[RsponseOps][Alerting] Explicitly set access to all API routes of actions, connectors, rules, alerts, and cases plugins #193520
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
js-jankisalvi
changed the title
js-jankisalvi
commented
Sep 20, 2024
| @@ -102,6 +102,7 @@ const buildFindRulesRoute = ({ | |||
| router.post( | |||
| { | |||
| path, | |||
| options: { access: 'internal' }, | |||
There was a problem hiding this comment.
In this file, GET method has public route and path at line 45 and POST method uses internal path at line 101. However in the list internal path is listed as GET:
| GET /internal/alerting/rules/_find | internal | ❌ |
|---|
There was a problem hiding this comment.
Related PR with a fix: #193757
js-jankisalvi
commented
Sep 23, 2024
| @@ -33,6 +33,7 @@ const buildBulkEditRulesRoute = ({ licenseState, path, router }: BuildBulkEditRu | |||
| router.post( | |||
| { | |||
| path, | |||
| options: { access: 'internal' }, | |||
There was a problem hiding this comment.
Couldn't find PATCH route, only POST.
There was a problem hiding this comment.
My mistake 😄! I updated the issue.
js-jankisalvi
added
release_note:skip
|
Pinging @elastic/response-ops (Team:ResponseOps) |
dominiqueclarke
approved these changes
Sep 23, 2024
jcger
approved these changes
Sep 25, 2024
cnasikas
approved these changes
Sep 26, 2024
💚 Build Succeeded
Metrics [docs]
History
To update your PR or re-run it, just comment with: |
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this pull request
Sep 26, 2024
…ions, connectors, rules, alerts, and cases plugins (elastic#193520) ## Summary Resolves elastic#192956 This PR adds - `access: internal` option to internal routes - `access: public` option to public routes It which will help restrict access of internal routes and allow users to access all public routes. This PR updates api routes of following `x-pack/plugins` - actions - alerting - cases - rule_registry - stack_connectors - triggers_actions_ui (cherry picked from commit 9c78643)
💚 All backports created successfully
Note: Successful backport PRs will be merged automatically after passing CI. Questions ?Please refer to the Backport tool documentation |
kibanamachine
added a commit
that referenced
this pull request
Sep 26, 2024
…of actions, connectors, rules, alerts, and cases plugins (#193520) (#194111) # Backport This will backport the following commits from `main` to `8.x`: - [[RsponseOps][Alerting] Explicitly set access to all API routes of actions, connectors, rules, alerts, and cases plugins (#193520)](#193520) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Janki Salvi","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-09-26T10:00:08Z","message":"[RsponseOps][Alerting] Explicitly set access to all API routes of actions, connectors, rules, alerts, and cases plugins (#193520)\n\n## Summary\r\nResolves https://github.com/elastic/kibana/issues/192956\r\nThis PR adds \r\n- `access: internal` option to internal routes \r\n- `access: public` option to public routes \r\n\r\nIt which will help restrict access of internal routes and allow users to\r\naccess all public routes.\r\n\r\nThis PR updates api routes of following `x-pack/plugins`\r\n- actions\r\n- alerting\r\n- cases\r\n- rule_registry\r\n- stack_connectors\r\n- triggers_actions_ui","sha":"9c7864309ce1c5a3d085151e3b67d1635bc558c8","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","v9.0.0","backport:prev-minor","v8.16.0"],"title":"[RsponseOps][Alerting] Explicitly set access to all API routes of actions, connectors, rules, alerts, and cases plugins","number":193520,"url":"https://github.com/elastic/kibana/pull/193520","mergeCommit":{"message":"[RsponseOps][Alerting] Explicitly set access to all API routes of actions, connectors, rules, alerts, and cases plugins (#193520)\n\n## Summary\r\nResolves https://github.com/elastic/kibana/issues/192956\r\nThis PR adds \r\n- `access: internal` option to internal routes \r\n- `access: public` option to public routes \r\n\r\nIt which will help restrict access of internal routes and allow users to\r\naccess all public routes.\r\n\r\nThis PR updates api routes of following `x-pack/plugins`\r\n- actions\r\n- alerting\r\n- cases\r\n- rule_registry\r\n- stack_connectors\r\n- triggers_actions_ui","sha":"9c7864309ce1c5a3d085151e3b67d1635bc558c8"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/193520","number":193520,"mergeCommit":{"message":"[RsponseOps][Alerting] Explicitly set access to all API routes of actions, connectors, rules, alerts, and cases plugins (#193520)\n\n## Summary\r\nResolves https://github.com/elastic/kibana/issues/192956\r\nThis PR adds \r\n- `access: internal` option to internal routes \r\n- `access: public` option to public routes \r\n\r\nIt which will help restrict access of internal routes and allow users to\r\naccess all public routes.\r\n\r\nThis PR updates api routes of following `x-pack/plugins`\r\n- actions\r\n- alerting\r\n- cases\r\n- rule_registry\r\n- stack_connectors\r\n- triggers_actions_ui","sha":"9c7864309ce1c5a3d085151e3b67d1635bc558c8"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Janki Salvi <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Resolves #192956
This PR adds
access: internaloption to internal routesaccess: publicoption to public routesIt which will help restrict access of internal routes and allow users to access all public routes.
This PR updates api routes of following
x-pack/plugins