FIX: change origin to host

src/modules/auth/auth.controller.ts

@@ -479,7 +479,7 @@ export class AuthController {
     const accessToken = req.cookies['ddf-auth'];
     const refreshToken = req.cookies['ddf-refresh-auth']; 
     const userId = req.cookies['ddf-user-id']; 
-    const resourceOrigin = req.headers["origin"]
+    const resourceHost = req.headers["host"]
 
     const hasUserSession = Boolean(accessToken) && Boolean(userId);
     this.logger.info('Has User Session: ' + hasUserSession);
@@ -489,7 +489,7 @@ export class AuthController {
     }
 
     try {
-      const userDto = await this.authClient.validateUserSession(accessToken, resourceOrigin);
+      const userDto = await this.authClient.validateUserSession(accessToken, resourceHost);
       return res.status(200).json(userDto);
     } catch (error) {
 
@@ -501,7 +501,7 @@ export class AuthController {
       const {
         authSession,
         user
-      } = await this.authClient.refreshUserSession(refreshToken, userId, resourceOrigin);
+      } = await this.authClient.refreshUserSession(refreshToken, userId, resourceHost);
       this.authClient.writeAuthSession(res, authSession);
       return res.status(200).json(user);
     }

src/modules/auth/auth.service.ts

@@ -3,7 +3,8 @@ import {
   Inject,
   Injectable,
   ForbiddenException,
-  UnauthorizedException,
+  HttpException,
+  HttpStatus,
 } from '@nestjs/common';
 import { ClientGrpc } from '@nestjs/microservices';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
@@ -12,7 +13,6 @@ import { lastValueFrom } from 'rxjs';
 import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
 import {
   AuthProtoService as AuthServiceInterface,
-  IdentityProviderProtoService,
   UsersProtoService,
 } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
 import {
@@ -304,12 +304,12 @@ export class AuthClientService implements OnModuleInit {
     }
   }
 
-  public async validateUserSession(accessToken: any, originHeader: string) {
+  public async validateUserSession(accessToken: any, resourceHost: string) {
     const payload = await this.validateJwtToken(accessToken);
 
     const userDto = await this.getUserfromPayload(payload);
 
-    this.validateResourceAccess(originHeader, userDto);
+    this.validateResourceAccess(resourceHost, userDto);
     return userDto;
   }
 
@@ -449,29 +449,41 @@ export class AuthClientService implements OnModuleInit {
     return userDto;
   }
 
-  private validateResourceAccess(origin: string, user: UserDTO) {
+  private validateResourceAccess(host: string, user: UserDTO) {
     this.logger.info(
       "Validate whether the source URL is a resource belonging to the user's client",
     );
-    this.logger.info('Origin: ' + origin);
+    this.logger.info('Host: ' + host);
     this.logger.info('Customer: ' + user.customer.name);
 
-    const urlParts = origin.replace('https://', '').split('.');
-    const domain = urlParts[0];
-    const isResouceStg = urlParts[1] === 'stg';
+    const hostParts = host.split('.');
+    const domain = hostParts[0];
+    const isResouceStg = hostParts[1] === 'stg';
+
+    const notFoundCustomerInDomain = !domain.includes('-')
+
+    if (notFoundCustomerInDomain) {
+      this.logger.info(`Not found Customer Name in domain`);
+      return;
+    }
 
     const domainParts = domain.split('-');
+
     const customerInDomain = domainParts[domainParts.length - 1];
 
     if (isResouceStg && process.env.ENV !== 'stg') {
-      throw new ForbiddenException(
-        `Customer ${user.customer.name} cannot access ${origin}`,
+      this.logger.error(`Customer ${user.customer.name} cannot access ${host}`);
+      throw new HttpException(
+        `Customer ${user.customer.name} cannot access ${host}`,
+        HttpStatus.FORBIDDEN
       );
     }
 
     if (customerInDomain != user.customer.name) {
-      throw new ForbiddenException(
-        `Customer ${user.customer.name} cannot access ${origin}`,
+      this.logger.error(`Customer ${user.customer.name} cannot access ${host}`);
+      throw new HttpException(
+        `Customer ${user.customer.name} cannot access ${host}`,
+        HttpStatus.FORBIDDEN
       );
     }