allow user to disable alert even if they dont have privileges to the …

…underlying action
elastic · Jul 20, 2020 · a894e5a · a894e5a
1 parent 46f46c7
commit a894e5a
Show file tree

Hide file tree

Showing 2 changed files with 0 additions and 13 deletions.
diff --git a/x-pack/plugins/alerts/server/alerts_client.ts b/x-pack/plugins/alerts/server/alerts_client.ts
@@ -613,10 +613,6 @@ export class AlertsClient {
  WriteOperations.Disable
  );
 
- if (attributes.actions.length) {
- await this.actionsAuthorization.ensureAuthorized('execute');
- }
-
  if (attributes.enabled === true) {
  await this.unsecuredSavedObjectsClient.update(
  'alert',

diff --git a/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/disable.ts b/x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/disable.ts
@@ -90,15 +90,6 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
  await getScheduledTask(createdAlert.scheduledTaskId);
  break;
  case 'space_1_all_alerts_none_actions at space1':
- expect(response.statusCode).to.eql(403);
- expect(response.body).to.eql({
- error: 'Forbidden',
- message: `Unauthorized to execute actions`,
- statusCode: 403,
- });
- // Ensure task still exists
- await getScheduledTask(createdAlert.scheduledTaskId);
- break;
  case 'superuser at space1':
  case 'space_1_all at space1':
  case 'space_1_all_with_restricted_fixture at space1':