Add security policy for unscoped endpoints (#2099)

Fixes OPS-3885.

Author: MarceloRGonc

packages/server/api/src/app/ai/providers/ai-providers.controller.ts

@@ -1,6 +1,4 @@
 import { FastifyPluginAsyncTypebox } from '@fastify/type-provider-typebox';
-import { Type } from '@sinclair/typebox';
-
 import {
   getAiProvider,
   getAvailableProvidersWithModels,
@@ -10,6 +8,8 @@ import {
   GetProvidersResponse,
   PrincipalType,
 } from '@openops/shared';
+import { Type } from '@sinclair/typebox';
+import { getUnscopedRoutePolicy } from '../../core/security/route-policies/route-security-policy-factory';
 
 export const aiProvidersController: FastifyPluginAsyncTypebox = async (app) => {
   app.get(
@@ -37,6 +37,7 @@ export const aiProvidersController: FastifyPluginAsyncTypebox = async (app) => {
 const ListAiProvidersRequest = {
   config: {
     allowedPrincipals: [PrincipalType.USER],
+    security: getUnscopedRoutePolicy([PrincipalType.USER]),
   },
   schema: {
     tags: ['ai-providers'],
@@ -48,6 +49,7 @@ const ListAiProvidersRequest = {
 const GetAiProviderRequest = {
   config: {
     allowedPrincipals: [PrincipalType.USER],
+    security: getUnscopedRoutePolicy([PrincipalType.USER]),
   },
   schema: {
     tags: ['ai-providers'],

packages/server/api/src/app/user/user.module.ts

@@ -1,17 +1,19 @@
 import { FastifyPluginAsyncTypebox } from '@fastify/type-provider-typebox';
 import { PrincipalType, UpdateTrackingRequestBody } from '@openops/shared';
 import { FastifyRequest } from 'fastify';
+import { getUnscopedRoutePolicy } from '../core/security/route-policies/route-security-policy-factory';
 import { userService } from './user-service';
 
 export const userModule: FastifyPluginAsyncTypebox = async (app) => {
   await app.register(usersController, { prefix: '/v1/users' });
 };
 
 const usersController: FastifyPluginAsyncTypebox = async (app) => {
-  app.get('/me', async (request: FastifyRequest) => {
+  app.get('/me', MeRequestOptions, async (request: FastifyRequest) => {
     const user = await userService.getMetaInfo({
       principal: request.principal,
     });
+
     return user;
   });
 
@@ -41,9 +43,17 @@ const usersController: FastifyPluginAsyncTypebox = async (app) => {
   );
 };
 
+const MeRequestOptions = {
+  config: {
+    allowedPrincipals: [PrincipalType.USER],
+    security: getUnscopedRoutePolicy([PrincipalType.USER]),
+  },
+};
+
 const UpdateTrackingRequestOptions = {
   config: {
     allowedPrincipals: [PrincipalType.USER],
+    security: getUnscopedRoutePolicy([PrincipalType.USER]),
   },
   schema: {
     body: UpdateTrackingRequestBody,