Apply security policy to auth controller (#2084)

Fixes OPS-3876.

Author: MarceloRGonc

packages/server/api/src/app/authentication/authentication.controller.ts

@@ -8,13 +8,18 @@ import {
   ALL_PRINCIPAL_TYPES,
   createAuthResponse,
   OpsEdition,
+  Permission,
   PrincipalType,
   Provider,
   PUBLIC_ROUTE_POLICY,
   SignInRequest,
   SignUpRequest,
 } from '@openops/shared';
 import { StatusCodes } from 'http-status-codes';
+import {
+  getOrganizationScopedRoutePolicy,
+  getProjectScopedRoutePolicy,
+} from '../core/security/route-policies/route-security-policy-factory';
 import { analyticsDashboardService } from '../openops-analytics/analytics-dashboard-service';
 import { resolveOrganizationIdForAuthnRequest } from '../organization/organization-utils';
 import { userService } from '../user/user-service';
@@ -35,6 +40,10 @@ export const GetBlockRequestParams = Type.Object({
 const AnalyticsGuestTokenRequestOptions = {
   config: {
     allowedPrincipals: [PrincipalType.USER],
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER],
+      permission: Permission.WRITE_ANALYTICS,
+    }),
   },
   schema: {
     description:
@@ -66,20 +75,32 @@ export const authenticationController: FastifyPluginAsyncTypebox = async (
   );
 
   if (analyticsEnabled) {
-    app.get('/analytics-embed-id', async (request, reply) => {
-      const { access_token } =
-        await analyticsAuthenticationService.authenticateAnalyticsRequest(
-          request.principal.id,
-          request.principal.projectId,
-        );
-
-      const embedId =
-        await analyticsDashboardService.fetchFinopsDashboardEmbedId(
-          access_token,
-        );
-
-      return reply.send(embedId);
-    });
+    app.get(
+      '/analytics-embed-id',
+      {
+        config: {
+          allowedPrincipals: [PrincipalType.USER],
+          security: getProjectScopedRoutePolicy({
+            allowedPrincipals: [PrincipalType.USER],
+            permission: Permission.WRITE_ANALYTICS,
+          }),
+        },
+      },
+      async (request, reply) => {
+        const { access_token } =
+          await analyticsAuthenticationService.authenticateAnalyticsRequest(
+            request.principal.id,
+            request.principal.projectId,
+          );
+
+        const embedId =
+          await analyticsDashboardService.fetchFinopsDashboardEmbedId(
+            access_token,
+          );
+
+        return reply.send(embedId);
+      },
+    );
 
     app.get(
       '/analytics-guest-token',
@@ -159,6 +180,10 @@ const rateLimitOptions: RateLimitOptions = {
 const SignUpRequestOptions = {
   config: {
     allowedPrincipals: [PrincipalType.USER],
+    security: getOrganizationScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER],
+      permission: Permission.WRITE_USER,
+    }),
     rateLimit: rateLimitOptions,
   },
   schema: {

packages/server/api/test/unit/authentication/authentication.controller.test.ts

@@ -108,7 +108,7 @@ describe('authenticationController analytics routes', () => {
       ([path]) => path === '/analytics-embed-id',
     );
     expect(embedRoute).toBeDefined();
-    expect(embedRoute?.[1]).toEqual(expect.any(Function));
+    expect(embedRoute?.[2]).toEqual(expect.any(Function));
 
     const guestRoute = app.get.mock.calls.find(
       ([path]) => path === '/analytics-guest-token',

packages/shared/src/lib/common/security/permission.ts

@@ -27,4 +27,7 @@ export enum Permission {
 
   // Tables
   WRITE_TABLE = 'table:write',
+
+  // Analytics
+  WRITE_ANALYTICS = 'analytics:write',
 }