[8.x] Unauthorized route migration for routes owned by kibana-data-di…

…scovery (elastic#198332) (elastic#202519)

# Backport

This will backport the following commits from `main` to `8.x`:
- [Unauthorized route migration for routes owned by
kibana-data-discovery
(elastic#198332)](elastic#198332)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Kibana
Machine","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-02T15:46:33Z","message":"Unauthorized
route migration for routes owned by kibana-data-discovery
(elastic#198332)\n\n### Authz API migration for unauthorized routes\r\n\r\nThis
PR migrates unauthorized routes owned by your team to a new\r\nsecurity
configuration.\r\nPlease refer to the documentation for more
information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<[email protected]>\r\nCo-authored-by: Lukas Olson
<[email protected]>\r\nCo-authored-by: Davis McPhee
<[email protected]>\r\nCo-authored-by: Matthias Wilhelm
<[email protected]>","sha":"fc8ca4f3b846f6858cb769c64a99cecd3a8ea5c0","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["enhancement","release_note:skip","Feature:Security/Authorization","v9.0.0","Team:DataDiscovery","backport:prev-minor","Authz:
API migration"],"title":"Unauthorized route migration for routes owned
by
kibana-data-discovery","number":198332,"url":"https://github.com/elastic/kibana/pull/198332","mergeCommit":{"message":"Unauthorized
route migration for routes owned by kibana-data-discovery
(elastic#198332)\n\n### Authz API migration for unauthorized routes\r\n\r\nThis
PR migrates unauthorized routes owned by your team to a new\r\nsecurity
configuration.\r\nPlease refer to the documentation for more
information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<[email protected]>\r\nCo-authored-by: Lukas Olson
<[email protected]>\r\nCo-authored-by: Davis McPhee
<[email protected]>\r\nCo-authored-by: Matthias Wilhelm
<[email protected]>","sha":"fc8ca4f3b846f6858cb769c64a99cecd3a8ea5c0"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/198332","number":198332,"mergeCommit":{"message":"Unauthorized
route migration for routes owned by kibana-data-discovery
(elastic#198332)\n\n### Authz API migration for unauthorized routes\r\n\r\nThis
PR migrates unauthorized routes owned by your team to a new\r\nsecurity
configuration.\r\nPlease refer to the documentation for more
information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine
<[email protected]>\r\nCo-authored-by: Lukas Olson
<[email protected]>\r\nCo-authored-by: Davis McPhee
<[email protected]>\r\nCo-authored-by: Matthias Wilhelm
<[email protected]>","sha":"fc8ca4f3b846f6858cb769c64a99cecd3a8ea5c0"}}]}]
BACKPORT-->

src/plugins/data_view_field_editor/server/routes/field_preview.ts

@@ -51,6 +51,12 @@ export const registerFieldPreviewRoute = ({ router }: RouteDependencies): void =
   router.versioned.post({ path, access: 'internal' }).addVersion(
     {
       version: '1',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Authorization provided by Elasticsearch',
+        },
+      },
       validate: {
         request: {
           body: bodySchema,

src/plugins/data_view_management/server/routes/preview_scripted_field.ts

@@ -14,6 +14,12 @@ export function registerPreviewScriptedFieldRoute(router: IRouter): void {
   router.post(
     {
       path: '/internal/index-pattern-management/preview_scripted_field',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Authorization provided by Elasticsearch',
+        },
+      },
       validate: {
         body: schema.object({
           index: schema.string(),

src/plugins/data_view_management/server/routes/resolve_index.ts

@@ -15,6 +15,12 @@ export function registerResolveIndexRoute(router: IRouter): void {
   router.get(
     {
       path: '/internal/index-pattern-management/resolve_index/{query}',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Authorization provided by Elasticsearch',
+        },
+      },
       validate: {
         params: schema.object({
           query: schema.string(),

src/plugins/data_views/server/rest_api_routes/internal/existing_indices.ts

@@ -60,6 +60,12 @@ export const registerExistingIndicesPath = (router: IRouter): void => {
     .addVersion(
       {
         version,
+        security: {
+          authz: {
+            enabled: false,
+            reason: 'This route is opted out from authorization',
+          },
+        },
         validate: {
           request: {
             query: schema.object({

src/plugins/data_views/server/rest_api_routes/internal/fields.ts

@@ -146,10 +146,17 @@ export const registerFields = (
   >,
   isRollupsEnabled: () => boolean
 ) => {
-  router.versioned
-    .get({ path, access: 'internal', enableQueryVersion: true })
-    .addVersion(
-      { version: '1', validate: { request: { query: querySchema }, response: validate.response } },
-      handler(isRollupsEnabled)
-    );
+  router.versioned.get({ path, access: 'internal', enableQueryVersion: true }).addVersion(
+    {
+      version: '1',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'Authorization provided by Elasticsearch',
+        },
+      },
+      validate: { request: { query: querySchema }, response: validate.response },
+    },
+    handler(isRollupsEnabled)
+  );
 };

src/plugins/data_views/server/rest_api_routes/internal/fields_for.ts

@@ -9,7 +9,7 @@
 
 import { estypes } from '@elastic/elasticsearch';
 import { schema } from '@kbn/config-schema';
-import { IRouter, RequestHandler, StartServicesAccessor } from '@kbn/core/server';
+import type { IRouter, RequestHandler, RouteAuthz, StartServicesAccessor } from '@kbn/core/server';
 import { VersionedRouteValidation } from '@kbn/core-http-server';
 import { INITIAL_REST_VERSION_INTERNAL as version } from '../../constants';
 import { IndexPatternsFetcher } from '../../fetcher';
@@ -217,14 +217,31 @@ export const registerFieldForWildcard = (
   isRollupsEnabled: () => boolean
 ) => {
   const configuredHandler = handler(isRollupsEnabled);
+  const authz: RouteAuthz = { enabled: false, reason: 'Authorization provided by Elasticsearch' };
 
   // handler
-  router.versioned.put({ path, access }).addVersion({ version, validate }, configuredHandler);
-  router.versioned.post({ path, access }).addVersion({ version, validate }, configuredHandler);
-  router.versioned
-    .get({ path, access })
-    .addVersion(
-      { version, validate: { request: { query: querySchema }, response: validate.response } },
-      configuredHandler
-    );
+  router.versioned.put({ path, access }).addVersion(
+    {
+      version,
+      security: { authz },
+      validate,
+    },
+    configuredHandler
+  );
+  router.versioned.post({ path, access }).addVersion(
+    {
+      version,
+      security: { authz },
+      validate,
+    },
+    configuredHandler
+  );
+  router.versioned.get({ path, access }).addVersion(
+    {
+      version,
+      security: { authz },
+      validate: { request: { query: querySchema }, response: validate.response },
+    },
+    configuredHandler
+  );
 };

src/plugins/data_views/server/rest_api_routes/internal/has_data_views.ts

@@ -45,6 +45,12 @@ export const registerHasDataViewsRoute = (router: IRouter): void => {
     .addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            enabled: false,
+            reason: 'Authorization provided by saved objects client',
+          },
+        },
         validate: {
           response: {
             200: {

src/plugins/data_views/server/rest_api_routes/internal/has_es_data.ts

@@ -133,6 +133,12 @@ export const registerHasEsDataRoute = (
     .addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            enabled: false,
+            reason: 'Authorization provided by Elasticsearch',
+          },
+        },
         validate: {
           response: {
             200: {

src/plugins/data_views/server/rest_api_routes/public/create_data_view.ts

@@ -61,6 +61,11 @@ const registerCreateDataViewRouteFactory =
     router.versioned.post({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             body: schema.object({

src/plugins/data_views/server/rest_api_routes/public/default_data_view.ts

@@ -73,6 +73,12 @@ const manageDefaultIndexPatternRoutesFactory =
     router.versioned.get({ path, access: 'public', description: getDescription }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            enabled: false,
+            reason: 'Authorization provided by saved objects client',
+          },
+        },
         validate: {
           request: {},
           response: {
@@ -110,6 +116,11 @@ const manageDefaultIndexPatternRoutesFactory =
     router.versioned.post({ path, access: 'public', description: postDescription }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             body: schema.object({

src/plugins/data_views/server/rest_api_routes/public/delete_data_view.ts

@@ -53,6 +53,11 @@ const deleteIndexPatternRouteFactory =
     router.versioned.delete({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object(

src/plugins/data_views/server/rest_api_routes/public/fields/update_fields.ts

@@ -131,6 +131,11 @@ const updateFieldsActionRouteFactory = (path: string, serviceKey: string, descri
     router.versioned.post({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object(

src/plugins/data_views/server/rest_api_routes/public/get_data_view.ts

@@ -57,6 +57,12 @@ const getDataViewRouteFactory =
     router.versioned.get({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            enabled: false,
+            reason: 'Authorization provided by saved objects client',
+          },
+        },
         validate: {
           request: {
             params: schema.object(

src/plugins/data_views/server/rest_api_routes/public/get_data_views.ts

@@ -66,6 +66,12 @@ const getDataViewsRouteFactory =
     router.versioned.get({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            enabled: false,
+            reason: 'Authorization provided by saved objects client',
+          },
+        },
         validate: {
           request: {},
           response: { 200: { body: responseValidation } },

src/plugins/data_views/server/rest_api_routes/public/has_user_data_view.ts

@@ -46,6 +46,12 @@ const hasUserDataViewRouteFactory =
     router.versioned.get({ path, access: 'internal' }).addVersion(
       {
         version: '1',
+        security: {
+          authz: {
+            enabled: false,
+            reason: 'Authorization provided by saved objects client',
+          },
+        },
         validate: {
           request: {},
           response: {

src/plugins/data_views/server/rest_api_routes/public/runtime_fields/create_runtime_field.ts

@@ -82,6 +82,11 @@ const runtimeCreateFieldRouteFactory =
     router.versioned.post({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object({

src/plugins/data_views/server/rest_api_routes/public/runtime_fields/delete_runtime_field.ts

@@ -65,6 +65,11 @@ const deleteRuntimeFieldRouteFactory =
     router.versioned.delete({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object({

src/plugins/data_views/server/rest_api_routes/public/runtime_fields/get_runtime_field.ts

@@ -73,6 +73,12 @@ const getRuntimeFieldRouteFactory =
     router.versioned.get({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            enabled: false,
+            reason: 'Authorization provided by saved objects client',
+          },
+        },
         validate: {
           request: {
             params: schema.object({

src/plugins/data_views/server/rest_api_routes/public/runtime_fields/put_runtime_field.ts

@@ -81,6 +81,11 @@ const putRuntimeFieldRouteFactory =
     router.versioned.put({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object({

src/plugins/data_views/server/rest_api_routes/public/runtime_fields/update_runtime_field.ts

@@ -81,6 +81,11 @@ const updateRuntimeFieldRouteFactory =
     router.versioned.post({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object({

src/plugins/data_views/server/rest_api_routes/public/scripted_fields/create_scripted_field.ts

@@ -31,6 +31,11 @@ export const registerCreateScriptedFieldRoute = (
     .addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object(

src/plugins/data_views/server/rest_api_routes/public/scripted_fields/delete_scripted_field.ts

@@ -32,6 +32,11 @@ export const registerDeleteScriptedFieldRoute = (
     .addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object(

src/plugins/data_views/server/rest_api_routes/public/scripted_fields/get_scripted_field.ts

@@ -31,6 +31,12 @@ export const registerGetScriptedFieldRoute = (
     .addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            enabled: false,
+            reason: 'Authorization provided by saved objects client',
+          },
+        },
         validate: {
           request: {
             params: schema.object(

src/plugins/data_views/server/rest_api_routes/public/scripted_fields/put_scripted_field.ts

@@ -31,6 +31,11 @@ export const registerPutScriptedFieldRoute = (
     .addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object(

src/plugins/data_views/server/rest_api_routes/public/scripted_fields/update_scripted_field.ts

@@ -36,6 +36,11 @@ export const registerUpdateScriptedFieldRoute = (
     .addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object(

src/plugins/data_views/server/rest_api_routes/public/swap_references.ts

@@ -70,6 +70,14 @@ export const swapReferencesRoute =
     router.versioned.post({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            enabled: false,
+            // We don't use the indexPatterns:manage privilege for this route because it can be used for saved object
+            // types other than index-pattern
+            reason: 'Authorization provided by saved objects client',
+          },
+        },
         validate: {
           request: {
             body: schema.object({

src/plugins/data_views/server/rest_api_routes/public/update_data_view.ts

@@ -147,6 +147,11 @@ const updateDataViewRouteFactory =
     router.versioned.post({ path, access: 'public', description }).addVersion(
       {
         version: INITIAL_REST_VERSION,
+        security: {
+          authz: {
+            requiredPrivileges: ['indexPatterns:manage'],
+          },
+        },
         validate: {
           request: {
             params: schema.object(