Merge pull request #400 from dadosfera/fix/redis-tls-configurable

UPDATE: force deployment

README.md

@@ -3,6 +3,7 @@
 </p>
 
 
+
 # Maestro
 
 Maestro é a API principal da Dadosfera. É responsável pela comunicação do Frontend com nossos microsserviços.

deploy/helm-chart/templates/deployment.yaml

@@ -104,6 +104,8 @@ spec:
               value: {{ .Values.maestro.redis_host }}
             - name: REDIS_PORT
               value: "{{ .Values.maestro.redis_port }}"
+            - name: REDIS_TLS
+              value: "{{ .Values.maestro.redis_tls }}"
             - name: JWT_PRIVATE_KEY
               valueFrom:
                 secretKeyRef:

deploy/helm-chart/values.yaml

@@ -48,6 +48,7 @@ maestro:
   redis_host: "aaapzppmlyamkocqwstpo7zvopczyyiyuy6xzm2g6c5k4mq3a66be4a-0.redis.sa-saopaulo-1.oci.oraclecloud.com"
   redis_port: "6379"
   redis_database: "0"
+  redis_tls: "true"
   cookie_secret: "13cc5e136d3074bcc05bec8697092ec1f5f376bf"
 autoscaling:
   enabled: false

environment.d.ts

@@ -16,6 +16,7 @@ declare global {
       OPEN_CUSTOMER_ID: string;
       DEDICATED_PROXY: string;
       COOKIE_SECRET: string;
+      REDIS_TLS?: string;
     }
   }
 }

src/modules/auth/auth.controller.ts

@@ -54,7 +54,6 @@ import jwt, { JwtPayload } from 'jsonwebtoken';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { Language } from 'src/decorators/language.decorator';
 import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
-import { Cookie } from 'express-session';
 
 type CookiesValues = {
   accessToken?: string;
@@ -498,29 +497,10 @@ export class AuthController {
     const userId = req.cookies['ddf-user-id'];
 
     this.logger.info('Has cookie: ' + Boolean(accessToken))
-    let payload: any;
-    let userInfo: any = {};
     try {
       // Decodifica e valida o JWT de acesso
-      const decoded: any = accessToken && jwt.decode(accessToken, { complete: true });
-      if (!decoded) throw new Error('Invalid token')
-      const { kid } = decoded.header;
-      // Busca a chave pública
-      const { keys } = await this.authClient.getPublicKeys();
-      const pemValue = keys.find((k) => k.kid === kid)?.pem;
-      if (!pemValue) throw new Error('Public key not found');
-      jwt.verify(accessToken, pemValue);
-      payload = decoded.payload;
-      userInfo = {
-        id: payload.user_id,
-        name: payload.username,
-        customer: {
-          id: payload.customer_id,
-          name: payload.customer_name,
-          tier: payload.customer_tier,
-        }
-      };
-      return res.status(200).json(userInfo);
+      const userDto = await this.authClient.extractUserFrom(accessToken);
+      return res.status(200).json(userDto);
     } catch (err) {
       this.logger.error(err.message);
       const refreshToken = req.cookies['ddf-refresh-auth'];
@@ -545,18 +525,8 @@ export class AuthController {
           userId
         });
         // Decodifica novo token
-        const decoded: any = jwt.decode(data.accessToken, { complete: true });
-        const payload = decoded.payload;
-        userInfo = {
-          id: payload.user_id,
-          name: payload.username,
-          customer: {
-            id: payload.customer_id,
-            name: payload.customer_name,
-            tier: payload.customer_tier,
-          }
-        };
-        return res.status(200).json(userInfo);
+        const userDto = await this.authClient.extractUserFrom(accessToken);
+        return res.status(200).json(userDto);
       } catch (refreshErr) {
         this.logger.error(refreshErr)
         return res.status(401).json({ error: 'Not authenticated' });

src/modules/auth/auth.service.ts

@@ -4,7 +4,7 @@ import { DadosferaLogger } from '@dadosfera/dadosfera-logs';
 import { lastValueFrom } from 'rxjs';
 
 import { ProtoServices } from '@dadosfera/protospack-v2/dist/lib/Duc';
-import { AuthProtoService as AuthServiceInterface, IdentityProviderProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
+import { AuthProtoService as AuthServiceInterface, IdentityProviderProtoService, UsersProtoService } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/write-service';
 import {
   AuthSnowflakeSignInRequest,
   AuthSignInRequest,
@@ -21,18 +21,18 @@ import {
 } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/messages';
 import { DucClient } from '../duc/client.config';
 import { Metadata } from '@grpc/grpc-js';
-import { BulkEditResponse } from './dtos/login';
-
+import { BulkEditResponse, UserDTO } from './dtos/login';
+import jwt from 'jsonwebtoken';
+import { PackTheMetadata } from 'src/utils/PackTheMetadata';
 
 @Injectable()
 export class AuthClientService implements OnModuleInit {
 
-
   logger: DadosferaLogger;
 
-
   private authService: AuthServiceInterface;
-  private identityProviderService: IdentityProviderProtoService;
+  private userService: UsersProtoService;
+
   constructor(
     @Inject(DadosferaLogger)
     dadosferaLogger: DadosferaLogger,
@@ -46,8 +46,8 @@ export class AuthClientService implements OnModuleInit {
       ProtoServices.AuthProtoService,
     );
 
-    this.identityProviderService = this.grpcClient.getService<IdentityProviderProtoService>(
-      ProtoServices.IdentityProviderProtoService,
+    this.userService = this.grpcClient.getService<UsersProtoService>(
+      ProtoServices.UsersProtoService,
     );
   }
 
@@ -283,4 +283,51 @@ export class AuthClientService implements OnModuleInit {
       throw error;
     }
   }
+
+  private async getUser(id: string, metadata: Metadata) {
+    this.logger.info('getUser');
+    return await lastValueFrom(
+      this.userService.UserFindOneById({ id }, metadata),
+    );
+  }
+
+  public async extractUserFrom(token: string) {
+      const decoded: any = token && jwt.decode(token, { complete: true });
+      if (!decoded) throw new Error('Invalid token');
+
+      const { kid } = decoded.header;
+      // Busca a chave pública
+      const { keys } = await this.getPublicKeys();
+      const pemValue = keys.find((k) => k.kid === kid)?.pem;
+      if (!pemValue)
+          throw new Error('Public key not found');
+      jwt.verify(token, pemValue);
+
+      const payload = decoded.payload;
+      const metadata = PackTheMetadata({
+        customer_id: payload.customer_id
+      })
+
+      const {
+        user
+      } = await this.getUser(
+        payload.user_id,
+        metadata
+      );
+
+      const userDto: UserDTO = {
+          id: user.id,
+          name: user.username,
+          jobTitle: user?.jobTitle || null,
+          department: user?.department || null,
+          hierarchy: user?.hierarchy || null,
+          customer: {
+            id: payload.customer_id,
+            name: payload.customer_name,
+            tier: payload.customer_tier,
+          }
+        };
+
+      return userDto;
+    }
 }

src/modules/auth/dtos/login.ts

@@ -140,3 +140,16 @@ export interface BulkEditResponse {
   successfulUsers: string[];
   failedUsers: string[];
 }
+
+export type UserDTO = {
+  id: string,
+  name: string,
+  jobTitle?: string,
+  department?: string,
+  hierarchy?: string,
+  customer: {
+    id: string,
+    name: string,
+    tier: string,
+  }
+}

src/modules/catalog/catalog.service.ts

@@ -197,9 +197,11 @@ class CatalogService implements OnModuleInit {
   async getUserRolesIds(userId: string) {
     const result = await this.userService.findOneById(userId).catch(() => null);
 
-    const roles_ids = result.user.roles.map((role) => role.id);
+    if (result) {
+      return result.user.roles.map((role) => role.id);
+    }
 
-    return roles_ids;
+    return [];
   }
 
   async searchDataAssets(

src/services/service.module.ts

@@ -14,7 +14,7 @@ import { redisStore } from 'cache-manager-ioredis-yet';
           keyPrefix: 'maestro:sso',
         }
 
-        if (process.env.ENV !== 'local') {  
+        if (process.env.REDIS_TLS === 'true') {
           baseRedisConfig['tls'] = {
             servername: process.env.REDIS_HOST,
           }