Merge pull request #177 from dadosfera/catalog-permissions

FIX: create data asset permission public

docsfera.json

@@ -3298,9 +3298,9 @@
       }
     },
     "info": {
-      "title": "Maestro - fix/pipeline-details-bug",
+      "title": "Maestro - catalog-permissions",
       "description": "Documentation for Maestro gateway",
-      "version": "10.11.2022 - 10:7",
+      "version": "14.11.2022 - 16:15",
       "contact": {}
     },
     "tags": [],

package-lock.json

@@ -12,7 +12,7 @@
       "dependencies": {
         "@aws-sdk/client-secrets-manager": "^3.112.0",
         "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
-        "@dadosfera/protospack-v2": "3.19.3",
+        "@dadosfera/protospack-v2": "3.19.4",
         "@grpc/grpc-js": "^1.6.7",
         "@grpc/proto-loader": "^0.6.13",
         "@nestjs/common": "^8.4.7",
@@ -1727,9 +1727,9 @@
       }
     },
     "node_modules/@dadosfera/protospack-v2": {
-      "version": "3.19.3",
-      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.19.3.tgz",
-      "integrity": "sha512-27mewnpCr7gYqwumVgKeqvaRZTbSrpjVHtevemavLUxkZvacfvCQUy+uIv5BZYZpST3lMEPKyvA5wA5XtMAB6A==",
+      "version": "3.19.4",
+      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.19.4.tgz",
+      "integrity": "sha512-Vb6bdFgQKYHf0kDK9kuMtN+nt3nkaMhJZ3wNVaUmQNxsnpGyARWBL29R2n+YnxS8g23tRwuj331sjg+DY0Fnhg==",
       "dependencies": {
         "@grpc/grpc-js": "^1.6.7",
         "rxjs": "^7.5.5",
@@ -12330,9 +12330,9 @@
       }
     },
     "@dadosfera/protospack-v2": {
-      "version": "3.19.3",
-      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.19.3.tgz",
-      "integrity": "sha512-27mewnpCr7gYqwumVgKeqvaRZTbSrpjVHtevemavLUxkZvacfvCQUy+uIv5BZYZpST3lMEPKyvA5wA5XtMAB6A==",
+      "version": "3.19.4",
+      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com:443/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.19.4.tgz",
+      "integrity": "sha512-Vb6bdFgQKYHf0kDK9kuMtN+nt3nkaMhJZ3wNVaUmQNxsnpGyARWBL29R2n+YnxS8g23tRwuj331sjg+DY0Fnhg==",
       "requires": {
         "@grpc/grpc-js": "^1.6.7",
         "rxjs": "^7.5.5",

package.json

@@ -28,7 +28,7 @@
   "dependencies": {
     "@aws-sdk/client-secrets-manager": "^3.112.0",
     "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
-    "@dadosfera/protospack-v2": "3.19.3",
+    "@dadosfera/protospack-v2": "3.19.4",
     "@grpc/grpc-js": "^1.6.7",
     "@grpc/proto-loader": "^0.6.13",
     "@nestjs/common": "^8.4.7",

src/authentication/authentication.guard.spec.ts

@@ -44,7 +44,7 @@ class NoClassAuthController {
   @Get('has-all-permissions')
   @RequireAllPermissions(
     PERMISSIONS_GROUPS.ZENDESK.permissions.OPEN,
-    PERMISSIONS_GROUPS.METABASE.permissions.OPEN,
+    PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE,
   )
   async hasAllPermissions(@Body() body) {
     return { body };
@@ -53,7 +53,7 @@ class NoClassAuthController {
   @Get('has-some-permission')
   @RequireSomePermission(
     PERMISSIONS_GROUPS.ZENDESK.permissions.OPEN,
-    PERMISSIONS_GROUPS.METABASE.permissions.OPEN,
+    PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE,
   )
   async hasSomePermission(@Body() body) {
     return { body };
@@ -62,7 +62,7 @@ class NoClassAuthController {
 
 @Controller('class-auth-condition')
 @AuthenticateCondition((req) => req.get('x-on-class') === 'ok')
-@RequireSomePermission(PERMISSIONS_GROUPS.METABASE.permissions.OPEN)
+@RequireSomePermission(PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE)
 class ClassAuthConditionController {
   @Get('body')
   async getBody(@Body() body) {
@@ -444,13 +444,13 @@ describe('authentication.guard', () => {
   NoClassAuthTest(tokenZ, ['zendesk']);
   ClassAuthConditionTest(tokenZ, ['zendesk']);
 
-  const tokenM = CreateToken([PERMISSIONS_GROUPS.METABASE.permissions.OPEN]);
+  const tokenM = CreateToken([PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE]);
   NoClassAuthTest(tokenM, ['metabase']);
   ClassAuthConditionTest(tokenM, ['metabase']);
 
   const tokenZM = CreateToken([
     PERMISSIONS_GROUPS.ZENDESK.permissions.OPEN,
-    PERMISSIONS_GROUPS.METABASE.permissions.OPEN,
+    PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE,
   ]);
   NoClassAuthTest(tokenZM, ['zendesk', 'metabase']);
   ClassAuthConditionTest(tokenZM, ['zendesk', 'metabase']);

src/authentication/permissions.enum.ts

@@ -297,12 +297,12 @@ export const PERMISSIONS_GROUPS = {
       },
       CREATE: {
         seqid: 19,
-        claim: 'POST /catalog',
-        usage: PermissionUsages.INTERNAL,
+        claim: 'catalog:create',
+        usage: PermissionUsages.PUBLIC,
         name: {
-          'pt-br': 'Criar atributos no catálogo',
-          'en-us': 'Create attributes',
-          'es-es': 'Crear atributos',
+          'pt-br': 'Criar Ativos',
+          'en-us': 'Create Assets',
+          'es-es': 'Crear Activos',
         },
       },
       UPDATE: {
@@ -429,14 +429,14 @@ export const PERMISSIONS_GROUPS = {
     },
   },
 
-  METABASE: {
+  ANALYZE: {
     title: {
       'pt-br': 'Analisar | Visualização',
       'en-us': 'Analyze | Visualization',
       'es-es': 'Analizar | Visualización',
     },
     permissions: {
-      OPEN: {
+      METABASE: {
         seqid: 11,
         claim: 'GET /metabase',
         usage: PermissionUsages.PUBLIC,
@@ -446,26 +446,26 @@ export const PERMISSIONS_GROUPS = {
           'es-es': 'Acceso Metabase',
         },
       },
-    },
-  },
-
-  ORCHEST: {
-    title: {
-      'pt-br': 'Analisar | Inteligência',
-      'en-us': 'Analyze | Intelligence',
-      'es-es': 'Analizar | Inteligencia',
-    },
-    permissions: {
       INTELLIGENCE: {
         seqid: 31,
         claim: 'intelligence:open',
-        usage: PermissionUsages.INTERNAL,
+        usage: PermissionUsages.PUBLIC,
         name: {
-          'pt-br': 'Acessar Orchest',
-          'en-us': 'Access Orchest',
-          'es-s': 'Acceso Orchest',
+          'pt-br': 'Acessar Módulo de Inteligência',
+          'en-us': 'Access Intelligence Module',
+          'es-s': 'Acceder Módulo de Inteligencia',
         },
       },
+    },
+  },
+
+  MODULES: {
+    title: {
+      'pt-br': 'Módulos da Dadosfera',
+      'en-us': 'Dadosfera Modules',
+      'es-es': 'Módulos de la Dadosfera',
+    },
+    permissions: {
       APP_BUILDER: {
         seqid: 32,
         claim: 'app-builder:open',
@@ -473,7 +473,7 @@ export const PERMISSIONS_GROUPS = {
         name: {
           'pt-br': 'Acessar App Builder',
           'en-us': 'Access App Builder',
-          'es-es': 'Acceso App Builder',
+          'es-es': 'Acceder App Builder',
         },
       },
       MACHINE_LEARNING: {
@@ -483,7 +483,7 @@ export const PERMISSIONS_GROUPS = {
         name: {
           'pt-br': 'Acessar Machine Learning',
           'en-us': 'Access Machine Learning',
-          'es-es': 'Acceso Machine Learning',
+          'es-es': 'Acceder Machine Learning',
         },
       },
     },
@@ -507,6 +507,25 @@ export const PERMISSIONS_GROUPS = {
       },
     },
   },
+  PROCESS: {
+    title: {
+      'pt-br': 'Processar',
+      'en-us': 'Process',
+      'es-es': 'Procesar',
+    },
+    permissions: {
+      TRANSFORMATION: {
+        seqid: 43,
+        claim: 'process:open',
+        usage: PermissionUsages.PUBLIC,
+        name: {
+          'pt-br': 'Acessar Módulo de Transformação',
+          'en-us': 'Access Transformation Module',
+          'es-es': 'Acceder Módulo de transformación',
+        },
+      },
+    },
+  },
   DADOSFERA: {
     title: {
       'pt-br': 'Usuários',

src/authentication/user.decorator.spec.ts

@@ -49,7 +49,7 @@ describe('user.decorator', () => {
   const fakeUserPayload = {
     user_id: 'd50d33c7-6c2b-463c-861f-e21667e7c125',
     username: 'super.admin',
-    permissions: [PERMISSIONS_GROUPS.METABASE.permissions.OPEN].map(
+    permissions: [PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE].map(
       ({ seqid }) => seqid,
     ),
     customer_id: '9d18e8ae-24b9-41a3-9e8f-a25ce57555b11',

src/modules/catalog/catalog.controller.ts

@@ -14,8 +14,8 @@ import {
 } from '@nestjs/common';
 import { ApiTags } from '@nestjs/swagger';
 import {
-  AuthenticateCondition,
   Authenticated,
+  RequireSomePermission,
 } from '../../authentication/authentication.decorator';
 import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { CatalogService } from './catalog.service';
@@ -34,36 +34,9 @@ import {
   IUpdateDataRequest,
 } from './dtos';
 
-const catalogPermissions = PERMISSIONS_GROUPS.CATALOG.permissions;
 @ApiTags('Catalog')
 @Controller('catalog')
 @Authenticated()
-@AuthenticateCondition((req, user: RequestUser) => {
-  if (user.permissions.includes(catalogPermissions.DATA_MANAGER.seqid))
-    return true;
-
-  if (req.path.includes('/manage-permissions')) return true;
-  let action: keyof typeof catalogPermissions;
-
-  switch (req.method) {
-    case 'POST':
-    case 'PUT':
-      action = 'UPDATE';
-      break;
-
-    case 'DELETE':
-      if (req.path.includes('/comment')) action = 'UPDATE';
-      else action = req.method;
-      break;
-
-    default:
-      action = req.method as 'GET';
-  }
-
-  return user.permissions.includes(
-    PERMISSIONS_GROUPS.CATALOG.permissions[action].seqid,
-  );
-})
 export class CatalogController {
   logger: DadosferaLogger;
   constructor(
@@ -75,6 +48,10 @@ export class CatalogController {
   }
 
   @Get()
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async catalogAll(
     @User() user: RequestUser,
     @Query() query,
@@ -110,6 +87,10 @@ export class CatalogController {
   }
 
   @Get('tags')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async findAllTags(@Body() body) {
     this.logger.info(`/catalog - ON FIND ALL TAGS ROUTE`, {
       user: body.info.user_id,
@@ -129,6 +110,10 @@ export class CatalogController {
   }
 
   @Get('data-asset/:id')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async getDataAsset(
     @User() user: RequestUser,
     @Headers() headers,
@@ -183,6 +168,10 @@ export class CatalogController {
   }
 
   @Get('data-asset/rls/:id')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async getDataAssetRls(
     @User() user: RequestUser,
     @Headers() headers,
@@ -237,6 +226,10 @@ export class CatalogController {
   }
 
   @Get('data-asset/:id/columns-metadata')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async getDataAssetColumnsMetadata(
     @User() user: RequestUser,
     @Headers('Dadosfera-Lang') language,
@@ -273,6 +266,10 @@ export class CatalogController {
   }
 
   @Get('data-asset/:id/preview')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async getDataAssetPreview(
     @User() user: RequestUser,
     @Headers('Dadosfera-lang') language,
@@ -308,6 +305,10 @@ export class CatalogController {
   }
 
   @Get('data-asset/:id/docs')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async getDataAssetDocs(
     @User() user: RequestUser,
     @Headers('Dadosfera-Lang') language,
@@ -343,6 +344,10 @@ export class CatalogController {
   }
 
   @Put('data-asset/:id')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.UPDATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async updateDataAsset(
     @User() user: RequestUser,
     @Headers('Dadosfera-Lang') language,
@@ -372,6 +377,10 @@ export class CatalogController {
   }
 
   @Post('data-asset/:id/docs')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.UPDATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async manageDataAssetDocs(
     @User() user: RequestUser,
     @Headers() headers,
@@ -440,6 +449,10 @@ export class CatalogController {
   }
 
   @Post()
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.CREATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async createDataAsset(
     @User() user: RequestUser,
     @Body() body: ICreateDataAsset,
@@ -460,6 +473,10 @@ export class CatalogController {
   }
 
   @Post('data-asset/:id/comment')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.UPDATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async commentOnDataAsset(
     @Param('id') id: string,
     @User() user: RequestUser,
@@ -482,6 +499,10 @@ export class CatalogController {
   }
 
   @Delete('data-asset/:id')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.DELETE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async deleteDataAsset(
     @Param('id') data_asset_id: string,
     @User() user: RequestUser,
@@ -504,6 +525,10 @@ export class CatalogController {
   }
 
   @Delete('data-asset/:id/comment')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.UPDATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async deleteComment(
     @Param('id') id: string,
     @User() user: RequestUser,

src/modules/mixpanel/mixpanel.controller.ts

@@ -1,7 +1,9 @@
 import { Body, Controller, Inject, Param, Post } from '@nestjs/common';
 import { init } from 'mixpanel';
+import { Authenticated } from 'src/authentication/authentication.decorator';
 import { RequestUser, User } from 'src/authentication/user.decorator';
 
+@Authenticated()
 @Controller('trackEvent')
 export class MixpanelController {
   constructor(

src/modules/permissions/permissions.controller.ts

@@ -1,14 +1,8 @@
 import { Controller, Get, Headers, Inject } from '@nestjs/common';
 import { ApiHeader, ApiOkResponse, ApiTags } from '@nestjs/swagger';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
-import {
-  Authenticated,
-  RequireAllPermissions,
-} from 'src/authentication/authentication.decorator';
-import {
-  PERMISSIONS_GROUPS,
-  PermissionUsages,
-} from 'src/authentication/permissions.enum';
+import { Authenticated } from 'src/authentication/authentication.decorator';
+import { PermissionUsages } from 'src/authentication/permissions.enum';
 import { RequestUser, User } from 'src/authentication/user.decorator';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { GetPublicPermissionsRes } from './dto/entities';