[8.x] [Fleet] Require AgentPolicies:All to add a fleet server (#193014)…

… (#193156)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Fleet] Require AgentPolicies:All to add a fleet server
(#193014)](#193014)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Nicolas
Chaulet","email":"nicolas.chaulet@elastic.co"},"sourceCommit":{"committedDate":"2024-09-17T12:13:54Z","message":"[Fleet]
Require AgentPolicies:All to add a fleet server
(#193014)","sha":"193935cbf25c96ae1e6952f7233f001053e60a59","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Fleet","v9.0.0","backport:prev-minor","v8.16.0"],"title":"[Fleet]
Require AgentPolicies:All to add a fleet
server","number":193014,"url":"https://github.com/elastic/kibana/pull/193014","mergeCommit":{"message":"[Fleet]
Require AgentPolicies:All to add a fleet server
(#193014)","sha":"193935cbf25c96ae1e6952f7233f001053e60a59"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/193014","number":193014,"mergeCommit":{"message":"[Fleet]
Require AgentPolicies:All to add a fleet server
(#193014)","sha":"193935cbf25c96ae1e6952f7233f001053e60a59"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Nicolas Chaulet <nicolas.chaulet@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

x-pack/plugins/fleet/common/authz.ts

@@ -117,7 +117,8 @@ export const calculateAuthz = ({
         allSettings: fleet.settings?.all ?? false,
         allAgentPolicies: fleet.agentPolicies?.all ?? false,
         addAgents: fleet.agents?.all ?? false,
-        addFleetServers: (fleet.agents?.all && fleet.settings?.all) ?? false,
+        addFleetServers:
+          (fleet.agents?.all && fleet.agentPolicies?.all && fleet.settings?.all) ?? false,
         // Setup is needed to access the Fleet UI
         setup:
           hasFleetAll ||

x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/settings_page/fleet_server_hosts_section.tsx

@@ -59,7 +59,7 @@ export const FleetServerHostsSection: React.FunctionComponent<FleetServerHostsSe
         fleetServerHosts={fleetServerHosts}
         deleteFleetServerHost={deleteFleetServerHost}
       />
-      {authz.fleet.allSettings && authz.fleet.allAgents ? (
+      {authz.fleet.addFleetServers ? (
         <>
           <EuiSpacer size="s" />
           <EuiButtonEmpty

x-pack/plugins/fleet/server/services/security/security.test.ts

@@ -886,4 +886,57 @@ describe('getAuthzFromRequest', () => {
       expect(res.fleet.readAgents).toBe(false);
     });
   });
+
+  describe('Fleet addFleetServer', () => {
+    beforeEach(() => {
+      mockSecurity.authz.mode.useRbacForRequest.mockReturnValue(true);
+    });
+    it('should authorize user with Fleet:Agents:All Fleet:AgentsPolicies:All Fleet:Settings:All', async () => {
+      checkPrivileges.mockResolvedValue({
+        privileges: {
+          kibana: [
+            {
+              resource: 'default',
+              privilege: 'api:fleet-agents-all',
+              authorized: true,
+            },
+            {
+              resource: 'default',
+              privilege: 'api:fleet-agent-policies-all',
+              authorized: true,
+            },
+            {
+              resource: 'default',
+              privilege: 'api:fleet-settings-all',
+              authorized: true,
+            },
+          ],
+          elasticsearch: {} as any,
+        },
+        hasAllRequested: true,
+        username: 'test',
+      });
+      const res = await getAuthzFromRequest({} as any);
+      expect(res.fleet.addFleetServers).toBe(true);
+    });
+
+    it('should not authorize user with only Fleet:Agents:All', async () => {
+      checkPrivileges.mockResolvedValue({
+        privileges: {
+          kibana: [
+            {
+              resource: 'default',
+              privilege: 'api:fleet-agents-all',
+              authorized: true,
+            },
+          ],
+          elasticsearch: {} as any,
+        },
+        hasAllRequested: true,
+        username: 'test',
+      });
+      const res = await getAuthzFromRequest({} as any);
+      expect(res.fleet.addFleetServers).toBe(false);
+    });
+  });
 });