import { DADOSFERA_MODULES_KEYS, PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { CatalogService } from './catalog.service';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
 import { RequestUser, User } from 'src/decorators/user.decorator';
-import { lastValueFrom } from 'rxjs';
 import {
   BatchRemoveRlsRulesRequest,
   GetDatasetCatalogTaskRes,
@@ -59,6 +60,8 @@ import {
   GetRlsRulesRequest,
   RegisterDatasetWithMetatadaRequest,
 } from '@dadosfera/protospack-v2/dist/lib/Catalog/interfaces/messages';
+import { Response } from 'express';
+import { TypeParser } from 'src/utils/FileParser/parser-types';
 
 @ApiTags('Catalog')
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
@@ -344,7 +347,7 @@ export class CatalogController {
     @Language() language: LanguageEnum,
     @Param('id') id: string,
   ): Promise<IPreviewResponse> {
-    const { customer_name, customer_id, user_id, username } = user;
+    const { customer_name, customer_id, user_id, username, customer_modules } = user;
 
     this.logger.info(`/catalog - ON GET DATA DOCS ROUTE`, {
       user_id,
@@ -357,6 +360,7 @@ export class CatalogController {
       user_id,
       username,
       language,
+      is_mask: customer_modules.some(mod => mod === 'pii')
     });
 
     const preview = await this.catalogService.getDatasetPreview(id, metadata);
@@ -748,25 +752,23 @@ export class CatalogController {
     return JSON.parse(dashboards);
   }
 
-
   @Post('register-dataset')
   @RequireSomePermission(
     PERMISSIONS_GROUPS.CATALOG.permissions.CREATE,
-    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
   )
   async registerDatasetWithMetadataRequest(
     @Body() body: RegisterDatasetWithMetatadaRequest,
     @User() user: RequestUser,
   ) {
-      const { customer_id, customer_name, user_id, username } = user;
-      const logMetadata = {
-        customer_name: customer_name,
-        user_id: user_id,
-        method: 'POST',
-        path: '/catalog/register-dataset',
-      };
+    const { customer_id, customer_name, user_id, username } = user;
+    const logMetadata = {
+      customer_name: customer_name,
+      user_id: user_id,
+      method: 'POST',
+      path: '/catalog/register-dataset',
+    };
     try {
-
       const metadata = PackTheMetadata({
         customer_id,
         customer_name,
@@ -774,18 +776,20 @@ export class CatalogController {
         username,
       });
 
-      this.logger.log(`Request from user ${user_id} for customer ${customer_name}`, logMetadata);
+      this.logger.log(
+        `Request from user ${user_id} for customer ${customer_name}`,
+        logMetadata,
+      );
 
       // Create table metadata
       const tableMetadataBody = {
         table_metadata: body.table_metadata,
         info: {
           customer: customer_name,
-          
         },
-        logMetadata: logMetadata
+        logMetadata: logMetadata,
       };
-      
+
       const table_metadata_id = await this.catalogService.createTableMetadata(
         tableMetadataBody,
       );
@@ -798,8 +802,12 @@ export class CatalogController {
           customer: customer_name,
         },
       };
-      this.logger.info(`Creating column metadata for table ${table_metadata_id}`, logMetadata);
-      const column_metadata_ids = await this.catalogService.createColumnMetadata(columnMetadataBody)
+      this.logger.info(
+        `Creating column metadata for table ${table_metadata_id}`,
+        logMetadata,
+      );
+      const column_metadata_ids =
+        await this.catalogService.createColumnMetadata(columnMetadataBody);
 
       // Create data preview
       const dataPreviewBody = {
@@ -808,15 +816,24 @@ export class CatalogController {
           customer: customer_name,
         },
       };
-      this.logger.debug(`Creating data preview for table ${table_metadata_id}`, logMetadata);
+      this.logger.debug(
+        `Creating data preview for table ${table_metadata_id}`,
+        logMetadata,
+      );
       const data_preview_id = await this.catalogService.createDataPreview(
         dataPreviewBody,
       );
 
       // Catalog dataset item
-      this.logger.info(`Cataloging dataset item for table ${table_metadata_id}`, logMetadata);
+      this.logger.info(
+        `Cataloging dataset item for table ${table_metadata_id}`,
+        logMetadata,
+      );
       await this.catalogService.catalogDatasetItem(table_metadata_id, metadata);
-      this.logger.info(`Dataset registration completed successfully for table ${table_metadata_id}`, logMetadata);
+      this.logger.info(
+        `Dataset registration completed successfully for table ${table_metadata_id}`,
+        logMetadata,
+      );
       return {
         message: 'Dataset registered successfully',
         table_metadata_id: table_metadata_id,
@@ -824,7 +841,10 @@ export class CatalogController {
         data_preview_id: data_preview_id,
       };
     } catch (error) {
-      this.logger.error(`Failed to register dataset. The following error occurred: ${error.response.data}`, logMetadata);
+      this.logger.error(
+        `Failed to register dataset. The following error occurred: ${error.response.data}`,
+        logMetadata,
+      );
 
       throw new HttpException(
         {
@@ -837,4 +857,32 @@ export class CatalogController {
       );
     }
   }
+
+  @Get('pii-reporter')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.USERS.permissions.ADMIN
+  )
+  @RequireModule(
+    DADOSFERA_MODULES_KEYS.PII
+  )
+  async getPiiReporter(@User() user: RequestUser, @Res() res: Response, @Query('type') contentType: TypeParser = "pdf") {
+    this.logger.info('GET pii-reporter');
+    const metadata = PackTheMetadata(user);
+
+    try {
+      const {
+        file,
+        filename,
+        type
+      } = await this.catalogService.getPiiReporter(metadata, contentType);
+      res.setHeader('Content-Disposition', `attachment; filename="${filename}"`);
+      res.setHeader('Content-Type', type);
+
+      // use res.end to send buffer
+      return res.end(file);
+    } catch (error) {
+      console.error(error)
+      this.logger.error(error.message);
+    }
+  }
 }

src/modules/catalog/catalog.service.ts

@@ -33,7 +33,16 @@ import {
   AddRlsRuleRequest,
   GetNimbusDashboardsRequest,
   GetRlsRulesRequest,
+  PiiMetadata,
 } from '@dadosfera/protospack-v2/dist/lib/Catalog/interfaces/messages';
+import { writeFileSync } from 'fs';
+import path from 'path';
+import { HtmlParser } from 'src/utils/FileParser/html-parser';
+import { PiiDto } from './dtos/pii.dto';
+import { CsvParser } from 'src/utils/FileParser/csv-parser';
+import { PDFParser } from 'src/utils/FileParser/pdf-parser';
+import { TypeParser } from 'src/utils/FileParser/parser-types';
+import { ParserBuilder } from 'src/utils/FileParser/parser.builder';
 
 class CatalogService implements OnModuleInit {
   catalogReadService: ReadService.CatalogReadServices;
@@ -80,6 +89,42 @@ class CatalogService implements OnModuleInit {
     )}.dadosfera.ai`;
   }
 
+  async getPiiReporter(metadata: Metadata, type: TypeParser) {
+    this.logger.info('getPiiReporter: ' + type)
+    try {
+      const {
+        data
+      } = await lastValueFrom(
+        this.catalogWriteService.GetPiiReporter({}, metadata)
+      )
+      this.logger.info("Finish grpc call")
+
+      const parser = ParserBuilder.build<PiiMetadata>(type);
+
+      this.logger.info('parser file to: ' + type)
+      const file = await parser.parse(data)
+      this.logger.info('finish parser')
+      const mimeTypes: Record<TypeParser, string> = {
+        'csv': 'text/csv',
+        'html': 'text/html',
+        'pdf': 'application/pdf'
+      }
+
+      const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+      const filename = `relatorio-pii-${timestamp}.${type}`;
+
+      return {
+        file,
+        filename: filename,
+        type: mimeTypes[type]
+      }
+    } catch (error) {
+      this.logger.error(error.message);
+      throw error;
+    }
+
+  }
+
   async createDataAsset(data: Messages.CreateDataAssetRequest, metadata) {
     this.logger.info('CatalogService - Manage Data assets permissions');
     if (!data.embed) data.embed = undefined;

src/modules/catalog/dtos/pii.dto.ts

@@ -0,0 +1,8 @@
+export class PiiDto {
+  database_name: string;
+  table_schema: string;
+  table_name: string;
+  column_name: string;
+  data_type: string;
+  pii_rules: string;
+}

src/modules/customers/customers.controller.ts

@@ -7,15 +7,18 @@ import {
   HttpStatus,
   Inject,
   Param,
+  Post,
   Put,
   Query,
   UseFilters,
 } from '@nestjs/common';
 import { ApiOkResponse, ApiProduces, ApiTags } from '@nestjs/swagger';
-import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+import { DADOSFERA_MODULES_KEYS, PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
 import {
   Authenticated,
   RequireAllPermissions,
+  RequireModule,
+  RequireSomePermission,
 } from 'src/decorators/authentication.decorator';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
 import { CustomersService } from './customers.service';
@@ -23,6 +26,7 @@ import { CustomerLinkRequest, CustomerLinksResponse } from './dtos/customers';
 import { RequestUser, User } from 'src/decorators/user.decorator';
 import type { StringValue } from 'ms';
 import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+import { EnforceMfa } from './dtos/enforce-mfa';
 
 @ApiTags('Customers')
 @Controller('customers')
@@ -38,6 +42,15 @@ export class CustomersController {
     this.logger = dadosferaLogger.logger;
   }
 
+  @Post(':id/mfa')
+  @Authenticated()
+  @RequireSomePermission(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @RequireModule(DADOSFERA_MODULES_KEYS.DANGER_ZONE)
+  async enableMfaEnforce(@Param('id') id: string, @Body() data: EnforceMfa) {
+    this.logger.info('enableMfaEnforce', { id });
+    return await this.customersService.enableEnforceMfa(id, data.enabled);
+  }
+
   @Get(':id/links')
   @Authenticated()
   @ApiOkResponse({ type: CustomerLinksResponse })
@@ -91,4 +104,36 @@ export class CustomersController {
     const metadata = PackTheMetadata(user);
     return this.customersService.getMonitoringDashboardUrl(metadata);
   }
+
+  @Get('logs-dashboard')
+  @Authenticated()
+  @RequireAllPermissions(
+    PERMISSIONS_GROUPS.USERS.permissions.ADMIN,
+  )
+  @RequireModule(DADOSFERA_MODULES_KEYS.LOG_DASHBOARD)
+  async getCustomerMixPanelLogsDashboard(
+    @User() user: RequestUser,
+  ): Promise<{ url: string }> {
+    this.logger.info('getLogsDashboardUrl');
+    const metadata = PackTheMetadata(user);
+  
+    const result = await this.customersService.getLogsDashboardUrl(metadata);
+    return result;
+  }
+
+  @Get('access-dashboard')
+  @Authenticated()
+  @RequireAllPermissions(
+    PERMISSIONS_GROUPS.USERS.permissions.ADMIN,
+  )
+  @RequireModule(DADOSFERA_MODULES_KEYS.ACCESS_DASHBOARD)
+  async getAccessDashboard(
+    @User() user: RequestUser,
+  ): Promise<{ url: string }> {
+    this.logger.info('getAccessDashboard');
+    const metadata = PackTheMetadata(user);
+  
+    const result = await this.customersService.getAccessDashboardUrl(user.customer_name, metadata);
+    return result;
+  }
 }

src/modules/customers/customers.service.ts

@@ -5,6 +5,7 @@ import {
   HttpException,
   HttpStatus,
   InternalServerErrorException,
+  ForbiddenException,
 } from '@nestjs/common';
 
 import { firstValueFrom, lastValueFrom } from 'rxjs';
@@ -33,6 +34,7 @@ import DadosferaLogger from '@dadosfera/dadosfera-logs';
 // This function will accept any string, which may result in a bug.
 @Injectable()
 export class CustomersService implements OnModuleInit {
+
   private customerService: CustomersProtoService;
   private logger: DadosferaLogger;
   private pipelineReadService: ReadService.PipelineV2ReadService;
@@ -156,4 +158,59 @@ export class CustomersService implements OnModuleInit {
 
     return res;
   }
+  async getLogsDashboardUrl(metadata: Metadata) {
+    logger.info('CustomersService - getMixPanelLogsDashboardUrl');
+  
+    const res = await lastValueFrom(
+      this.pipelineReadService.PipelineV2GetDashboardUrl(
+        {
+          dashboard_id: '103',
+          exp: '15m',
+          metabase_customer_name: 'dadosferatech',
+        },
+        metadata,
+      ),
+    );
+    logger.info('Done');
+  
+    return res;
+  }
+
+  async getAccessDashboardUrl(customerName: string, metadata: Metadata) {
+    /*
+     * TODO(Refactor): dar um jeito de exibir o dash da sbm diferente dos outros customer
+     * pois o signicado de department para sbm significa as instituições do usuários
+     */
+    if (customerName !== 'sbmoffshorecom') {
+      throw new ForbiddenException();
+    }
+    logger.info('CustomersService - getAccessDashboardUrl');
+  
+    const res = await this.getDashboardUrl('105', metadata);
+    logger.info('Done');
+  
+    return res;
+  }
+
+  private async getDashboardUrl(dashboardId: string, metadata: Metadata) {
+    return await lastValueFrom(
+      this.pipelineReadService.PipelineV2GetDashboardUrl(
+        {
+          dashboard_id: dashboardId,
+          exp: '15m',
+          metabase_customer_name: 'dadosferatech',
+        },
+        metadata
+      )
+    );
+  }
+
+  async enableEnforceMfa(id: string, enabled: boolean) {
+    return await lastValueFrom(
+      this.customerService.CustomerUpdateEnforceMfa({
+        customerId: id,
+        enforceMfa: enabled
+      })
+    )
+  }
 }

src/modules/customers/dtos/enforce-mfa.ts

@@ -0,0 +1,6 @@
+import { ApiProperty } from "@nestjs/swagger";
+
+export class EnforceMfa {
+    @ApiProperty()
+    enabled: boolean
+}

src/modules/mixpanel/mixpanel.controller.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Inject, Param, Post } from '@nestjs/common';
+import { Body, Controller, Inject, Param, Post, Req } from '@nestjs/common';
 import { init } from 'mixpanel';
 import { Authenticated } from 'src/decorators/authentication.decorator';
 import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
@@ -13,7 +13,12 @@ export class MixpanelController {
     private readonly mixpanelToken: string,
   ) {}
   @Post(':id')
-  async trackEvent(@Param('id') id, @Body() body, @User() user: RequestUser) {
+  async trackEvent(
+    @Param('id') id,
+    @Body() body,
+    @User() user: RequestUser,
+    @Req() request
+  ) {
     delete body.info;
     const mixpanel = init(this.mixpanelToken);
 
@@ -66,13 +71,16 @@ export class MixpanelController {
       $email: user.username.includes('@')
         ? user.username
         : user.username + '@dadosfera.ai',
-      customer_name: user.customer_name,
+      customer_name: user.customer_name
     });
 
     await mixpanel.track(id, {
       distinct_id: user.username,
       customer: user.customer_name,
       env: process.env.ENV,
+      $ip: request.ip,
+      $os: request.headers['sec-ch-ua-platform'] || '',
+      $browser: request.headers['user-agent'],
       ...body,
     });
 

src/modules/network-policy/dto/network-policy.dto.ts

@@ -0,0 +1,6 @@
+import { ApiProperty } from "@nestjs/swagger";
+
+export class NetworkPoliciesDTO {
+    @ApiProperty()
+    policies: string []
+}

src/modules/network-policy/network-policy.controller.ts

@@ -0,0 +1,64 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Post } from '@nestjs/common';
+import { ApiOkResponse } from '@nestjs/swagger';
+import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+import {
+  Authenticated,
+  RequireAllPermissions,
+} from 'src/decorators/authentication.decorator';
+import { NetworkPoliciesDTO } from './dto/network-policy.dto';
+import { RequestUser, User } from 'src/decorators/user.decorator';
+import { NetworkPolicyService } from './network-policy.service';
+import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
+
+@Controller('network-policy')
+export class NetworkPolicyController {
+  constructor(private networkPolicyService: NetworkPolicyService) {}
+
+  @Get()
+  @Authenticated()
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @HttpCode(HttpStatus.OK)
+  async getNetworks(
+    @User() user: RequestUser,
+  ) {
+    return await this.networkPolicyService.getByCustomer(
+      user.customer_id
+    );
+  }
+
+  @Post()
+  @Authenticated()
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @ApiOkResponse()
+  @HttpCode(HttpStatus.CREATED)
+  async applyNetworkPolicies(
+    @User() user: RequestUser,
+    @Body() data: NetworkPoliciesDTO,
+  ) {
+    const metadata = PackTheMetadata(user);
+
+    return await this.networkPolicyService.apply(
+      data.policies,
+      user.customer_id,
+      metadata,
+    );
+  }
+
+  @Delete()
+  @Authenticated()
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
+  @ApiOkResponse()
+  @HttpCode(HttpStatus.OK)
+  async removeNetworkPolicies(
+    @User() user: RequestUser,
+    @Body() data: NetworkPoliciesDTO,
+  ) {
+    const metadata = PackTheMetadata(user);
+
+    return await this.networkPolicyService.delete(
+      data.policies,
+      user.customer_id,
+      metadata,
+    );
+  }
+}

src/modules/network-policy/network-policy.module.ts

@@ -0,0 +1,19 @@
+import { Module } from '@nestjs/common';
+import { NetworkPolicyController } from './network-policy.controller';
+import { NetworkPolicyService } from './network-policy.service';
+import { ClientsModule } from '@nestjs/microservices';
+import { DucClient } from '../duc/client.config';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+
+const ducClient = new DucClient();
+
+@Module({
+  imports: [
+    ClientsModule.register([
+      ducClient.providerOptions
+    ]),
+  ],
+  controllers: [NetworkPolicyController],
+  providers: [NetworkPolicyService, DadosferaLogger]
+})
+export class NetworkPolicyModule {}

src/modules/network-policy/network-policy.service.ts

@@ -0,0 +1,74 @@
+import { Inject, Injectable } from '@nestjs/common';
+import { DucClient } from '../duc/client.config';
+import { ClientGrpc } from '@nestjs/microservices';
+import DadosferaLogger from '@dadosfera/dadosfera-logs';
+import { CustomersProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
+import { Metadata } from '@grpc/grpc-js';
+import { lastValueFrom } from 'rxjs';
+import { NetworkPoliciesDTO } from './dto/network-policy.dto';
+
+
+@Injectable()
+export class NetworkPolicyService {
+  private customerService: CustomersProtoService;
+  private logger: DadosferaLogger;
+
+  constructor(
+    @Inject(DucClient.name) private readonly grpcClient: ClientGrpc,
+    @Inject(DadosferaLogger)
+    dadosferaLogger: DadosferaLogger,
+  ) {
+    this.logger = dadosferaLogger.logger;
+  }
+
+  onModuleInit() {
+    this.customerService = this.grpcClient.getService<CustomersProtoService>(
+      ProtoServices.CustomersProtoService,
+    );
+  }
+
+  async getByCustomer(id: string): Promise<NetworkPoliciesDTO> {
+    const {
+      customer
+    } = await lastValueFrom(this.customerService.CustomerFindOneById({
+      id
+    }));
+
+    return {
+      policies: customer.networkPolicies
+    }
+  }
+
+  async apply(
+    networkPolicies: string[],
+    customerId: string,
+    metadata: Metadata,
+  ) {
+    return await lastValueFrom(
+      this.customerService.CustomerCreateNetworkPolicy(
+        {
+          customerId,
+          networkPolicies,
+        },
+        metadata,
+      ),
+    );
+  }
+
+  async delete(
+    networkPolicies: string[],
+    customerId: string,
+    metadata: Metadata,
+  ) {
+    return await lastValueFrom(
+      this.customerService.CustomerRemoveNetworkPolicy(
+        {
+          customerId,
+          networkPolicies,
+        },
+        metadata,
+      ),
+    );
+  }
+}

src/modules/roles/roles.service.ts

@@ -20,6 +20,7 @@ import { PermissionsService } from '../permissions/permissions.service';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { RequestUser } from 'src/decorators/user.decorator';
 import { DucClient } from '../duc/client.config';
+import { PUBLIC_PERMISSIONS_SEQID } from 'src/authentication/permissions.enum';
 
 interface GetRolesPermissionsName {
   id: string;
@@ -103,6 +104,20 @@ export class RolesService {
     const meta = new Metadata();
     meta.add('access_token', access_token);
     const { description, name, permissionIds, userIds } = data;
+
+    const invalidPermissions = [];
+    for (const permission of permissionIds) {
+      if (!PUBLIC_PERMISSIONS_SEQID.includes(permission)) {
+        invalidPermissions.push(permission);
+      }
+    }
+
+    if (invalidPermissions.length > 0) {
+      throw new BadRequestException(
+        `Invalid permissions: ${invalidPermissions.join(', ')}`,
+      );
+    }
+
     const role = await lastValueFrom(
       this.rolesClientService.RoleCreate(
         {

src/utils/ PackTheMetadata.ts

@@ -11,6 +11,10 @@ interface IMetadata {
   roles?: string[];
   is_data_manager?: boolean;
   access_token?: string;
+  host?: string;
+  origin?: string;
+  custom_host?: string;
+  is_mask?: boolean;
 }
 
 export function PackTheMetadata(info: IMetadata): Metadata {

src/utils/ErrorBuilder.ts

@@ -77,6 +77,13 @@ export function EnrichErrorCode(code: string) {
         message: 'Token para recuperar senha inválido',
         code,
       };
+    case ErrorCodes.AUTH.REQUIRED_PASSWORD_RESET:
+      return {
+        statusCode: HttpStatus.UNAUTHORIZED,
+        error: 'Não permitido',
+        message: 'Seu usuário foi resetado por um administrador, resete a senha pelo link "Esqueci a senha", para prosseguir',
+        code,
+      };
 
     case ErrorCodes.AUTH.WEAK_NEW_PASSWORD:
       return {

src/utils/FileParser/csv-parser.ts

@@ -0,0 +1,14 @@
+import { stringify } from 'csv'
+import { Parser } from './parser.interface';
+
+export class CsvParser<T> implements Parser<T>{
+  async parse(data: T[]) {
+    return new Promise<string>((resolve, reject) => {
+      stringify(data, { header: true }, function (err, output) {
+        if (err) reject(err);
+  
+        resolve(output)
+      });
+    })
+  }
+}

src/utils/FileParser/html-parser.ts

@@ -0,0 +1,17 @@
+import { readFileSync } from 'fs';
+import Handlebars from 'handlebars';
+import { Parser } from './parser.interface';
+
+export class HtmlParser<T> implements Parser<T> {
+  constructor(private readonly templatePath: string) {}
+  async parse(data: T[]) {
+    const templateSource = readFileSync(this.templatePath, 'utf8');
+
+    const template = Handlebars.compile(templateSource);
+
+    return template({
+      dados: data,
+      dataGeracao: new Date().toLocaleString('pt-BR'),
+    });
+  }
+}

src/utils/FileParser/parser-types.ts

@@ -0,0 +1 @@
+export type TypeParser =  "html" | "csv" | "pdf"

src/utils/FileParser/parser.builder.ts

@@ -0,0 +1,25 @@
+import { TypeParser } from './parser-types';
+import { HtmlParser } from './html-parser';
+import { CsvParser } from './csv-parser';
+import { PDFParser } from './pdf-parser';
+import { Parser } from './parser.interface';
+
+export class ParserBuilder {
+  static build<T>(type: TypeParser): Parser<T> {
+    const templatePath = '/app/dist/assets/template/pii-reporter.html';
+
+    if (type === 'html') {
+      const htmlParser = new HtmlParser<T>(templatePath);
+      return htmlParser;
+    } else if (type === 'csv') {
+      const csvParser = new CsvParser<T>();
+      return csvParser;
+    } else if (type === 'pdf') {
+      const htmlParser = new HtmlParser<T>(templatePath);
+      const pdfParser = new PDFParser(htmlParser);
+      return pdfParser;
+    }
+
+    throw new Error('Unsupported Type: ' + type);
+  }
+}

src/utils/FileParser/parser.interface.ts

@@ -0,0 +1,3 @@
+export interface Parser<T> {
+    parse(data: T[]): Promise<string | Buffer>
+}

src/utils/FileParser/pdf-parser.ts

@@ -0,0 +1,57 @@
+import puppeteer from 'puppeteer';
+import { Parser } from './parser.interface';
+import { HtmlParser } from './html-parser';
+
+export class PDFParser<T> implements Parser<T> {
+  constructor(private htmlParser: HtmlParser<T>) {}
+
+  async parse(data: T[]) {
+    try {
+      const browser = await puppeteer.launch({
+        executablePath: process.env.PUPPETEER_EXECUTABLE_PATH,
+        args: [
+          '--no-sandbox',
+          '--disable-setuid-sandbox',
+          '--disable-dev-shm-usage',
+        ],
+      });
+
+      const page = await browser.newPage();
+      page.setDefaultNavigationTimeout(0);
+
+      const html = await this.htmlParser.parse(data);
+      await page.setContent(html, {
+        waitUntil: 'networkidle0',
+        timeout: 30000,
+      });
+
+      // Configurações adicionais para garantir um PDF válido
+      const pdf = await page.pdf({
+        format: 'A4',
+        printBackground: true,
+        margin: {
+          top: '20mm',
+          right: '15mm',
+          bottom: '20mm',
+          left: '15mm',
+        },
+        preferCSSPageSize: true,
+        displayHeaderFooter: false,
+        headerTemplate: '',
+        footerTemplate: '',
+        omitBackground: false,
+        pageRanges: '',
+        tagged: true,
+        outline: false,
+        timeout: 30000,
+      });
+
+      await browser.close();
+
+      return Buffer.from(pdf);
+    } catch (error) {
+      console.error('Error generating PDF:', error);
+      throw error;
+    }
+  }
+}

src/utils/errorCodes.ts

@@ -13,6 +13,7 @@ export const AUTH = {
   RESET_PASSWORD_CODE_EXPIRED: 'AUTH.RESET_PASSWORD_CODE_EXPIRED',
   RESET_PASSWORD_CODE_INVALID: 'AUTH.RESET_PASSWORD_CODE_INVALID',
   WEAK_NEW_PASSWORD: 'AUTH.WEAK_NEW_PASSWORD',
+  REQUIRED_PASSWORD_RESET: 'AUTH.REQUIRED_PASSWORD_RESET'
 };
 export const ROLE = {
   INVALID_ID: 'ROLE.INVALID_ID',