Add security policy to Worker-Only endpoints (#2083)

Fixes OPS-3867.

Author: MarceloRGonc

packages/server/api/src/app/workers/machine/machine-controller.ts

@@ -6,6 +6,7 @@ import { system } from '@openops/server-shared';
 import {
   OpsEdition,
   PrincipalType,
+  WORKER_ROUTE_POLICY,
   WorkerMachineHealthcheckRequest,
   WorkerMachineType,
   WorkerPrincipal,
@@ -69,6 +70,7 @@ const GenerateWorkerTokenParams = {
 const HeartbeatParams = {
   config: {
     allowedPrincipals: [PrincipalType.WORKER],
+    security: WORKER_ROUTE_POLICY,
   },
   schema: {
     description:

packages/server/api/src/app/workers/worker-controller.ts

@@ -21,6 +21,7 @@ import {
   PrincipalType,
   ProgressUpdateType,
   RunEnvironment,
+  WORKER_ROUTE_POLICY,
 } from '@openops/shared';
 import { accessTokenManager } from '../authentication/context/access-token-manager';
 import { flowRunService } from '../flows/flow-run/flow-run-service';
@@ -37,6 +38,7 @@ export const flowWorkerController: FastifyPluginAsyncTypebox = async (app) => {
     {
       config: {
         allowedPrincipals: [PrincipalType.WORKER],
+        security: WORKER_ROUTE_POLICY,
       },
       logLevel: 'silent',
       schema: {
@@ -63,6 +65,7 @@ export const flowWorkerController: FastifyPluginAsyncTypebox = async (app) => {
     {
       config: {
         allowedPrincipals: [PrincipalType.WORKER],
+        security: WORKER_ROUTE_POLICY,
       },
       schema: {
         description:
@@ -81,6 +84,7 @@ export const flowWorkerController: FastifyPluginAsyncTypebox = async (app) => {
     {
       config: {
         allowedPrincipals: [PrincipalType.WORKER],
+        security: WORKER_ROUTE_POLICY,
       },
       schema: {
         description:
@@ -104,6 +108,7 @@ export const flowWorkerController: FastifyPluginAsyncTypebox = async (app) => {
     {
       config: {
         allowedPrincipals: [PrincipalType.WORKER],
+        security: WORKER_ROUTE_POLICY,
       },
       schema: {
         description:
@@ -133,6 +138,7 @@ export const flowWorkerController: FastifyPluginAsyncTypebox = async (app) => {
     {
       config: {
         allowedPrincipals: [PrincipalType.WORKER],
+        security: WORKER_ROUTE_POLICY,
       },
       schema: {
         description:
@@ -169,6 +175,7 @@ export const flowWorkerController: FastifyPluginAsyncTypebox = async (app) => {
     {
       config: {
         allowedPrincipals: [PrincipalType.WORKER],
+        security: WORKER_ROUTE_POLICY,
       },
       schema: {
         description:
@@ -213,6 +220,7 @@ export const flowWorkerController: FastifyPluginAsyncTypebox = async (app) => {
     {
       config: {
         allowedPrincipals: [PrincipalType.WORKER],
+        security: WORKER_ROUTE_POLICY,
       },
       schema: {
         description:

packages/shared/src/lib/authentication/model/principal-type.ts

@@ -52,3 +52,13 @@ export const ENGINE_ROUTE_POLICY: Readonly<UnscopedRoutePolicy> = Object.freeze(
     } as UnscopedAuthorizationPolicy,
   },
 );
+
+export const WORKER_ROUTE_POLICY: Readonly<UnscopedRoutePolicy> = Object.freeze(
+  {
+    routeAccessType: RouteAccessType.AUTHENTICATED,
+    authorization: {
+      authorizationScope: AuthorizationScope.UNSCOPED,
+      allowedPrincipals: [PrincipalType.WORKER],
+    } as UnscopedAuthorizationPolicy,
+  },
+);