From 5cd7cce787a6638b0bd96457934cf16a1140a546 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Fri, 15 Nov 2024 12:39:12 +1100
Subject: [PATCH] [8.x] Unauthorized route migration for routes owned by
 kibana-cloud-security-posture (#198353) (#200282)

# Backport

This will backport the following commits from `main` to `8.x`:
- [Unauthorized route migration for routes owned by
kibana-cloud-security-posture
(#198353)](https://github.com/elastic/kibana/pull/198353)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Kibana
Machine","email":"42973632+kibanamachine@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-11-14T23:50:01Z","message":"Unauthorized
route migration for routes owned by kibana-cloud-security-posture
(#198353)\n\n### Authz API migration for unauthorized routes\r\n\r\nThis
PR migrates unauthorized routes owned by your team to a new\r\nsecurity
configuration.\r\nPlease refer to the documentation for more
information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: Paulo Silva
<paulo.henrique@elastic.co>","sha":"767a4bbd406bb5d87ca39d1b9a474820343147bb","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["enhancement","release_note:skip","Feature:Security/Authorization","v9.0.0","Team:Cloud
Security","backport:prev-minor","Authz: API
migration"],"title":"Unauthorized route migration for routes owned by
kibana-cloud-security-posture","number":198353,"url":"https://github.com/elastic/kibana/pull/198353","mergeCommit":{"message":"Unauthorized
route migration for routes owned by kibana-cloud-security-posture
(#198353)\n\n### Authz API migration for unauthorized routes\r\n\r\nThis
PR migrates unauthorized routes owned by your team to a new\r\nsecurity
configuration.\r\nPlease refer to the documentation for more
information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: Paulo Silva
<paulo.henrique@elastic.co>","sha":"767a4bbd406bb5d87ca39d1b9a474820343147bb"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/198353","number":198353,"mergeCommit":{"message":"Unauthorized
route migration for routes owned by kibana-cloud-security-posture
(#198353)\n\n### Authz API migration for unauthorized routes\r\n\r\nThis
PR migrates unauthorized routes owned by your team to a new\r\nsecurity
configuration.\r\nPlease refer to the documentation for more
information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: Paulo Silva
<paulo.henrique@elastic.co>","sha":"767a4bbd406bb5d87ca39d1b9a474820343147bb"}}]}]
BACKPORT-->
---
 .../plugins/kubernetes_security/server/routes/aggregate.ts  | 5 +++++
 x-pack/plugins/kubernetes_security/server/routes/count.ts   | 5 +++++
 .../server/routes/multi_terms_aggregate.ts                  | 5 +++++
 .../session_view/server/routes/alert_status_route.ts        | 5 +++++
 x-pack/plugins/session_view/server/routes/alerts_route.ts   | 5 +++++
 .../session_view/server/routes/get_total_io_bytes_route.ts  | 6 ++++++
 .../plugins/session_view/server/routes/io_events_route.ts   | 6 ++++++
 .../session_view/server/routes/process_events_route.ts      | 6 ++++++
 8 files changed, 43 insertions(+)

diff --git a/x-pack/plugins/kubernetes_security/server/routes/aggregate.ts b/x-pack/plugins/kubernetes_security/server/routes/aggregate.ts
index f83ddc818cbb4..4ddb828b68976 100644
--- a/x-pack/plugins/kubernetes_security/server/routes/aggregate.ts
+++ b/x-pack/plugins/kubernetes_security/server/routes/aggregate.ts
@@ -38,6 +38,11 @@ export const registerAggregateRoute = (router: IRouter, logger: Logger) => {
     .addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            requiredPrivileges: ['securitySolution'],
+          },
+        },
         validate: {
           request: {
             query: schema.object({
diff --git a/x-pack/plugins/kubernetes_security/server/routes/count.ts b/x-pack/plugins/kubernetes_security/server/routes/count.ts
index 0922adeb0cf45..b73452e8e45fc 100644
--- a/x-pack/plugins/kubernetes_security/server/routes/count.ts
+++ b/x-pack/plugins/kubernetes_security/server/routes/count.ts
@@ -28,6 +28,11 @@ export const registerCountRoute = (router: IRouter, logger: Logger) => {
     .addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            requiredPrivileges: ['securitySolution'],
+          },
+        },
         validate: {
           request: {
             query: schema.object({
diff --git a/x-pack/plugins/kubernetes_security/server/routes/multi_terms_aggregate.ts b/x-pack/plugins/kubernetes_security/server/routes/multi_terms_aggregate.ts
index 83f5b70efe051..b4a0271b63edc 100644
--- a/x-pack/plugins/kubernetes_security/server/routes/multi_terms_aggregate.ts
+++ b/x-pack/plugins/kubernetes_security/server/routes/multi_terms_aggregate.ts
@@ -35,6 +35,11 @@ export const registerMultiTermsAggregateRoute = (router: IRouter, logger: Logger
     .addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            requiredPrivileges: ['securitySolution'],
+          },
+        },
         validate: {
           request: {
             query: schema.object({
diff --git a/x-pack/plugins/session_view/server/routes/alert_status_route.ts b/x-pack/plugins/session_view/server/routes/alert_status_route.ts
index e0b95f9705e9d..64192198b5e46 100644
--- a/x-pack/plugins/session_view/server/routes/alert_status_route.ts
+++ b/x-pack/plugins/session_view/server/routes/alert_status_route.ts
@@ -31,6 +31,11 @@ export const registerAlertStatusRoute = (
     .addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            requiredPrivileges: ['securitySolution'],
+          },
+        },
         validate: {
           request: {
             query: schema.object({
diff --git a/x-pack/plugins/session_view/server/routes/alerts_route.ts b/x-pack/plugins/session_view/server/routes/alerts_route.ts
index c6b7fd8db7896..c875236989efe 100644
--- a/x-pack/plugins/session_view/server/routes/alerts_route.ts
+++ b/x-pack/plugins/session_view/server/routes/alerts_route.ts
@@ -36,6 +36,11 @@ export const registerAlertsRoute = (
     .addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            requiredPrivileges: ['securitySolution'],
+          },
+        },
         validate: {
           request: {
             query: schema.object({
diff --git a/x-pack/plugins/session_view/server/routes/get_total_io_bytes_route.ts b/x-pack/plugins/session_view/server/routes/get_total_io_bytes_route.ts
index 50f36ac47f5a4..7d54654c89cdc 100644
--- a/x-pack/plugins/session_view/server/routes/get_total_io_bytes_route.ts
+++ b/x-pack/plugins/session_view/server/routes/get_total_io_bytes_route.ts
@@ -22,6 +22,12 @@ export const registerGetTotalIOBytesRoute = (router: IRouter, logger: Logger) =>
     .addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            enabled: false,
+            reason: `This route delegates authorization to Elasticsearch and it's not tied to a Kibana privilege.`,
+          },
+        },
         validate: {
           request: {
             query: schema.object({
diff --git a/x-pack/plugins/session_view/server/routes/io_events_route.ts b/x-pack/plugins/session_view/server/routes/io_events_route.ts
index 9810f9da5aa77..3e73517a978c3 100644
--- a/x-pack/plugins/session_view/server/routes/io_events_route.ts
+++ b/x-pack/plugins/session_view/server/routes/io_events_route.ts
@@ -29,6 +29,12 @@ export const registerIOEventsRoute = (router: IRouter, logger: Logger) => {
     .addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            enabled: false,
+            reason: `This route delegates authorization to Elasticsearch and it's not tied to a Kibana privilege.`,
+          },
+        },
         validate: {
           request: {
             query: schema.object({
diff --git a/x-pack/plugins/session_view/server/routes/process_events_route.ts b/x-pack/plugins/session_view/server/routes/process_events_route.ts
index bc6b24fc36bc5..b30b3b6ddcc51 100644
--- a/x-pack/plugins/session_view/server/routes/process_events_route.ts
+++ b/x-pack/plugins/session_view/server/routes/process_events_route.ts
@@ -43,6 +43,12 @@ export const registerProcessEventsRoute = (
     .addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            enabled: false,
+            reason: `This route delegates authorization to Elasticsearch and it's not tied to a Kibana privilege.`,
+          },
+        },
         validate: {
           request: {
             query: schema.object({