Add security policy for unscoped endpoints

[MarceloRGonc]

Fixes OPS-3885.

[linear]

OPS-3885 Apply security policy to unscoped endpoints

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR addresses OPS-3885 by ensuring previously “unscoped” authenticated endpoints explicitly declare a route security policy, aligning them with the newer route security policy configuration pattern used across the API.

Changes:

• Add config.security using getUnscopedRoutePolicy([PrincipalType.USER]) to the /v1/users/me and /v1/users/tracking-events endpoints.
• Add config.security using getUnscopedRoutePolicy([PrincipalType.USER]) to AI provider listing and detail endpoints.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
packages/server/api/src/app/user/user.module.ts	Adds unscoped authenticated security policy to user “me” and tracking endpoints.
packages/server/api/src/app/ai/providers/ai-providers.controller.ts	Adds unscoped authenticated security policy to AI providers endpoints.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.