[Obs AI Assistant] Manual migration for routes with access tag (#202817)

## Summary

### Problem
`tags: [access:ai_assistant]` is deprecated. 

### Solution
All the routes that use this tag needs to be migrated to the `authz`:
`requiredPrivileges` property.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/chat/route.ts

@@ -126,8 +126,10 @@ async function initializeChatRequest({
 
 const chatRoute = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /internal/observability_ai_assistant/chat',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   params: t.type({
     body: t.intersection([
@@ -174,8 +176,10 @@ const chatRoute = createObservabilityAIAssistantServerRoute({
 
 const chatRecallRoute = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /internal/observability_ai_assistant/chat/recall',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   params: t.type({
     body: t.type({
@@ -282,8 +286,10 @@ async function chatComplete(
 
 const chatCompleteRoute = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /internal/observability_ai_assistant/chat/complete',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   params: chatCompleteInternalRt,
   handler: async (resources): Promise<Readable> => {
@@ -293,8 +299,10 @@ const chatCompleteRoute = createObservabilityAIAssistantServerRoute({
 
 const publicChatCompleteRoute = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /api/observability_ai_assistant/chat/complete 2023-10-31',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   params: chatCompletePublicRt,
   handler: async (resources): Promise<Readable> => {

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/connectors/route.ts

@@ -10,8 +10,10 @@ import { createObservabilityAIAssistantServerRoute } from '../create_observabili
 
 const listConnectorsRoute = createObservabilityAIAssistantServerRoute({
   endpoint: 'GET /internal/observability_ai_assistant/connectors',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<FindActionResult[]> => {
     const { request, plugins } = resources;

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/conversations/route.ts

@@ -17,8 +17,10 @@ const getConversationRoute = createObservabilityAIAssistantServerRoute({
       conversationId: t.string,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<Conversation> => {
     const { service, request, params } = resources;
@@ -40,8 +42,10 @@ const findConversationsRoute = createObservabilityAIAssistantServerRoute({
       query: t.string,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<{ conversations: Conversation[] }> => {
     const { service, request, params } = resources;
@@ -63,8 +67,10 @@ const createConversationRoute = createObservabilityAIAssistantServerRoute({
       conversation: conversationCreateRt,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<Conversation> => {
     const { service, request, params } = resources;
@@ -89,8 +95,10 @@ const updateConversationRoute = createObservabilityAIAssistantServerRoute({
       conversation: conversationUpdateRt,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<Conversation> => {
     const { service, request, params } = resources;
@@ -115,8 +123,10 @@ const updateConversationTitle = createObservabilityAIAssistantServerRoute({
       title: t.string,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<Conversation> => {
     const { service, request, params } = resources;
@@ -143,8 +153,10 @@ const deleteConversationRoute = createObservabilityAIAssistantServerRoute({
       conversationId: t.string,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const { service, request, params } = resources;

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/functions/route.ts

@@ -22,8 +22,10 @@ const getFunctionsRoute = createObservabilityAIAssistantServerRoute({
       scopes: t.union([t.array(assistantScopeType), assistantScopeType]),
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (
     resources
@@ -97,8 +99,10 @@ const functionRecallRoute = createObservabilityAIAssistantServerRoute({
       }),
     ]),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (
     resources
@@ -132,8 +136,10 @@ const functionSummariseRoute = createObservabilityAIAssistantServerRoute({
       labels: t.record(t.string, t.string),
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/knowledge_base/route.ts

@@ -20,8 +20,10 @@ import { Instruction, KnowledgeBaseEntry, KnowledgeBaseEntryRole } from '../../.
 
 const getKnowledgeBaseStatus = createObservabilityAIAssistantServerRoute({
   endpoint: 'GET /internal/observability_ai_assistant/kb/status',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async ({
     service,
@@ -54,11 +56,15 @@ const setupKnowledgeBase = createObservabilityAIAssistantServerRoute({
     }),
   }),
   options: {
-    tags: ['access:ai_assistant'],
     timeout: {
       idleSocket: moment.duration(20, 'minutes').asMilliseconds(),
     },
   },
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
+  },
   handler: async (resources): Promise<InferenceInferenceEndpointInfo> => {
     const client = await resources.service.getClient({ request: resources.request });
 
@@ -74,8 +80,10 @@ const setupKnowledgeBase = createObservabilityAIAssistantServerRoute({
 
 const resetKnowledgeBase = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /internal/observability_ai_assistant/kb/reset',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<{ result: string }> => {
     const client = await resources.service.getClient({ request: resources.request });
@@ -92,8 +100,10 @@ const resetKnowledgeBase = createObservabilityAIAssistantServerRoute({
 
 const semanticTextMigrationKnowledgeBase = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /internal/observability_ai_assistant/kb/semantic_text_migration',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });
@@ -108,8 +118,10 @@ const semanticTextMigrationKnowledgeBase = createObservabilityAIAssistantServerR
 
 const getKnowledgeBaseUserInstructions = createObservabilityAIAssistantServerRoute({
   endpoint: 'GET /internal/observability_ai_assistant/kb/user_instructions',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (
     resources
@@ -137,8 +149,10 @@ const saveKnowledgeBaseUserInstruction = createObservabilityAIAssistantServerRou
       public: toBooleanRt,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });
@@ -156,8 +170,10 @@ const saveKnowledgeBaseUserInstruction = createObservabilityAIAssistantServerRou
 
 const getKnowledgeBaseEntries = createObservabilityAIAssistantServerRoute({
   endpoint: 'GET /internal/observability_ai_assistant/kb/entries',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   params: t.type({
     query: t.type({
@@ -207,8 +223,10 @@ const saveKnowledgeBaseEntry = createObservabilityAIAssistantServerRoute({
   params: t.type({
     body: knowledgeBaseEntryRt,
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });
@@ -238,8 +256,10 @@ const deleteKnowledgeBaseEntry = createObservabilityAIAssistantServerRoute({
       entryId: t.string,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });
@@ -259,8 +279,10 @@ const importKnowledgeBaseEntries = createObservabilityAIAssistantServerRoute({
       entries: t.array(knowledgeBaseEntryRt),
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/types.ts

@@ -85,5 +85,4 @@ export interface ObservabilityAIAssistantRouteCreateOptions {
     payload?: number;
     idleSocket?: number;
   };
-  tags: Array<'access:ai_assistant'>;
 }

x-pack/test/observability_ai_assistant_api_integration/common/config.ts

@@ -11,7 +11,7 @@ import { ObservabilityAIAssistantFtrConfigName } from '../configs';
 import { getApmSynthtraceEsClient } from './create_synthtrace_client';
 import { InheritedFtrProviderContext, InheritedServices } from './ftr_provider_context';
 import { getScopedApiClient } from './observability_ai_assistant_api_client';
-import { editor, secondaryEditor, viewer } from './users/users';
+import { editor, secondaryEditor, unauthorizedUser, viewer } from './users/users';
 
 export interface ObservabilityAIAssistantFtrConfig {
   name: ObservabilityAIAssistantFtrConfigName;
@@ -33,6 +33,16 @@ export type ObservabilityAIAssistantAPIClient = Awaited<
 
 export type ObservabilityAIAssistantServices = Awaited<ReturnType<CreateTestConfig>>['services'];
 
+export class ForbiddenApiError extends Error {
+  status: number;
+
+  constructor(message: string = 'Forbidden') {
+    super(message);
+    this.name = 'ForbiddenApiError';
+    this.status = 403;
+  }
+}
+
 export function createObservabilityAIAssistantAPIConfig({
   config,
   license,
@@ -67,6 +77,7 @@ export function createObservabilityAIAssistantAPIConfig({
           viewer: getScopedApiClientForUsername(viewer.username),
           editor: getScopedApiClientForUsername(editor.username),
           secondaryEditor: getScopedApiClientForUsername(secondaryEditor.username),
+          unauthorizedUser: getScopedApiClientForUsername(unauthorizedUser.username),
         };
       },
     },

x-pack/test/observability_ai_assistant_api_integration/common/users/users.ts

@@ -6,10 +6,14 @@
  */
 
 import { kbnTestConfig } from '@kbn/test';
+
 const password = kbnTestConfig.getUrlParts().password!;
 
+export const UNAUTHORIZED_USERNAME = 'unauthorized_user';
+export const UNAUTHORIZED_USER_PASSWORD = 'unauthorized_password';
+
 export interface User {
-  username: 'elastic' | 'editor' | 'viewer' | 'secondary_editor';
+  username: 'elastic' | 'editor' | 'viewer' | 'secondary_editor' | 'unauthorized_user';
   password: string;
   roles: string[];
 }
@@ -32,4 +36,10 @@ export const viewer: User = {
   roles: ['viewer'],
 };
 
-export const allUsers = [editor, secondaryEditor, viewer];
+export const unauthorizedUser: User = {
+  username: UNAUTHORIZED_USERNAME,
+  password: UNAUTHORIZED_USER_PASSWORD,
+  roles: [],
+};
+
+export const allUsers = [editor, secondaryEditor, viewer, unauthorizedUser];