Skip to content

Commit

Permalink
[8.x] Unauthorized route migration for routes owned by kibana-visuali…
Browse files Browse the repository at this point in the history 
…zations,kibana-data-discovery (#198331) (#203031)

# Backport

This will backport the following commits from `main` to `8.x`:
- [Unauthorized route migration for routes owned by
kibana-visualizations,kibana-data-discovery
(#198331)](#198331)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Kibana
Machine","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-04T22:29:15Z","message":"Unauthorized
route migration for routes owned by
kibana-visualizations,kibana-data-discovery (#198331)\n\n### Authz API
migration for unauthorized routes\r\n\r\nThis PR migrates unauthorized
routes owned by your team to a new\r\nsecurity configuration.\r\nPlease
refer to the documentation for more information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n---
EDIT ---\r\n\r\nThis PR also adds two privileges related to saved query
APIs:\r\n`savedQuery:read` and `savedQuery:manage`. These are given by
default to\r\nthe same roles that already have access to the
`query`-type saved\r\nobjects.\r\n\r\n### **Before
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: Lukas Olson
<[email protected]>\r\nCo-authored-by: Matthias Wilhelm
<[email protected]>\r\nCo-authored-by: Marta Bondyra
<[email protected]>\r\nCo-authored-by: Davis
McPhee
<[email protected]>","sha":"56c38bca201ee453ee14c5eaf10baba87d6c2d8c","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["enhancement","Team:Visualizations","release_note:skip","Feature:Security/Authorization","v9.0.0","Team:DataDiscovery","backport:prev-minor","Authz:
API migration"],"title":"Unauthorized route migration for routes owned
by
kibana-visualizations,kibana-data-discovery","number":198331,"url":"https://github.com/elastic/kibana/pull/198331","mergeCommit":{"message":"Unauthorized
route migration for routes owned by
kibana-visualizations,kibana-data-discovery (#198331)\n\n### Authz API
migration for unauthorized routes\r\n\r\nThis PR migrates unauthorized
routes owned by your team to a new\r\nsecurity configuration.\r\nPlease
refer to the documentation for more information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n---
EDIT ---\r\n\r\nThis PR also adds two privileges related to saved query
APIs:\r\n`savedQuery:read` and `savedQuery:manage`. These are given by
default to\r\nthe same roles that already have access to the
`query`-type saved\r\nobjects.\r\n\r\n### **Before
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: Lukas Olson
<[email protected]>\r\nCo-authored-by: Matthias Wilhelm
<[email protected]>\r\nCo-authored-by: Marta Bondyra
<[email protected]>\r\nCo-authored-by: Davis
McPhee
<[email protected]>","sha":"56c38bca201ee453ee14c5eaf10baba87d6c2d8c"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/198331","number":198331,"mergeCommit":{"message":"Unauthorized
route migration for routes owned by
kibana-visualizations,kibana-data-discovery (#198331)\n\n### Authz API
migration for unauthorized routes\r\n\r\nThis PR migrates unauthorized
routes owned by your team to a new\r\nsecurity configuration.\r\nPlease
refer to the documentation for more information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n---
EDIT ---\r\n\r\nThis PR also adds two privileges related to saved query
APIs:\r\n`savedQuery:read` and `savedQuery:manage`. These are given by
default to\r\nthe same roles that already have access to the
`query`-type saved\r\nobjects.\r\n\r\n### **Before
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: Lukas Olson
<[email protected]>\r\nCo-authored-by: Matthias Wilhelm
<[email protected]>\r\nCo-authored-by: Marta Bondyra
<[email protected]>\r\nCo-authored-by: Davis
McPhee
<[email protected]>","sha":"56c38bca201ee453ee14c5eaf10baba87d6c2d8c"}}]}]
BACKPORT-->
  • Loading branch information
@kibanamachine
kibanamachine authored Dec 5, 2024
1 parent d852946 commit 8f1d3c6
Show file tree
Hide file tree
Showing 10 changed files with 183 additions and 24 deletions.
6 changes: 6 additions & 0 deletions src/plugins/data/server/kql_telemetry/route.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,12 @@ export function registerKqlTelemetryRoute(
.addVersion(
{
version: KQL_TELEMETRY_ROUTE_LATEST_VERSION,
security: {
authz: {
enabled: false,
reason: 'This route is opted out from authorization',
},
},
validate: {
request: {
body: schema.object({
Expand Down
35 changes: 35 additions & 0 deletions src/plugins/data/server/query/routes.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,11 @@ export function registerSavedQueryRoutes({ http }: CoreSetup): void {
router.versioned.post({ path: `${SAVED_QUERY_BASE_URL}/_is_duplicate_title`, access }).addVersion(
{
version,
security: {
authz: {
requiredPrivileges: ['savedQuery:read'],
},
},
validate: {
request: {
body: schema.object({
Expand Down Expand Up @@ -75,6 +80,11 @@ export function registerSavedQueryRoutes({ http }: CoreSetup): void {
router.versioned.post({ path: `${SAVED_QUERY_BASE_URL}/_create`, access }).addVersion(
{
version,
security: {
authz: {
requiredPrivileges: ['savedQuery:manage'],
},
},
validate: {
request: {
body: SAVED_QUERY_ATTRS_CONFIG,
Expand All @@ -101,6 +111,11 @@ export function registerSavedQueryRoutes({ http }: CoreSetup): void {
router.versioned.put({ path: `${SAVED_QUERY_BASE_URL}/{id}`, access }).addVersion(
{
version,
security: {
authz: {
requiredPrivileges: ['savedQuery:manage'],
},
},
validate: {
request: {
params: SAVED_QUERY_ID_CONFIG,
Expand Down Expand Up @@ -129,6 +144,11 @@ export function registerSavedQueryRoutes({ http }: CoreSetup): void {
router.versioned.get({ path: `${SAVED_QUERY_BASE_URL}/{id}`, access }).addVersion(
{
version,
security: {
authz: {
requiredPrivileges: ['savedQuery:read'],
},
},
validate: {
request: {
params: SAVED_QUERY_ID_CONFIG,
Expand Down Expand Up @@ -156,6 +176,11 @@ export function registerSavedQueryRoutes({ http }: CoreSetup): void {
router.versioned.get({ path: `${SAVED_QUERY_BASE_URL}/_count`, access }).addVersion(
{
version,
security: {
authz: {
requiredPrivileges: ['savedQuery:read'],
},
},
validate: {
request: {},
response: {
Expand All @@ -180,6 +205,11 @@ export function registerSavedQueryRoutes({ http }: CoreSetup): void {
router.versioned.post({ path: `${SAVED_QUERY_BASE_URL}/_find`, access }).addVersion(
{
version,
security: {
authz: {
requiredPrivileges: ['savedQuery:read'],
},
},
validate: {
request: {
body: schema.object({
Expand Down Expand Up @@ -214,6 +244,11 @@ export function registerSavedQueryRoutes({ http }: CoreSetup): void {
router.versioned.delete({ path: `${SAVED_QUERY_BASE_URL}/{id}`, access }).addVersion(
{
version,
security: {
authz: {
requiredPrivileges: ['savedQuery:manage'],
},
},
validate: {
request: {
params: SAVED_QUERY_ID_CONFIG,
Expand Down
6 changes: 6 additions & 0 deletions src/plugins/data/server/scripts/route.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,12 @@ export function registerScriptsRoute(router: IRouter) {
.addVersion(
{
version: SCRIPT_LANGUAGES_ROUTE_LATEST_VERSION,
security: {
authz: {
enabled: false,
reason: 'This route is opted out from authorization',
},
},
validate: {
response: {
'200': {
Expand Down
45 changes: 33 additions & 12 deletions src/plugins/data/server/search/routes/session.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,8 @@ import {
searchSessionsUpdateSchema,
} from './response_schema';

const STORE_SEARCH_SESSIONS_ROLE_TAG = `access:store_search_session`;
const access = 'internal';
const options = {
tags: [STORE_SEARCH_SESSIONS_ROLE_TAG],
};
const requiredPrivileges = ['store_search_session'];
const pathPrefix = '/internal/session';
export const INITIAL_SEARCH_SESSION_REST_VERSION = '1';
const version = INITIAL_SEARCH_SESSION_REST_VERSION;
Expand All @@ -37,9 +34,12 @@ const idAndAttrsOnly = (so?: SearchSessionRestResponse) =>
so && { id: so.id, attributes: so.attributes };

export function registerSessionRoutes(router: DataPluginRouter, logger: Logger): void {
router.versioned.post({ path: pathPrefix, access, options }).addVersion(
router.versioned.post({ path: pathPrefix, access }).addVersion(
{
version,
security: {
authz: { requiredPrivileges },
},
validate: {
request: {
body: schema.object({
Expand Down Expand Up @@ -85,9 +85,12 @@ export function registerSessionRoutes(router: DataPluginRouter, logger: Logger):
}
);

router.versioned.get({ path: `${pathPrefix}/{id}`, access, options }).addVersion(
router.versioned.get({ path: `${pathPrefix}/{id}`, access }).addVersion(
{
version,
security: {
authz: { requiredPrivileges },
},
validate: {
request: {
params: schema.object({
Expand Down Expand Up @@ -117,9 +120,12 @@ export function registerSessionRoutes(router: DataPluginRouter, logger: Logger):
}
);

router.versioned.get({ path: `${pathPrefix}/{id}/status`, access, options }).addVersion(
router.versioned.get({ path: `${pathPrefix}/{id}/status`, access }).addVersion(
{
version,
security: {
authz: { requiredPrivileges },
},
validate: {
request: {
params: schema.object({
Expand Down Expand Up @@ -150,9 +156,12 @@ export function registerSessionRoutes(router: DataPluginRouter, logger: Logger):
}
);

router.versioned.post({ path: `${pathPrefix}/_find`, access, options }).addVersion(
router.versioned.post({ path: `${pathPrefix}/_find`, access }).addVersion(
{
version,
security: {
authz: { requiredPrivileges },
},
validate: {
request: {
body: schema.object({
Expand Down Expand Up @@ -200,9 +209,12 @@ export function registerSessionRoutes(router: DataPluginRouter, logger: Logger):
}
);

router.versioned.delete({ path: `${pathPrefix}/{id}`, access, options }).addVersion(
router.versioned.delete({ path: `${pathPrefix}/{id}`, access }).addVersion(
{
version,
security: {
authz: { requiredPrivileges },
},
validate: {
request: {
params: schema.object({
Expand All @@ -226,9 +238,12 @@ export function registerSessionRoutes(router: DataPluginRouter, logger: Logger):
}
);

router.versioned.post({ path: `${pathPrefix}/{id}/cancel`, access, options }).addVersion(
router.versioned.post({ path: `${pathPrefix}/{id}/cancel`, access }).addVersion(
{
version,
security: {
authz: { requiredPrivileges },
},
validate: {
request: {
params: schema.object({
Expand All @@ -252,9 +267,12 @@ export function registerSessionRoutes(router: DataPluginRouter, logger: Logger):
}
);

router.versioned.put({ path: `${pathPrefix}/{id}`, access, options }).addVersion(
router.versioned.put({ path: `${pathPrefix}/{id}`, access }).addVersion(
{
version,
security: {
authz: { requiredPrivileges },
},
validate: {
request: {
params: schema.object({
Expand Down Expand Up @@ -291,9 +309,12 @@ export function registerSessionRoutes(router: DataPluginRouter, logger: Logger):
}
);

router.versioned.post({ path: `${pathPrefix}/{id}/_extend`, access, options }).addVersion(
router.versioned.post({ path: `${pathPrefix}/{id}/_extend`, access }).addVersion(
{
version,
security: {
authz: { requiredPrivileges },
},
validate: {
request: {
params: schema.object({
Expand Down
Loading

0 comments on commit 8f1d3c6

Please sign in to comment.