[8.x] [RsponseOps][Alerting] Explicitly set access to all API routes of actions, connectors, rules, alerts, and cases plugins (#193520) (#194111)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[RsponseOps][Alerting] Explicitly set access to all API routes of
actions, connectors, rules, alerts, and cases plugins
(#193520)](https://github.com/elastic/kibana/pull/193520)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Janki
Salvi","email":"117571355+js-jankisalvi@users.noreply.github.com"},"sourceCommit":{"committedDate":"2024-09-26T10:00:08Z","message":"[RsponseOps][Alerting]
Explicitly set access to all API routes of actions, connectors, rules,
alerts, and cases plugins (#193520)\n\n## Summary\r\nResolves
https://github.com/elastic/kibana/issues/192956\r\nThis PR adds \r\n-
`access: internal` option to internal routes \r\n- `access: public`
option to public routes \r\n\r\nIt which will help restrict access of
internal routes and allow users to\r\naccess all public
routes.\r\n\r\nThis PR updates api routes of following
`x-pack/plugins`\r\n- actions\r\n- alerting\r\n- cases\r\n-
rule_registry\r\n- stack_connectors\r\n-
triggers_actions_ui","sha":"9c7864309ce1c5a3d085151e3b67d1635bc558c8","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:ResponseOps","v9.0.0","backport:prev-minor","v8.16.0"],"title":"[RsponseOps][Alerting]
Explicitly set access to all API routes of actions, connectors, rules,
alerts, and cases
plugins","number":193520,"url":"https://github.com/elastic/kibana/pull/193520","mergeCommit":{"message":"[RsponseOps][Alerting]
Explicitly set access to all API routes of actions, connectors, rules,
alerts, and cases plugins (#193520)\n\n## Summary\r\nResolves
https://github.com/elastic/kibana/issues/192956\r\nThis PR adds \r\n-
`access: internal` option to internal routes \r\n- `access: public`
option to public routes \r\n\r\nIt which will help restrict access of
internal routes and allow users to\r\naccess all public
routes.\r\n\r\nThis PR updates api routes of following
`x-pack/plugins`\r\n- actions\r\n- alerting\r\n- cases\r\n-
rule_registry\r\n- stack_connectors\r\n-
triggers_actions_ui","sha":"9c7864309ce1c5a3d085151e3b67d1635bc558c8"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/193520","number":193520,"mergeCommit":{"message":"[RsponseOps][Alerting]
Explicitly set access to all API routes of actions, connectors, rules,
alerts, and cases plugins (#193520)\n\n## Summary\r\nResolves
https://github.com/elastic/kibana/issues/192956\r\nThis PR adds \r\n-
`access: internal` option to internal routes \r\n- `access: public`
option to public routes \r\n\r\nIt which will help restrict access of
internal routes and allow users to\r\naccess all public
routes.\r\n\r\nThis PR updates api routes of following
`x-pack/plugins`\r\n- actions\r\n- alerting\r\n- cases\r\n-
rule_registry\r\n- stack_connectors\r\n-
triggers_actions_ui","sha":"9c7864309ce1c5a3d085151e3b67d1635bc558c8"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com>

x-pack/plugins/actions/server/routes/connector/get_all_system/get_all_system.ts

@@ -21,6 +21,9 @@ export const getAllConnectorsIncludingSystemRoute = (
     {
       path: `${INTERNAL_BASE_ACTION_API_PATH}/connectors`,
       validate: {},
+      options: {
+        access: 'internal',
+      },
     },
     router.handleLegacyErrors(
       verifyAccessAndContext(licenseState, async function (context, req, res) {

x-pack/plugins/actions/server/routes/connector/list_types_system/list_types_system.ts

@@ -27,6 +27,9 @@ export const listTypesWithSystemRoute = (
       validate: {
         query: connectorTypesQuerySchemaV1,
       },
+      options: {
+        access: 'internal',
+      },
     },
     router.handleLegacyErrors(
       verifyAccessAndContext(licenseState, async function (context, req, res) {

x-pack/plugins/actions/server/routes/get_global_execution_kpi.ts

@@ -45,6 +45,9 @@ export const getGlobalExecutionKPIRoute = (
       validate: {
         body: bodySchema,
       },
+      options: {
+        access: 'internal',
+      },
     },
     router.handleLegacyErrors(
       verifyAccessAndContext(licenseState, async function (context, req, res) {

x-pack/plugins/actions/server/routes/get_global_execution_logs.ts

@@ -57,6 +57,9 @@ export const getGlobalExecutionLogRoute = (
       validate: {
         body: bodySchema,
       },
+      options: {
+        access: 'internal',
+      },
     },
     router.handleLegacyErrors(
       verifyAccessAndContext(licenseState, async function (context, req, res) {

x-pack/plugins/actions/server/routes/get_oauth_access_token.ts

@@ -66,6 +66,9 @@ export const getOAuthAccessToken = (
       validate: {
         body: bodySchema,
       },
+      options: {
+        access: 'internal',
+      },
     },
     router.handleLegacyErrors(
       verifyAccessAndContext(licenseState, async function (context, req, res) {

x-pack/plugins/alerting/server/plugin.ts

@@ -409,6 +409,7 @@ export class AlertingPlugin {
       getAlertIndicesAlias: createGetAlertIndicesAliasFn(this.ruleTypeRegistry!),
       encryptedSavedObjects: plugins.encryptedSavedObjects,
       config$: plugins.unifiedSearch.autocomplete.getInitializerContextConfig().create(),
+      isServerless: !!plugins.serverless,
     });
 
     return {

x-pack/plugins/alerting/server/routes/backfill/apis/delete/delete_backfill_route.ts

@@ -20,6 +20,9 @@ export const deleteBackfillRoute = (
   router.delete(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/backfill/{id}`,
+      options: {
+        access: 'internal',
+      },
       validate: {
         params: deleteParamsSchemaV1,
       },

x-pack/plugins/alerting/server/routes/backfill/apis/find/find_backfill_route.ts

@@ -28,6 +28,9 @@ export const findBackfillRoute = (
       validate: {
         query: findQuerySchemaV1,
       },
+      options: {
+        access: 'internal',
+      },
     },
     router.handleLegacyErrors(
       verifyAccessAndContext(licenseState, async function (context, req, res) {

x-pack/plugins/alerting/server/routes/backfill/apis/get/get_backfill_route.ts

@@ -22,6 +22,9 @@ export const getBackfillRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/backfill/{id}`,
+      options: {
+        access: 'internal',
+      },
       validate: {
         params: getParamsSchemaV1,
       },

x-pack/plugins/alerting/server/routes/backfill/apis/schedule/schedule_backfill_route.ts

@@ -22,6 +22,7 @@ export const scheduleBackfillRoute = (
   router.post(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/backfill/_schedule`,
+      options: { access: 'internal' },
       validate: {
         body: scheduleBodySchemaV1,
       },

x-pack/plugins/alerting/server/routes/get_action_error_log.ts

@@ -63,6 +63,9 @@ export const getActionErrorLogRoute = (
         params: paramSchema,
         query: querySchema,
       },
+      options: {
+        access: 'internal',
+      },
     },
     router.handleLegacyErrors(
       verifyAccessAndContext(licenseState, async function (context, req, res) {

x-pack/plugins/alerting/server/routes/get_flapping_settings.test.ts

@@ -37,6 +37,7 @@ describe('getFlappingSettingsRoute', () => {
     expect(config).toMatchInlineSnapshot(`
       Object {
         "options": Object {
+          "access": "internal",
           "tags": Array [
             "access:read-flapping-settings",
           ],

x-pack/plugins/alerting/server/routes/get_flapping_settings.ts

@@ -38,6 +38,7 @@ export const getFlappingSettingsRoute = (
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/settings/_flapping`,
       validate: false,
       options: {
+        access: 'internal',
         tags: [`access:${API_PRIVILEGES.READ_FLAPPING_SETTINGS}`],
       },
     },

x-pack/plugins/alerting/server/routes/get_global_execution_kpi.ts

@@ -37,6 +37,9 @@ export const getGlobalExecutionKPIRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/_global_execution_kpi`,
+      options: {
+        access: 'internal',
+      },
       validate: {
         query: querySchema,
       },

x-pack/plugins/alerting/server/routes/get_global_execution_logs.ts

@@ -62,6 +62,9 @@ export const getGlobalExecutionLogRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/_global_execution_logs`,
+      options: {
+        access: 'internal',
+      },
       validate: {
         query: querySchema,
       },

x-pack/plugins/alerting/server/routes/get_rule_alert_summary.ts

@@ -65,6 +65,9 @@ export const getRuleAlertSummaryRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_alert_summary`,
+      options: {
+        access: 'internal',
+      },
       validate: {
         params: paramSchema,
         query: querySchema,

x-pack/plugins/alerting/server/routes/get_rule_execution_kpi.ts

@@ -38,6 +38,9 @@ export const getRuleExecutionKPIRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_execution_kpi`,
+      options: {
+        access: 'internal',
+      },
       validate: {
         params: paramSchema,
         query: querySchema,

x-pack/plugins/alerting/server/routes/get_rule_execution_log.ts

@@ -63,6 +63,9 @@ export const getRuleExecutionLogRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_execution_log`,
+      options: {
+        access: 'internal',
+      },
       validate: {
         params: paramSchema,
         query: querySchema,

x-pack/plugins/alerting/server/routes/get_rule_state.ts

@@ -38,6 +38,9 @@ export const getRuleStateRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/state`,
+      options: {
+        access: 'internal',
+      },
       validate: {
         params: paramSchema,
       },

x-pack/plugins/alerting/server/routes/index.ts

@@ -79,6 +79,7 @@ export interface RouteOptions {
   getAlertIndicesAlias?: GetAlertIndicesAlias;
   usageCounter?: UsageCounter;
   config$?: Observable<ConfigSchema>;
+  isServerless?: boolean;
 }
 
 export function defineRoutes(opts: RouteOptions) {

x-pack/plugins/alerting/server/routes/legacy/create.test.ts

@@ -110,6 +110,8 @@ describe('createAlertRoute', () => {
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id?}"`);
 
+    expect(config.options?.access).toBe('public');
+
     rulesClient.create.mockResolvedValueOnce(createResult);
 
     const [context, req, res] = mockHandlerArguments(
@@ -164,6 +166,28 @@ describe('createAlertRoute', () => {
     });
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+    const encryptedSavedObjects = encryptedSavedObjectsMock.createSetup({ canEncrypt: true });
+    const mockUsageCountersSetup = usageCountersServiceMock.createSetupContract();
+    const mockUsageCounter = mockUsageCountersSetup.createUsageCounter('test');
+
+    createAlertRoute({
+      router,
+      licenseState,
+      encryptedSavedObjects,
+      usageCounter: mockUsageCounter,
+      isServerless: true,
+    });
+
+    const [config] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id?}"`);
+
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('allows providing a custom id when space is undefined', async () => {
     const expectedResult = {
       ...createResult,

x-pack/plugins/alerting/server/routes/legacy/create.ts

@@ -44,7 +44,12 @@ export const bodySchema = schema.object({
   notifyWhen: schema.nullable(schema.string({ validate: validateNotifyWhenType })),
 });
 
-export const createAlertRoute = ({ router, licenseState, usageCounter }: RouteOptions) => {
+export const createAlertRoute = ({
+  router,
+  licenseState,
+  usageCounter,
+  isServerless,
+}: RouteOptions) => {
   router.post(
     {
       path: `${LEGACY_BASE_ALERT_API_PATH}/alert/{id?}`,
@@ -57,6 +62,7 @@ export const createAlertRoute = ({ router, licenseState, usageCounter }: RouteOp
         body: bodySchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Create an alert',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/delete.test.ts

@@ -38,6 +38,7 @@ describe('deleteAlertRoute', () => {
     const [config, handler] = router.delete.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}"`);
+    expect(config.options?.access).toBe('public');
 
     rulesClient.delete.mockResolvedValueOnce({});
 
@@ -65,6 +66,18 @@ describe('deleteAlertRoute', () => {
     expect(res.noContent).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    deleteAlertRoute(router, licenseState, undefined, true);
+
+    const [config] = router.delete.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the license allows deleting alerts', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/delete.ts

@@ -20,7 +20,8 @@ const paramSchema = schema.object({
 export const deleteAlertRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.delete(
     {
@@ -29,6 +30,7 @@ export const deleteAlertRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Delete an alert',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/disable.test.ts

@@ -37,6 +37,7 @@ describe('disableAlertRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_disable"`);
+    expect(config.options?.access).toBe('public');
 
     rulesClient.disableRule.mockResolvedValueOnce();
 
@@ -64,6 +65,18 @@ describe('disableAlertRoute', () => {
     expect(res.noContent).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    disableAlertRoute(router, licenseState, undefined, true);
+
+    const [config] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_disable"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the alert type gets validated for the license', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/disable.ts

@@ -21,7 +21,8 @@ const paramSchema = schema.object({
 export const disableAlertRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.post(
     {
@@ -30,6 +31,7 @@ export const disableAlertRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Disable an alert',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/enable.test.ts

@@ -37,6 +37,7 @@ describe('enableAlertRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_enable"`);
+    expect(config.options?.access).toBe('public');
 
     rulesClient.enableRule.mockResolvedValueOnce();
 
@@ -64,6 +65,18 @@ describe('enableAlertRoute', () => {
     expect(res.noContent).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    enableAlertRoute(router, licenseState, undefined, true);
+
+    const [config] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_enable"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the alert type gets validated for the license', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/enable.ts

@@ -22,7 +22,8 @@ const paramSchema = schema.object({
 export const enableAlertRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.post(
     {
@@ -31,6 +32,7 @@ export const enableAlertRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Enable an alert',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/find.test.ts

@@ -44,6 +44,7 @@ describe('findAlertRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/_find"`);
+    expect(config.options?.access).toBe('public');
 
     const findResult = {
       page: 1,
@@ -95,6 +96,18 @@ describe('findAlertRoute', () => {
     });
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    findAlertRoute(router, licenseState, undefined, true);
+
+    const [config] = router.get.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/_find"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the license allows finding alerts', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/find.ts

@@ -64,7 +64,8 @@ const querySchema = schema.object({
 export const findAlertRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.get(
     {
@@ -73,6 +74,7 @@ export const findAlertRoute = (
         query: querySchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Find alerts',
         tags: ['oas-tag:alerting'],
         description:

x-pack/plugins/alerting/server/routes/legacy/get.test.ts

@@ -86,6 +86,7 @@ describe('getAlertRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}"`);
+    expect(config.options?.access).toBe('public');
 
     rulesClient.get.mockResolvedValueOnce(mockedAlert);
 
@@ -106,6 +107,17 @@ describe('getAlertRoute', () => {
     });
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    getAlertRoute(router, licenseState, undefined, true);
+    const [config] = router.get.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the license allows getting alerts', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/get.ts

@@ -20,7 +20,8 @@ const paramSchema = schema.object({
 export const getAlertRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.get(
     {
@@ -29,6 +30,7 @@ export const getAlertRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Get an alert',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/get_alert_instance_summary.test.ts

@@ -60,6 +60,7 @@ describe('getAlertInstanceSummaryRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_instance_summary"`);
+    expect(config.options?.access).toBe('public');
 
     rulesClient.getAlertSummary.mockResolvedValueOnce(mockedAlertInstanceSummary);
 
@@ -89,6 +90,18 @@ describe('getAlertInstanceSummaryRoute', () => {
     expect(res.ok).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    getAlertInstanceSummaryRoute(router, licenseState, undefined, true);
+
+    const [config] = router.get.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_instance_summary"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('returns NOT-FOUND when alert is not found', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/get_alert_instance_summary.ts

@@ -30,7 +30,8 @@ const rewriteBodyRes = ({ ruleTypeId, alerts, ...rest }: AlertSummary) => ({
 export const getAlertInstanceSummaryRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.get(
     {
@@ -40,6 +41,7 @@ export const getAlertInstanceSummaryRoute = (
         query: querySchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Get an alert summary',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/get_alert_state.test.ts

@@ -55,6 +55,7 @@ describe('getAlertStateRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/state"`);
+    expect(config.options?.access).toBe('public');
 
     rulesClient.getAlertState.mockResolvedValueOnce(mockedAlertState);
 
@@ -82,6 +83,18 @@ describe('getAlertStateRoute', () => {
     expect(res.ok).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    getAlertStateRoute(router, licenseState, undefined, true);
+
+    const [config] = router.get.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/state"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('returns NO-CONTENT when alert exists but has no task state yet', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/get_alert_state.ts

@@ -20,7 +20,8 @@ const paramSchema = schema.object({
 export const getAlertStateRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.get(
     {
@@ -29,6 +30,7 @@ export const getAlertStateRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Get the state of an alert',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/health.test.ts

@@ -91,6 +91,21 @@ describe('healthRoute', () => {
     const [config] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/_health"`);
+    expect(config.options?.access).toBe('public');
+  });
+
+  it('should have internal access for serverless', async () => {
+    rulesClient.listRuleTypes.mockResolvedValueOnce(new Set(ruleTypes));
+    const router = httpServiceMock.createRouter();
+
+    const licenseState = licenseStateMock.create();
+    const encryptedSavedObjects = encryptedSavedObjectsMock.createSetup({ canEncrypt: true });
+    healthRoute(router, licenseState, encryptedSavedObjects, undefined, true);
+
+    const [config] = router.get.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/_health"`);
+    expect(config.options?.access).toBe('internal');
   });
 
   it('throws error when user does not have any access to any rule types', async () => {

x-pack/plugins/alerting/server/routes/legacy/health.ts

@@ -18,13 +18,15 @@ export function healthRoute(
   router: AlertingRouter,
   licenseState: ILicenseState,
   encryptedSavedObjects: EncryptedSavedObjectsPluginSetup,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) {
   router.get(
     {
       path: '/api/alerts/_health',
       validate: false,
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Get the alerting framework health',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/index.ts

@@ -24,22 +24,22 @@ import { healthRoute } from './health';
 import { RouteOptions } from '..';
 
 export function defineLegacyRoutes(opts: RouteOptions) {
-  const { router, licenseState, encryptedSavedObjects, usageCounter } = opts;
+  const { router, licenseState, encryptedSavedObjects, usageCounter, isServerless } = opts;
 
   createAlertRoute(opts);
-  deleteAlertRoute(router, licenseState, usageCounter);
-  findAlertRoute(router, licenseState, usageCounter);
-  getAlertRoute(router, licenseState, usageCounter);
-  getAlertStateRoute(router, licenseState, usageCounter);
-  getAlertInstanceSummaryRoute(router, licenseState, usageCounter);
-  listAlertTypesRoute(router, licenseState, usageCounter);
-  updateAlertRoute(router, licenseState, usageCounter);
-  enableAlertRoute(router, licenseState, usageCounter);
-  disableAlertRoute(router, licenseState, usageCounter);
-  updateApiKeyRoute(router, licenseState, usageCounter);
-  muteAllAlertRoute(router, licenseState, usageCounter);
-  unmuteAllAlertRoute(router, licenseState, usageCounter);
-  muteAlertInstanceRoute(router, licenseState, usageCounter);
-  unmuteAlertInstanceRoute(router, licenseState, usageCounter);
-  healthRoute(router, licenseState, encryptedSavedObjects, usageCounter);
+  deleteAlertRoute(router, licenseState, usageCounter, isServerless);
+  findAlertRoute(router, licenseState, usageCounter, isServerless);
+  getAlertRoute(router, licenseState, usageCounter, isServerless);
+  getAlertStateRoute(router, licenseState, usageCounter, isServerless);
+  getAlertInstanceSummaryRoute(router, licenseState, usageCounter, isServerless);
+  listAlertTypesRoute(router, licenseState, usageCounter, isServerless);
+  updateAlertRoute(router, licenseState, usageCounter, isServerless);
+  enableAlertRoute(router, licenseState, usageCounter, isServerless);
+  disableAlertRoute(router, licenseState, usageCounter, isServerless);
+  updateApiKeyRoute(router, licenseState, usageCounter, isServerless);
+  muteAllAlertRoute(router, licenseState, usageCounter, isServerless);
+  unmuteAllAlertRoute(router, licenseState, usageCounter, isServerless);
+  muteAlertInstanceRoute(router, licenseState, usageCounter, isServerless);
+  unmuteAlertInstanceRoute(router, licenseState, usageCounter, isServerless);
+  healthRoute(router, licenseState, encryptedSavedObjects, usageCounter, isServerless);
 }

x-pack/plugins/alerting/server/routes/legacy/list_alert_types.test.ts

@@ -40,6 +40,7 @@ describe('listAlertTypesRoute', () => {
     const [config, handler] = router.get.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/list_alert_types"`);
+    expect(config.options?.access).toBe('public');
 
     const listTypes = [
       {
@@ -114,6 +115,18 @@ describe('listAlertTypesRoute', () => {
     });
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    listAlertTypesRoute(router, licenseState, undefined, true);
+
+    const [config] = router.get.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/list_alert_types"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the license allows listing alert types', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/list_alert_types.ts

@@ -14,13 +14,15 @@ import { trackLegacyRouteUsage } from '../../lib/track_legacy_route_usage';
 export const listAlertTypesRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.get(
     {
       path: `${LEGACY_BASE_ALERT_API_PATH}/list_alert_types`,
       validate: {},
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Get the alert types',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/mute_all.test.ts

@@ -37,6 +37,7 @@ describe('muteAllAlertRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_mute_all"`);
+    expect(config.options?.access).toBe('public');
 
     rulesClient.muteAll.mockResolvedValueOnce();
 
@@ -64,6 +65,18 @@ describe('muteAllAlertRoute', () => {
     expect(res.noContent).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    muteAllAlertRoute(router, licenseState, undefined, true);
+
+    const [config] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_mute_all"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the alert type gets validated for the license', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/mute_all.ts

@@ -21,7 +21,8 @@ const paramSchema = schema.object({
 export const muteAllAlertRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.post(
     {
@@ -30,6 +31,7 @@ export const muteAllAlertRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Mute all alert instances',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/mute_instance.test.ts

@@ -39,6 +39,7 @@ describe('muteAlertInstanceRoute', () => {
     expect(config.path).toMatchInlineSnapshot(
       `"/api/alerts/alert/{alert_id}/alert_instance/{alert_instance_id}/_mute"`
     );
+    expect(config.options?.access).toBe('public');
 
     rulesClient.muteInstance.mockResolvedValueOnce();
 
@@ -68,6 +69,20 @@ describe('muteAlertInstanceRoute', () => {
     expect(res.noContent).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    muteAlertInstanceRoute(router, licenseState, undefined, true);
+
+    const [config] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(
+      `"/api/alerts/alert/{alert_id}/alert_instance/{alert_instance_id}/_mute"`
+    );
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the alert type gets validated for the license', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/mute_instance.ts

@@ -24,7 +24,8 @@ const paramSchema = schema.object({
 export const muteAlertInstanceRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.post(
     {
@@ -33,6 +34,7 @@ export const muteAlertInstanceRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Mute an alert',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/unmute_all.test.ts

@@ -37,6 +37,7 @@ describe('unmuteAllAlertRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_unmute_all"`);
+    expect(config.options?.access).toBe('public');
 
     rulesClient.unmuteAll.mockResolvedValueOnce();
 
@@ -64,6 +65,18 @@ describe('unmuteAllAlertRoute', () => {
     expect(res.noContent).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    unmuteAllAlertRoute(router, licenseState, undefined, true);
+
+    const [config] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_unmute_all"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the alert type gets validated for the license', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/unmute_all.ts

@@ -21,7 +21,8 @@ const paramSchema = schema.object({
 export const unmuteAllAlertRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.post(
     {
@@ -30,6 +31,7 @@ export const unmuteAllAlertRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Unmute all alert instances',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/unmute_instance.test.ts

@@ -39,6 +39,7 @@ describe('unmuteAlertInstanceRoute', () => {
     expect(config.path).toMatchInlineSnapshot(
       `"/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute"`
     );
+    expect(config.options?.access).toBe('public');
 
     rulesClient.unmuteInstance.mockResolvedValueOnce();
 
@@ -68,6 +69,20 @@ describe('unmuteAlertInstanceRoute', () => {
     expect(res.noContent).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    unmuteAlertInstanceRoute(router, licenseState, undefined, true);
+
+    const [config] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(
+      `"/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute"`
+    );
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the alert type gets validated for the license', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/unmute_instance.ts

@@ -22,7 +22,8 @@ const paramSchema = schema.object({
 export const unmuteAlertInstanceRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.post(
     {
@@ -31,6 +32,7 @@ export const unmuteAlertInstanceRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Unmute an alert',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/update.test.ts

@@ -71,6 +71,7 @@ describe('updateAlertRoute', () => {
     const [config, handler] = router.put.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}"`);
+    expect(config.options?.access).toBe('public');
 
     rulesClient.update.mockResolvedValueOnce(mockedResponse as unknown as SanitizedRule);
 
@@ -140,6 +141,18 @@ describe('updateAlertRoute', () => {
     expect(res.ok).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    updateAlertRoute(router, licenseState, undefined, true);
+
+    const [config] = router.put.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the license allows updating alerts', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/update.ts

@@ -47,7 +47,8 @@ const bodySchema = schema.object({
 export const updateAlertRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.put(
     {
@@ -57,6 +58,7 @@ export const updateAlertRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Update an alert',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/legacy/update_api_key.test.ts

@@ -37,6 +37,7 @@ describe('updateApiKeyRoute', () => {
     const [config, handler] = router.post.mock.calls[0];
 
     expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_update_api_key"`);
+    expect(config.options?.access).toBe('public');
 
     rulesClient.updateRuleApiKey.mockResolvedValueOnce();
 
@@ -64,6 +65,18 @@ describe('updateApiKeyRoute', () => {
     expect(res.noContent).toHaveBeenCalled();
   });
 
+  it('should have internal access for serverless', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    updateApiKeyRoute(router, licenseState, undefined, true);
+
+    const [config] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(`"/api/alerts/alert/{id}/_update_api_key"`);
+    expect(config.options?.access).toBe('internal');
+  });
+
   it('ensures the alert type gets validated for the license', async () => {
     const licenseState = licenseStateMock.create();
     const router = httpServiceMock.createRouter();

x-pack/plugins/alerting/server/routes/legacy/update_api_key.ts

@@ -22,7 +22,8 @@ const paramSchema = schema.object({
 export const updateApiKeyRoute = (
   router: AlertingRouter,
   licenseState: ILicenseState,
-  usageCounter?: UsageCounter
+  usageCounter?: UsageCounter,
+  isServerless?: boolean
 ) => {
   router.post(
     {
@@ -31,6 +32,7 @@ export const updateApiKeyRoute = (
         params: paramSchema,
       },
       options: {
+        access: isServerless ? 'internal' : 'public',
         summary: 'Update the API key for an alert',
         tags: ['oas-tag:alerting'],
         deprecated: true,

x-pack/plugins/alerting/server/routes/maintenance_window/apis/archive/archive_maintenance_window_route.test.ts

@@ -55,7 +55,14 @@ describe('archiveMaintenanceWindowRoute', () => {
     );
 
     expect(config.path).toEqual('/internal/alerting/rules/maintenance_window/{id}/_archive');
-    expect(config.options?.tags?.[0]).toEqual('access:write-maintenance-window');
+    expect(config.options).toMatchInlineSnapshot(`
+      Object {
+        "access": "internal",
+        "tags": Array [
+          "access:write-maintenance-window",
+        ],
+      }
+    `);
 
     await handler(context, req, res);
 

x-pack/plugins/alerting/server/routes/maintenance_window/apis/archive/archive_maintenance_window_route.ts

@@ -35,6 +35,7 @@ export const archiveMaintenanceWindowRoute = (
         body: archiveBodySchemaV1,
       },
       options: {
+        access: 'internal',
         tags: [`access:${MAINTENANCE_WINDOW_API_PRIVILEGES.WRITE_MAINTENANCE_WINDOW}`],
       },
     },

x-pack/plugins/alerting/server/routes/maintenance_window/apis/bulk_get/bulk_get_maintenance_windows_route.test.ts

@@ -68,7 +68,14 @@ describe('bulkGetMaintenanceWindowRoute', () => {
     );
 
     expect(config.path).toEqual('/internal/alerting/rules/maintenance_window/_bulk_get');
-    expect(config.options?.tags?.[0]).toEqual('access:read-maintenance-window');
+    expect(config.options).toMatchInlineSnapshot(`
+      Object {
+        "access": "internal",
+        "tags": Array [
+          "access:read-maintenance-window",
+        ],
+      }
+    `);
 
     await handler(context, req, res);
 

x-pack/plugins/alerting/server/routes/maintenance_window/apis/bulk_get/bulk_get_maintenance_windows_route.ts

@@ -32,6 +32,7 @@ export const bulkGetMaintenanceWindowRoute = (
         body: bulkGetBodySchemaV1,
       },
       options: {
+        access: 'internal',
         tags: [`access:${MAINTENANCE_WINDOW_API_PRIVILEGES.READ_MAINTENANCE_WINDOW}`],
       },
     },

x-pack/plugins/alerting/server/routes/maintenance_window/apis/create/create_maintenance_window_route.test.ts

@@ -59,7 +59,14 @@ describe('createMaintenanceWindowRoute', () => {
     );
 
     expect(config.path).toEqual('/internal/alerting/rules/maintenance_window');
-    expect(config.options?.tags?.[0]).toEqual('access:write-maintenance-window');
+    expect(config.options).toMatchInlineSnapshot(`
+      Object {
+        "access": "internal",
+        "tags": Array [
+          "access:write-maintenance-window",
+        ],
+      }
+    `);
 
     await handler(context, req, res);
 

x-pack/plugins/alerting/server/routes/maintenance_window/apis/create/create_maintenance_window_route.ts

@@ -33,6 +33,7 @@ export const createMaintenanceWindowRoute = (
         body: createBodySchemaV1,
       },
       options: {
+        access: 'internal',
         tags: [`access:${MAINTENANCE_WINDOW_API_PRIVILEGES.WRITE_MAINTENANCE_WINDOW}`],
       },
     },

x-pack/plugins/alerting/server/routes/maintenance_window/apis/delete/delete_maintenance_window_route.test.ts

@@ -47,7 +47,14 @@ describe('deleteMaintenanceWindowRoute', () => {
     );
 
     expect(config.path).toEqual('/internal/alerting/rules/maintenance_window/{id}');
-    expect(config.options?.tags?.[0]).toEqual('access:write-maintenance-window');
+    expect(config.options).toMatchInlineSnapshot(`
+      Object {
+        "access": "internal",
+        "tags": Array [
+          "access:write-maintenance-window",
+        ],
+      }
+    `);
 
     await handler(context, req, res);
 

x-pack/plugins/alerting/server/routes/maintenance_window/apis/delete/delete_maintenance_window_route.ts

@@ -30,6 +30,7 @@ export const deleteMaintenanceWindowRoute = (
         params: deleteParamsSchemaV1,
       },
       options: {
+        access: 'internal',
         tags: [`access:${MAINTENANCE_WINDOW_API_PRIVILEGES.WRITE_MAINTENANCE_WINDOW}`],
       },
     },

x-pack/plugins/alerting/server/routes/maintenance_window/apis/find/find_maintenance_windows_route.test.ts

@@ -56,7 +56,14 @@ describe('findMaintenanceWindowsRoute', () => {
     const [context, req, res] = mockHandlerArguments({ maintenanceWindowClient }, { body: {} });
 
     expect(config.path).toEqual('/internal/alerting/rules/maintenance_window/_find');
-    expect(config.options?.tags?.[0]).toEqual('access:read-maintenance-window');
+    expect(config.options).toMatchInlineSnapshot(`
+      Object {
+        "access": "internal",
+        "tags": Array [
+          "access:read-maintenance-window",
+        ],
+      }
+    `);
 
     await handler(context, req, res);
 

x-pack/plugins/alerting/server/routes/maintenance_window/apis/find/find_maintenance_windows_route.ts

@@ -26,6 +26,7 @@ export const findMaintenanceWindowsRoute = (
       path: `${INTERNAL_ALERTING_API_MAINTENANCE_WINDOW_PATH}/_find`,
       validate: {},
       options: {
+        access: 'internal',
         tags: [`access:${MAINTENANCE_WINDOW_API_PRIVILEGES.READ_MAINTENANCE_WINDOW}`],
       },
     },

x-pack/plugins/alerting/server/routes/maintenance_window/apis/finish/finish_maintenance_window_route.test.ts

@@ -48,7 +48,14 @@ describe('finishMaintenanceWindowRoute', () => {
     );
 
     expect(config.path).toEqual('/internal/alerting/rules/maintenance_window/{id}/_finish');
-    expect(config.options?.tags?.[0]).toEqual('access:write-maintenance-window');
+    expect(config.options).toMatchInlineSnapshot(`
+      Object {
+        "access": "internal",
+        "tags": Array [
+          "access:write-maintenance-window",
+        ],
+      }
+    `);
 
     await handler(context, req, res);
 

x-pack/plugins/alerting/server/routes/maintenance_window/apis/finish/finish_maintenance_window_route.ts

@@ -32,6 +32,7 @@ export const finishMaintenanceWindowRoute = (
         params: finishParamsSchemaV1,
       },
       options: {
+        access: 'internal',
         tags: [`access:${MAINTENANCE_WINDOW_API_PRIVILEGES.WRITE_MAINTENANCE_WINDOW}`],
       },
     },

x-pack/plugins/alerting/server/routes/maintenance_window/apis/get/get_maintenance_window_route.test.ts

@@ -48,7 +48,14 @@ describe('getMaintenanceWindowRoute', () => {
     );
 
     expect(config.path).toEqual('/internal/alerting/rules/maintenance_window/{id}');
-    expect(config.options?.tags?.[0]).toEqual('access:read-maintenance-window');
+    expect(config.options).toMatchInlineSnapshot(`
+      Object {
+        "access": "internal",
+        "tags": Array [
+          "access:read-maintenance-window",
+        ],
+      }
+    `);
 
     await handler(context, req, res);
 

x-pack/plugins/alerting/server/routes/maintenance_window/apis/get/get_maintenance_window_route.ts

@@ -32,6 +32,7 @@ export const getMaintenanceWindowRoute = (
         params: getParamsSchemaV1,
       },
       options: {
+        access: 'internal',
         tags: [`access:${MAINTENANCE_WINDOW_API_PRIVILEGES.READ_MAINTENANCE_WINDOW}`],
       },
     },

x-pack/plugins/alerting/server/routes/maintenance_window/apis/get_active/get_active_maintenance_windows_route.test.ts

@@ -56,7 +56,14 @@ describe('getActiveMaintenanceWindowsRoute', () => {
     const [context, req, res] = mockHandlerArguments({ maintenanceWindowClient }, { body: {} });
 
     expect(config.path).toEqual('/internal/alerting/rules/maintenance_window/_active');
-    expect(config.options?.tags?.[0]).toEqual('access:read-maintenance-window');
+    expect(config.options).toMatchInlineSnapshot(`
+      Object {
+        "access": "internal",
+        "tags": Array [
+          "access:read-maintenance-window",
+        ],
+      }
+    `);
 
     await handler(context, req, res);
 

x-pack/plugins/alerting/server/routes/maintenance_window/apis/get_active/get_active_maintenance_windows_route.ts

@@ -27,6 +27,7 @@ export const getActiveMaintenanceWindowsRoute = (
       path: INTERNAL_ALERTING_API_GET_ACTIVE_MAINTENANCE_WINDOWS_PATH,
       validate: {},
       options: {
+        access: 'internal',
         tags: [`access:${MAINTENANCE_WINDOW_API_PRIVILEGES.READ_MAINTENANCE_WINDOW}`],
       },
     },

x-pack/plugins/alerting/server/routes/maintenance_window/apis/update/update_maintenance_window_route.test.ts

@@ -65,7 +65,14 @@ describe('updateMaintenanceWindowRoute', () => {
     );
 
     expect(config.path).toEqual('/internal/alerting/rules/maintenance_window/{id}');
-    expect(config.options?.tags?.[0]).toEqual('access:write-maintenance-window');
+    expect(config.options).toMatchInlineSnapshot(`
+      Object {
+        "access": "internal",
+        "tags": Array [
+          "access:write-maintenance-window",
+        ],
+      }
+    `);
 
     await handler(context, req, res);
 

x-pack/plugins/alerting/server/routes/maintenance_window/apis/update/update_maintenance_window_route.ts

@@ -36,6 +36,7 @@ export const updateMaintenanceWindowRoute = (
         params: updateParamsSchemaV1,
       },
       options: {
+        access: 'internal',
         tags: [`access:${MAINTENANCE_WINDOW_API_PRIVILEGES.WRITE_MAINTENANCE_WINDOW}`],
       },
     },

x-pack/plugins/alerting/server/routes/rule/apis/aggregate/aggregate_rules_route.ts

@@ -30,6 +30,7 @@ export const aggregateRulesRoute = (
   router.post(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/_aggregate`,
+      options: { access: 'internal' },
       validate: {
         body: aggregateRulesRequestBodySchemaV1,
       },

x-pack/plugins/alerting/server/routes/rule/apis/bulk_delete/bulk_delete_rules_route.ts

@@ -28,6 +28,7 @@ export const bulkDeleteRulesRoute = ({
   router.patch(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/_bulk_delete`,
+      options: { access: 'internal' },
       validate: {
         body: bulkDeleteRulesRequestBodySchemaV1,
       },

x-pack/plugins/alerting/server/routes/rule/apis/bulk_disable/bulk_disable_rules_route.ts

@@ -29,6 +29,7 @@ export const bulkDisableRulesRoute = ({
   router.patch(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/_bulk_disable`,
+      options: { access: 'internal' },
       validate: {
         body: bulkDisableRulesRequestBodySchemaV1,
       },

x-pack/plugins/alerting/server/routes/rule/apis/bulk_edit/bulk_edit_rules_route.ts

@@ -33,6 +33,7 @@ const buildBulkEditRulesRoute = ({ licenseState, path, router }: BuildBulkEditRu
   router.post(
     {
       path,
+      options: { access: 'internal' },
       validate: {
         body: bulkEditRulesRequestBodySchemaV1,
       },

x-pack/plugins/alerting/server/routes/rule/apis/bulk_enable/bulk_enable_rules_route.ts

@@ -27,6 +27,7 @@ export const bulkEnableRulesRoute = ({
   router.patch(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/_bulk_enable`,
+      options: { access: 'internal' },
       validate: {
         body: bulkEnableBodySchemaV1,
       },

x-pack/plugins/alerting/server/routes/rule/apis/bulk_untrack/bulk_untrack_alerts_route.ts

@@ -21,6 +21,7 @@ export const bulkUntrackAlertsRoute = (
   router.post(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/alerts/_bulk_untrack`,
+      options: { access: 'internal' },
       validate: {
         body: bulkUntrackBodySchemaV1,
       },

x-pack/plugins/alerting/server/routes/rule/apis/bulk_untrack_by_query/bulk_untrack_alerts_by_query_route.ts

@@ -22,6 +22,7 @@ export const bulkUntrackAlertsByQueryRoute = (
   router.post(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/alerts/_bulk_untrack_by_query`,
+      options: { access: 'internal' },
       validate: {
         body: bulkUntrackByQueryBodySchemaV1,
       },

x-pack/plugins/alerting/server/routes/rule/apis/clone/clone_rule_route.ts

@@ -25,6 +25,7 @@ export const cloneRuleRoute = (
   router.post(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_clone/{newId?}`,
+      options: { access: 'internal' },
       validate: {
         params: cloneRuleRequestParamsSchemaV1,
       },

x-pack/plugins/alerting/server/routes/rule/apis/find/find_rules_route.ts

@@ -108,6 +108,7 @@ const buildFindRulesRoute = ({
     router.post(
       {
         path,
+        options: { access: 'internal' },
         validate: {
           body: findRulesRequestQuerySchemaV1,
         },

x-pack/plugins/alerting/server/routes/rule/apis/get/get_rule_route.ts

@@ -109,4 +109,5 @@ export const getInternalRuleRoute = (
     licenseState,
     path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}`,
     router,
+    options: { access: 'internal' },
   });

x-pack/plugins/alerting/server/routes/rule/apis/get_schedule_frequency/get_schedule_frequency_route.test.ts

@@ -34,6 +34,9 @@ describe('getScheduleFrequencyRoute', () => {
 
     expect(config).toMatchInlineSnapshot(`
       Object {
+        "options": Object {
+          "access": "internal",
+        },
         "path": "/internal/alerting/rules/_schedule_frequency",
         "validate": Object {},
       }

x-pack/plugins/alerting/server/routes/rule/apis/get_schedule_frequency/get_schedule_frequency_route.ts

@@ -19,6 +19,7 @@ export const getScheduleFrequencyRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/_schedule_frequency`,
+      options: { access: 'internal' },
       validate: {},
     },
     router.handleLegacyErrors(

x-pack/plugins/alerting/server/routes/rule/apis/resolve/resolve_rule_route.ts

@@ -27,6 +27,7 @@ export const resolveRuleRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_resolve`,
+      options: { access: 'internal' },
       validate: {
         params: resolveParamsSchemaV1,
       },

x-pack/plugins/alerting/server/routes/rule/apis/snooze/snooze_rule_route.ts

@@ -25,6 +25,7 @@ export const snoozeRuleRoute = (
   router.post(
     {
       path: INTERNAL_ALERTING_SNOOZE_RULE,
+      options: { access: 'internal' },
       validate: {
         params: snoozeParamsSchema,
         body: snoozeBodySchema,

x-pack/plugins/alerting/server/routes/rule/apis/tags/get_rule_tags.ts

@@ -22,6 +22,7 @@ export const getRuleTagsRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/_tags`,
+      options: { access: 'internal' },
       validate: {
         query: ruleTagsRequestQuerySchemaV1,
       },

x-pack/plugins/alerting/server/routes/rule/apis/unsnooze/unsnooze_rule_route.ts

@@ -25,6 +25,7 @@ export const unsnoozeRuleRoute = (
   router.post(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_unsnooze`,
+      options: { access: 'internal' },
       validate: {
         params: unsnoozeParamsSchema,
         body: unsnoozeBodySchema,

x-pack/plugins/alerting/server/routes/rules_settings/apis/get/get_query_delay_settings.test.ts

@@ -37,6 +37,7 @@ describe('getQueryDelaySettingsRoute', () => {
     expect(config).toMatchInlineSnapshot(`
       Object {
         "options": Object {
+          "access": "internal",
           "tags": Array [
             "access:read-query-delay-settings",
           ],

x-pack/plugins/alerting/server/routes/rules_settings/apis/get/get_query_delay_settings.ts

@@ -22,6 +22,7 @@ export const getQueryDelaySettingsRoute = (
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/settings/_query_delay`,
       validate: {},
       options: {
+        access: 'internal',
         tags: [`access:${API_PRIVILEGES.READ_QUERY_DELAY_SETTINGS}`],
       },
     },

x-pack/plugins/alerting/server/routes/rules_settings/apis/update/update_query_delay_settings.test.ts

@@ -45,6 +45,7 @@ describe('updateQueryDelaySettingsRoute', () => {
     expect(config.path).toMatchInlineSnapshot(`"/internal/alerting/rules/settings/_query_delay"`);
     expect(config.options).toMatchInlineSnapshot(`
       Object {
+        "access": "internal",
         "tags": Array [
           "access:write-query-delay-settings",
         ],

x-pack/plugins/alerting/server/routes/rules_settings/apis/update/update_query_delay_settings.ts

@@ -28,6 +28,7 @@ export const updateQueryDelaySettingsRoute = (
         body: updateQueryDelaySettingsBodySchemaV1,
       },
       options: {
+        access: 'internal',
         tags: [`access:${API_PRIVILEGES.WRITE_QUERY_DELAY_SETTINGS}`],
       },
     },

x-pack/plugins/alerting/server/routes/run_soon.ts

@@ -22,6 +22,9 @@ export const runSoonRoute = (
   router.post(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_run_soon`,
+      options: {
+        access: 'internal',
+      },
       validate: {
         params: paramSchema,
       },

x-pack/plugins/alerting/server/routes/suggestions/fields_rules.ts

@@ -30,6 +30,7 @@ export function registerFieldsRoute(
   router.post(
     {
       path: '/internal/rules/saved_objects/fields',
+      options: { access: 'internal' },
       validate: {
         body: schema.nullable(
           schema.object({

x-pack/plugins/alerting/server/routes/suggestions/values_suggestion_alerts.ts

@@ -63,6 +63,7 @@ export function registerAlertsValueSuggestionsRoute(
   router.post(
     {
       path: '/internal/alerts/suggestions/values',
+      options: { access: 'internal' },
       validate: AlertsSuggestionsSchema,
     },
     router.handleLegacyErrors(

x-pack/plugins/alerting/server/routes/suggestions/values_suggestion_rules.ts

@@ -49,6 +49,7 @@ export function registerRulesValueSuggestionsRoute(
   router.post(
     {
       path: '/internal/rules/suggestions/values',
+      options: { access: 'internal' },
       validate: RulesSuggestionsSchema,
     },
     router.handleLegacyErrors(

x-pack/plugins/alerting/server/routes/update_flapping_settings.test.ts

@@ -47,6 +47,7 @@ describe('updateFlappingSettingsRoute', () => {
     expect(config.path).toMatchInlineSnapshot(`"/internal/alerting/rules/settings/_flapping"`);
     expect(config.options).toMatchInlineSnapshot(`
       Object {
+        "access": "internal",
         "tags": Array [
           "access:write-flapping-settings",
         ],

x-pack/plugins/alerting/server/routes/update_flapping_settings.ts

@@ -61,6 +61,7 @@ export const updateFlappingSettingsRoute = (
         body: bodySchema,
       },
       options: {
+        access: 'internal',
         tags: [`access:${API_PRIVILEGES.WRITE_FLAPPING_SETTINGS}`],
       },
     },

x-pack/plugins/cases/server/routes/api/cases/categories/get_categories.ts

@@ -13,6 +13,9 @@ import type { caseApiV1 } from '../../../../../common/types/api';
 export const getCategoriesRoute = createCasesRoute({
   method: 'get',
   path: INTERNAL_GET_CASE_CATEGORIES_URL,
+  routerOptions: {
+    access: 'internal',
+  },
   handler: async ({ context, request, response }) => {
     try {
       const caseContext = await context.cases;

x-pack/plugins/cases/server/routes/api/cases/get_case.ts

@@ -77,6 +77,9 @@ export const getCaseRoute = createCasesRoute({
 export const resolveCaseRoute = createCasesRoute({
   method: 'get',
   path: `${CASE_DETAILS_URL}/resolve`,
+  routerOptions: {
+    access: 'internal',
+  },
   params,
   handler: async ({ context, request, response }) => {
     try {

x-pack/plugins/cases/server/routes/api/internal/bulk_create_attachments.ts

@@ -22,6 +22,9 @@ export const bulkCreateAttachmentsRoute = createCasesRoute({
     }),
     body: schema.arrayOf(escapeHatch),
   },
+  routerOptions: {
+    access: 'internal',
+  },
   handler: async ({ context, request, response }) => {
     try {
       const casesContext = await context.cases;