Unauthorized route migration for routes owned by appex-ai-infra,obs-ai-assistant,security-generative-ai

[kibanamachine]

Authz API migration for unauthorized routes

This PR migrates unauthorized routes owned by your team to a new security configuration.
Please refer to the documentation for more information: Authorization API

Before migration:

router.get({
  path: '/api/path',
  ...
}, handler);

After migration:

router.get({
  path: '/api/path',
  security: {
    authz: {
      enabled: false,
      reason: 'This route is opted out from authorization because ...',
    },
  },
  ...
}, handler);

What to do next?

1. Review the changes in this PR.
2. Elaborate on the reasoning to opt-out of authorization.
3. Routes without a compelling reason to opt-out of authorization should plan to introduce them as soon as possible.
4. You might need to update your tests to reflect the new security configuration:

• If you have snapshot tests that include the route definition.

Any questions?

If you have any questions or need help with API authorization, please reach out to the @elastic/kibana-security team.

[elasticmachine]

Pinging @elastic/obs-ai-assistant (Team:Obs AI Assistant)

[elasticmachine]

Pinging @elastic/appex-ai-infra (Team:AI Infra)

[sorenlouv]

@dgieselaar I don't think we intended to opt-out of authorization here? Don't we want to require a minimum set of privileges?

[pgayvallet]

That's true, but atm we don't know what set of roles or permission swe should restraint to (virtual any plugin can call those APIs from the inference public contract) - it's a platform API. Plus, RBAC regarding inference APIs could be lower level than the endpoints (once we figure that what RBAC model we might want).

The PR is just adapting the code to the new route rbac format, basically

[legrego]

Can we model privileges based on the features that currently call this endpoint? For example, could this route require any of the privileges that grant access to the AI Assistants?

[pgayvallet]

@elasticmachine merge upstream

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: b5fc5b3

Failed CI Steps

• Jest Tests #13

Test Failures

• [job] [logs] Jest Tests #13 / Case View Page files tab should render the custom fields correctly

Metrics [docs]

✅ unchanged