Apply security policy to flow endpoints (#2098)

Fixes OPS-3884.

Author: MarceloRGonc

packages/server/api/src/app/flows/flow.module.ts

@@ -31,6 +31,7 @@ export const flowModule: FastifyPluginAsyncTypebox = async (app) => {
   await app.register(flowVersionController, { prefix: '/v1/flow-versions' });
   await app.register(flowController, { prefix: '/v1/flows' });
   await app.register(testController, { prefix: '/v1/test' });
+
   websocketService.addListener(WebsocketServerEvent.TEST_FLOW_RUN, (socket) => {
     return async (data: TestFlowRunRequestBody) => {
       let principal;
@@ -82,6 +83,7 @@ export const flowModule: FastifyPluginAsyncTypebox = async (app) => {
       }
     };
   });
+
   websocketService.addListener(WebsocketServerEvent.TEST_STEP_RUN, (socket) => {
     return async (data: CreateStepRunRequestBody) => {
       let principal;

packages/server/api/src/app/flows/flow/flow-version.controller.ts

@@ -15,6 +15,7 @@ import {
   UpdateFlowVersionRequest,
 } from '@openops/shared';
 import { StatusCodes } from 'http-status-codes';
+import { getProjectScopedRoutePolicy } from '../../core/security/route-policies/route-security-policy-factory';
 import { validateFlowVersionBelongsToProject } from '../common/flow-version-validation';
 import { flowVersionService } from '../flow-version/flow-version.service';
 import { flowStepTestOutputService } from '../step-test-output/flow-step-test-output.service';
@@ -25,6 +26,12 @@ export const flowVersionController: FastifyPluginAsyncTypebox = async (
   fastify.post(
     '/:flowVersionId/trigger',
     {
+      config: {
+        security: getProjectScopedRoutePolicy({
+          allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
+          permission: Permission.WRITE_FLOW,
+        }),
+      },
       schema: {
         description:
           'Updates the trigger configuration for a specific flow version',
@@ -243,7 +250,10 @@ export const flowVersionController: FastifyPluginAsyncTypebox = async (
 const GetLatestVersionsByConnectionRequestOptions = {
   config: {
     allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
-    permission: Permission.READ_FLOW,
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
+      permission: Permission.READ_FLOW,
+    }),
   },
   schema: {
     operationId: 'List Flows By Connection',

packages/server/api/src/app/flows/flow/flow.controller.ts

@@ -32,6 +32,7 @@ import {
 } from '@openops/shared';
 import { StatusCodes } from 'http-status-codes';
 import { entitiesMustBeOwnedByCurrentProject } from '../../authentication/authorization';
+import { getProjectScopedRoutePolicy } from '../../core/security/route-policies/route-security-policy-factory';
 import { projectService } from '../../project/project-service';
 import { sendWorkflowCreatedFromTemplateEvent } from '../../telemetry/event-models';
 import { flowRunService } from '../flow-run/flow-run-service';
@@ -266,7 +267,10 @@ async function extractUserIdFromPrincipal(
 const CreateFlowRequestOptions = {
   config: {
     allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
-    permission: Permission.WRITE_FLOW,
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
+      permission: Permission.WRITE_FLOW,
+    }),
   },
   schema: {
     tags: ['flows'],
@@ -282,7 +286,10 @@ const CreateFlowRequestOptions = {
 
 const UpdateFlowRequestOptions = {
   config: {
-    permission: Permission.UPDATE_FLOW_STATUS,
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
+      permission: Permission.UPDATE_FLOW_STATUS,
+    }),
   },
   schema: {
     tags: ['flows'],
@@ -303,7 +310,14 @@ const ListFlowsRequestOptions = {
       PrincipalType.SERVICE,
       PrincipalType.WORKER,
     ],
-    permission: Permission.READ_FLOW,
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [
+        PrincipalType.USER,
+        PrincipalType.SERVICE,
+        PrincipalType.WORKER,
+      ],
+      permission: Permission.READ_FLOW,
+    }),
   },
   schema: {
     operationId: 'List Workflows',
@@ -321,6 +335,10 @@ const ListFlowsRequestOptions = {
 const CountFlowsRequestOptions = {
   config: {
     allowedPrincipals: [PrincipalType.SERVICE, PrincipalType.USER],
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
+      permission: Permission.READ_FLOW,
+    }),
   },
   schema: {
     operationId: 'Get Flow Count',
@@ -331,6 +349,13 @@ const CountFlowsRequestOptions = {
 };
 
 const GetFlowVersionRequestOptions = {
+  config: {
+    allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
+      permission: Permission.READ_FLOW,
+    }),
+  },
   schema: {
     tags: ['flows'],
     description:
@@ -347,6 +372,12 @@ const GetFlowVersionRequestOptions = {
 };
 
 const GetFlowTemplateRequestOptions = {
+  config: {
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
+      permission: Permission.READ_FLOW,
+    }),
+  },
   schema: {
     params: Type.Object({
       id: OpenOpsId,
@@ -361,7 +392,10 @@ const GetFlowTemplateRequestOptions = {
 const GetFlowRequestOptions = {
   config: {
     allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
-    permission: Permission.READ_FLOW,
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
+      permission: Permission.READ_FLOW,
+    }),
   },
   schema: {
     operationId: 'Get Flow Details',
@@ -382,7 +416,10 @@ const GetFlowRequestOptions = {
 const DeleteFlowRequestOptions = {
   config: {
     allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
-    permission: Permission.WRITE_FLOW,
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER, PrincipalType.SERVICE],
+      permission: Permission.WRITE_FLOW,
+    }),
   },
   schema: {
     tags: ['flows'],
@@ -401,7 +438,10 @@ const DeleteFlowRequestOptions = {
 const RunFlowRequestOptions = {
   config: {
     allowedPrincipals: [PrincipalType.USER],
-    permission: Permission.WRITE_FLOW,
+    security: getProjectScopedRoutePolicy({
+      allowedPrincipals: [PrincipalType.USER],
+      permission: Permission.TEST_RUN_FLOW,
+    }),
     preSerializationHook: entitiesMustBeOwnedByCurrentProject,
   },
   schema: {