FIX: user patch route

Merge pull request #425 from dadosfera/beta
Beta
2026-09-02 12:44:48 +00:00 · 2025-12-26 17:53:02 -03:00 · 2025-12-18 17:42:10 -03:00 · 2025-12-18 12:33:29 -03:00 · 2025-12-18 12:32:53 -03:00 · 2025-12-18 10:53:31 -03:00
7 changed files with 81 additions and 13 deletions
@@ -1321,9 +1321,6 @@
            "Users"
          ],
          "security": [
-            {
-              "access-token": []
-            },
            {
              "access-token": []
            }
@@ -8166,6 +8163,15 @@
            "hierarchy": {
              "type": "string"
            },
+            "bio": {
+              "type": "string"
+            },
+            "companyName": {
+              "type": "string"
+            },
+            "companySite": {
+              "type": "string"
+            },
            "mfaStatus": {
              "type": "string"
            },
@@ -8196,6 +8202,9 @@
            "jobTitle",
            "department",
            "hierarchy",
+            "bio",
+            "companyName",
+            "companySite",
            "mfaStatus",
            "createdAt",
            "updatedAt",
@@ -8329,6 +8338,15 @@
            "hierarchy": {
              "type": "string"
            },
+            "bio": {
+              "type": "string"
+            },
+            "companyName": {
+              "type": "string"
+            },
+            "companySite": {
+              "type": "string"
+            },
            "customer": {
              "$ref": "#/components/schemas/Customer"
            },
@@ -8356,6 +8374,9 @@
            "jobTitle",
            "department",
            "hierarchy",
+            "bio",
+            "companyName",
+            "companySite",
            "mfaStatus",
            "createdAt",
            "updatedAt",
@@ -8545,6 +8566,15 @@
            "hierarchy": {
              "type": "string"
            },
+            "bio": {
+              "type": "string"
+            },
+            "companyName": {
+              "type": "string"
+            },
+            "companySite": {
+              "type": "string"
+            },
            "mfaStatus": {
              "type": "string"
            },
@@ -8568,6 +8598,9 @@
            "jobTitle",
            "department",
            "hierarchy",
+            "bio",
+            "companyName",
+            "companySite",
            "mfaStatus",
            "createdAt",
            "updatedAt",
@@ -17,7 +17,7 @@
        "@aws-sdk/signature-v4": "^3.370.0",
        "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
        "@dadosfera/protospack": "2.5.3",
-        "@dadosfera/protospack-v2": "3.38.0-beta.17",
+        "@dadosfera/protospack-v2": "3.38.0-beta.18",
        "@grpc/grpc-js": "^1.9.3",
        "@grpc/proto-loader": "^0.7.9",
        "@nestjs/cli": "^9.5.0",
@@ -2972,9 +2972,9 @@
      }
    },
    "node_modules/@dadosfera/protospack-v2": {
-      "version": "3.38.0-beta.17",
-      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.38.0-beta.17.tgz",
-      "integrity": "sha512-3E6m0ZKy5QOfuuTig05RC7Kj+zrh1GqZlTp6aePECDTrIyLhp2GIrALqJuD3LEjT+LG6eA88X2b4iXfV17Qmkg==",
+      "version": "3.38.0-beta.18",
+      "resolved": "https://dadosfera-611330257153.d.codeartifact.us-east-1.amazonaws.com/npm/dadosfera-npm/@dadosfera/protospack-v2/-/protospack-v2-3.38.0-beta.18.tgz",
+      "integrity": "sha512-rD2UOKa0P17A6YXIpclXF7F9b86mhRNE7fImTrbFamOcHpGmXBBVU8U53mCfLzzOA+MdDZ4/1uDNurCyQCjsLQ==",
      "license": "ISC",
      "dependencies": {
        "@grpc/grpc-js": "^1.9.3",
@@ -35,7 +35,7 @@
    "@aws-sdk/signature-v4": "^3.370.0",
    "@dadosfera/dadosfera-logs": "^1.0.0-beta.4",
    "@dadosfera/protospack": "2.5.3",
-    "@dadosfera/protospack-v2": "3.38.0-beta.17",
+    "@dadosfera/protospack-v2": "3.38.0-beta.18",
    "@grpc/grpc-js": "^1.9.3",
    "@grpc/proto-loader": "^0.7.9",
    "@nestjs/cli": "^9.5.0",
@@ -630,21 +630,39 @@ export class PlatformApiController {
  @ApiOperation({ summary: 'Execute a pipeline' })
  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
  async executePipeline(@Body() body: any, @User() user: RequestUser) {
-    return this.platformApiService.proxy('POST', '/pipeline/execute', user, body);
+    // Inject customer_id (actually customer_name) into body for Platform-API
+    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
+    const enrichedBody = {
+      ...body,
+      customer_id: user.customer_name,
+    };
+    return this.platformApiService.proxy('POST', '/pipeline/execute', user, enrichedBody);
  }

  @Post('pipeline/pause')
  @ApiOperation({ summary: 'Pause a pipeline' })
  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
  async pausePipeline(@Body() body: any, @User() user: RequestUser) {
-    return this.platformApiService.proxy('POST', '/pipeline/pause', user, body);
+    // Inject customer_id (actually customer_name) into body for Platform-API
+    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
+    const enrichedBody = {
+      ...body,
+      customer_id: user.customer_name,
+    };
+    return this.platformApiService.proxy('POST', '/pipeline/pause', user, enrichedBody);
  }

  @Post('pipeline/unpause')
  @ApiOperation({ summary: 'Unpause a pipeline' })
  @RequireAllPermissions(PERMISSIONS_GROUPS.PIPELINE.permissions.UPDATE)
  async unpausePipeline(@Body() body: any, @User() user: RequestUser) {
-    return this.platformApiService.proxy('POST', '/pipeline/unpause', user, body);
+    // Inject customer_id (actually customer_name) into body for Platform-API
+    // Note: Platform-API was created before customer_id existed, so it expects customer_name in the customer_id field
+    const enrichedBody = {
+      ...body,
+      customer_id: user.customer_name,
+    };
+    return this.platformApiService.proxy('POST', '/pipeline/unpause', user, enrichedBody);
  }

  @Put('pipeline/:pipelineId/memory')
@@ -38,6 +38,12 @@ export class User {
  department?: string;
  @ApiProperty()
  hierarchy?: string;
+  @ApiProperty()
+  bio?: string;
+  @ApiProperty()
+  companyName?: string;
+  @ApiProperty()
+  companySite?: string;
  @ApiPropertyOptional()
  customer?: Customer;
  @ApiProperty()
@@ -266,7 +266,6 @@ export class UsersController {
  }

  @Patch(':id')
-  @RequireAllPermissions(PERMISSIONS_GROUPS.USERS.permissions.ADMIN)
  @ApiOkResponse({ type: UpdateUserRes })
  async updateUser(
    @User() user: RequestUser,
@@ -274,6 +273,18 @@ export class UsersController {
    @Param('id') id: string,
    @Language() language: LanguageEnum,
  ) {
+
+    const isSameUser = user.user_id === id;
+    const isSuperAdmin = user.permissions.includes(PERMISSIONS_GROUPS.USERS.permissions.ADMIN.seqid)
+    if (!isSameUser && !isSuperAdmin) {
+      throw new ErrorBuilder(ErrorCodes.AUTH.FORBIDDEN);
+    }
+
+    if (isSameUser && !isSuperAdmin && body.roleNames) {
+      // Prevent users from updating their own roles
+      delete body.roleNames;
+    }
+
    this.logger.info('updateUser', { user });
    this.userService.setLanguage(language);
    return await this.userService.updateUser(body, id, user.customer_id);
@@ -149,7 +149,7 @@ export class UsersService implements OnModuleInit {

  async updateUser(req: UpdateUserReq, id: string, customerId: string) {
    const { roleNames, ...updateUserDTO } = req;
-    if (roleNames) {
+    if (roleNames && roleNames.length > 0) {
      await this.setRoles({ roleNames, userId: id }, customerId);
    }
Author	SHA1	Message	Date
Marcos Rodrigues	76485f929d	FIX: user patch route	2025-12-26 17:53:02 -03:00
Marcos Rodrigues Silva	1f9d0c29ec	Merge pull request #425 from dadosfera/beta Beta	2025-12-18 17:42:10 -03:00
Marcos Rodrigues Silva	31f8c2c1a6	Merge pull request #424 from dadosfera/feature/user-form FEAT: protected update route with admin seqid or if user request to e…	2025-12-18 12:33:29 -03:00
Marcos Rodrigues	8b93d4e97b	FEAT: protected update route with admin seqid or if user request to equal a jwt user id claim	2025-12-18 12:32:53 -03:00
Rafael Santana	adeb022818	Merge pull request #423 from dadosfera/fix/reference-column-object-format FIX: inject customer_id in pipeline execute/pause/unpause routes	2025-12-18 10:53:31 -03:00
RafaelandClaude Opus 4.5	f61c241dde	FIX: inject customer_id in pipeline execute/pause/unpause routes Users no longer need to provide customer_id in the request body for execute, pause, and unpause pipeline operations - it's now automatically injected from the authenticated user's session. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2025-12-18 10:30:09 -03:00
Marcos Rodrigues Silva	e326cab44d	Merge pull request #422 from dadosfera/feature/user-form FIX: send new user info	2025-12-18 10:29:09 -03:00
Marcos Rodrigues	61109f8ae9	FIX: send new user info	2025-12-18 10:24:29 -03:00
Marcos Rodrigues Silva	e7f410831f	Merge pull request #395 from dadosfera/beta Beta	2025-12-01 17:47:24 -03:00