FEAT: protected update route with admin seqid or if user request to equal a jwt user id claim

docsfera.json

@@ -1321,9 +1321,6 @@
             "Users"
           ],
           "security": [
-            {
-              "access-token": []
-            },
             {
               "access-token": []
             }
@@ -8166,6 +8163,15 @@
             "hierarchy": {
               "type": "string"
             },
+            "bio": {
+              "type": "string"
+            },
+            "companyName": {
+              "type": "string"
+            },
+            "companySite": {
+              "type": "string"
+            },
             "mfaStatus": {
               "type": "string"
             },
@@ -8196,6 +8202,9 @@
             "jobTitle",
             "department",
             "hierarchy",
+            "bio",
+            "companyName",
+            "companySite",
             "mfaStatus",
             "createdAt",
             "updatedAt",
@@ -8329,6 +8338,15 @@
             "hierarchy": {
               "type": "string"
             },
+            "bio": {
+              "type": "string"
+            },
+            "companyName": {
+              "type": "string"
+            },
+            "companySite": {
+              "type": "string"
+            },
             "customer": {
               "$ref": "#/components/schemas/Customer"
             },
@@ -8356,6 +8374,9 @@
             "jobTitle",
             "department",
             "hierarchy",
+            "bio",
+            "companyName",
+            "companySite",
             "mfaStatus",
             "createdAt",
             "updatedAt",
@@ -8545,6 +8566,15 @@
             "hierarchy": {
               "type": "string"
             },
+            "bio": {
+              "type": "string"
+            },
+            "companyName": {
+              "type": "string"
+            },
+            "companySite": {
+              "type": "string"
+            },
             "mfaStatus": {
               "type": "string"
             },
@@ -8568,6 +8598,9 @@
             "jobTitle",
             "department",
             "hierarchy",
+            "bio",
+            "companyName",
+            "companySite",
             "mfaStatus",
             "createdAt",
             "updatedAt",

package-lock.json

@@ -17,7 +17,7 @@
         "@aws-sdk/signature-v4": "^3.370.0",
         "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
         "@dadosfera/protospack": "2.5.3",
-        "@dadosfera/protospack-v2": "3.38.0-beta.17",
+        "@dadosfera/protospack-v2": "3.38.0-beta.18",
         "@grpc/grpc-js": "^1.9.3",
         "@grpc/proto-loader": "^0.7.9",
         "@nestjs/cli": "^9.5.0",
@@ -2972,9 +2972,9 @@
       }
     },
     "node_modules/@dadosfera/protospack-v2": {
-      "version": "3.38.0-beta.17",
-      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.38.0-beta.17.tgz",
-      "integrity": "sha512-3E6m0ZKy5QOfuuTig05RC7Kj+zrh1GqZlTp6aePECDTrIyLhp2GIrALqJuD3LEjT+LG6eA88X2b4iXfV17Qmkg==",
+      "version": "3.38.0-beta.18",
+      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.38.0-beta.18.tgz",
+      "integrity": "sha512-rD2UOKa0P17A6YXIpclXF7F9b86mhRNE7fImTrbFamOcHpGmXBBVU8U53mCfLzzOA+MdDZ4/1uDNurCyQCjsLQ==",
       "license": "ISC",
       "dependencies": {
         "@grpc/grpc-js": "^1.9.3",

package.json

@@ -35,7 +35,7 @@
     "@aws-sdk/signature-v4": "^3.370.0",
     "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
     "@dadosfera/protospack": "2.5.3",
-    "@dadosfera/protospack-v2": "3.38.0-beta.17",
+    "@dadosfera/protospack-v2": "3.38.0-beta.18",
     "@grpc/grpc-js": "^1.9.3",
     "@grpc/proto-loader": "^0.7.9",
     "@nestjs/cli": "^9.5.0",

src/modules/users/dtos/entities.ts

@@ -38,6 +38,12 @@ export class User {
   department?: string;
   @ApiProperty()
   hierarchy?: string;
+  @ApiProperty()
+  bio?: string;
+  @ApiProperty()
+  companyName?: string;
+  @ApiProperty()
+  companySite?: string;
   @ApiPropertyOptional()
   customer?: Customer;
   @ApiProperty()

src/modules/users/users.controller.ts

@@ -266,7 +266,6 @@ export class UsersController {
   }
 
   @Patch(':id')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
   @ApiOkResponse({ type: UpdateUserRes })
   async updateUser(
     @User() user: RequestUser,
@@ -274,6 +273,10 @@ export class UsersController {
     @Param('id') id: string,
     @Language() language: LanguageEnum,
   ) {
+
+    if (user.user_id !== id || !user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)) {
+      throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
+    }
     this.logger.info('updateUser', { user });
     this.userService.setLanguage(language);
     return await this.userService.updateUser(body, id, user.customer_id);

src/modules/users/users.service.ts

@@ -149,7 +149,7 @@ export class UsersService implements OnModuleInit {
 
   async updateUser(req: UpdateUserReq, id: string, customerId: string) {
     const { roleNames, ...updateUserDTO } = req;
-    if (roleNames) {
+    if (roleNames && roleNames.length > 0) {
       await this.setRoles({ roleNames, userId: id }, customerId);
     }