Task/restrict health check of AI service to admin (#8326)

* Restrict health check of AI service to admin

* Update changelog

CHANGELOG.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Restricted the health check endpoint of the AI service (`GET api/v1/health/ai`) to administrators
+- Increased the timeout in the health check endpoint of the AI service to 30 seconds
 - Deprecated the `api/v1/access` endpoints in favor of the `api/v1/accesses` endpoints
 
 ### Fixed

apps/api/src/app/__snapshots__/app.module.spec.ts.snap

@@ -539,8 +539,12 @@ exports[`AppModule should keep the security of each route 1`] = `
     "interceptors": [],
   },
   "GET /health/ai": {
-    "guards": [],
+    "guards": [
+      "AuthGuard('jwt')",
+      "HasPermissionGuard",
+    ],
     "interceptors": [],
+    "permission": "accessAdminControl",
   },
   "GET /health/data-enhancer/:name": {
     "guards": [],

apps/api/src/app/app.module.spec.ts

@@ -67,7 +67,6 @@ const PUBLIC_ROUTES = [
   'GET /auth/oidc/callback',
   'GET /benchmarks',
   'GET /health',
-  'GET /health/ai',
   'GET /health/data-enhancer/:name',
   'GET /health/data-provider/:dataSource',
   'GET /health/liveness',

apps/api/src/app/endpoints/health/health.controller.ts

@@ -1,4 +1,6 @@
 import { AiService } from '@ghostfolio/api/app/endpoints/ai/ai.service';
+import { HasPermission } from '@ghostfolio/api/decorators/has-permission.decorator';
+import { HasPermissionGuard } from '@ghostfolio/api/guards/has-permission.guard';
 import { TransformDataSourceInRequestInterceptor } from '@ghostfolio/api/interceptors/transform-data-source-in-request/transform-data-source-in-request.interceptor';
 import {
   AiServiceHealthResponse,
@@ -6,6 +8,7 @@ import {
   DataProviderHealthResponse,
   LivenessHealthResponse
 } from '@ghostfolio/common/interfaces';
+import { permissions } from '@ghostfolio/common/permissions';
 
 import {
   Controller,
@@ -15,11 +18,14 @@ import {
   Logger,
   Param,
   Res,
+  UseGuards,
   UseInterceptors
 } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
 import { DataSource } from '@prisma/client';
 import { Response } from 'express';
 import { StatusCodes, getReasonPhrase } from 'http-status-codes';
+import ms from 'ms';
 
 import { HealthService } from './health.service';
 
@@ -52,12 +58,15 @@ export class HealthController {
   }
 
   @Get('ai')
+  @HasPermission(permissions.accessAdminControl)
+  @UseGuards(AuthGuard('jwt'), HasPermissionGuard)
   public async getHealthOfAiService(
     @Res() response: Response
   ): Promise<Response<AiServiceHealthResponse>> {
     try {
       const { text } = await this.aiService.generateText({
-        prompt: `Reply with the word "OK" and nothing else.`
+        prompt: `Reply with the word "OK" and nothing else.`,
+        requestTimeout: ms('30 seconds')
       });
 
       if (text === 'OK') {

apps/client/src/app/pages/api/api-page.component.ts

@@ -1,3 +1,4 @@
+import { UserService } from '@ghostfolio/client/services/user/user.service';
 import {
   HEADER_KEY_SKIP_INTERCEPTOR,
   HEADER_KEY_TOKEN
@@ -13,6 +14,7 @@ import {
   MarketDataOfMarketsResponse,
   QuotesResponse
 } from '@ghostfolio/common/interfaces';
+import { hasPermission, permissions } from '@ghostfolio/common/permissions';
 import { GfFearAndGreedIndexComponent } from '@ghostfolio/ui/fear-and-greed-index';
 
 import { CommonModule } from '@angular/common';
@@ -24,6 +26,7 @@ import {
 } from '@angular/common/http';
 import {
   ChangeDetectionStrategy,
+  ChangeDetectorRef,
   Component,
   DestroyRef,
   inject,
@@ -57,6 +60,7 @@ export class GfApiPageComponent implements OnInit {
     FetchResult<DataProviderGhostfolioAssetProfileResponse>
   >;
   protected dividends$: Observable<FetchResult<DividendsResponse['dividends']>>;
+  protected hasPermissionToAccessAdminControl: boolean;
   protected historicalData$: Observable<
     FetchResult<HistoricalResponse['historicalData']>
   >;
@@ -72,13 +76,26 @@ export class GfApiPageComponent implements OnInit {
 
   private apiKey: string;
 
+  private readonly changeDetectorRef = inject(ChangeDetectorRef);
   private readonly destroyRef = inject(DestroyRef);
   private readonly http = inject(HttpClient);
+  private readonly userService = inject(UserService);
 
   public ngOnInit() {
     this.apiKey =
       prompt($localize`Please enter your Ghostfolio API key:`) ?? '';
 
+    this.userService.stateChanged
+      .pipe(takeUntilDestroyed(this.destroyRef))
+      .subscribe((state) => {
+        this.hasPermissionToAccessAdminControl = hasPermission(
+          state?.user?.permissions,
+          permissions.accessAdminControl
+        );
+
+        this.changeDetectorRef.markForCheck();
+      });
+
     this.aiServiceHealth$ = this.fetchAiServiceHealth();
     this.assetProfile$ = this.fetchAssetProfile({ symbol: 'AAPL' });
     this.dividends$ = this.fetchDividends({ symbol: 'KO' });

apps/client/src/app/pages/api/api-page.html

@@ -1,6 +1,7 @@
 <div class="container">
   <div class="mb-5 row">
     <div class="col">
+      @if (hasPermissionToAccessAdminControl) {
         <mat-card appearance="outlined" class="mb-3">
           <mat-card-header>
             <mat-card-title>AI Service Health</mat-card-title>
@@ -19,6 +20,7 @@
             }
           </mat-card-content>
         </mat-card>
+      }
       <mat-card appearance="outlined" class="mb-3">
         <mat-card-header>
           <mat-card-title>Status</mat-card-title>