Add security policy to Engine-Only endpoints

[MarceloRGonc]

Fixes OPS-3866.

[MarceloRGonc]

The file has a preHandler. So this is the same behavior.

app.addHook('preHandler', allowWorkersOnly);

export const allowWorkersOnly: onRequestHookHandler = (request, _res, done) => {
  if (request.principal.type !== PrincipalType.ENGINE) {
    throw new ApplicationError({
      code: ErrorCode.AUTHORIZATION,
      params: {},
    });
  }

  done();
};

[MarceloRGonc]

Same for this file

[linear]

OPS-3866 Apply Security Policy to Engine-Only Endpoints

[Copilot]

Pull request overview

This PR introduces a reusable “engine-only” security policy and applies it to Engine-only API endpoints to make their access rules explicit and consistent (OPS-3866).

Changes:

• Add shared ENGINE_ROUTE_POLICY and supporting unscoped route/policy types in @openops/shared.
• Attach config.security: ENGINE_ROUTE_POLICY to multiple engine-only endpoints (workers, store-entry, project worker, flags, app-connection worker).
• Begin wiring shared UnscopedAuthorizationPolicy into the server route-policy type definitions.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/shared/src/lib/authentication/model/principal-type.ts	Adds unscoped policy types and a shared ENGINE_ROUTE_POLICY.
packages/server/api/src/app/workers/engine-controller.ts	Applies ENGINE_ROUTE_POLICY to engine worker endpoints.
packages/server/api/src/app/store-entry/store-entry.controller.ts	Applies ENGINE_ROUTE_POLICY to store-entry endpoints.
packages/server/api/src/app/project/project-worker-controller.ts	Applies ENGINE_ROUTE_POLICY to the project worker endpoint.
packages/server/api/src/app/flags/flag.module.ts	Applies ENGINE_ROUTE_POLICY to the engine-only flags endpoint.
packages/server/api/src/app/core/security/route-policies/route-security-policy.ts	Imports shared UnscopedAuthorizationPolicy (currently conflicting with a local type).
packages/server/api/src/app/app-connection/app-connection-worker-controller.ts	Applies ENGINE_ROUTE_POLICY to the worker app-connection endpoint.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud