Alerting appears under management even when users can't use them

[gmmorris]

This is a follow up issue that came out of the RBAC work, specifically @legrego 's comment here: #67157 (comment)

It seems we should be limiting the appearance of the Alerting UI under Management to users who have privileges to use alerts, but at the moment we don't.

So, here are the question we need to answer:

1. Do we want to limit this UI from appearing?
2. At the moment, all users have privileges to create built-in alerts through management, should this remain the case? If not, how should we grant users privileges to these (this would usually work using a feature, but Alerting isn't a feature).
3. Should we rely on features to grant access themselves? (As per Larry's example in the link)?

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[mikecote]

In theory everyone has access to alerting so there wouldn't be a UI to limit?

The goal is to give everyone access to this UI. It may not appear for those who don't have access to management but anyone who can should see the "alerts and actions" section to create and manage built in alerts at a minimum. For those who can't access the management app, the HTTP APIs will still work for them until we find a way to make the UI show up (either by moving alerting into its own app or something along those lines).

There is some limiting currently happening in this file with hardcoded values that can now be removed and be calculated from features. This file is the previous way of determining if a user can see and edit alerts.

At the moment, all users have privileges to create built-in alerts through management, should this remain the case?

Yes

Should we rely on features to grant access themselves?

This could be troublesome if a developer forgets to add this section though I don't think there's an alternative. The best way may be to provide developers a function that builds or merges a feature object to include pieces like this.

[legrego]

The goal is to give everyone access to this UI

Everyone? Just to make sure I understand, you would expect a user with read-only access to Canvas (and nothing else) to be able to see alerts and actions?

For those who can't access the management app, the HTTP APIs will still work for them until we find a way to make the UI show up (either by moving alerting into its own app or something along those lines).

The management app itself isn't something that's directly controllable. We don't have a way to turn off the management app altogether, but rather, we are relying on access to the individual features inside to figure out of management should be visible.

[mikecote]

I had a chat with @legrego and I'm thinking of backtracking some of my answers above.

For now, users will need to have access to alerting via a sub-feature of an application (SIEM, Metric, etc) and if they want general alerting, we could create a sub feature under actions to grant them access to alerting. This would mean not any user can create alerts, they will need a sub-feature privilege somewhere and that yes the UI will be limited to those who have access to alerts.

[mikecote]

Another issue to allow users to not have access to management (probably same with alerts): #35040.

[gmmorris]

Turns out we're the first customers to require a management section controlled by multiple features.
@legrego has added an issue that should address this: #71091

We'll block this issue on that.