Merge pull request #155 from dadosfera/fix/user-permissions

FIX: permissions array on user findOneById

src/modules/auth/auth.controller.ts

@@ -27,6 +27,7 @@ import { AuthClientService } from './auth.service';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { GrpcToHttpExceptionFilter } from '../../error/grpc-to-http-exception.filter';
 import { RequestUser, User } from 'src/authentication/user.decorator';
+import { Metadata } from '@grpc/grpc-js';
 
 @ApiTags('Auth')
 @UseFilters(new GrpcToHttpExceptionFilter())
@@ -59,20 +60,27 @@ export class AuthController {
 
   @Post('sign-in')
   @HttpCode(HttpStatus.OK)
-  async signIn(@Body() { username, password, totp }: AuthSignInRequest) {
+  async signIn(
+    @Body() { username, password, totp }: AuthSignInRequest,
+    @Headers('Dadosfera-Lang') language: string,
+  ) {
     this.logger.info('/auth - SignIn');
-
-    return this.authClient.signIn({ username, password, totp });
+    const metadata = new Metadata();
+    metadata.add('language', language || 'pt-br');
+    return this.authClient.signIn({ username, password, totp }, metadata);
   }
 
   @Post('refresh-access-token')
   @HttpCode(HttpStatus.OK)
   async refreshAccessToken(
     @Body() { refreshToken }: AuthRefreshAccessTokenRequest,
+    @Headers('Dadosfera-Lang') language: string,
   ) {
     this.logger.info('/auth - RefreshAccessToken');
+    const metadata = new Metadata();
+    metadata.add('language', language || 'pt-br');
 
-    return this.authClient.refreshAccessToken({ refreshToken });
+    return this.authClient.refreshAccessToken({ refreshToken }, metadata);
   }
 
   @Post('change-password')

src/modules/auth/auth.service.ts

@@ -19,6 +19,7 @@ import {
   AuthConfirmResetPasswordRequest,
 } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/messages';
 import { DucClient } from '../duc/client.config';
+import { Metadata } from '@grpc/grpc-js';
 
 @Injectable()
 export class AuthClientService implements OnModuleInit {
@@ -51,19 +52,25 @@ export class AuthClientService implements OnModuleInit {
     return lastValueFrom(this.authService.AuthSnowflakeSignIn(input));
   }
 
-  async signIn({ username, password, totp }: AuthSignInRequest) {
+  async signIn(
+    { username, password, totp }: AuthSignInRequest,
+    metadata: Metadata,
+  ) {
     this.logger.info('SignIn');
 
     return lastValueFrom(
-      this.authService.AuthSignIn({ username, password, totp }),
+      this.authService.AuthSignIn({ username, password, totp }, metadata),
     );
   }
 
-  async refreshAccessToken({ refreshToken }: AuthRefreshAccessTokenRequest) {
+  async refreshAccessToken(
+    { refreshToken }: AuthRefreshAccessTokenRequest,
+    metadata: Metadata,
+  ) {
     this.logger.info('RefreshAccessToken');
 
     return lastValueFrom(
-      this.authService.AuthRefreshAccessToken({ refreshToken }),
+      this.authService.AuthRefreshAccessToken({ refreshToken }, metadata),
     );
   }
 

src/modules/catalog/catalog.service.ts

@@ -407,7 +407,7 @@ class CatalogService implements OnModuleInit {
   }
 
   async createDataDescription(body, metadata) {
-    const response = await lastValueFrom(
+    await lastValueFrom(
       this.catalogWriteService.UpdateDataAsset(
         {
           id: `dataset-${body.table_id}`,

src/modules/oauth/oauth.controller.ts

@@ -5,9 +5,7 @@ import { ConnectionClientService } from '../connection/client.service';
 import jwt from 'jsonwebtoken';
 import DadosferaLogger from '@dadosfera/dadosfera-logs/dist';
 import { PackTheMetadata } from 'src/utils/ PackTheMetadata';
-import { Authenticated } from 'src/authentication/authentication.decorator';
 @ApiTags('oauth')
-@Authenticated()
 @Controller('oauth')
 export class OauthController {
   redirectUrl: string;

src/modules/termsOfUse/termsOfUse.controller.ts

@@ -17,6 +17,7 @@ import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 
 import { GrpcToHttpExceptionFilter } from '../../error/grpc-to-http-exception.filter';
 import { RequestUser, User } from '../../authentication/user.decorator';
+import { Metadata } from '@grpc/grpc-js';
 
 @ApiTags('TermsOfUse')
 @UseFilters(new GrpcToHttpExceptionFilter())
@@ -33,10 +34,15 @@ export class TermsOfUseController {
   }
 
   @Get('token')
-  async getToken(@User({ required: true }) user: RequestUser) {
+  async getToken(
+    @User({ required: true }) user: RequestUser,
+    @Headers('Dadosfera-Lang') language: string,
+  ) {
     this.logger.info('/terms-of-use - get token');
+    const metadata = new Metadata();
+    metadata.add('language', language || 'pt-br');
 
-    return this.termsOfUseClient.getToken({ userId: user.user_id });
+    return this.termsOfUseClient.getToken({ userId: user.user_id }, metadata);
   }
 
   @Post('accept')

src/modules/termsOfUse/termsOfUse.service.ts

@@ -10,6 +10,7 @@ import {
   TermsOfUseAcceptRequest,
 } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/messages';
 import { DucClient } from '../duc/client.config';
+import { Metadata } from '@grpc/grpc-js';
 
 @Injectable()
 export class TermsOfUseClientService implements OnModuleInit {
@@ -31,8 +32,10 @@ export class TermsOfUseClientService implements OnModuleInit {
       );
   }
 
-  async getToken(data: TermsOfUseGetTokenRequest) {
-    return lastValueFrom(this.termsOfUseService.TermsOfUseGetToken(data));
+  async getToken(data: TermsOfUseGetTokenRequest, metadata: Metadata) {
+    return lastValueFrom(
+      this.termsOfUseService.TermsOfUseGetToken(data, metadata),
+    );
   }
 
   async accept(data: TermsOfUseAcceptRequest) {

src/modules/users/dtos/entities.ts

@@ -55,7 +55,10 @@ export class UserNoRoles extends OmitType(User, ['roles']) {}
 export class UserNoRolesAndCustomer extends OmitType(UserNoRoles, [
   'customer',
 ]) {}
-export class UserByCustomer extends OmitType(User, ['customer']) {}
+export class IUserByCustomer extends OmitType(User, ['customer']) {
+  @ApiPropertyOptional()
+  permissions?: string[];
+}
 
 export class CreateUserReq {
   @ApiPropertyOptional()
@@ -111,11 +114,11 @@ export class UpdateUserReq {
 
 export class UpdateUserRes {
   @ApiProperty()
-  user: UserByCustomer;
+  user: IUserByCustomer;
 }
 export class GetAllUsersByCustomerIdRes {
-  @ApiProperty({ type: [UserByCustomer] })
-  users: UserByCustomer[];
+  @ApiProperty({ type: [IUserByCustomer] })
+  users: IUserByCustomer[];
   @ApiProperty()
   departments: string[];
   @ApiProperty()
@@ -153,7 +156,7 @@ export class SetUserRolesReq {
 
 export class SetUserRolesRes {
   @ApiProperty()
-  user: UserByCustomer;
+  user: IUserByCustomer;
 }
 
 export class SearchUserRes extends GetAllUsersByCustomerIdRes {}

src/modules/users/users.controller.ts

@@ -45,10 +45,12 @@ import {
   UnassignRoleToUserReq,
   UpdateUserReq,
   UpdateUserRes,
-  UserByCustomer,
+  IUserByCustomer,
 } from './dtos/entities';
 import { UsersService } from './users.service';
 import { Metadata } from '@grpc/grpc-js';
+import ErrorBuilder from 'src/utils/ErrorBuilder';
+import ErrorCodes from 'src/utils/errorCodes';
 
 // TODO GET de hierarquias e do PATCH em usuário
 @ApiTags('Users')
@@ -123,9 +125,8 @@ export class UsersController {
   }
 
   @Get(':id')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   @ApiOkResponse({
-    type: UserByCustomer,
+    type: IUserByCustomer,
   })
   async findOneById(
     @User() user: RequestUser,
@@ -134,6 +135,14 @@ export class UsersController {
   ) {
     this.logger.info('findOneById', { user });
     this.userService.setLanguage(language);
+    if (
+      id !== user.user_id &&
+      !user.permissions.includes(
+        PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid,
+      )
+    ) {
+      throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
+    }
     return await this.userService.findOneById(id);
   }
 

src/modules/users/users.service.ts

@@ -18,6 +18,7 @@ import {
   BatchCreateUserReq,
   CreateUserReq,
   Hierarchy,
+  IUserByCustomer,
   SetUserRolesReq,
   UpdateUserReq,
 } from './dtos/entities';
@@ -77,11 +78,21 @@ export class UsersService implements OnModuleInit {
     };
   }
 
-  async findOneById(id: string) {
+  async findOneById(id: string): Promise<{ user: IUserByCustomer }> {
     const { user } = await lastValueFrom(
       this.usersClientService.UserFindOneById({ id }),
     );
-    return { user: this.adjustUsersPayload([user])[0] };
+    const res: { user: IUserByCustomer } = {
+      user: this.adjustUsersPayload([user])[0],
+    };
+    if (res.user.roles?.length) {
+      const allPermissions = res.user.roles.flatMap((r) => r.permissions);
+      const distinctPermissions = Array.from(
+        new Set(allPermissions.map((p) => p.claim)),
+      );
+      res.user.permissions = distinctPermissions;
+    }
+    return res;
   }
 
   async createUser(req: CreateUserReq, meta?: Metadata) {