Add security policy to Engine-Only endpoints (#2082)

Fixes OPS-3866.

Author: MarceloRGonc

packages/server/api/src/app/app-connection/app-connection-worker-controller.ts

@@ -5,8 +5,10 @@ import {
 import {
   AppConnection,
   ApplicationError,
+  ENGINE_ROUTE_POLICY,
   ErrorCode,
   isNil,
+  PrincipalType,
 } from '@openops/shared';
 import { allowWorkersOnly } from '../authentication/authorization';
 import { appConnectionService } from './app-connection-service/app-connection-service';
@@ -45,6 +47,10 @@ export const appConnectionWorkerController: FastifyPluginCallbackTypebox = (
 };
 
 const GetAppConnectionRequest = {
+  config: {
+    allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
+  },
   schema: {
     params: Type.Object({
       connectionName: Type.String(),

packages/server/api/src/app/core/security/route-policies/route-security-policy.ts

@@ -4,6 +4,7 @@ import {
   PrincipalType,
   PublicRoutePolicy,
   RouteAccessType,
+  UnscopedAuthorizationPolicy,
 } from '@openops/shared';
 import { PropertySource } from './property-source';
 
@@ -31,9 +32,4 @@ export type ProjectAuthorizationPolicy = {
   permission?: Permission;
 };
 
-export type UnscopedAuthorizationPolicy = {
-  authorizationScope: AuthorizationScope.UNSCOPED;
-  allowedPrincipals: readonly PrincipalType[];
-};
-
 export type RouteSecurityPolicy = AuthenticatedRoutePolicy | PublicRoutePolicy;

packages/server/api/src/app/flags/flag.module.ts

@@ -1,6 +1,7 @@
 import { FastifyPluginAsyncTypebox } from '@fastify/type-provider-typebox';
 import {
   ALL_PRINCIPAL_TYPES,
+  ENGINE_ROUTE_POLICY,
   FlagId,
   PrincipalType,
   PUBLIC_ROUTE_POLICY,
@@ -46,6 +47,7 @@ export const flagController: FastifyPluginAsyncTypebox = async (app) => {
     {
       config: {
         allowedPrincipals: [PrincipalType.ENGINE],
+        security: ENGINE_ROUTE_POLICY,
       },
       schema: {
         description:

packages/server/api/src/app/project/project-worker-controller.ts

@@ -1,5 +1,5 @@
 import { FastifyPluginAsyncTypebox } from '@fastify/type-provider-typebox';
-import { PrincipalType } from '@openops/shared';
+import { ENGINE_ROUTE_POLICY, PrincipalType } from '@openops/shared';
 import { projectService } from './project-service';
 
 export const projectWorkerController: FastifyPluginAsyncTypebox = async (
@@ -14,5 +14,6 @@ export const projectWorkerController: FastifyPluginAsyncTypebox = async (
 const GetWorkerProjectRequest = {
   config: {
     allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
   },
 };

packages/server/api/src/app/store-entry/store-entry.controller.ts

@@ -5,6 +5,7 @@ import {
 import { MAX_REQUEST_BODY_BYTES } from '@openops/server-shared';
 import {
   DeleteStoreEntryRequest,
+  ENGINE_ROUTE_POLICY,
   GetStoreEntryRequest,
   PrincipalType,
   PutStoreEntryRequest,
@@ -65,6 +66,10 @@ export const storeEntryController: FastifyPluginAsyncTypebox = async (
 };
 
 const CreateRequest = {
+  config: {
+    allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
+  },
   schema: {
     body: PutStoreEntryRequest,
     description:
@@ -73,6 +78,10 @@ const CreateRequest = {
 };
 
 const GetRequest = {
+  config: {
+    allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
+  },
   schema: {
     querystring: GetStoreEntryRequest,
     description:
@@ -81,6 +90,10 @@ const GetRequest = {
 };
 
 const DeleteStoreRequest = {
+  config: {
+    allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
+  },
   schema: {
     querystring: DeleteStoreEntryRequest,
     description:
@@ -89,6 +102,10 @@ const DeleteStoreRequest = {
 };
 
 const ListRequest = {
+  config: {
+    allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
+  },
   schema: {
     querystring: Type.Object({
       prefix: Type.String(),

packages/server/api/src/app/workers/engine-controller.ts

@@ -14,6 +14,7 @@ import {
 import {
   ApplicationError,
   assertNotNullOrUndefined,
+  ENGINE_ROUTE_POLICY,
   EngineHttpResponse,
   EnginePrincipal,
   ErrorCode,
@@ -55,6 +56,7 @@ export const flowEngineWorker: FastifyPluginAsyncTypebox = async (app) => {
     {
       config: {
         allowedPrincipals: [PrincipalType.ENGINE],
+        security: ENGINE_ROUTE_POLICY,
       },
       schema: {
         description:
@@ -76,6 +78,7 @@ export const flowEngineWorker: FastifyPluginAsyncTypebox = async (app) => {
     {
       config: {
         allowedPrincipals: [PrincipalType.ENGINE],
+        security: ENGINE_ROUTE_POLICY,
       },
       schema: {
         description:
@@ -397,6 +400,7 @@ async function trackExecution(
 const GetFileRequestParams = {
   config: {
     allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
   },
   schema: {
     params: Type.Object({
@@ -408,6 +412,7 @@ const GetFileRequestParams = {
 const UpdateStepProgress = {
   config: {
     allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
   },
   schema: {
     body: UpdateRunProgressRequest,
@@ -417,6 +422,7 @@ const UpdateStepProgress = {
 const SendWebhookResponse = {
   config: {
     allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
   },
   schema: {
     description:
@@ -428,6 +434,7 @@ const SendWebhookResponse = {
 const UpdateFailureCount = {
   config: {
     allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
   },
   schema: {
     description:
@@ -439,6 +446,7 @@ const UpdateFailureCount = {
 const GetLockedVersionRequest = {
   config: {
     allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
   },
   schema: {
     description:
@@ -453,6 +461,7 @@ const GetLockedVersionRequest = {
 const RemoveFlowRequest = {
   config: {
     allowedPrincipals: [PrincipalType.ENGINE],
+    security: ENGINE_ROUTE_POLICY,
   },
   schema: {
     description:

packages/shared/src/lib/authentication/model/principal-type.ts

@@ -25,10 +25,30 @@ export enum RouteAccessType {
   PUBLIC = 'PUBLIC',
 }
 
+export type UnscopedAuthorizationPolicy = {
+  authorizationScope: AuthorizationScope.UNSCOPED;
+  allowedPrincipals: readonly PrincipalType[];
+};
+
+export type UnscopedRoutePolicy = {
+  routeAccessType: RouteAccessType.AUTHENTICATED;
+  authorization: UnscopedAuthorizationPolicy;
+};
+
 export type PublicRoutePolicy = {
   routeAccessType: RouteAccessType.PUBLIC;
 };
 
 export const PUBLIC_ROUTE_POLICY: Readonly<PublicRoutePolicy> = Object.freeze({
   routeAccessType: RouteAccessType.PUBLIC,
 });
+
+export const ENGINE_ROUTE_POLICY: Readonly<UnscopedRoutePolicy> = Object.freeze(
+  {
+    routeAccessType: RouteAccessType.AUTHENTICATED,
+    authorization: {
+      authorizationScope: AuthorizationScope.UNSCOPED,
+      allowedPrincipals: [PrincipalType.ENGINE],
+    } as UnscopedAuthorizationPolicy,
+  },
+);