[8.12] [Synthetics] Simplify write access default behavior (#177088) (#177227)

# Backport This will backport the following commits from `main` to `8.12`: - [[Synthetics] Simplify write access default behavior (#177088)](https://github.com/elastic/kibana/pull/177088)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Justin Kambic <jk@elastic.co>
2025-04-24 09:48:58 -04:00 · 2024-02-19 14:33:17 -05:00 · 2024-02-19 14:33:17 -05:00 · 0763a057d3
commit 0763a057d3
parent f5bd489c5f
6 changed files with 48 additions and 42 deletions
--- a/x-pack/plugins/synthetics/server/routes/create_route_with_auth.test.ts
+++ b/x-pack/plugins/synthetics/server/routes/create_route_with_auth.test.ts
@ -6,9 +6,37 @@
 */

 import { createSyntheticsRouteWithAuth } from './create_route_with_auth';
+import { SupportedMethod } from './types';
+
+const methods: SupportedMethod[][] = [['GET'], ['POST'], ['PUT'], ['DELETE']];

 describe('createSyntheticsRouteWithAuth', () => {
-  it('should create a route with auth', () => {
+  it.each(
+    methods
+      .map<[SupportedMethod, boolean]>((m) => [m[0], true])
+      .concat(methods.map((m) => [m[0], false]))
+  )('%s methods continues to support the writeAccess %s flag', (mStr, writeAccess) => {
+    const method: SupportedMethod = mStr as SupportedMethod;
+    const route = createSyntheticsRouteWithAuth(() => ({
+      method,
+      path: '/foo',
+      validate: {},
+      writeAccess,
+      handler: async () => {
+        return { success: true };
+      },
+    }));
+
+    expect(route).toEqual({
+      method,
+      path: '/foo',
+      validate: {},
+      handler: expect.any(Function),
+      writeAccess,
+    });
+  });
+
+  it('by default allows read access for GET by default', () => {
    const route = createSyntheticsRouteWithAuth(() => ({
      method: 'GET',
      path: '/foo',
@ -27,11 +55,9 @@ describe('createSyntheticsRouteWithAuth', () => {
    });
  });

-  it.each([['POST'], ['PUT'], ['DELETE']])(
-    'requires write permissions for %s requests',
+  it.each(methods.filter((m) => m[0] !== 'GET'))(
+    'by default requires write access for %s route requests',
    (method) => {
-      if (method !== 'POST' && method !== 'PUT' && method !== 'DELETE')
-        throw Error('Invalid method');
      const route = createSyntheticsRouteWithAuth(() => ({
        method,
        path: '/foo',
@ -50,29 +76,4 @@ describe('createSyntheticsRouteWithAuth', () => {
      });
    }
  );
-
-  it.each([['POST'], ['PUT'], ['DELETE']])(
-    'allows write access override for %s requests',
-    (method) => {
-      if (method !== 'POST' && method !== 'PUT' && method !== 'DELETE')
-        throw Error('Invalid method');
-      const route = createSyntheticsRouteWithAuth(() => ({
-        method,
-        path: '/foo',
-        validate: {},
-        handler: async () => {
-          return { success: true };
-        },
-        writeAccessOverride: true,
-      }));
-
-      expect(route).toEqual({
-        method,
-        path: '/foo',
-        validate: {},
-        handler: expect.any(Function),
-        writeAccess: undefined,
-      });
-    }
-  );
 });
--- a/x-pack/plugins/synthetics/server/routes/create_route_with_auth.ts
+++ b/x-pack/plugins/synthetics/server/routes/create_route_with_auth.ts
@ -11,20 +11,23 @@ import {
  LICENSE_NOT_ACTIVE_ERROR,
  LICENSE_NOT_SUPPORTED_ERROR,
 } from '../../common/constants';
-import { SyntheticsRestApiRouteFactory, SyntheticsRoute, SyntheticsRouteHandler } from './types';
+import {
+  SupportedMethod,
+  SyntheticsRestApiRouteFactory,
+  SyntheticsRoute,
+  SyntheticsRouteHandler,
+} from './types';

-function getWriteAccessFlag(method: string, writeAccessOverride?: boolean, writeAccess?: boolean) {
-  // if route includes an override, skip write-only access with `undefined`
-  // otherwise, if route is not a GET, require write access
-  // if route is get, use writeAccess value with `false` as default
-  return writeAccessOverride === true ? undefined : method !== 'GET' ? true : writeAccess ?? false;
+function getDefaultWriteAccessFlag(method: SupportedMethod) {
+  // if the method is not GET, it defaults to requiring write access
+  return method !== 'GET';
 }

 export const createSyntheticsRouteWithAuth = <ClientContract = unknown>(
  routeCreator: SyntheticsRestApiRouteFactory
 ): SyntheticsRoute<ClientContract> => {
  const restRoute = routeCreator();
-  const { handler, method, path, options, writeAccess, writeAccessOverride, ...rest } = restRoute;
+  const { handler, method, path, options, writeAccess, ...rest } = restRoute;
  const licenseCheckHandler: SyntheticsRouteHandler<ClientContract> = async ({
    context,
    response,
@ -56,7 +59,7 @@ export const createSyntheticsRouteWithAuth = <ClientContract = unknown>(
    options,
    handler: licenseCheckHandler,
    ...rest,
-    writeAccess: getWriteAccessFlag(method, writeAccessOverride, writeAccess),
+    writeAccess: writeAccess ?? getDefaultWriteAccessFlag(method),
  };
 };

--- a/x-pack/plugins/synthetics/server/routes/pings/journey_screenshot_blocks.ts
+++ b/x-pack/plugins/synthetics/server/routes/pings/journey_screenshot_blocks.ts
@ -22,7 +22,7 @@ export const createJourneyScreenshotBlocksRoute: SyntheticsRestApiRouteFactory =
      hashes: schema.arrayOf(schema.string()),
    }),
  },
-  writeAccessOverride: true,
+  writeAccess: false,
  handler: async (routeProps) => {
    return await journeyScreenshotBlocksHandler(routeProps);
  },
--- a/x-pack/plugins/synthetics/server/routes/synthetics_service/enablement.ts
+++ b/x-pack/plugins/synthetics/server/routes/synthetics_service/enablement.ts
@ -16,7 +16,7 @@ import {
 export const getSyntheticsEnablementRoute: SyntheticsRestApiRouteFactory = () => ({
  method: 'PUT',
  path: SYNTHETICS_API_URLS.SYNTHETICS_ENABLEMENT,
-  writeAccessOverride: true,
+  writeAccess: false,
  validate: {},
  handler: async ({ savedObjectsClient, request, server }): Promise<any> => {
    try {
--- a/x-pack/plugins/synthetics/server/routes/synthetics_service/test_now_monitor.ts
+++ b/x-pack/plugins/synthetics/server/routes/synthetics_service/test_now_monitor.ts
@ -27,6 +27,7 @@ export const testNowMonitorRoute: SyntheticsRestApiRouteFactory<TestNowResponse>
    const { monitorId } = routeContext.request.params;
    return triggerTestNow(monitorId, routeContext);
  },
+  writeAccess: true,
 });

 export const triggerTestNow = async (
--- a/x-pack/plugins/synthetics/server/routes/types.ts
+++ b/x-pack/plugins/synthetics/server/routes/types.ts
@ -26,13 +26,14 @@ export type SyntheticsRequest = KibanaRequest<
  Record<string, any>
 >;

+export type SupportedMethod = 'GET' | 'POST' | 'PUT' | 'DELETE';
+
 /**
 * Defines the basic properties employed by Uptime routes.
 */
 export interface UMServerRoute<T> {
-  method: 'GET' | 'PUT' | 'POST' | 'DELETE';
+  method: SupportedMethod;
  writeAccess?: boolean;
-  writeAccessOverride?: boolean;
  handler: T;
  validation?: FullValidationConfig<any, any, any>;
  streamHandler?: (