Skip to content

Commit 43fa8a5

Browse files
nkhristininkibanamachineelasticmachine
authored
[8.x] Authorized route migration for routes owned by @elastic/security-detection-engine (#198195) (#199752)
# Backport This will backport the following commits from `main` to `8.x`: - [Authorized route migration for routes owned by @elastic/security-detection-engine (#198195)](#198195) <!--- Backport version: 8.9.8 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Kibana Machine","email":"42973632+kibanamachine@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-11-08T08:39:05Z","message":"Authorized route migration for routes owned by @elastic/security-detection-engine (#198195)\n\n### Authz API migration for authorized routes\r\n\r\nThis PR migrates `access:<privilege>` tags used in route definitions to\r\nnew security configuration.\r\nPlease refer to the documentation for more information: [Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n### **Before migration:**\r\nAccess control tags were defined in the `options` object of the route:\r\n\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n options: {\r\n tags: ['access:<privilege_1>', 'access:<privilege_2>'],\r\n },\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After migration:**\r\nTags have been replaced with the more robust\r\n`security.authz.requiredPrivileges` field under `security`:\r\n\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n security: {\r\n authz: {\r\n requiredPrivileges: ['<privilege_1>', '<privilege_2>'],\r\n },\r\n },\r\n ...\r\n}, handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in this PR.\r\n2. You might need to update your tests to reflect the new security\r\nconfiguration:\r\n - If you have tests that rely on checking `access` tags.\r\n - If you have snapshot tests that include the route definition.\r\n- If you have FTR tests that rely on checking unauthorized error\r\nmessage. The error message changed to also include missing privileges.\r\n\r\n## Any questions?\r\nIf you have any questions or need help with API authorization, please\r\nreach out to the `@elastic/kibana-security` team.\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>\r\nCo-authored-by: Nikita Khristinin <nkhristinin@gmail.com>","sha":"32f0396b277f255ca3465de4f1a8fcf11bbddfb3","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["enhancement","release_note:skip","Feature:Security/Authorization","backport missing","v9.0.0","backport:prev-minor","Team:Detection Engine","Authz: API migration"],"number":198195,"url":"https://github.com/elastic/kibana/pull/198195","mergeCommit":{"message":"Authorized route migration for routes owned by @elastic/security-detection-engine (#198195)\n\n### Authz API migration for authorized routes\r\n\r\nThis PR migrates `access:<privilege>` tags used in route definitions to\r\nnew security configuration.\r\nPlease refer to the documentation for more information: [Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n### **Before migration:**\r\nAccess control tags were defined in the `options` object of the route:\r\n\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n options: {\r\n tags: ['access:<privilege_1>', 'access:<privilege_2>'],\r\n },\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After migration:**\r\nTags have been replaced with the more robust\r\n`security.authz.requiredPrivileges` field under `security`:\r\n\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n security: {\r\n authz: {\r\n requiredPrivileges: ['<privilege_1>', '<privilege_2>'],\r\n },\r\n },\r\n ...\r\n}, handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in this PR.\r\n2. You might need to update your tests to reflect the new security\r\nconfiguration:\r\n - If you have tests that rely on checking `access` tags.\r\n - If you have snapshot tests that include the route definition.\r\n- If you have FTR tests that rely on checking unauthorized error\r\nmessage. The error message changed to also include missing privileges.\r\n\r\n## Any questions?\r\nIf you have any questions or need help with API authorization, please\r\nreach out to the `@elastic/kibana-security` team.\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>\r\nCo-authored-by: Nikita Khristinin <nkhristinin@gmail.com>","sha":"32f0396b277f255ca3465de4f1a8fcf11bbddfb3"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","labelRegex":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/198195","number":198195,"mergeCommit":{"message":"Authorized route migration for routes owned by @elastic/security-detection-engine (#198195)\n\n### Authz API migration for authorized routes\r\n\r\nThis PR migrates `access:<privilege>` tags used in route definitions to\r\nnew security configuration.\r\nPlease refer to the documentation for more information: [Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n### **Before migration:**\r\nAccess control tags were defined in the `options` object of the route:\r\n\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n options: {\r\n tags: ['access:<privilege_1>', 'access:<privilege_2>'],\r\n },\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After migration:**\r\nTags have been replaced with the more robust\r\n`security.authz.requiredPrivileges` field under `security`:\r\n\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n security: {\r\n authz: {\r\n requiredPrivileges: ['<privilege_1>', '<privilege_2>'],\r\n },\r\n },\r\n ...\r\n}, handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in this PR.\r\n2. You might need to update your tests to reflect the new security\r\nconfiguration:\r\n - If you have tests that rely on checking `access` tags.\r\n - If you have snapshot tests that include the route definition.\r\n- If you have FTR tests that rely on checking unauthorized error\r\nmessage. The error message changed to also include missing privileges.\r\n\r\n## Any questions?\r\nIf you have any questions or need help with API authorization, please\r\nreach out to the `@elastic/kibana-security` team.\r\n\r\n---------\r\n\r\nCo-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>\r\nCo-authored-by: Nikita Khristinin <nkhristinin@gmail.com>","sha":"32f0396b277f255ca3465de4f1a8fcf11bbddfb3"}}]}] BACKPORT--> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
1 parent b7dad96 commit 43fa8a5

44 files changed

Lines changed: 208 additions & 124 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎x-pack/plugins/lists/server/routes/create_endpoint_list_item_route.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,12 @@ export const createEndpointListItemRoute = (router: ListsPluginRouter): void =>
2323
router.versioned
2424
.post({
2525
access: 'public',
26-
options: {
27-
tags: ['access:lists-all'],
28-
},
2926
path: ENDPOINT_LIST_ITEM_URL,
27+
security: {
28+
authz: {
29+
requiredPrivileges: ['lists-all'],
30+
},
31+
},
3032
})
3133
.addVersion(
3234
{

‎x-pack/plugins/lists/server/routes/create_endpoint_list_route.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,12 @@ export const createEndpointListRoute = (router: ListsPluginRouter): void => {
2727
router.versioned
2828
.post({
2929
access: 'public',
30-
options: {
31-
tags: ['access:lists-all'],
32-
},
3330
path: ENDPOINT_LIST_URL,
31+
security: {
32+
authz: {
33+
requiredPrivileges: ['lists-all'],
34+
},
35+
},
3436
})
3537
.addVersion(
3638
{

‎x-pack/plugins/lists/server/routes/create_exception_list_item_route.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,12 @@ export const createExceptionListItemRoute = (router: ListsPluginRouter): void =>
2525
router.versioned
2626
.post({
2727
access: 'public',
28-
options: {
29-
tags: ['access:lists-all'],
30-
},
3128
path: EXCEPTION_LIST_ITEM_URL,
29+
security: {
30+
authz: {
31+
requiredPrivileges: ['lists-all'],
32+
},
33+
},
3234
})
3335
.addVersion(
3436
{

‎x-pack/plugins/lists/server/routes/create_exception_list_route.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,12 @@ export const createExceptionListRoute = (router: ListsPluginRouter): void => {
2222
router.versioned
2323
.post({
2424
access: 'public',
25-
options: {
26-
tags: ['access:lists-all'],
27-
},
2825
path: EXCEPTION_LIST_URL,
26+
security: {
27+
authz: {
28+
requiredPrivileges: ['lists-all'],
29+
},
30+
},
2931
})
3032
.addVersion(
3133
{

‎x-pack/plugins/lists/server/routes/delete_endpoint_list_item_route.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,12 @@ export const deleteEndpointListItemRoute = (router: ListsPluginRouter): void =>
2525
router.versioned
2626
.delete({
2727
access: 'public',
28-
options: {
29-
tags: ['access:lists-all'],
30-
},
3128
path: ENDPOINT_LIST_ITEM_URL,
29+
security: {
30+
authz: {
31+
requiredPrivileges: ['lists-all'],
32+
},
33+
},
3234
})
3335
.addVersion(
3436
{

‎x-pack/plugins/lists/server/routes/delete_exception_list_item_route.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,10 +25,12 @@ export const deleteExceptionListItemRoute = (router: ListsPluginRouter): void =>
2525
router.versioned
2626
.delete({
2727
access: 'public',
28-
options: {
29-
tags: ['access:lists-all'],
30-
},
3128
path: EXCEPTION_LIST_ITEM_URL,
29+
security: {
30+
authz: {
31+
requiredPrivileges: ['lists-all'],
32+
},
33+
},
3234
})
3335
.addVersion(
3436
{

‎x-pack/plugins/lists/server/routes/delete_exception_list_route.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,12 @@ export const deleteExceptionListRoute = (router: ListsPluginRouter): void => {
2121
router.versioned
2222
.delete({
2323
access: 'public',
24-
options: {
25-
tags: ['access:lists-all'],
26-
},
2724
path: EXCEPTION_LIST_URL,
25+
security: {
26+
authz: {
27+
requiredPrivileges: ['lists-all'],
28+
},
29+
},
2830
})
2931
.addVersion(
3032
{

‎x-pack/plugins/lists/server/routes/duplicate_exception_list_route.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,12 @@ export const duplicateExceptionsRoute = (router: ListsPluginRouter): void => {
2121
router.versioned
2222
.post({
2323
access: 'public',
24-
options: {
25-
tags: ['access:lists-all'],
26-
},
2724
path: `${EXCEPTION_LIST_URL}/_duplicate`,
25+
security: {
26+
authz: {
27+
requiredPrivileges: ['lists-all'],
28+
},
29+
},
2830
})
2931
.addVersion(
3032
{

‎x-pack/plugins/lists/server/routes/export_exception_list_route.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,12 @@ export const exportExceptionsRoute = (router: ListsPluginRouter): void => {
1818
router.versioned
1919
.post({
2020
access: 'public',
21-
options: {
22-
tags: ['access:lists-read'],
23-
},
2421
path: `${EXCEPTION_LIST_URL}/_export`,
22+
security: {
23+
authz: {
24+
requiredPrivileges: ['lists-read'],
25+
},
26+
},
2527
})
2628
.addVersion(
2729
{

‎x-pack/plugins/lists/server/routes/find_endpoint_list_item_route.ts‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,12 @@ export const findEndpointListItemRoute = (router: ListsPluginRouter): void => {
2121
router.versioned
2222
.get({
2323
access: 'public',
24-
options: {
25-
tags: ['access:lists-read'],
26-
},
2724
path: `${ENDPOINT_LIST_ITEM_URL}/_find`,
25+
security: {
26+
authz: {
27+
requiredPrivileges: ['lists-read'],
28+
},
29+
},
2830
})
2931
.addVersion(
3032
{

0 commit comments

Comments
 (0)