[8.x] Authorized route migration for routes owned by security-entity-…

…analytics (elastic#198385) (elastic#199114)

# Backport

This will backport the following commits from `main` to `8.x`:
- [Authorized route migration for routes owned by
security-entity-analytics
(elastic#198385)](elastic#198385)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Kibana
Machine","email":"42973632+kibanamachine@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-11-06T12:09:41Z","message":"Authorized
route migration for routes owned by security-entity-analytics
(elastic#198385)\n\n### Authz API migration for authorized routes\r\n\r\nThis
PR migrates `access:<privilege>` tags used in route definitions
to\r\nnew security configuration.\r\nPlease refer to the documentation
for more information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\nAccess control tags were defined in the
`options` object of the route:\r\n\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n options: {\r\n tags: ['access:<privilege_1>',
'access:<privilege_2>'],\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### **After migration:**\r\nTags have been
replaced with the more robust\r\n`security.authz.requiredPrivileges`
field under `security`:\r\n\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n security: {\r\n authz: {\r\n requiredPrivileges:
['<privilege_1>', '<privilege_2>'],\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have tests that rely on checking
`access` tags.\r\n - If you have snapshot tests that include the route
definition.\r\n- If you have FTR tests that rely on checking
unauthorized error\r\nmessage. The error message changed to also include
missing privileges.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security` team.\r\n\r\nCo-authored-by: Pablo
Machado
<pablo.nevesmachado@elastic.co>","sha":"0e99a779e29946377123071dfcf61e14c21300d9","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["enhancement","release_note:skip","Feature:Security/Authorization","v9.0.0","backport:prev-minor","Team:Entity
Analytics","Authz: API migration"],"title":"Authorized route migration
for routes owned by
security-entity-analytics","number":198385,"url":"https://github.com/elastic/kibana/pull/198385","mergeCommit":{"message":"Authorized
route migration for routes owned by security-entity-analytics
(elastic#198385)\n\n### Authz API migration for authorized routes\r\n\r\nThis
PR migrates `access:<privilege>` tags used in route definitions
to\r\nnew security configuration.\r\nPlease refer to the documentation
for more information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\nAccess control tags were defined in the
`options` object of the route:\r\n\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n options: {\r\n tags: ['access:<privilege_1>',
'access:<privilege_2>'],\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### **After migration:**\r\nTags have been
replaced with the more robust\r\n`security.authz.requiredPrivileges`
field under `security`:\r\n\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n security: {\r\n authz: {\r\n requiredPrivileges:
['<privilege_1>', '<privilege_2>'],\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have tests that rely on checking
`access` tags.\r\n - If you have snapshot tests that include the route
definition.\r\n- If you have FTR tests that rely on checking
unauthorized error\r\nmessage. The error message changed to also include
missing privileges.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security` team.\r\n\r\nCo-authored-by: Pablo
Machado
<pablo.nevesmachado@elastic.co>","sha":"0e99a779e29946377123071dfcf61e14c21300d9"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/198385","number":198385,"mergeCommit":{"message":"Authorized
route migration for routes owned by security-entity-analytics
(elastic#198385)\n\n### Authz API migration for authorized routes\r\n\r\nThis
PR migrates `access:<privilege>` tags used in route definitions
to\r\nnew security configuration.\r\nPlease refer to the documentation
for more information:
[Authorization\r\nAPI](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization)\r\n\r\n###
**Before migration:**\r\nAccess control tags were defined in the
`options` object of the route:\r\n\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n options: {\r\n tags: ['access:<privilege_1>',
'access:<privilege_2>'],\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### **After migration:**\r\nTags have been
replaced with the more robust\r\n`security.authz.requiredPrivileges`
field under `security`:\r\n\r\n```ts\r\nrouter.get({\r\n path:
'/api/path',\r\n security: {\r\n authz: {\r\n requiredPrivileges:
['<privilege_1>', '<privilege_2>'],\r\n },\r\n },\r\n ...\r\n},
handler);\r\n```\r\n\r\n### What to do next?\r\n1. Review the changes in
this PR.\r\n2. You might need to update your tests to reflect the new
security\r\nconfiguration:\r\n - If you have tests that rely on checking
`access` tags.\r\n - If you have snapshot tests that include the route
definition.\r\n- If you have FTR tests that rely on checking
unauthorized error\r\nmessage. The error message changed to also include
missing privileges.\r\n\r\n## Any questions?\r\nIf you have any
questions or need help with API authorization, please\r\nreach out to
the `@elastic/kibana-security` team.\r\n\r\nCo-authored-by: Pablo
Machado
<pablo.nevesmachado@elastic.co>","sha":"0e99a779e29946377123071dfcf61e14c21300d9"}}]}]
BACKPORT-->

x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/bulk_upload.ts

@@ -33,8 +33,10 @@ export const assetCriticalityPublicBulkUploadRoute = (
     .post({
       access: 'public',
       path: ASSET_CRITICALITY_PUBLIC_BULK_UPLOAD_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/delete.ts

@@ -28,8 +28,10 @@ export const assetCriticalityPublicDeleteRoute = (
     .delete({
       access: 'public',
       path: ASSET_CRITICALITY_PUBLIC_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/get.ts

@@ -30,8 +30,10 @@ export const assetCriticalityPublicGetRoute = (
     .get({
       access: 'public',
       path: ASSET_CRITICALITY_PUBLIC_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/list.ts

@@ -28,8 +28,10 @@ export const assetCriticalityPublicListRoute = (
     .get({
       access: 'public',
       path: ASSET_CRITICALITY_PUBLIC_LIST_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/privileges.ts

@@ -28,8 +28,10 @@ export const assetCriticalityInternalPrivilegesRoute = (
     .get({
       access: 'internal',
       path: ASSET_CRITICALITY_INTERNAL_PRIVILEGES_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/status.ts

@@ -26,8 +26,10 @@ export const assetCriticalityInternalStatusRoute = (
     .get({
       access: 'internal',
       path: ASSET_CRITICALITY_INTERNAL_STATUS_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/upload_csv.ts

@@ -35,8 +35,12 @@ export const assetCriticalityPublicCSVUploadRoute = (
     .post({
       access: 'public',
       path: ASSET_CRITICALITY_PUBLIC_CSV_UPLOAD_URL,
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
+      },
       options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
         body: {
           output: 'stream',
           accepts: 'multipart/form-data',

x-pack/plugins/security_solution/server/lib/entity_analytics/asset_criticality/routes/upsert.ts

@@ -31,8 +31,10 @@ export const assetCriticalityPublicUpsertRoute = (
     .post({
       access: 'public',
       path: ASSET_CRITICALITY_PUBLIC_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/apply_dataview_indices.ts

@@ -20,8 +20,10 @@ export const applyDataViewIndicesEntityEngineRoute = (
     .post({
       access: 'public',
       path: '/api/entity_store/engines/apply_dataview_indices',
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/delete.ts

@@ -28,8 +28,10 @@ export const deleteEntityEngineRoute = (
     .delete({
       access: 'public',
       path: '/api/entity_store/engines/{entityType}',
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/entities/list.ts

@@ -32,8 +32,10 @@ export const listEntitiesRoute = (router: EntityAnalyticsRoutesDeps['router'], l
     .get({
       access: 'public',
       path: LIST_ENTITIES_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/get.ts

@@ -23,8 +23,10 @@ export const getEntityEngineRoute = (
     .get({
       access: 'public',
       path: '/api/entity_store/engines/{entityType}',
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/init.ts

@@ -28,8 +28,10 @@ export const initEntityEngineRoute = (
     .post({
       access: 'public',
       path: '/api/entity_store/engines/{entityType}/init',
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/list.ts

@@ -22,8 +22,10 @@ export const listEntityEnginesRoute = (
     .get({
       access: 'public',
       path: '/api/entity_store/engines',
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/start.ts

@@ -24,8 +24,10 @@ export const startEntityEngineRoute = (
     .post({
       access: 'public',
       path: '/api/entity_store/engines/{entityType}/start',
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/stats.ts

@@ -23,8 +23,10 @@ export const getEntityEngineStatsRoute = (
     .post({
       access: 'public',
       path: '/api/entity_store/engines/{entityType}/stats',
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/entity_store/routes/stop.ts

@@ -24,8 +24,10 @@ export const stopEntityEngineRoute = (
     .post({
       access: 'public',
       path: '/api/entity_store/engines/{entityType}/stop',
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/delete.ts

@@ -23,8 +23,10 @@ export const riskEngineCleanupRoute = (
     .delete({
       access: 'public',
       path: RISK_ENGINE_CLEANUP_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/disable.ts

@@ -24,8 +24,10 @@ export const riskEngineDisableRoute = (
     .post({
       access: 'internal',
       path: RISK_ENGINE_DISABLE_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/enable.ts

@@ -24,8 +24,10 @@ export const riskEngineEnableRoute = (
     .post({
       access: 'internal',
       path: RISK_ENGINE_ENABLE_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/init.ts

@@ -26,8 +26,10 @@ export const riskEngineInitRoute = (
     .post({
       access: 'internal',
       path: RISK_ENGINE_INIT_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/privileges.ts

@@ -24,8 +24,10 @@ export const riskEnginePrivilegesRoute = (
     .get({
       access: 'internal',
       path: RISK_ENGINE_PRIVILEGES_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/schedule_now.ts

@@ -27,8 +27,10 @@ export const riskEngineScheduleNowRoute = (
     .post({
       access: 'public',
       path: RISK_ENGINE_SCHEDULE_NOW_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/settings.ts

@@ -19,8 +19,10 @@ export const riskEngineSettingsRoute = (router: EntityAnalyticsRoutesDeps['route
     .get({
       access: 'internal',
       path: RISK_ENGINE_SETTINGS_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/risk_engine/routes/status.ts

@@ -20,8 +20,10 @@ export const riskEngineStatusRoute = (
     .get({
       access: 'internal',
       path: RISK_ENGINE_STATUS_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/entity_calculation.ts

@@ -166,8 +166,10 @@ export const deprecatedRiskScoreEntityCalculationRoute = (
     .post({
       path: '/api/risk_scores/calculation/entity',
       access: 'internal',
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(
@@ -192,8 +194,10 @@ export const riskScoreEntityCalculationRoute = (
     .post({
       path: RISK_SCORE_ENTITY_CALCULATION_URL,
       access: 'internal',
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/entity_analytics/risk_score/routes/preview.ts

@@ -30,8 +30,10 @@ export const riskScorePreviewRoute = (
     .post({
       access: 'internal',
       path: RISK_SCORE_PREVIEW_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/risk_score/index_status/index.ts

@@ -18,8 +18,10 @@ export const getRiskScoreIndexStatusRoute = (router: SecuritySolutionPluginRoute
     .get({
       access: 'internal',
       path: RISK_SCORE_INDEX_STATUS_API_URL,
-      options: {
-        tags: ['access:securitySolution', `access:${APP_ID}-entity-analytics`],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution', `${APP_ID}-entity-analytics`],
+        },
       },
     })
     .addVersion(

x-pack/plugins/security_solution/server/lib/risk_score/indices/create_index_route.ts

@@ -19,8 +19,10 @@ export const createEsIndexRoute = (router: SecuritySolutionPluginRouter, logger:
     .put({
       access: 'internal',
       path: RISK_SCORE_CREATE_INDEX,
-      options: {
-        tags: ['access:securitySolution'],
+      security: {
+        authz: {
+          requiredPrivileges: ['securitySolution'],
+        },
       },
     })
     .addVersion(