[8.x] Unauthorized route migration for routes owned by response-ops (#…

…198336) (#205091)

# Backport

This will backport the following commits from `main` to `8.x`:
- [Unauthorized route migration for routes owned by response-ops
(#198336)](#198336)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Kibana
Machine","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-23T14:05:43Z","message":"Unauthorized
route migration for routes owned by response-ops (#198336)\n\n### Authz
API migration for unauthorized routes\r\n\r\nThis PR migrates
unauthorized routes owned by your team to a new\r\nsecurity
configuration.\r\nPlease refer to the documentation for more
information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: adcoelho
<[email protected]>","sha":"1df66ad4c709709f7b27dccb05375e84e9bb13a4","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["enhancement","release_note:skip","Feature:Security/Authorization","Team:ResponseOps","v9.0.0","backport:prev-minor","Authz:
API migration"],"title":"Unauthorized route migration for routes owned
by
response-ops","number":198336,"url":"https://github.com/elastic/kibana/pull/198336","mergeCommit":{"message":"Unauthorized
route migration for routes owned by response-ops (#198336)\n\n### Authz
API migration for unauthorized routes\r\n\r\nThis PR migrates
unauthorized routes owned by your team to a new\r\nsecurity
configuration.\r\nPlease refer to the documentation for more
information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: adcoelho
<[email protected]>","sha":"1df66ad4c709709f7b27dccb05375e84e9bb13a4"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/198336","number":198336,"mergeCommit":{"message":"Unauthorized
route migration for routes owned by response-ops (#198336)\n\n### Authz
API migration for unauthorized routes\r\n\r\nThis PR migrates
unauthorized routes owned by your team to a new\r\nsecurity
configuration.\r\nPlease refer to the documentation for more
information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n ...\r\n}, handler);\r\n```\r\n\r\n### **After
migration:**\r\n```ts\r\nrouter.get({\r\n path: '/api/path',\r\n
security: {\r\n authz: {\r\n enabled: false,\r\n reason: 'This route is
opted out from authorization because ...',\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. Elaborate on the reasoning to opt-out of
authorization.\r\n3. Routes without a compelling reason to opt-out of
authorization should\r\nplan to introduce them as soon as
possible.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have snapshot tests that include
the route definition.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security`
team.\r\n\r\n---------\r\n\r\nCo-authored-by: adcoelho
<[email protected]>","sha":"1df66ad4c709709f7b27dccb05375e84e9bb13a4"}}]}]
BACKPORT-->

x-pack/plugins/task_manager/server/routes/background_task_utilization.ts

@@ -111,6 +111,13 @@ export function backgroundTaskUtilizationRoute(
     router.get(
       {
         path: `/${routeOption.basePath}/task_manager/_background_task_utilization`,
+        security: {
+          authz: {
+            enabled: false,
+            reason:
+              'This route is opted out from authorization. It can be accessed with JWT credentials.',
+          },
+        },
         // Uncomment when we determine that we can restrict API usage to Global admins based on telemetry
         // options: { tags: ['access:taskManager'] },
         validate: false,

x-pack/plugins/task_manager/server/routes/health.ts

@@ -139,6 +139,14 @@ export function healthRoute(params: HealthRouteParams): {
   router.get(
     {
       path: '/api/task_manager/_health',
+      security: {
+        authz: {
+          enabled: false,
+          // https://github.com/elastic/kibana/issues/136157
+          reason:
+            'This route is opted out from authorization. Authorization is planned but not implemented yet(breaking change).',
+        },
+      },
       // Uncomment when we determine that we can restrict API usage to Global admins based on telemetry
       // options: { tags: ['access:taskManager'] },
       validate: false,

x-pack/plugins/task_manager/server/routes/metrics.ts

@@ -48,6 +48,13 @@ export function metricsRoute(params: MetricsRouteParams) {
   router.get(
     {
       path: `/api/task_manager/metrics`,
+      security: {
+        authz: {
+          enabled: false,
+          reason:
+            'This route is opted out from authorization. It can be accessed with JWT credentials.',
+        },
+      },
       options: {
         access: 'public',
         // The `security:acceptJWT` tag allows route to be accessed with JWT credentials. It points to

x-pack/plugins/triggers_actions_ui/server/data/routes/fields.ts

@@ -29,6 +29,13 @@ export function createFieldsRoute(logger: Logger, router: IRouter, baseRoute: st
   router.post(
     {
       path,
+      security: {
+        authz: {
+          enabled: false,
+          reason:
+            'This route is opted out of authorization as it relies on ES authorization instead.',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/plugins/triggers_actions_ui/server/data/routes/indices.ts

@@ -33,6 +33,13 @@ export function createIndicesRoute(logger: Logger, router: IRouter, baseRoute: s
   router.post(
     {
       path,
+      security: {
+        authz: {
+          enabled: false,
+          reason:
+            'This route is opted out of authorization as it relies on ES authorization instead.',
+        },
+      },
       validate: {
         body: bodySchema,
       },

x-pack/plugins/triggers_actions_ui/server/data/routes/time_series_query.ts

@@ -28,6 +28,13 @@ export function createTimeSeriesQueryRoute(
   router.post(
     {
       path,
+      security: {
+        authz: {
+          enabled: false,
+          reason:
+            'This route is opted out of authorization as it relies on ES authorization instead.',
+        },
+      },
       validate: {
         body: TimeSeriesQuerySchema,
       },