Merge pull request #176 from dadosfera/catalog-permissions

FIX: renamed catalog create permission

docsfera.json

@@ -3298,9 +3298,9 @@
       }
     },
     "info": {
-      "title": "Maestro - fix/modules-permissions",
+      "title": "Maestro - main",
       "description": "Documentation for Maestro gateway",
-      "version": "10.11.2022 - 14:43",
+      "version": "14.11.2022 - 15:37",
       "contact": {}
     },
     "tags": [],

src/authentication/authentication.guard.spec.ts

@@ -44,7 +44,7 @@ class NoClassAuthController {
   @Get('has-all-permissions')
   @RequireAllPermissions(
     PERMISSIONS_GROUPS.ZENDESK.permissions.OPEN,
-    PERMISSIONS_GROUPS.METABASE.permissions.OPEN,
+    PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE,
   )
   async hasAllPermissions(@Body() body) {
     return { body };
@@ -53,7 +53,7 @@ class NoClassAuthController {
   @Get('has-some-permission')
   @RequireSomePermission(
     PERMISSIONS_GROUPS.ZENDESK.permissions.OPEN,
-    PERMISSIONS_GROUPS.METABASE.permissions.OPEN,
+    PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE,
   )
   async hasSomePermission(@Body() body) {
     return { body };
@@ -62,7 +62,7 @@ class NoClassAuthController {
 
 @Controller('class-auth-condition')
 @AuthenticateCondition((req) => req.get('x-on-class') === 'ok')
-@RequireSomePermission(PERMISSIONS_GROUPS.METABASE.permissions.OPEN)
+@RequireSomePermission(PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE)
 class ClassAuthConditionController {
   @Get('body')
   async getBody(@Body() body) {
@@ -444,13 +444,13 @@ describe('authentication.guard', () => {
   NoClassAuthTest(tokenZ, ['zendesk']);
   ClassAuthConditionTest(tokenZ, ['zendesk']);
 
-  const tokenM = CreateToken([PERMISSIONS_GROUPS.METABASE.permissions.OPEN]);
+  const tokenM = CreateToken([PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE]);
   NoClassAuthTest(tokenM, ['metabase']);
   ClassAuthConditionTest(tokenM, ['metabase']);
 
   const tokenZM = CreateToken([
     PERMISSIONS_GROUPS.ZENDESK.permissions.OPEN,
-    PERMISSIONS_GROUPS.METABASE.permissions.OPEN,
+    PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE,
   ]);
   NoClassAuthTest(tokenZM, ['zendesk', 'metabase']);
   ClassAuthConditionTest(tokenZM, ['zendesk', 'metabase']);

src/authentication/permissions.enum.ts

@@ -297,12 +297,12 @@ export const PERMISSIONS_GROUPS = {
       },
       CREATE: {
         seqid: 19,
-        claim: 'POST /catalog',
+        claim: 'catalog:create',
         usage: PermissionUsages.INTERNAL,
         name: {
-          'pt-br': 'Criar atributos no catálogo',
-          'en-us': 'Create attributes',
-          'es-es': 'Crear atributos',
+          'pt-br': 'Criar Ativos',
+          'en-us': 'Create Assets',
+          'es-es': 'Crear Activos',
         },
       },
       UPDATE: {
@@ -429,14 +429,14 @@ export const PERMISSIONS_GROUPS = {
     },
   },
 
-  METABASE: {
+  ANALYZE: {
     title: {
       'pt-br': 'Analisar | Visualização',
       'en-us': 'Analyze | Visualization',
       'es-es': 'Analizar | Visualización',
     },
     permissions: {
-      OPEN: {
+      METABASE: {
         seqid: 11,
         claim: 'GET /metabase',
         usage: PermissionUsages.PUBLIC,
@@ -446,6 +446,16 @@ export const PERMISSIONS_GROUPS = {
           'es-es': 'Acceso Metabase',
         },
       },
+      INTELLIGENCE: {
+        seqid: 31,
+        claim: 'intelligence:open',
+        usage: PermissionUsages.PUBLIC,
+        name: {
+          'pt-br': 'Acessar Módulo de Inteligência',
+          'en-us': 'Access Intelligence Module',
+          'es-s': 'Acceder Módulo de Inteligencia',
+        },
+      },
     },
   },
 
@@ -456,16 +466,6 @@ export const PERMISSIONS_GROUPS = {
       'es-es': 'Módulos de la Dadosfera',
     },
     permissions: {
-      INTELLIGENCE: {
-        seqid: 31,
-        claim: 'intelligence:open',
-        usage: PermissionUsages.INTERNAL,
-        name: {
-          'pt-br': 'Acessar Módulo de Inteligência',
-          'en-us': 'Access Intelligence Module',
-          'es-s': 'Acceder Módulo de Inteligencia',
-        },
-      },
       APP_BUILDER: {
         seqid: 32,
         claim: 'app-builder:open',
@@ -486,16 +486,6 @@ export const PERMISSIONS_GROUPS = {
           'es-es': 'Acceder Machine Learning',
         },
       },
-      PROCESS: {
-        seqid: 43,
-        claim: 'process:open',
-        usage: PermissionUsages.INTERNAL,
-        name: {
-          'pt-br': 'Acessar Módulo de Processamento',
-          'en-us': 'Access Processing Module',
-          'es-es': 'Acceder Módulo de Tramitación',
-        },
-      },
     },
   },
   USERS: {
@@ -517,6 +507,25 @@ export const PERMISSIONS_GROUPS = {
       },
     },
   },
+  PROCESS: {
+    title: {
+      'pt-br': 'Processar',
+      'en-us': 'Process',
+      'es-es': 'Procesar',
+    },
+    permissions: {
+      TRANSFORMATION: {
+        seqid: 43,
+        claim: 'process:open',
+        usage: PermissionUsages.PUBLIC,
+        name: {
+          'pt-br': 'Acessar Módulo de Transformação',
+          'en-us': 'Access Transformation Module',
+          'es-es': 'Acceder Módulo de transformación',
+        },
+      },
+    },
+  },
   DADOSFERA: {
     title: {
       'pt-br': 'Usuários',

src/authentication/user.decorator.spec.ts

@@ -49,7 +49,7 @@ describe('user.decorator', () => {
   const fakeUserPayload = {
     user_id: 'd50d33c7-6c2b-463c-861f-e21667e7c125',
     username: 'super.admin',
-    permissions: [PERMISSIONS_GROUPS.METABASE.permissions.OPEN].map(
+    permissions: [PERMISSIONS_GROUPS.ANALYZE.permissions.METABASE].map(
       ({ seqid }) => seqid,
     ),
     customer_id: '9d18e8ae-24b9-41a3-9e8f-a25ce57555b11',

src/modules/catalog/catalog.controller.ts

@@ -14,8 +14,8 @@ import {
 } from '@nestjs/common';
 import { ApiTags } from '@nestjs/swagger';
 import {
-  AuthenticateCondition,
   Authenticated,
+  RequireSomePermission,
 } from '../../authentication/authentication.decorator';
 import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { CatalogService } from './catalog.service';
@@ -34,36 +34,9 @@ import {
   IUpdateDataRequest,
 } from './dtos';
 
-const catalogPermissions = PERMISSIONS_GROUPS.CATALOG.permissions;
 @ApiTags('Catalog')
 @Controller('catalog')
 @Authenticated()
-@AuthenticateCondition((req, user: RequestUser) => {
-  if (user.permissions.includes(catalogPermissions.DATA_MANAGER.seqid))
-    return true;
-
-  if (req.path.includes('/manage-permissions')) return true;
-  let action: keyof typeof catalogPermissions;
-
-  switch (req.method) {
-    case 'POST':
-    case 'PUT':
-      action = 'UPDATE';
-      break;
-
-    case 'DELETE':
-      if (req.path.includes('/comment')) action = 'UPDATE';
-      else action = req.method;
-      break;
-
-    default:
-      action = req.method as 'GET';
-  }
-
-  return user.permissions.includes(
-    PERMISSIONS_GROUPS.CATALOG.permissions[action].seqid,
-  );
-})
 export class CatalogController {
   logger: DadosferaLogger;
   constructor(
@@ -75,6 +48,10 @@ export class CatalogController {
   }
 
   @Get()
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async catalogAll(
     @User() user: RequestUser,
     @Query() query,
@@ -110,6 +87,10 @@ export class CatalogController {
   }
 
   @Get('tags')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async findAllTags(@Body() body) {
     this.logger.info(`/catalog - ON FIND ALL TAGS ROUTE`, {
       user: body.info.user_id,
@@ -129,6 +110,10 @@ export class CatalogController {
   }
 
   @Get('data-asset/:id')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async getDataAsset(
     @User() user: RequestUser,
     @Headers() headers,
@@ -183,6 +168,10 @@ export class CatalogController {
   }
 
   @Get('data-asset/rls/:id')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async getDataAssetRls(
     @User() user: RequestUser,
     @Headers() headers,
@@ -237,6 +226,10 @@ export class CatalogController {
   }
 
   @Get('data-asset/:id/columns-metadata')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async getDataAssetColumnsMetadata(
     @User() user: RequestUser,
     @Headers('Dadosfera-Lang') language,
@@ -273,6 +266,10 @@ export class CatalogController {
   }
 
   @Get('data-asset/:id/preview')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async getDataAssetPreview(
     @User() user: RequestUser,
     @Headers('Dadosfera-lang') language,
@@ -308,6 +305,10 @@ export class CatalogController {
   }
 
   @Get('data-asset/:id/docs')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.GET,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async getDataAssetDocs(
     @User() user: RequestUser,
     @Headers('Dadosfera-Lang') language,
@@ -343,6 +344,10 @@ export class CatalogController {
   }
 
   @Put('data-asset/:id')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.UPDATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async updateDataAsset(
     @User() user: RequestUser,
     @Headers('Dadosfera-Lang') language,
@@ -372,6 +377,10 @@ export class CatalogController {
   }
 
   @Post('data-asset/:id/docs')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.UPDATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async manageDataAssetDocs(
     @User() user: RequestUser,
     @Headers() headers,
@@ -440,6 +449,10 @@ export class CatalogController {
   }
 
   @Post()
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.CREATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async createDataAsset(
     @User() user: RequestUser,
     @Body() body: ICreateDataAsset,
@@ -460,6 +473,10 @@ export class CatalogController {
   }
 
   @Post('data-asset/:id/comment')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.UPDATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async commentOnDataAsset(
     @Param('id') id: string,
     @User() user: RequestUser,
@@ -482,6 +499,10 @@ export class CatalogController {
   }
 
   @Delete('data-asset/:id')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.DELETE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async deleteDataAsset(
     @Param('id') data_asset_id: string,
     @User() user: RequestUser,
@@ -504,6 +525,10 @@ export class CatalogController {
   }
 
   @Delete('data-asset/:id/comment')
+  @RequireSomePermission(
+    PERMISSIONS_GROUPS.CATALOG.permissions.UPDATE,
+    PERMISSIONS_GROUPS.CATALOG.permissions.DATA_MANAGER,
+  )
   async deleteComment(
     @Param('id') id: string,
     @User() user: RequestUser,

src/modules/mixpanel/mixpanel.controller.ts

@@ -1,7 +1,9 @@
 import { Body, Controller, Inject, Param, Post } from '@nestjs/common';
 import { init } from 'mixpanel';
+import { Authenticated } from 'src/authentication/authentication.decorator';
 import { RequestUser, User } from 'src/authentication/user.decorator';
 
+@Authenticated()
 @Controller('trackEvent')
 export class MixpanelController {
   constructor(