Skip to content

Commit

Permalink
Authorized route migration for routes owned by @elastic/obs-ux-infra_…
Browse files Browse the repository at this point in the history
…services-team (elastic#198196)

### Authz API migration for authorized routes

This PR migrates `access:<privilege>` tags used in route definitions to
new security configuration.
Please refer to the documentation for more information: [Authorization
API](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)

### **Before migration:**
Access control tags were defined in the `options` object of the route:

```ts
router.get({
  path: '/api/path',
  options: {
    tags: ['access:<privilege_1>', 'access:<privilege_2>'],
  },
  ...
}, handler);
```

### **After migration:**
Tags have been replaced with the more robust
`security.authz.requiredPrivileges` field under `security`:

```ts
router.get({
  path: '/api/path',
  security: {
    authz: {
      requiredPrivileges: ['<privilege_1>', '<privilege_2>'],
    },
  },
  ...
}, handler);
```

### What to do next?
1. Review the changes in this PR.
2. You might need to update your tests to reflect the new security
configuration:
  - If you have tests that rely on checking `access` tags.
  - If you have snapshot tests that include the route definition.
- If you have FTR tests that rely on checking unauthorized error
message. The error message changed to also include missing privileges.

## Any questions?
If you have any questions or need help with API authorization, please
reach out to the `@elastic/kibana-security` team.
  • Loading branch information
kibanamachine authored and paulinashakirova committed Nov 26, 2024
1 parent 4336ef0 commit 3adf14c
Show file tree
Hide file tree
Showing 6 changed files with 53 additions and 10 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -34,8 +34,12 @@ export function registerTopNFunctionsAPMTransactionsRoute({
router.get(
{
path: paths.APMTransactions,
security: {
authz: {
requiredPrivileges: ['profiling', 'apm'],
},
},
options: {
tags: ['access:profiling', 'access:apm'],
timeout: { idleSocket: IDLE_SOCKET_TIMEOUT },
},
validate: { query: querySchema },
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,12 @@ export function registerFlameChartSearchRoute({
router.get(
{
path: paths.Flamechart,
options: { tags: ['access:profiling'], timeout: { idleSocket: IDLE_SOCKET_TIMEOUT } },
security: {
authz: {
requiredPrivileges: ['profiling'],
},
},
options: { timeout: { idleSocket: IDLE_SOCKET_TIMEOUT } },
validate: {
query: schema.object({
timeFrom: schema.number(),
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,12 @@ export function registerTopNFunctionsSearchRoute({
router.get(
{
path: paths.TopNFunctions,
options: { tags: ['access:profiling'], timeout: { idleSocket: IDLE_SOCKET_TIMEOUT } },
security: {
authz: {
requiredPrivileges: ['profiling'],
},
},
options: { timeout: { idleSocket: IDLE_SOCKET_TIMEOUT } },
validate: { query: querySchema },
},
async (context, request, response) => {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,11 @@ export function registerSetupRoute({
router.get(
{
path: paths.HasSetupESResources,
options: { tags: ['access:profiling'] },
security: {
authz: {
requiredPrivileges: ['profiling'],
},
},
validate: false,
},
async (context, request, response) => {
Expand Down Expand Up @@ -62,7 +66,11 @@ export function registerSetupRoute({
router.post(
{
path: paths.HasSetupESResources,
options: { tags: ['access:profiling'] },
security: {
authz: {
requiredPrivileges: ['profiling'],
},
},
validate: false,
},
async (context, request, response) => {
Expand Down Expand Up @@ -166,7 +174,11 @@ export function registerSetupRoute({
router.get(
{
path: paths.SetupDataCollectionInstructions,
options: { tags: ['access:profiling'] },
security: {
authz: {
requiredPrivileges: ['profiling'],
},
},
validate: false,
},
async (context, request, response) => {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,11 @@ export function registerStorageExplorerRoute({
router.get(
{
path: paths.StorageExplorerSummary,
options: { tags: ['access:profiling'] },
security: {
authz: {
requiredPrivileges: ['profiling'],
},
},
validate: {
query: schema.object({
indexLifecyclePhase: schema.oneOf([
Expand Down Expand Up @@ -112,7 +116,11 @@ export function registerStorageExplorerRoute({
router.get(
{
path: paths.StorageExplorerHostStorageDetails,
options: { tags: ['access:profiling'] },
security: {
authz: {
requiredPrivileges: ['profiling'],
},
},
validate: {
query: schema.object({
indexLifecyclePhase: schema.oneOf([
Expand Down Expand Up @@ -156,7 +164,11 @@ export function registerStorageExplorerRoute({
router.get(
{
path: paths.StorageExplorerIndicesStorageDetails,
options: { tags: ['access:profiling'] },
security: {
authz: {
requiredPrivileges: ['profiling'],
},
},
validate: {
query: schema.object({
indexLifecyclePhase: schema.oneOf([
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,12 @@ export function queryTopNCommon({
router.get(
{
path: pathName,
options: { tags: ['access:profiling'], timeout: { idleSocket: IDLE_SOCKET_TIMEOUT } },
security: {
authz: {
requiredPrivileges: ['profiling'],
},
},
options: { timeout: { idleSocket: IDLE_SOCKET_TIMEOUT } },
validate: {
query: schema.object({
timeFrom: schema.number(),
Expand Down

0 comments on commit 3adf14c

Please sign in to comment.