Merge pull request #385 from dadosfera/hotfix/import-files

FIX: permissions

src/modules/pipelines/pipelines.controller.ts

@@ -3,6 +3,7 @@ import { ApiOperation, ApiTags } from '@nestjs/swagger';
 import {
   AuthenticateCondition,
   Authenticated,
+  RequireSomePermission,
 } from 'src/decorators/authentication.decorator';
 import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { PipelinesService } from './pipelines.service';
@@ -13,26 +14,6 @@ import { ApiInternalOnlyController } from 'src/decorators/swagger.decorator';
 @ApiTags('Pipelines')
 @Controller('pipelines')
 @Authenticated()
-@AuthenticateCondition((req, user) => {
-  let action;
-
-  switch (req.method) {
-    case 'POST':
-      action = 'CREATE';
-      break;
-
-    case 'PUT':
-      action = 'UPDATE';
-      break;
-
-    default:
-      action = req.method;
-  }
-
-  return user.permissions.includes(
-    PERMISSIONS_GROUPS.PIPELINE.permissions[action].seqid,
-  );
-})
 export class PipelinesController {
   logger: DadosferaLogger;
   constructor(
@@ -44,6 +25,7 @@ export class PipelinesController {
   }
 
   @Post('start/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   @ApiOperation({
     deprecated: true,
     description:
@@ -71,6 +53,7 @@ export class PipelinesController {
     description:
       'This method is deprecated. Please use route /pipelinesV2/:id/status instead',
   })
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineStatus(@Body() body, @Param('id') id: string) {
     body.id = id;
 

src/modules/pipelinesV2/pipelines.controller.ts

@@ -26,6 +26,7 @@ import {
 import {
   AuthenticateCondition,
   RequireAllPermissions,
+  RequireSomePermission,
 } from 'src/decorators/authentication.decorator';
 import { PERMISSIONS_GROUPS } from '../../authentication/permissions.enum';
 import { PipelinesService } from './pipelines.service';
@@ -52,30 +53,6 @@ import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
 @ApiHeaders([{ name: 'dadosfera-lang', enum: LanguageEnum, required: false }])
 @UseFilters(new GrpcToHttpExceptionFilter())
 @Controller('pipelinesV2')
-@AuthenticateCondition((req, user) => {
-  let action;
-
-  switch (req.method) {
-    case 'POST':
-      action = 'CREATE';
-      break;
-
-    case 'PUT':
-      action = 'UPDATE';
-      break;
-
-    case 'PATCH':
-      action = 'UPDATE';
-      break;
-
-    default:
-      action = req.method;
-  }
-
-  return user.permissions.includes(
-    PERMISSIONS_GROUPS.PIPELINE.permissions[action].seqid,
-  );
-})
 export class PipelinesController {
   logger: DadosferaLogger;
   constructor(
@@ -88,6 +65,7 @@ export class PipelinesController {
   }
 
   @Get('monitoring-dashboard')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getMonitoringDashboard(@User() user: RequestUser) {
     this.logger.info('PipelinesController - getMonitoringDashboard', { user });
 
@@ -100,6 +78,7 @@ export class PipelinesController {
   }
 
   @Post()
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   @ApiCreatedResponse({ type: IPipelineV2 })
   async create(
     @Language() language: LanguageEnum,
@@ -126,6 +105,7 @@ export class PipelinesController {
   }
 
   @Get()
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async findAll(
     @User() user: RequestUser,
     @Language() language: LanguageEnum,
@@ -150,6 +130,7 @@ export class PipelinesController {
   }
 
   @Get('/download-logs')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async downloadLogs(
     @User() user: RequestUser,
     @Language() language: LanguageEnum,
@@ -180,6 +161,7 @@ export class PipelinesController {
   }
 
   @Get(':id/config')
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW,PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineproperties(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
@@ -191,6 +173,7 @@ export class PipelinesController {
   }
 
   @Get(':id/objects')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineObjects(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
@@ -202,6 +185,7 @@ export class PipelinesController {
   }
 
   @Get(':id/status')
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async getPipelineStatus(@Body() body, @Param('id') id: string) {
     body.id = id;
 
@@ -216,6 +200,7 @@ export class PipelinesController {
   }
 
   @Get('/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.GET)
   async findOne(
     @Language() language: LanguageEnum,
     @User() user: RequestUser,
@@ -258,6 +243,7 @@ export class PipelinesController {
   }
 
   @Patch('/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async update(
     @Language() language: LanguageEnum,
     @Body() updatePipelineDto,
@@ -297,6 +283,7 @@ export class PipelinesController {
     deprecated: true,
     description: 'This method is deprecated. Please use PATCH instead',
   })
+  @RequireSomePermission(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW, PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
   async updateDeprecated(
     @Language() language: LanguageEnum,
     @Body() updatePipelineDto,
@@ -312,6 +299,7 @@ export class PipelinesController {
   @Delete(':id')
   @ApiNoContentResponse()
   @HttpCode(HttpStatus.NO_CONTENT)
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.DELETE)
   async delete(@Param('id') id: string, @User() user: RequestUser) {
     this.logger.info('PipelinesController - delete', { user });
     const metadata = PackTheMetadata({
@@ -325,7 +313,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('/init-upload')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
+  @RequireAllPermissions(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW)
   async initUploadFile(
     @User() user: RequestUser,
     @Body() body: IInitUploadCSVFile,
@@ -357,7 +345,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('/complete-upload')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
+  @RequireAllPermissions(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW)
   async completeUploadFile(
     @User() user: RequestUser,
     @Body() body: ICompleteUploadCSVFile,
@@ -375,7 +363,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('/file')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
+  @RequireAllPermissions(PERMISSIONS_GROUPS.IMPORT_FILES.permissions.VIEW)
   async uploadedFile(
     @User() user: RequestUser,
     @Body() body: ICreatePipelineCSVFile,
@@ -425,6 +413,7 @@ export class PipelinesController {
 
   @ApiInternalOnlyEndpoint()
   @Post('start/:id')
+  @RequireSomePermission(PERMISSIONS_GROUPS.PIPELINE.permissions.CREATE)
   async activate(@Param('id') id: string, @Body() body) {
     const { info } = body;