FIX: validate if permission is public

docsfera.json

@@ -6022,6 +6022,9 @@
             "ApiKey"
           ],
           "security": [
+            {
+              "access-token": []
+            },
             {
               "access-token": []
             }
@@ -6075,6 +6078,9 @@
             "ApiKey"
           ],
           "security": [
+            {
+              "access-token": []
+            },
             {
               "access-token": []
             }
@@ -6115,6 +6121,9 @@
             "ApiKey"
           ],
           "security": [
+            {
+              "access-token": []
+            },
             {
               "access-token": []
             }

environment.d.ts

@@ -14,7 +14,6 @@ declare global {
       AWS_REGION: string;
       OPEN_GROUP_ID: string;
       OPEN_CUSTOMER_ID: string;
-      DEDICATED_PROXY: string;
     }
   }
 }

helmfiles/stg.yaml

@@ -8,31 +8,6 @@ charts:
         value: duc.stg.dadosfera.ai
       - name: hostname
         value: maestro.stg.dadosfera.ai
-      - name: maestro.pi_factory_url
-        value: pi-factory.stg.dadosfera.ai
-      - name: maestro.in_factory_url
-        value: in-factory.stg.dadosfera.ai
-      - name: maestro.tr_factory_url
-        value: in-factory.stg.dadosfera.ai
-      - name: maestro.open_customer_id
-        value: b3e3dfe5-b992-4586-a73c-c0b0c00f615d
-      - name: maestro.open_group_id
-        value: e3f98a2f-7748-4981-8505-7695c8ca8218
-      - name: replicaCount
-        value: 1
-  
-    # Environment to test Network Policies
-  - name: private-maestro
-    chart: ../maestro
-    values:
-    - ../maestro/values.yaml
-    set:
-      - name: app_name
-        value: maestro-private
-      - name: maestro.duc_url
-        value: duc.stg.dadosfera.ai
-      - name: hostname
-        value: private-maestro.stg.dadosfera.ai
       - name: maestro.pi_factory_url
         value: pi-factory.dadosfera.ai
       - name: maestro.in_factory_url
@@ -43,8 +18,5 @@ charts:
         value: b3e3dfe5-b992-4586-a73c-c0b0c00f615d
       - name: maestro.open_group_id
         value: e3f98a2f-7748-4981-8505-7695c8ca8218
-      # Customer id
-      - name: maestro.dedicated_proxy
-        value: 14d52fd4-d83d-4cdd-be34-bf11cc28b3bd
       - name: replicaCount
         value: 1

maestro/templates/deployment.yaml

@@ -1,16 +1,16 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ .Values.app_name }}
+  name: maestro
   namespace: applications
   labels:
-    app: {{ .Values.app_name }}
+    app: maestro
 
 spec:
   replicas: {{ .Values.replicaCount }}
   selector:
     matchLabels:
-      app: {{ .Values.app_name }}
+      app: maestro
   
   strategy:
     rollingUpdate:
@@ -20,7 +20,7 @@ spec:
   template:
     metadata:
       labels:
-        app: {{ .Values.app_name }}
+        app: maestro
     
     spec:
       imagePullSecrets:
@@ -100,8 +100,6 @@ spec:
               value: {{ .Values.maestro.open_customer_id }}
             - name: OPEN_GROUP_ID
               value: {{ .Values.maestro.open_group_id }}
-            - name: DEDICATED_PROXY
-              value: {{ .Values.maestro.dedicated_proxy }}
             - name: JWT_PRIVATE_KEY
               valueFrom:
                 secretKeyRef:
@@ -110,15 +108,15 @@ spec:
             - name: AWS_ACCESS_KEY_ID
               valueFrom:
                 secretKeyRef:
-                  name: prd-{{ .Values.app_name }}
+                  name: prd-maestro
                   key: AWS_ACCESS_KEY_ID
             - name: AWS_SECRET_ACCESS_KEY
               valueFrom:
                 secretKeyRef:
-                  name: prd-{{ .Values.app_name }}
+                  name: prd-maestro
                   key: AWS_SECRET_ACCESS_KEY
             - name: AWS_DEFAULT_REGION
               valueFrom:
                 secretKeyRef:
-                  name: prd-{{ .Values.app_name }}
+                  name: prd-maestro
                   key: AWS_DEFAULT_REGION

maestro/templates/ingress-private.yaml

@@ -10,12 +10,8 @@ metadata:
       
   generation: 1
   labels:
-    app: {{ .Values.app_name }}
+    app: maestro
-  {{- if .Values.maestro.dedicated_proxy}}
-  name: open-data-{{ .Values.app_name }}
-  {{- else }}
   name: open-data
-  {{- end }}
   namespace: applications
 spec:
   ingressClassName: nginx
@@ -25,7 +21,7 @@ spec:
       paths:
       - backend:
           service:
-            name: {{ .Values.app_name }}
+            name: maestro
             port:
               number: {{ .Values.ingress.port }}
         path: /open-data/sharing-ocean-data

maestro/templates/ingress.yaml

@@ -9,8 +9,8 @@ metadata:
       
   generation: 1
   labels:
-    app: {{ .Values.app_name }}
+    app: maestro
-  name: {{ .Values.app_name }}
+  name: maestro
   namespace: applications
 spec:
   ingressClassName: nginx
@@ -20,7 +20,7 @@ spec:
       paths:
       - backend:
           service:
-            name: {{ .Values.app_name }}
+            name: maestro
             port:
               number: {{ .Values.ingress.port }}
         path: /

maestro/templates/secret.yaml

@@ -1,17 +1,17 @@
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
-  name: prd-{{ .Values.app_name }}
+  name: prd-maestro
   namespace: applications
   labels:
-    app: {{ .Values.app_name }}
+    app: maestro
 spec:
   refreshInterval: 1h
   secretStoreRef:
     name: secretsmanager-prd
     kind: SecretStore
   target:
-    name: prd-{{ .Values.app_name }}
+    name: prd-maestro
     creationPolicy: Owner
   data:
   - secretKey: AWS_ACCESS_KEY_ID

maestro/templates/service.yaml

@@ -1,18 +1,18 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ .Values.app_name }}
+  name: maestro
   namespace: applications
   labels:
-    app: {{ .Values.app_name }}
+    app: maestro
 
 spec:
   type: ClusterIP
   ports:
-  - name: {{ .Values.app_name }}
+  - name: maestro
     protocol: TCP
     port: {{ .Values.service.port }}
     targetPort: {{ .Values.service.targetPort }}
   selector:
-    app: {{ .Values.app_name }}
+    app: maestro
 

maestro/values.yaml

@@ -9,7 +9,6 @@ image:
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
   tag: 1.56.0
-app_name: maestro
 containerPort: 3333
 imagePullSecrets: "applications-secrets-ecr-auth-token-external-secret"
 service:
@@ -43,7 +42,6 @@ maestro:
   upload_file_agent_connection: cbc2f881-58c4-4d60-8003-0979b0b5b911
   open_customer_id: f239718a-a271-4ef9-ae7e-02a2f0f3aa6e
   open_group_id: 401573bb-334f-44b2-b30e-88d4cea31ae9
-  dedicated_proxy: ""
 autoscaling:
   enabled: false
   minReplicas: 1

src/authentication/permissions.enum.ts

@@ -603,6 +603,22 @@ export const PERMISSIONS_GROUPS = {
     },
   },
 };
+
+export const PUBLIC_PERMISSIONS_SEQID = [
+  46, // AUTH.GENERATE_TOKEN
+  23, 13, 29, 5, // PIPELINE
+  37, 38, // CONNECTION
+  35, // NETWORK_CONFIG
+  7, 19, 25, 1, // CATALOG
+  14, // SNOWFLAKE
+  11, // DATAVIZ
+  31, // INTELLIGENCE
+  34, // USERS
+  43, // PROCESS
+  47  // CUSTOMER
+];
+
+
 export interface DadosferaModule {
   name: string;
   description: string;

src/modules/api-key/api-key.controller.ts

@@ -1,12 +1,13 @@
 import { Controller, Get, Post, Body, Param, Delete, UseFilters, Inject } from '@nestjs/common';
 import { ApiKeyService } from './api-key.service';
 import { CreateApiKeyDto, CreateApiKeyResponseDto, ApiKeyBaseResponseDto } from './dto/api-key.dto';
-import { Authenticated } from 'src/decorators/authentication.decorator';
+import { Authenticated, RequireAllPermissions } from 'src/decorators/authentication.decorator';
 import { ApiHeaders, ApiTags, ApiResponse } from '@nestjs/swagger';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { GrpcToHttpExceptionFilter } from 'src/error/grpc-to-http-exception.filter';
 import { RequestUser, User } from 'src/decorators/user.decorator';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
+import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
 
 @Controller('api-key')
 @Authenticated()
@@ -26,6 +27,7 @@ export class ApiKeyController {
 
   @Post()
   @ApiResponse({ type: CreateApiKeyResponseDto })
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   async create(@Body() createApiKeyDto: CreateApiKeyDto, @User() user: RequestUser): Promise<CreateApiKeyResponseDto> {
     this.logger.info('POST /api-key', {
       permissions: createApiKeyDto.permissions,
@@ -41,6 +43,7 @@ export class ApiKeyController {
 
   @Get()
   @ApiResponse({ type: [ApiKeyBaseResponseDto] })
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   async findAll(@User() user: RequestUser): Promise<ApiKeyBaseResponseDto[]> {
     this.logger.info('GET /api-key', {
       method: 'findAll'
@@ -54,6 +57,7 @@ export class ApiKeyController {
   }
 
   @Delete(':id')
+  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   async remove(@Param('id') id: string, @User() user: RequestUser): Promise<void> {
     this.logger.info('DELETE /api-key/:id', { 
       id,

src/modules/api-key/api-key.service.ts

@@ -1,38 +1,73 @@
-import { Injectable, Inject, OnModuleInit } from '@nestjs/common';
+import {
+  Injectable,
+  Inject,
+  OnModuleInit,
+  BadRequestException,
+} from '@nestjs/common';
 import { ClientGrpc } from '@nestjs/microservices';
-import { CreateApiKeyDto, CreateApiKeyResponseDto, ApiKeyBaseResponseDto } from './dto/api-key.dto';
+import {
+  CreateApiKeyDto,
+  CreateApiKeyResponseDto,
+  ApiKeyBaseResponseDto,
+} from './dto/api-key.dto';
 import { RequestUser } from 'src/decorators/user.decorator';
 import { DucClient } from '../duc/client.config';
 import { PackTheMetadata } from '../../utils/ PackTheMetadata';
 import { ApiKeyWriteProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
 import { lastValueFrom } from 'rxjs';
 import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
+import { PUBLIC_PERMISSIONS_SEQID } from 'src/authentication/permissions.enum';
 
 @Injectable()
 export class ApiKeyService implements OnModuleInit {
   private apiKeyService: ApiKeyWriteProtoService;
 
   constructor(
-    @Inject(DucClient.name) private readonly client: ClientGrpc,
+    @Inject(DucClient.name) private readonly client: ClientGrpc
   ) {}
 
   onModuleInit() {
-    this.apiKeyService = this.client.getService<ApiKeyWriteProtoService>(ProtoServices.ApiKeyWriteProtoService);
+    this.apiKeyService = this.client.getService<ApiKeyWriteProtoService>(
+      ProtoServices.ApiKeyWriteProtoService,
+    );
   }
 
-  create(createApiKeyDto: CreateApiKeyDto, user: RequestUser): Promise<CreateApiKeyResponseDto> {
+  create(
+    createApiKeyDto: CreateApiKeyDto,
+    user: RequestUser,
+  ): Promise<CreateApiKeyResponseDto> {
     const metadata = PackTheMetadata(user);
 
-    return lastValueFrom(this.apiKeyService.CreateApiKey({
+    const invalidPermissions = [];
-      permissions: createApiKeyDto.permissions
+    for (const permission of createApiKeyDto.permissions) {
-    }, metadata));
+      if (!PUBLIC_PERMISSIONS_SEQID.includes(permission)) {
+        invalidPermissions.push(permission);
+      }
+    }
+
+    if (invalidPermissions.length > 0) {
+      throw new BadRequestException(
+        `Invalid permissions: ${invalidPermissions.join(', ')}`,
+      );
+    }
+
+    return lastValueFrom(
+      this.apiKeyService.CreateApiKey(
+        {
+          permissions: createApiKeyDto.permissions,
+        },
+        metadata,
+      ),
+    );
   }
 
   async findAll(user: RequestUser): Promise<ApiKeyBaseResponseDto[]> {
     const metadata = PackTheMetadata(user);
-    console.log(metadata)
+    console.log(metadata);
 
-    const data = await lastValueFrom(this.apiKeyService.ListApiKeys({}, metadata));
+    const data = await lastValueFrom(
+      this.apiKeyService.ListApiKeys({}, metadata),
+    );
     return data.api_keys;
   }
 

src/modules/auth/auth.controller.ts

@@ -86,9 +86,11 @@ export class AuthController {
   async signIn(
     @Body() { username, password, totp }: AuthSignInReq,
     @Language() language: LanguageEnum,
+    @Headers('origin') origin = '',
   ): Promise<AuthSignInRes> {
     this.logger.info('/auth - SignIn');
-    const metadata = PackTheMetadata({ language });
+    const frontHost = origin.replace(/^https?:\/\//, '');
+    const metadata = PackTheMetadata({ language, custom_host: frontHost });
     this.logger.info('metadata: ' + JSON.stringify(metadata.toJSON()));
     return this.authClient.signIn({ username, password, totp }, metadata);
   }

src/modules/auth/auth.service.ts

@@ -1,4 +1,4 @@
-import { OnModuleInit, Inject, Injectable, ForbiddenException } from '@nestjs/common';
+import { OnModuleInit, Inject, Injectable } from '@nestjs/common';
 import { ClientGrpc } from '@nestjs/microservices';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { lastValueFrom } from 'rxjs';
@@ -17,7 +17,6 @@ import {
   AuthResetPasswordRequest,
   AuthVerifyResetPasswordCodeRequest,
   AuthConfirmResetPasswordRequest,
-  AuthSignInResponse,
 } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/messages';
 import { DucClient } from '../duc/client.config';
 import { Metadata } from '@grpc/grpc-js';
@@ -54,41 +53,15 @@ export class AuthClientService implements OnModuleInit {
     return lastValueFrom(this.authService.AuthSnowflakeSignIn(input));
   }
 
-  checkDedicatedProxy(customerId: string) {
-    const DEDICATED_PROXY = process.env.DEDICATED_PROXY || '';
-    this.logger.info('SignIn - Setting customer ID for dedicated proxy: ' + DEDICATED_PROXY);
-    if (DEDICATED_PROXY !== '') {
-      this.logger.info('Customer ID: ' + customerId);
-      if (DEDICATED_PROXY !== customerId)  {
-        throw new ForbiddenException();
-      }
-    }
-  }
-
   async signIn(
     { username, password, totp }: AuthSignInRequest,
     metadata: Metadata,
   ) {
     this.logger.info('SignIn');
 
-    let result: AuthSignInResponse;
+    return lastValueFrom(
-
+      this.authService.AuthSignIn({ username, password, totp }, metadata),
-    try {
+    );
-      result = await lastValueFrom(
-        this.authService.AuthSignIn({ username, password, totp }, metadata),
-      );
-
-    } catch (error) {
-      this.logger.error('SignIn - Error during sign-in');
-      this.logger.error(error);
-      throw error;
-    }
-
-    if (result.customer) {
-      this.checkDedicatedProxy(result.customer.id);
-    }
-
-    return result
   }
 
   async refreshAccessToken(

src/modules/open-data/open-data.controller.ts

@@ -45,11 +45,11 @@ export class OpenDataController {
   ) {
     this.logger.info('createUser for open data' + JSON.stringify(request.headers));
 
-    // const corslist = ["https://devsbm.dadosfera.io", "https://sharingoceandata.com"];
+    const corslist = ["https://devsbm.dadosfera.io", "https://sharingoceandata.com"];
-    // if (!corslist.includes(origin)) {
+    if (!corslist.includes(origin)) {
-    //   this.logger.info('block request by cors list: '+ origin);
+      this.logger.info('block request by cors list: '+ origin);
-    //   throw new ForbiddenException();
+      throw new ForbiddenException();
-    // }
+    }
 
     const OPENDATA_CUSTOMER_ID = process.env.OPEN_CUSTOMER_ID;
     const OPENDATA_GROUP_ID = process.env.OPEN_GROUP_ID;

src/modules/roles/roles.service.ts

@@ -20,6 +20,7 @@ import { PermissionsService } from '../permissions/permissions.service';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { RequestUser } from 'src/decorators/user.decorator';
 import { DucClient } from '../duc/client.config';
+import { PUBLIC_PERMISSIONS_SEQID } from 'src/authentication/permissions.enum';
 
 interface GetRolesPermissionsName {
   id: string;
@@ -103,6 +104,20 @@ export class RolesService {
     const meta = new Metadata();
     meta.add('access_token', access_token);
     const { description, name, permissionIds, userIds } = data;
+
+    const invalidPermissions = [];
+    for (const permission of permissionIds) {
+      if (!PUBLIC_PERMISSIONS_SEQID.includes(permission)) {
+        invalidPermissions.push(permission);
+      }
+    }
+
+    if (invalidPermissions.length > 0) {
+      throw new BadRequestException(
+        `Invalid permissions: ${invalidPermissions.join(', ')}`,
+      );
+    }
+
     const role = await lastValueFrom(
       this.rolesClientService.RoleCreate(
         {

src/utils/FileParser/pdf-parser.ts

@@ -22,7 +22,7 @@ export class PDFParser<T> implements Parser<T> {
       const html = await this.htmlParser.parse(data);
       await page.setContent(html, {
         waitUntil: 'networkidle0',
-        timeout: 90000,
+        timeout: 30000,
       });
 
       // Configurações adicionais para garantir um PDF válido
@@ -43,7 +43,7 @@ export class PDFParser<T> implements Parser<T> {
         pageRanges: '',
         tagged: true,
         outline: false,
-        timeout: 90000,
+        timeout: 30000,
       });
 
       await browser.close();