[9.0] [Authz] Added reason for authorization opt-out for logstash routes (#213891) (#214435)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Authz] Added reason for authorization opt-out for logstash routes
(#213891)](https://github.com/elastic/kibana/pull/213891)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Elena
Shostak","email":"165678770+elena-shostak@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-03-13T15:55:22Z","message":"[Authz]
Added reason for authorization opt-out for logstash routes
(#213891)\n\n## Summary\n\nAdded reason for authorization opt-out for
logstash routes.\n\n\n### Checklist\n\n- [x] The PR description includes
the appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"5d9fd46b2a28bb21c785f3e76e528bf7eb873dc2","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Feature:Security/Authorization","backport:prev-minor","backport:version","Authz:
API migration","v9.1.0","v8.19.0"],"title":"[Authz] Added reason for
authorization opt-out for logstash
routes","number":213891,"url":"https://github.com/elastic/kibana/pull/213891","mergeCommit":{"message":"[Authz]
Added reason for authorization opt-out for logstash routes
(#213891)\n\n## Summary\n\nAdded reason for authorization opt-out for
logstash routes.\n\n\n### Checklist\n\n- [x] The PR description includes
the appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"5d9fd46b2a28bb21c785f3e76e528bf7eb873dc2"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/213891","number":213891,"mergeCommit":{"message":"[Authz]
Added reason for authorization opt-out for logstash routes
(#213891)\n\n## Summary\n\nAdded reason for authorization opt-out for
logstash routes.\n\n\n### Checklist\n\n- [x] The PR description includes
the appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"5d9fd46b2a28bb21c785f3e76e528bf7eb873dc2"}},{"branch":"8.x","label":"v8.19.0","branchLabelMappingKey":"^v8.19.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Elena Shostak <165678770+elena-shostak@users.noreply.github.com>

x-pack/platform/plugins/private/logstash/server/routes/cluster/load.ts

@@ -14,6 +14,12 @@ export function registerClusterLoadRoute(router: LogstashPluginRouter) {
   router.get(
     {
       path: '/api/logstash/cluster',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'This route delegates authorization to the scoped ES client',
+        },
+      },
       validate: false,
     },
     wrapRouteWithLicenseCheck(checkLicense, async (context, request, response) => {

x-pack/platform/plugins/private/logstash/server/routes/pipeline/delete.ts

@@ -14,6 +14,12 @@ export function registerPipelineDeleteRoute(router: LogstashPluginRouter) {
   router.delete(
     {
       path: '/api/logstash/pipeline/{id}',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'This route delegates authorization to the scoped ES client',
+        },
+      },
       options: {
         access: 'public',
         summary: `Delete a managed Logstash pipeline`,

x-pack/platform/plugins/private/logstash/server/routes/pipeline/load.ts

@@ -16,6 +16,12 @@ export function registerPipelineLoadRoute(router: LogstashPluginRouter) {
   router.get(
     {
       path: '/api/logstash/pipeline/{id}',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'This route delegates authorization to the scoped ES client',
+        },
+      },
       options: {
         access: 'public',
         summary: `Get a managed Logstash pipeline`,

x-pack/platform/plugins/private/logstash/server/routes/pipeline/save.ts

@@ -17,6 +17,12 @@ export function registerPipelineSaveRoute(router: LogstashPluginRouter) {
   router.put(
     {
       path: '/api/logstash/pipeline/{id}',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'This route delegates authorization to the scoped ES client',
+        },
+      },
       options: {
         access: 'public',
         summary: `Create a managed Logstash pipeline`,

x-pack/platform/plugins/private/logstash/server/routes/pipelines/delete.ts

@@ -36,6 +36,12 @@ export function registerPipelinesDeleteRoute(router: LogstashPluginRouter) {
   router.post(
     {
       path: '/api/logstash/pipelines/delete',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'This route delegates authorization to the scoped ES client',
+        },
+      },
       options: {
         access: 'public',
         summary: `Delete managed Logstash pipelines`,

x-pack/platform/plugins/private/logstash/server/routes/pipelines/list.ts

@@ -27,6 +27,12 @@ export function registerPipelinesListRoute(router: LogstashPluginRouter) {
   router.get(
     {
       path: '/api/logstash/pipelines',
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'This route delegates authorization to the scoped ES client',
+        },
+      },
       options: {
         access: 'public',
         summary: `Get all managed Logstash pipelines`,