Merge pull request #158 from dadosfera/ft/rls-old-catalog

FEAT: Rls first change

package-lock.json

@@ -12,7 +12,7 @@
       "dependencies": {
         "@aws-sdk/client-secrets-manager": "^3.112.0",
         "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
-        "@dadosfera/protospack-v2": "3.18.10",
+        "@dadosfera/protospack-v2": "3.18.11",
         "@grpc/grpc-js": "^1.6.7",
         "@grpc/proto-loader": "^0.6.13",
         "@nestjs/common": "^8.4.7",
@@ -1726,9 +1726,9 @@
       }
     },
     "node_modules/@dadosfera/protospack-v2": {
-      "version": "3.18.10",
-      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.18.10.tgz",
-      "integrity": "sha512-0bRUvo4p7cJJOL+B0hVTiSDaA2MGtirPkFVQW4lUfzsyY5vrsbAkMz6R3iPdPPwFSxGn5LwidHGkP3/l7hlEpA==",
+      "version": "3.18.11",
+      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.18.11.tgz",
+      "integrity": "sha512-8/+RLEM6qheWIQf0hlgE3Rfu9y2vmoze0LvJ/imRkg2tObO+HRxxpZuGKaY+naH8maUawyOX8xO4lpmfotjOEw==",
       "dependencies": {
         "@grpc/grpc-js": "^1.6.7",
         "rxjs": "^7.5.5",
@@ -12306,9 +12306,9 @@
       }
     },
     "@dadosfera/protospack-v2": {
-      "version": "3.18.10",
-      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.18.10.tgz",
-      "integrity": "sha512-0bRUvo4p7cJJOL+B0hVTiSDaA2MGtirPkFVQW4lUfzsyY5vrsbAkMz6R3iPdPPwFSxGn5LwidHGkP3/l7hlEpA==",
+      "version": "3.18.11",
+      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.18.11.tgz",
+      "integrity": "sha512-8/+RLEM6qheWIQf0hlgE3Rfu9y2vmoze0LvJ/imRkg2tObO+HRxxpZuGKaY+naH8maUawyOX8xO4lpmfotjOEw==",
       "requires": {
         "@grpc/grpc-js": "^1.6.7",
         "rxjs": "^7.5.5",

package.json

@@ -27,7 +27,7 @@
   "dependencies": {
     "@aws-sdk/client-secrets-manager": "^3.112.0",
     "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
-    "@dadosfera/protospack-v2": "3.18.10",
+    "@dadosfera/protospack-v2": "3.18.11",
     "@grpc/grpc-js": "^1.6.7",
     "@grpc/proto-loader": "^0.6.13",
     "@nestjs/common": "^8.4.7",

src/modules/catalog/catalog.controller.ts

@@ -193,12 +193,69 @@ export class CatalogController {
 
     const user_roles = await this.catalogService.getUserRolesIds(user_id);
 
-    const res = await this.catalogService.getOneDashboardMetabase(
+    const res = await this.catalogService.getOneDashboardMetabase({
       id,
       body,
       metadata,
       customer_id,
+      user_id: undefined,
+    });
+
+    const dashboard = res.dashboard;
+
+    if (dashboard.owner === username) has_permission = true;
+
+    for (const role of user_roles) {
+      if (dashboard.p_roles.includes(role)) has_permission = true;
+    }
+
+    if (dashboard.p_users.includes(user_id)) has_permission = true;
+
+    if (is_data_manager || has_permission) {
+      delete dashboard.p_roles;
+      delete dashboard.p_users;
+      return res;
+    }
+
+    throw new HttpException(
+      'You do not have permission to access this data asset.',
+      403,
     );
+  }
+
+  @Get('dashboard-metabase/rls/:id')
+  async getOneDashboardMetabaseRls(
+    @Body() body,
+    @Param() params,
+    @User() user: RequestUser,
+  ) {
+    const { username, user_id, customer_id, customer_name, permissions } = user;
+    const { id } = params;
+    this.logger.info(`/catalog - ON GET ONE DASHBOARD METABASE ROUTE`, {
+      username,
+      customer_name,
+    });
+
+    const is_data_manager = permissions.includes(
+      PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER.seqid,
+    );
+    let has_permission = false;
+    const metadata = PackTheMetadata({
+      username,
+      user_id,
+      customer_id,
+      customer_name,
+    });
+
+    const user_roles = await this.catalogService.getUserRolesIds(user_id);
+
+    const res = await this.catalogService.getOneDashboardMetabase({
+      id,
+      body,
+      metadata,
+      customer_id,
+      user_id,
+    });
 
     const dashboard = res.dashboard;
 

src/modules/catalog/catalog.service.ts

@@ -233,10 +233,10 @@ class CatalogService implements OnModuleInit {
     return { data_assets };
   }
 
-  async getOneDashboardMetabase(id, body, metadata, customer_id) {
+  async getOneDashboardMetabase({ id, body, metadata, customer_id, user_id }) {
     const nimbusUrl = this._getNimbusUrl(body);
     const { data } = await axios.get(
-      `${nimbusUrl}/api/catalog/dashboard-metabase/${id}`,
+      `${nimbusUrl}/api/catalog/dashboard-metabase/${id}?user_id=${user_id}`,
     );
 
     const { data_asset } = await lastValueFrom(

src/modules/users/users.service.ts

@@ -85,13 +85,16 @@ export class UsersService implements OnModuleInit {
     const res: { user: IUserByCustomer } = {
       user: this.adjustUsersPayload([user])[0],
     };
-    if (res.user.roles?.length) {
-      const allPermissions = res.user.roles.flatMap((r) => r.permissions);
-      const distinctPermissions = Array.from(
-        new Set(allPermissions.map((p) => p.claim)),
-      );
-      res.user.permissions = distinctPermissions;
-    }
+    const { permissions } = await lastValueFrom(
+      this.usersClientService.GetUserPermissions({ id }),
+    ).catch((error) => {
+      this.logger.error('UsersService.findOneById - GetUserPermissions', {
+        error,
+      });
+      const permissions: string[] = [];
+      return { permissions };
+    });
+    res.user.permissions = permissions;
     return res;
   }