Merge pull request #164 from dadosfera/catalog-permissions

FIX: Catalog permissions

.github/workflows/deploy-manually.yml

@@ -26,9 +26,9 @@ jobs:
       - name: Extract Environment
         run: |
           if [ ${EVENT} == "workflow_dispatch" ]; then
-            echo "##[set-output name=environment;]$(echo ${DEPLOY_ENV})"
+            echo "environment=${DEPLOY_ENV}" >> $GITHUB_OUTPUT
           elif [ ${GITHUB_REF} == "refs/heads/main" ]; then
-            echo "##[set-output name=environment;]$(echo "prd")"
+            echo "environment=prd" >> $GITHUB_OUTPUT
           fi
         id: extract_environment
 
@@ -56,6 +56,19 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+  deploy-info:
+    if: ${{ github.event_name == 'workflow_dispatch'}}
+    needs: [extract_environment, semantic_release]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Create summary
+        env:
+          EVENT: ${{ github.event_name }}
+          IMAGE_TAG: ${{ needs.semantic_release.outputs.new_release_version }}
+          ENV: ${{ needs.extract_environment.outputs.environment }}
+        run: echo "### Deploy da branch \`$GITHUB_REF_NAME\` no ambiente **$ENV** :rocket:" >> $GITHUB_STEP_SUMMARY
+
   deploy:
     if: ${{ github.event_name == 'workflow_dispatch' || needs.semantic_release.outputs.new_release_published == 'true' }}
     needs: [extract_environment, semantic_release]
@@ -63,13 +76,6 @@ jobs:
       [self-hosted, '${{ needs.extract_environment.outputs.environment }}']
 
     steps:
-      - name: Printing stats
-        env:
-          EVENT: ${{ github.event_name }}
-          IMAGE_TAG: ${{ needs.semantic_release.outputs.new_release_version }}
-          ENV: ${{ needs.extract_environment.outputs.environment }}
-        run: echo ${GITHUB_REF#refs/heads/}
-
       - name: Checkout
         uses: actions/checkout@v2
 
@@ -90,7 +96,7 @@ jobs:
           python3 -m pip install awsebcli --upgrade
 
       - name: Configure AWS Region
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@v1-node16
         id: aws
         with:
           aws-region: us-east-1
@@ -113,10 +119,12 @@ jobs:
           ENV: ${{ needs.extract_environment.outputs.environment }}
           IMAGE_TAG: ${{ needs.semantic_release.outputs.new_release_version }}
           ACCOUNT_ID: ${{ steps.aws.outputs.aws-account-id }}
+          NODE_EXPORTER_URL: ${{needs.extract_environment.outputs.environment == 'prd' && '611330257153.dkr.ecr.us-east-1.amazonaws.com\/monitoring\/node_exporter:latest' || '468720548566.dkr.ecr.us-east-1.amazonaws.com\/monitoring\/node_exporter:latest'}}
         run: |
           sed -i -e "s/\${ENV}/$ENV/g" docker-compose.yml
           sed -i -e "s/\${IMAGE_TAG}/$IMAGE_TAG/g" docker-compose.yml
           sed -i -e "s/\${ACCOUNT_ID}/$ACCOUNT_ID/g" docker-compose.yml
+          sed -i -e "s/\${NODE_EXPORTER_URL}/$NODE_EXPORTER_URL/g" docker-compose.yml
           zip deploy.zip docker-compose.yml  -r .ebextensions
 
       - name: Deploy AWS Beanstalk
@@ -142,48 +150,36 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v2
 
-      - name: Extract Docs PageId
+      - name: Extract Docs BlockId and PageId 
         env:
           ENV: ${{ needs.extract_environment.outputs.environment }}
+          DEV_DOCS_BLOCK_ID: ${{ secrets.DEV_DOCS_BLOCK_ID }}
           DEV_DOCS_PAGE_ID: ${{ secrets.DEV_DOCS_PAGE_ID }}
+          STG_DOCS_BLOCK_ID: ${{ secrets.STG_DOCS_BLOCK_ID }}
           STG_DOCS_PAGE_ID: ${{ secrets.STG_DOCS_PAGE_ID }}
+          PRD_DOCS_BLOCK_ID: ${{ secrets.PRD_DOCS_BLOCK_ID }}
           PRD_DOCS_PAGE_ID: ${{ secrets.PRD_DOCS_PAGE_ID }}
         shell: bash
         run: |
           if [ $ENV == "dev" ]; then
-            echo "##[set-output name=result;]$(echo $DEV_DOCS_PAGE_ID)"
+            echo "block_id=$DEV_DOCS_BLOCK_ID" >> $GITHUB_OUTPUT
+            echo "page_id=$DEV_DOCS_PAGE_ID" >> $GITHUB_OUTPUT
           elif [ $ENV == "stg" ]; then
-            echo "##[set-output name=result;]$(echo $STG_DOCS_PAGE_ID)"
+            echo "block_id=$STG_DOCS_BLOCK_ID" >> $GITHUB_OUTPUT
+            echo "page_id=$STG_DOCS_PAGE_ID" >> $GITHUB_OUTPUT
           elif [ $ENV == "prd" ]; then
-            echo "##[set-output name=result;]$(echo $PRD_DOCS_PAGE_ID)"
+            echo "block_id=$PRD_DOCS_BLOCK_ID" >> $GITHUB_OUTPUT
+            echo "page_id=$PRD_DOCS_PAGE_ID" >> $GITHUB_OUTPUT
           fi
-        id: extract_docs_page_id
-
-      - name: Extract Docs BlockId
-        env:
-          ENV: ${{ needs.extract_environment.outputs.environment }}
-          DEV_DOCS_BLOCK_ID: ${{ secrets.DEV_DOCS_BLOCK_ID }}
-          STG_DOCS_BLOCK_ID: ${{ secrets.STG_DOCS_BLOCK_ID }}
-          PRD_DOCS_BLOCK_ID: ${{ secrets.PRD_DOCS_BLOCK_ID }}
-        shell: bash
-        run: |
-          if [ $ENV == "dev" ]; then
-            echo "##[set-output name=result;]$(echo $DEV_DOCS_BLOCK_ID)"
-          elif [ $ENV == "stg" ]; then
-            echo "##[set-output name=result;]$(echo $STG_DOCS_BLOCK_ID)"
-          elif [ $ENV == "prd" ]; then
-            echo "##[set-output name=result;]$(echo $PRD_DOCS_BLOCK_ID)"
-          fi
-        id: extract_docs_block_id
+        id: extract_docs_info
 
       - name: Generate API docs
         env:
           ENV: ${{ needs.extract_environment.outputs.environment }}
           DOCS_URL: ${{ secrets.DOCS_URL }}
           DOCS_API_TOKEN: ${{ secrets.DOCS_API_TOKEN }}
-          DOCS_PAGE_ID: ${{ steps.extract_docs_page_id.outputs.result }}
-          DOCS_BLOCK_ID: ${{ steps.extract_docs_block_id.outputs.result }}
-        continue-on-error: true
+          DOCS_PAGE_ID: ${{ steps.extract_docs_info.outputs.page_id }}
+          DOCS_BLOCK_ID: ${{ steps.extract_docs_info.outputs.block_id }}
         run: |
           SWAGGER=`cat swagger.txt`
           curl --request POST \
@@ -198,9 +194,3 @@ jobs:
           }
           EOF
           )
-      - name: Cleanup Docker's Leftovers
-        if: always()
-        continue-on-error: true
-        run: |
-          docker system prune
-          docker rmi -f $(docker images -aq)

docker-compose.yml

@@ -10,7 +10,7 @@ services:
       - .env
 
   node_exporter:
-    image: prom/node-exporter:v1.3.1
+    image: ${NODE_EXPORTER_URL}
     container_name: node_exporter
     restart: always
     volumes:

src/authentication/permissions.enum.ts

@@ -290,15 +290,15 @@ export const PERMISSIONS_GROUPS = {
         claim: 'GET /catalog',
         usage: PermissionUsages.PUBLIC,
         name: {
-          'pt-br': 'Buscar data assets',
-          'en-us': 'Search for data assets',
-          'es-es': 'Buscar data assets',
+          'pt-br': 'Acessar lista de Ativos e visualizar atributos',
+          'en-us': 'Access Assets list and its attributes',
+          'es-es': 'Acceda a la lista de Activos y vea los atributos',
         },
       },
       CREATE: {
         seqid: 19,
         claim: 'POST /catalog',
-        usage: PermissionUsages.PUBLIC,
+        usage: PermissionUsages.INTERNAL,
         name: {
           'pt-br': 'Criar atributos no catálogo',
           'en-us': 'Create attributes',
@@ -307,32 +307,33 @@ export const PERMISSIONS_GROUPS = {
       },
       UPDATE: {
         seqid: 25,
-        claim: 'PUT /catalog',
-        usage: PermissionUsages.INTERNAL,
+        claim: 'catalog:edit',
+        usage: PermissionUsages.PUBLIC,
         name: {
-          'pt-br': 'Editar atributos no catálogo',
-          'en-us': 'Edit attributes',
-          'es-es': 'Editar atributos',
+          'pt-br': 'Criar e editar atributos no catálogo',
+          'en-us': 'Create and edit attributes on the catalog',
+          'es-es': 'Crear y editar atributos en el catálogo',
         },
       },
       DELETE: {
         seqid: 1,
-        claim: 'DELETE /catalog',
-        usage: PermissionUsages.INTERNAL,
+        claim: 'catalog:delete',
+        usage: PermissionUsages.PUBLIC,
         name: {
-          'pt-br': 'Excluir atributos no catálogo',
-          'en-us': 'Remove attributes',
-          'es-es': 'Eliminar atributos',
+          'pt-br': 'Excluir Ativos do catálogo',
+          'en-us': 'Remove Assets from the catalog',
+          'es-es': 'Eliminar Activos del catálogo',
         },
       },
       DATA_MANAGER: {
         seqid: 42,
         claim: 'catalog:data_manager',
-        usage: PermissionUsages.PUBLIC,
+        usage: PermissionUsages.INTERNAL,
         name: {
-          'pt-br': 'Vizualizar todos os recursos do catálogo.',
-          'en-us': 'View all data assets.',
-          'es-es': 'Ver todos los activos de datos',
+          'pt-br':
+            'Gerente do catálogo. Consegue vizualizar e editar todos os ativos.',
+          'en-us': 'Catalog manager. Able to view and edit all assets.',
+          'es-es': 'Gestor de catálogos. Puede ver y editar todos los activos.',
         },
       },
     },

src/modules/catalog/catalog.controller.ts

@@ -33,24 +33,30 @@ import {
   IUpdateDataRequest,
 } from './dtos';
 
+const catalogPermissions = PERMISSIONS_GROUPS.CATALOG.permissions;
 @ApiTags('Catalog')
 @Controller('catalog')
 @Authenticated()
-@AuthenticateCondition((req, user) => {
-  if (req.path.includes('/manage_permissions/')) return true;
-  let action;
+@AuthenticateCondition((req, user: RequestUser) => {
+  if (user.permissions.includes(catalogPermissions.DATA_MANAGER.seqid))
+    return true;
+
+  if (req.path.includes('/manage-permissions')) return true;
+  let action: keyof typeof catalogPermissions;
 
   switch (req.method) {
     case 'POST':
-      action = 'CREATE';
-      break;
-
     case 'PUT':
       action = 'UPDATE';
       break;
 
+    case 'DELETE':
+      if (req.path.includes('/comment')) action = 'UPDATE';
+      else action = req.method;
+      break;
+
     default:
-      action = req.method;
+      action = req.method as 'GET';
   }
 
   return user.permissions.includes(
@@ -372,7 +378,7 @@ export class CatalogController {
     @Body('docs') docs: string,
   ) {
     const { user_id, customer_name } = user;
-    const [data_asset_type, id] = data_asset_id.split('-');
+    const [, id] = data_asset_id.split('-');
 
     this.logger.info(`/catalog - ON GET DATA DOCS ROUTE`, {
       user_id,

src/modules/pipelinesV2/pipelines.controller.ts

@@ -155,7 +155,7 @@ export class PipelinesController {
       .then((res) => {
         //{pipeline:{tables: {tables: [], input_id: ''}}}
         let tables = JSON.parse(res.pipeline.config.tables);
-        if (tables?.tables) tables = tables?.tables;
+        if (tables?.tables) tables = tables.tables;
         Object.assign(res.pipeline, {
           transformations: res.pipeline.transformations
             ? JSON.parse(res.pipeline.transformations)

src/modules/transformations/transformations.controller.ts

@@ -11,34 +11,19 @@ import {
 import { ApiTags } from '@nestjs/swagger';
 import { TransformationsClientService } from './client.service';
 import { IIdRequest } from './interfaces';
-import { AuthenticateCondition } from 'src/authentication/authentication.decorator';
+import {
+  AuthenticateCondition,
+  Authenticated,
+  RequireSomePermission,
+} from 'src/authentication/authentication.decorator';
 import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { TransformationsService } from './transformations.service';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { RequestUser, User } from 'src/authentication/user.decorator';
-
+const pipelinePermissions = PERMISSIONS_GROUPS.PIPELINE.permissions;
 @ApiTags('Transformations')
 @Controller('transformations')
-@AuthenticateCondition((req, user) => {
-  let action;
-
-  switch (req.method) {
-    case 'POST':
-      action = 'CREATE';
-      break;
-
-    case 'PUT':
-      action = 'UPDATE';
-      break;
-
-    default:
-      action = req.method;
-  }
-
-  return user.permissions.includes(
-    PERMISSIONS_GROUPS.TRANSFORMATIONS.permissions[action].seqid,
-  );
-})
+@Authenticated()
 export class TransformationsController {
   logger: DadosferaLogger;
   constructor(
@@ -50,6 +35,7 @@ export class TransformationsController {
   }
 
   @Post()
+  @RequireSomePermission(pipelinePermissions.CREATE, pipelinePermissions.UPDATE)
   async create(@Body() createTransformationDto) {
     this.logger.info(`/transformation - ON CREATE ROUTE`, {
       user: createTransformationDto.info.user_id,
@@ -67,6 +53,7 @@ export class TransformationsController {
   }
 
   @Get()
+  @RequireSomePermission(pipelinePermissions.GET)
   async findAll(@Body() data: IIdRequest) {
     this.logger.info(`/transformation - ON Find All ROUTE`, {
       user: data.info.user_id,
@@ -82,6 +69,7 @@ export class TransformationsController {
   }
 
   @Get('/:id')
+  @RequireSomePermission(pipelinePermissions.GET)
   async findOne(@Body() data, @Param() params) {
     const { id } = params;
     this.logger.info(`/transformation/${id} - ON Find One ROUTE`, {
@@ -98,6 +86,7 @@ export class TransformationsController {
   }
 
   @Put(':id')
+  @RequireSomePermission(pipelinePermissions.CREATE, pipelinePermissions.UPDATE)
   async update(
     @User() user: RequestUser,
     @Body() updateTransformationDto,
@@ -120,6 +109,7 @@ export class TransformationsController {
   }
 
   @Delete(':id')
+  @RequireSomePermission(pipelinePermissions.CREATE, pipelinePermissions.UPDATE)
   async delete(@Body() data, @Param() params) {
     const { id } = params;
     this.logger.info(`/transformation/${id} - ON DELETE ROUTE`, {