Merge pull request #395 from dadosfera/beta

Beta

README.md

@@ -3,7 +3,6 @@
 </p>
 
 
-
 # Maestro
 
 Maestro é a API principal da Dadosfera. É responsável pela comunicação do Frontend com nossos microsserviços.

deploy/helm-chart/templates/deployment.yaml

@@ -104,8 +104,6 @@ spec:
               value: {{ .Values.maestro.redis_host }}
             - name: REDIS_PORT
               value: "{{ .Values.maestro.redis_port }}"
-            - name: REDIS_TLS
-              value: "{{ .Values.maestro.redis_tls }}"
             - name: JWT_PRIVATE_KEY
               valueFrom:
                 secretKeyRef:

deploy/helm-chart/values.yaml

@@ -48,7 +48,6 @@ maestro:
   redis_host: "aaapzppmlyamkocqwstpo7zvopczyyiyuy6xzm2g6c5k4mq3a66be4a-0.redis.sa-saopaulo-1.oci.oraclecloud.com"
   redis_port: "6379"
   redis_database: "0"
-  redis_tls: "true"
   cookie_secret: "13cc5e136d3074bcc05bec8697092ec1f5f376bf"
 autoscaling:
   enabled: false

environment.d.ts

@@ -16,7 +16,6 @@ declare global {
       OPEN_CUSTOMER_ID: string;
       DEDICATED_PROXY: string;
       COOKIE_SECRET: string;
-      REDIS_TLS?: string;
     }
   }
 }

src/modules/auth/auth.controller.ts

@@ -13,7 +13,6 @@ import {
   Req,
   Param,
   Res,
-  UnauthorizedException,
 } from '@nestjs/common';
 import {
   ApiHeaders,
@@ -103,13 +102,14 @@ export class AuthController {
       const data = await this.authClient.signIn({ username, password, totp }, metadata);
 
       if (data.tokens) {
-        this.authClient.writeAuthSession(res, {
+        this.addTokenInCookie(res, {
           accessToken: data.tokens.accessToken,
           refreshToken: data.tokens.refreshToken,
           userId: data.user.id
         });
       }
 
+
       return res.send(data);
     } catch (error) {
       this.logger.error('/auth - SignIn - ERROR', error);
@@ -126,8 +126,27 @@ export class AuthController {
   ) {
     try {
       this.logger.info('/auth - SignOut');
-   
-      this.authClient.cleanUpAuthSession(res);
+      const exp = 1000 * 60 * 3;
+
+      res.cookie('ddf-auth', '', {
+        domain: 'dadosfera.local',
+        maxAge: Date.now() - exp,
+        expires: new Date(),
+        httpOnly: true,
+        secure: true,
+        sameSite: 'none', // Necessário para cookies em requisições cross-site
+      });
+
+      res.cookie('ddf-refresh-auth', '', {
+        domain: 'dadosfera.local',
+        maxAge: Date.now() - exp,
+        expires: new Date(),
+        httpOnly: true,
+        secure: true,
+        sameSite: 'none', // Necessário para cookies em requisições cross-site
+      });
+
+      this.logger.info('Clean cookie sessions');
 
       return res.send();
     } catch (error) {
@@ -156,9 +175,8 @@ export class AuthController {
 
     const data = await this.authClient.refreshAccessToken({ refreshToken, userId }, metadata);
 
-    this.authClient.writeAuthSession(res, {
+    this.addTokenInCookie(res, {
       accessToken: data.accessToken,
-      refreshToken: data.refreshToken,
       userId
     });
 
@@ -474,36 +492,85 @@ export class AuthController {
   @Get('me')
   async getMe(@Req() req: Request, @Res() res: Response) {
     this.logger.info('GET /auth/me ')
-
-    // Get token and headers
+    // Lê cookies
     const accessToken = req.cookies['ddf-auth'];
-    const refreshToken = req.cookies['ddf-refresh-auth']; 
-    const userId = req.cookies['ddf-user-id']; 
-    const resourceHost = req.headers["host"]
+    const userId = req.cookies['ddf-user-id'];
 
-    const hasUserSession = Boolean(accessToken) && Boolean(userId);
-    this.logger.info('Has User Session: ' + hasUserSession);
+    this.logger.info('Has cookie: ' + Boolean(accessToken))
+    try {
+      // Decodifica e valida o JWT de acesso
+      const userDto = await this.authClient.extractUserFrom(accessToken);
+      return res.status(200).json(userDto);
+    } catch (err) {
+      this.logger.error(err.message);
+      const refreshToken = req.cookies['ddf-refresh-auth'];
 
-    if (!hasUserSession) {
-      throw new UnauthorizedException()
+      this.logger.info('Token is invalid')
+      this.logger.info('Has Refresh Token: '+ Boolean(refreshToken))
+      // Se access token inválido, tenta refresh
+      if (!refreshToken || !userId) {
+        this.logger.error('Invalid refresh token or customer name');
+        return res.status(401).json({ error: 'Not authenticated' });
+      }
+      try {
+        // Chama refreshAccessToken
+        const metadata = PackTheMetadata({
+        });
+        this.logger.info('Call Refresh Token')
+        const data = await this.authClient.refreshAccessToken({ refreshToken, userId }, metadata);
+        this.logger.info('Finish Refresh Token')
+        // Retorna novo access token e dados mínimos
+        this.addTokenInCookie(res, {
+          accessToken: data.accessToken,
+          userId
+        });
+        // Decodifica novo token
+        const userDto = await this.authClient.extractUserFrom(accessToken);
+        return res.status(200).json(userDto);
+      } catch (refreshErr) {
+        this.logger.error(refreshErr)
+        return res.status(401).json({ error: 'Not authenticated' });
+      }
+    }
+  }
+
+  private addTokenInCookie(res: Response, data: CookiesValues) {
+    let exp = 1000 * 60 * 5; // 5 minutes
+
+    if (data.accessToken) {
+      const { exp: expiration } = jwt.decode(data.accessToken) as JwtPayload;
+      exp = (expiration - 30) * 1000; // exp em segundos, maxAge em ms
+
+      this.logger.info('Set Cookie ddf-auth')
+      res.cookie('ddf-auth', data.accessToken, {
+        domain: '.dadosfera.ai',
+        maxAge: exp,
+        httpOnly: true,
+        secure: true,
+        sameSite: 'none', // Necessário para cookies em requisições cross-site
+      });
     }
 
-    try {
-      const userDto = await this.authClient.validateUserSession(accessToken, resourceHost);
-      return res.status(200).json(userDto);
-    } catch (error) {
+    if (data.refreshToken) {
+      this.logger.info('Set Cookie ddf-refresh-auth')
+      res.cookie('ddf-refresh-auth', data.refreshToken, {
+        domain: '.dadosfera.ai',
+        maxAge: exp,
+        httpOnly: true,
+        secure: true,
+        sameSite: 'none', // Necessário para cookies em requisições cross-site
+      });
+    }
 
-      if (!refreshToken) {
-        this.logger.error('Invalid refresh token or customer name');
-        throw new UnauthorizedException("Invalid refresh token or customer name");
-      };
-
-      const {
-        authSession,
-        user
-      } = await this.authClient.refreshUserSession(refreshToken, userId, resourceHost);
-      this.authClient.writeAuthSession(res, authSession);
-      return res.status(200).json(user);
+    if (data.userId) {
+      this.logger.info('Set Cookie ddf-refresh-auth')
+      res.cookie('ddf-user-id', data.userId, {
+        domain: '.dadosfera.ai',
+        maxAge: exp,
+        httpOnly: true,
+        secure: true,
+        sameSite: 'none', // Necessário para cookies em requisições cross-site
+      });
     }
   }
 }

src/modules/auth/auth.service.ts

@@ -1,20 +1,10 @@
-import {
-  OnModuleInit,
-  Inject,
-  Injectable,
-  ForbiddenException,
-  UnauthorizedException,
-} from '@nestjs/common';
+import { OnModuleInit, Inject, Injectable, ForbiddenException } from '@nestjs/common';
 import { ClientGrpc } from '@nestjs/microservices';
 import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { lastValueFrom } from 'rxjs';
 
 import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
-import {
-  AuthProtoService as AuthServiceInterface,
-  IdentityProviderProtoService,
-  UsersProtoService,
-} from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+import { AuthProtoService as AuthServiceInterface, IdentityProviderProtoService, UsersProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
 import {
   AuthSnowflakeSignInRequest,
   AuthSignInRequest,
@@ -32,18 +22,12 @@ import {
 import { DucClient } from '../duc/client.config';
 import { Metadata } from '@grpc/grpc-js';
 import { BulkEditResponse, UserDTO } from './dtos/login';
-import jwt, { JwtPayload } from 'jsonwebtoken';
+import jwt from 'jsonwebtoken';
 import { PackTheMetadata } from 'src/utils/PackTheMetadata';
-import { Request, Response } from 'express';
-
-type AuthSession = {
-  accessToken?: string;
-  refreshToken?: string;
-  userId?: string;
-};
 
 @Injectable()
 export class AuthClientService implements OnModuleInit {
+
   logger: DadosferaLogger;
 
   private authService: AuthServiceInterface;
@@ -79,11 +63,11 @@ export class AuthClientService implements OnModuleInit {
     return lastValueFrom(this.authService.AuthSnowflakeSignIn(input));
   }
 
-  checkDedicatedProxy({ customer }: AuthSignInResponse) {
+  checkDedicatedProxy({
+    customer
+  }: AuthSignInResponse) {
     const DEDICATED_PROXY = process.env.DEDICATED_PROXY || '';
-    this.logger.info(
-      'SignIn - Setting customer ID for dedicated proxy: ' + DEDICATED_PROXY,
-    );
+    this.logger.info('SignIn - Setting customer ID for dedicated proxy: ' + DEDICATED_PROXY);
     this.logger.info('Customer ID: ' + customer.id);
 
     if (DEDICATED_PROXY !== '' && DEDICATED_PROXY !== customer.id) {
@@ -91,9 +75,7 @@ export class AuthClientService implements OnModuleInit {
     }
 
     // Bloquear o customer de acesso o maestro publico
-    this.logger.info(
-      'Check if customer have network policy: ' + customer.modules,
-    );
+    this.logger.info('Check if customer have network policy: ' + customer.modules);
     const hasNetworkPolicyModule = customer.modules.includes('network-policy');
     if (hasNetworkPolicyModule && DEDICATED_PROXY === '') {
       throw new ForbiddenException();
@@ -112,6 +94,7 @@ export class AuthClientService implements OnModuleInit {
       result = await lastValueFrom(
         this.authService.AuthSignIn({ username, password, totp }, metadata),
       );
+
     } catch (error) {
       this.logger.error('SignIn - Error during sign-in');
       this.logger.error(error);
@@ -122,7 +105,7 @@ export class AuthClientService implements OnModuleInit {
       this.checkDedicatedProxy(result);
     }
 
-    return result;
+    return result
   }
 
   async refreshAccessToken(
@@ -132,10 +115,7 @@ export class AuthClientService implements OnModuleInit {
     this.logger.info('RefreshAccessToken');
 
     return lastValueFrom(
-      this.authService.AuthRefreshAccessToken(
-        { refreshToken, userId },
-        metadata,
-      ),
+      this.authService.AuthRefreshAccessToken({ refreshToken, userId }, metadata),
     );
   }
 
@@ -304,177 +284,50 @@ export class AuthClientService implements OnModuleInit {
     }
   }
 
-  public async validateUserSession(accessToken: any, originHeader: string) {
-    const payload = await this.validateJwtToken(accessToken);
-
-    const userDto = await this.getUserfromPayload(payload);
-
-    this.validateResourceAccess(originHeader, userDto);
-    return userDto;
-  }
-
-  public async refreshUserSession(
-    refreshToken: string,
-    userId: string,
-    originHeader: string,
-  ): Promise<{
-    user: UserDTO;
-    authSession: AuthSession;
-  }> {
-    const metadata = PackTheMetadata({});
-
-    this.logger.info('Call Refresh Token');
-    const refreshCredentials = await this.refreshAccessToken(
-      { refreshToken, userId },
-      metadata,
-    );
-    this.logger.info('Finish Refresh Token');
-
-    const userDto = await this.validateUserSession(
-      refreshCredentials.accessToken,
-      originHeader,
-    );
-    return {
-      user: userDto,
-      authSession: {
-        accessToken: refreshCredentials.accessToken,
-        refreshToken: refreshCredentials.refreshToken,
-        userId,
-      },
-    };
-  }
-
-  public writeAuthSession(res: Response, data: AuthSession) {
-    let exp = 1000 * 60 * 5; // 5 minutes
-
-    if (data.accessToken) {
-      const { exp: expiration } = jwt.decode(data.accessToken) as JwtPayload;
-      exp = (expiration - 30) * 1000; // exp em segundos, maxAge em ms
-
-      this.logger.info('Set Cookie ddf-auth');
-      res.cookie('ddf-auth', data.accessToken, {
-        domain: '.dadosfera.ai',
-        maxAge: exp,
-        httpOnly: true,
-        secure: true,
-        sameSite: 'none', // Necessário para cookies em requisições cross-site
-      });
-    }
-
-    if (data.refreshToken) {
-      this.logger.info('Set Cookie ddf-refresh-auth');
-      res.cookie('ddf-refresh-auth', data.refreshToken, {
-        domain: '.dadosfera.ai',
-        maxAge: exp,
-        httpOnly: true,
-        secure: true,
-        sameSite: 'none', // Necessário para cookies em requisições cross-site
-      });
-    }
-
-    if (data.userId) {
-      this.logger.info('Set Cookie ddf-refresh-auth');
-      res.cookie('ddf-user-id', data.userId, {
-        domain: '.dadosfera.ai',
-        maxAge: exp,
-        httpOnly: true,
-        secure: true,
-        sameSite: 'none', // Necessário para cookies em requisições cross-site
-      });
-    }
-  }
-
-  public cleanUpAuthSession(res: Response) {
-    const exp = 1000 * 60 * 3;
-
-    res.cookie('ddf-auth', '', {
-      domain: 'dadosfera.ai',
-      maxAge: Date.now() - exp,
-      expires: new Date(),
-      httpOnly: true,
-      secure: true,
-      sameSite: 'none', // Necessário para cookies em requisições cross-site
-    });
-
-    res.cookie('ddf-refresh-auth', '', {
-      domain: 'dadosfera.ai',
-      maxAge: Date.now() - exp,
-      expires: new Date(),
-      httpOnly: true,
-      secure: true,
-      sameSite: 'none', // Necessário para cookies em requisições cross-site
-    });
-
-    this.logger.info('Clean cookie sessions');
-  }
-
-  private async validateJwtToken(token: string) {
-    const decoded: any = token && jwt.decode(token, { complete: true });
-    if (!decoded) throw new Error('Invalid token');
-
-    const { kid } = decoded.header;
-    // Busca a chave pública
-    const { keys } = await this.getPublicKeys();
-    const pemValue = keys.find((k) => k.kid === kid)?.pem;
-    if (!pemValue) throw new Error('Public key not found');
-    jwt.verify(token, pemValue);
-
-    return decoded.payload;
-  }
-
-  private async getUserfromPayload(payload: JwtPayload): Promise<UserDTO> {
+  private async getUser(id: string, metadata: Metadata) {
     this.logger.info('getUser');
-
-    const metadata = PackTheMetadata({
-      customer_id: payload.customer_id,
-    });
-
-    const { user } = await lastValueFrom(
-      this.userService.UserFindOneById({ id: payload.user_id }, metadata),
+    return await lastValueFrom(
+      this.userService.UserFindOneById({ id }, metadata),
     );
-
-    const userDto: UserDTO = {
-      id: user.id,
-      name: user.username,
-      jobTitle: user?.jobTitle || null,
-      department: user?.department || null,
-      hierarchy: user?.hierarchy || null,
-      customer: {
-        id: payload.customer_id,
-        name: payload.customer_name,
-        tier: payload.customer_tier,
-      },
-    };
-
-    return userDto;
   }
 
-  private validateResourceAccess(host: string, user: UserDTO) {
-    this.logger.info(
-      "Validate whether the source URL is a resource belonging to the user's client",
-    );
-    this.logger.info('Host: ' + host);
-    this.logger.info('Customer: ' + user.customer.name);
+  public async extractUserFrom(token: string) {
+      const decoded: any = token && jwt.decode(token, { complete: true });
+      if (!decoded) throw new Error('Invalid token');
 
-    const hostParts = host.split('.');
-    const domain = hostParts[0];
-    const isResouceStg = hostParts[1] === 'stg';
+      const { kid } = decoded.header;
+      // Busca a chave pública
+      const { keys } = await this.getPublicKeys();
+      const pemValue = keys.find((k) => k.kid === kid)?.pem;
+      if (!pemValue)
+          throw new Error('Public key not found');
+      jwt.verify(token, pemValue);
 
-    const domainParts = domain.split('-');
-    const customerInDomain = domainParts[domainParts.length - 1];
+      const payload = decoded.payload;
+      const metadata = PackTheMetadata({
+        customer_id: payload.customer_id
+      })
 
-    if (isResouceStg && process.env.ENV !== 'stg') {
-      throw new ForbiddenException(
-        `Customer ${user.customer.name} cannot access ${origin}`,
+      const {
+        user
+      } = await this.getUser(
+        payload.user_id,
+        metadata
       );
-    }
 
-    if (customerInDomain != user.customer.name) {
-      throw new ForbiddenException(
-        `Customer ${user.customer.name} cannot access ${origin}`,
-      );
-    }
+      const userDto: UserDTO = {
+          id: user.id,
+          name: user.username,
+          jobTitle: user?.jobTitle || null,
+          department: user?.department || null,
+          hierarchy: user?.hierarchy || null,
+          customer: {
+            id: payload.customer_id,
+            name: payload.customer_name,
+            tier: payload.customer_tier,
+          }
+        };
 
-    return;
-  }
+      return userDto;
+    }
 }

src/services/service.module.ts

@@ -14,7 +14,7 @@ import { redisStore } from 'cache-manager-ioredis-yet';
           keyPrefix: 'maestro:sso',
         }
 
-        if (process.env.REDIS_TLS === 'true') {
+        if (process.env.ENV !== 'local') {  
           baseRedisConfig['tls'] = {
             servername: process.env.REDIS_HOST,
           }