[8.x] [Obs AI Assistant] Manual migration for routes with access tag (#…

…202817) (#203013)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Obs AI Assistant] Manual migration for routes with access tag
(#202817)](#202817)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Viduni
Wickramarachchi","email":"viduni.wickramarachchi@elastic.co"},"sourceCommit":{"committedDate":"2024-12-04T20:21:25Z","message":"[Obs
AI Assistant] Manual migration for routes with access tag
(#202817)\n\n## Summary\r\n\r\n### Problem\r\n`tags:
[access:ai_assistant]` is deprecated. \r\n\r\n### Solution\r\nAll the
routes that use this tag needs to be migrated to the
`authz`:\r\n`requiredPrivileges` property.\r\n\r\n### Checklist\r\n\r\n-
[x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [x] The PR
description includes the appropriate Release Notes section,\r\nand the
correct `release_note:*` label is applied per
the\r\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"d669c83be8d7d79e157786dce9742a55c3e69a6b","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team:Obs
AI
Assistant","ci:project-deploy-observability","backport:version","Authz:
API migration","v8.18.0"],"title":"[Obs AI Assistant] Manual migration
for routes with access
tag","number":202817,"url":"https://github.com/elastic/kibana/pull/202817","mergeCommit":{"message":"[Obs
AI Assistant] Manual migration for routes with access tag
(#202817)\n\n## Summary\r\n\r\n### Problem\r\n`tags:
[access:ai_assistant]` is deprecated. \r\n\r\n### Solution\r\nAll the
routes that use this tag needs to be migrated to the
`authz`:\r\n`requiredPrivileges` property.\r\n\r\n### Checklist\r\n\r\n-
[x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [x] The PR
description includes the appropriate Release Notes section,\r\nand the
correct `release_note:*` label is applied per
the\r\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"d669c83be8d7d79e157786dce9742a55c3e69a6b"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/202817","number":202817,"mergeCommit":{"message":"[Obs
AI Assistant] Manual migration for routes with access tag
(#202817)\n\n## Summary\r\n\r\n### Problem\r\n`tags:
[access:ai_assistant]` is deprecated. \r\n\r\n### Solution\r\nAll the
routes that use this tag needs to be migrated to the
`authz`:\r\n`requiredPrivileges` property.\r\n\r\n### Checklist\r\n\r\n-
[x] [Unit or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [x] The PR
description includes the appropriate Release Notes section,\r\nand the
correct `release_note:*` label is applied per
the\r\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"d669c83be8d7d79e157786dce9742a55c3e69a6b"}},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Viduni Wickramarachchi <viduni.wickramarachchi@elastic.co>

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/chat/route.ts

@@ -126,8 +126,10 @@ async function initializeChatRequest({
 
 const chatRoute = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /internal/observability_ai_assistant/chat',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   params: t.type({
     body: t.intersection([
@@ -174,8 +176,10 @@ const chatRoute = createObservabilityAIAssistantServerRoute({
 
 const chatRecallRoute = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /internal/observability_ai_assistant/chat/recall',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   params: t.type({
     body: t.type({
@@ -282,8 +286,10 @@ async function chatComplete(
 
 const chatCompleteRoute = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /internal/observability_ai_assistant/chat/complete',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   params: chatCompleteInternalRt,
   handler: async (resources): Promise<Readable> => {
@@ -293,8 +299,10 @@ const chatCompleteRoute = createObservabilityAIAssistantServerRoute({
 
 const publicChatCompleteRoute = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /api/observability_ai_assistant/chat/complete 2023-10-31',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   params: chatCompletePublicRt,
   handler: async (resources): Promise<Readable> => {

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/connectors/route.ts

@@ -10,8 +10,10 @@ import { createObservabilityAIAssistantServerRoute } from '../create_observabili
 
 const listConnectorsRoute = createObservabilityAIAssistantServerRoute({
   endpoint: 'GET /internal/observability_ai_assistant/connectors',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<FindActionResult[]> => {
     const { request, plugins } = resources;

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/conversations/route.ts

@@ -17,8 +17,10 @@ const getConversationRoute = createObservabilityAIAssistantServerRoute({
       conversationId: t.string,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<Conversation> => {
     const { service, request, params } = resources;
@@ -40,8 +42,10 @@ const findConversationsRoute = createObservabilityAIAssistantServerRoute({
       query: t.string,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<{ conversations: Conversation[] }> => {
     const { service, request, params } = resources;
@@ -63,8 +67,10 @@ const createConversationRoute = createObservabilityAIAssistantServerRoute({
       conversation: conversationCreateRt,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<Conversation> => {
     const { service, request, params } = resources;
@@ -89,8 +95,10 @@ const updateConversationRoute = createObservabilityAIAssistantServerRoute({
       conversation: conversationUpdateRt,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<Conversation> => {
     const { service, request, params } = resources;
@@ -115,8 +123,10 @@ const updateConversationTitle = createObservabilityAIAssistantServerRoute({
       title: t.string,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<Conversation> => {
     const { service, request, params } = resources;
@@ -143,8 +153,10 @@ const deleteConversationRoute = createObservabilityAIAssistantServerRoute({
       conversationId: t.string,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const { service, request, params } = resources;

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/functions/route.ts

@@ -22,8 +22,10 @@ const getFunctionsRoute = createObservabilityAIAssistantServerRoute({
       scopes: t.union([t.array(assistantScopeType), assistantScopeType]),
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (
     resources
@@ -97,8 +99,10 @@ const functionRecallRoute = createObservabilityAIAssistantServerRoute({
       }),
     ]),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (
     resources
@@ -132,8 +136,10 @@ const functionSummariseRoute = createObservabilityAIAssistantServerRoute({
       labels: t.record(t.string, t.string),
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/knowledge_base/route.ts

@@ -20,8 +20,10 @@ import { Instruction, KnowledgeBaseEntry, KnowledgeBaseEntryRole } from '../../.
 
 const getKnowledgeBaseStatus = createObservabilityAIAssistantServerRoute({
   endpoint: 'GET /internal/observability_ai_assistant/kb/status',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async ({
     service,
@@ -54,11 +56,15 @@ const setupKnowledgeBase = createObservabilityAIAssistantServerRoute({
     }),
   }),
   options: {
-    tags: ['access:ai_assistant'],
     timeout: {
       idleSocket: moment.duration(20, 'minutes').asMilliseconds(),
     },
   },
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
+  },
   handler: async (resources): Promise<InferenceInferenceEndpointInfo> => {
     const client = await resources.service.getClient({ request: resources.request });
 
@@ -74,8 +80,10 @@ const setupKnowledgeBase = createObservabilityAIAssistantServerRoute({
 
 const resetKnowledgeBase = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /internal/observability_ai_assistant/kb/reset',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<{ result: string }> => {
     const client = await resources.service.getClient({ request: resources.request });
@@ -92,8 +100,10 @@ const resetKnowledgeBase = createObservabilityAIAssistantServerRoute({
 
 const semanticTextMigrationKnowledgeBase = createObservabilityAIAssistantServerRoute({
   endpoint: 'POST /internal/observability_ai_assistant/kb/semantic_text_migration',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });
@@ -108,8 +118,10 @@ const semanticTextMigrationKnowledgeBase = createObservabilityAIAssistantServerR
 
 const getKnowledgeBaseUserInstructions = createObservabilityAIAssistantServerRoute({
   endpoint: 'GET /internal/observability_ai_assistant/kb/user_instructions',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (
     resources
@@ -137,8 +149,10 @@ const saveKnowledgeBaseUserInstruction = createObservabilityAIAssistantServerRou
       public: toBooleanRt,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });
@@ -156,8 +170,10 @@ const saveKnowledgeBaseUserInstruction = createObservabilityAIAssistantServerRou
 
 const getKnowledgeBaseEntries = createObservabilityAIAssistantServerRoute({
   endpoint: 'GET /internal/observability_ai_assistant/kb/entries',
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   params: t.type({
     query: t.type({
@@ -207,8 +223,10 @@ const saveKnowledgeBaseEntry = createObservabilityAIAssistantServerRoute({
   params: t.type({
     body: knowledgeBaseEntryRt,
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });
@@ -238,8 +256,10 @@ const deleteKnowledgeBaseEntry = createObservabilityAIAssistantServerRoute({
       entryId: t.string,
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });
@@ -259,8 +279,10 @@ const importKnowledgeBaseEntries = createObservabilityAIAssistantServerRoute({
       entries: t.array(knowledgeBaseEntryRt),
     }),
   }),
-  options: {
-    tags: ['access:ai_assistant'],
+  security: {
+    authz: {
+      requiredPrivileges: ['ai_assistant'],
+    },
   },
   handler: async (resources): Promise<void> => {
     const client = await resources.service.getClient({ request: resources.request });

x-pack/plugins/observability_solution/observability_ai_assistant/server/routes/types.ts

@@ -85,5 +85,4 @@ export interface ObservabilityAIAssistantRouteCreateOptions {
     payload?: number;
     idleSocket?: number;
   };
-  tags: Array<'access:ai_assistant'>;
 }

x-pack/test/observability_ai_assistant_api_integration/common/config.ts

@@ -11,7 +11,7 @@ import { ObservabilityAIAssistantFtrConfigName } from '../configs';
 import { getApmSynthtraceEsClient } from './create_synthtrace_client';
 import { InheritedFtrProviderContext, InheritedServices } from './ftr_provider_context';
 import { getScopedApiClient } from './observability_ai_assistant_api_client';
-import { editor, secondaryEditor, viewer } from './users/users';
+import { editor, secondaryEditor, unauthorizedUser, viewer } from './users/users';
 
 export interface ObservabilityAIAssistantFtrConfig {
   name: ObservabilityAIAssistantFtrConfigName;
@@ -33,6 +33,16 @@ export type ObservabilityAIAssistantAPIClient = Awaited<
 
 export type ObservabilityAIAssistantServices = Awaited<ReturnType<CreateTestConfig>>['services'];
 
+export class ForbiddenApiError extends Error {
+  status: number;
+
+  constructor(message: string = 'Forbidden') {
+    super(message);
+    this.name = 'ForbiddenApiError';
+    this.status = 403;
+  }
+}
+
 export function createObservabilityAIAssistantAPIConfig({
   config,
   license,
@@ -67,6 +77,7 @@ export function createObservabilityAIAssistantAPIConfig({
           viewer: getScopedApiClientForUsername(viewer.username),
           editor: getScopedApiClientForUsername(editor.username),
           secondaryEditor: getScopedApiClientForUsername(secondaryEditor.username),
+          unauthorizedUser: getScopedApiClientForUsername(unauthorizedUser.username),
         };
       },
     },

x-pack/test/observability_ai_assistant_api_integration/common/users/users.ts

@@ -6,10 +6,14 @@
  */
 
 import { kbnTestConfig } from '@kbn/test';
+
 const password = kbnTestConfig.getUrlParts().password!;
 
+export const UNAUTHORIZED_USERNAME = 'unauthorized_user';
+export const UNAUTHORIZED_USER_PASSWORD = 'unauthorized_password';
+
 export interface User {
-  username: 'elastic' | 'editor' | 'viewer' | 'secondary_editor';
+  username: 'elastic' | 'editor' | 'viewer' | 'secondary_editor' | 'unauthorized_user';
   password: string;
   roles: string[];
 }
@@ -32,4 +36,10 @@ export const viewer: User = {
   roles: ['viewer'],
 };
 
-export const allUsers = [editor, secondaryEditor, viewer];
+export const unauthorizedUser: User = {
+  username: UNAUTHORIZED_USERNAME,
+  password: UNAUTHORIZED_USER_PASSWORD,
+  roles: [],
+};
+
+export const allUsers = [editor, secondaryEditor, viewer, unauthorizedUser];