FEAT: block user from login when maestro is dedicated

maestro/templates/deployment.yaml

@@ -100,6 +100,8 @@ spec:
               value: {{ .Values.maestro.open_customer_id }}
             - name: OPEN_GROUP_ID
               value: {{ .Values.maestro.open_group_id }}
+            - name: DEDICATED_PROXY
+              value: {{ .Values.maestro.dedicated_proxy }}
             - name: JWT_PRIVATE_KEY
               valueFrom:
                 secretKeyRef:

maestro/templates/ingress-private.yaml

@@ -11,7 +11,11 @@ metadata:
   generation: 1
   labels:
     app: {{ .Values.app_name }}
+  {{- if .Values.maestro.dedicated_proxy}}
+  name: open-data-{{ .Values.app_name }}
+  {{- else }}
   name: open-data
+  {{- end }}
   namespace: applications
 spec:
   ingressClassName: nginx

src/authentication/authentication.guard.ts

@@ -4,6 +4,7 @@ import {
   OnApplicationBootstrap,
   ExecutionContext,
   Inject,
+  ForbiddenException,
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import assert from 'assert';
@@ -113,6 +114,18 @@ export class AuthenticationGuard
       return false;
     }
 
+    // Bloquear outros customer de usar o maestor dedicado
+    const DEDICATED_PROXY = process.env.DEDICATED_PROXY
+    if (DEDICATED_PROXY !== '' && DEDICATED_PROXY !== accessTokenPayload.customer_id) {
+      throw new ForbiddenException();
+    }
+
+    // Bloquear o customer de acesso o maestro publico
+    const hasNetworkPolicyModule = accessTokenPayload.customer_modules.includes('network-policy');
+    if (hasNetworkPolicyModule && DEDICATED_PROXY === '') {
+      throw new ForbiddenException();
+    }
+
     request.accessTokenPayload = accessTokenPayload;
     request.user = {
       user_id: accessTokenPayload.user_id,

src/modules/auth/auth.service.ts

@@ -54,14 +54,22 @@ export class AuthClientService implements OnModuleInit {
     return lastValueFrom(this.authService.AuthSnowflakeSignIn(input));
   }
 
-  checkDedicatedProxy(customerId: string) {
+  checkDedicatedProxy({
+    customer
+  }: AuthSignInResponse) {
     const DEDICATED_PROXY = process.env.DEDICATED_PROXY || '';
     this.logger.info('SignIn - Setting customer ID for dedicated proxy: ' + DEDICATED_PROXY);
-    if (DEDICATED_PROXY !== '') {
-      this.logger.info('Customer ID: ' + customerId);
-      if (DEDICATED_PROXY !== customerId)  {
-        throw new ForbiddenException();
-      }
+    this.logger.info('Customer ID: ' + customer.id);
+
+    if (DEDICATED_PROXY !== '' && DEDICATED_PROXY !== customer.id) {
+      throw new ForbiddenException();
+    }
+
+    // Bloquear o customer de acesso o maestro publico
+    this.logger.info('Check if customer have network policy: ' + customer.modules);
+    const hasNetworkPolicyModule = customer.modules.includes('network-policy');
+    if (hasNetworkPolicyModule && DEDICATED_PROXY === '') {
+      throw new ForbiddenException();
     }
   }
 
@@ -85,7 +93,7 @@ export class AuthClientService implements OnModuleInit {
     }
 
     if (result.customer) {
-      this.checkDedicatedProxy(result.customer.id);
+      this.checkDedicatedProxy(result);
     }
 
     return result