Add security policy for general endpoints

[MarceloRGonc]

Fixes OPS-3886.

[linear]

OPS-3886 Apply security policy to general endpoints

[Copilot]

Pull request overview

This PR introduces project-scoped route security policies to several existing API endpoints, aiming to standardize how authorization intent (principal types + permissions) is expressed per route.

Changes:

• Add getProjectScopedRoutePolicy(...) configuration to selected endpoints (user settings, trigger events, folders, form retrieval, flow-version test output).
• Update folder endpoints to use folder-specific permissions (READ_FOLDER / WRITE_FOLDER) in the new policy configuration.
• Add explicit request options object for the “Get user settings” route to align with the existing “Upsert user settings” configuration pattern.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/server/api/src/app/user-settings/user-settings.module.ts	Adds route options + project-scoped security policy for GET user settings; adds policy to upsert route config.
packages/server/api/src/app/flows/trigger-events/trigger-event.module.ts	Adds project-scoped route policy (principal + flow permissions) to trigger-events routes.
packages/server/api/src/app/flows/folder/folder.module.ts	Adds project-scoped route policy to folder routes and switches to folder-specific permissions.
packages/server/api/src/app/flows/flow/form/form.controller.ts	Adds project-scoped route policy requiring READ_FLOW to form retrieval endpoint.
packages/server/api/src/app/flows/flow/flow-version.controller.ts	Adds project-scoped route policy requiring TEST_STEP_FLOW to test-output endpoints.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud