[ResponseOps][Rules] Remove unintended internal Find routes API with public access

x-pack/plugins/alerting/server/routes/rule/apis/find/find_rules_route.test.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 import { usageCountersServiceMock } from '@kbn/usage-collection-plugin/server/usage_counters/usage_counters_service.mock';
-import { findRulesRoute } from './find_rules_route';
+import { findRulesRoute, findInternalRulesRoute } from './find_rules_route';
 import { httpServiceMock } from '@kbn/core/server/mocks';
 import { licenseStateMock } from '../../../../lib/license_state.mock';
 import { verifyApiAccess } from '../../../../lib/license_api_access';
@@ -30,6 +30,18 @@ beforeEach(() => {
 });
 
 describe('findRulesRoute', () => {
+ it('registers the route with public access', async () => {
+ const licenseState = licenseStateMock.create();
+ const router = httpServiceMock.createRouter();
+
+ findRulesRoute(router, licenseState);
+ expect(router.get).toHaveBeenCalledWith(
+ expect.objectContaining({
+ options: expect.objectContaining({ access: 'public' }),
+ }),
+ expect.any(Function)
+ );
+ });
  it('finds rules with proper parameters', async () => {
  const licenseState = licenseStateMock.create();
  const router = httpServiceMock.createRouter();
@@ -435,3 +447,18 @@ describe('findRulesRoute', () => {
  });
  });
 });
+
+describe('findInternalRulesRoute', () => {
+ it('registers the route without public access', async () => {
+ const licenseState = licenseStateMock.create();
+ const router = httpServiceMock.createRouter();
+
+ findInternalRulesRoute(router, licenseState);
+ expect(router.post).toHaveBeenCalledWith(
+ expect.not.objectContaining({
+ options: expect.objectContaining({ access: 'public' }),
+ }),
+ expect.any(Function)
+ );
+ });
+});

x-pack/plugins/alerting/server/routes/rule/apis/find/find_rules_route.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { IRouter } from '@kbn/core/server';
+import { IRouter, RouteConfigOptions, RouteMethod } from '@kbn/core/server';
 import { UsageCounter } from '@kbn/usage-collection-plugin/server';
 import { ILicenseState } from '../../../../lib';
 import { verifyAccessAndContext } from '../../../lib';
@@ -29,6 +29,7 @@ interface BuildFindRulesRouteParams {
  router: IRouter<AlertingRequestHandlerContext>;
  excludeFromPublicApi?: boolean;
  usageCounter?: UsageCounter;
+ options?: RouteConfigOptions<RouteMethod>;
 }
 
 const buildFindRulesRoute = ({
@@ -37,74 +38,72 @@ const buildFindRulesRoute = ({
  router,
  excludeFromPublicApi = false,
  usageCounter,
+ options: routerOptions,
 }: BuildFindRulesRouteParams) => {
- router.get(
- {
- path,
- options: {
- access: 'public',
- summary: 'Get information about rules',
- tags: ['oas-tag:alerting'],
- },
- validate: {
- request: {
- query: findRulesRequestQuerySchemaV1,
- },
- response: {
- 200: {
- body: () => ruleResponseSchemaV1,
- description: 'Indicates a successful call.',
- },
- 400: {
- description: 'Indicates an invalid schema or parameters.',
+ if (path !== INTERNAL_ALERTING_API_FIND_RULES_PATH) {
+ router.get(
+ {
+ path,
+ options: routerOptions,
+ validate: {
+ request: {
+ query: findRulesRequestQuerySchemaV1,
  },
- 403: {
- description: 'Indicates that this call is forbidden.',
+ response: {
+ 200: {
+ body: () => ruleResponseSchemaV1,
+ description: 'Indicates a successful call.',
+ },
+ 400: {
+ description: 'Indicates an invalid schema or parameters.',
+ },
+ 403: {
+ description: 'Indicates that this call is forbidden.',
+ },
  },
  },
  },
- },
- router.handleLegacyErrors(
- verifyAccessAndContext(licenseState, async function (context, req, res) {
- const rulesClient = (await context.alerting).getRulesClient();
-
- const query: FindRulesRequestQueryV1 = req.query;
-
- trackLegacyTerminology(
- [query.search, query.search_fields, query.sort_field].filter(Boolean) as string[],
- usageCounter
- );
-
- const options = transformFindRulesBodyV1({
- ...query,
- has_reference: query.has_reference || undefined,
- search_fields: searchFieldsAsArray(query.search_fields),
- });
-
- if (req.query.fields) {
- usageCounter?.incrementCounter({
- counterName: `alertingFieldsUsage`,
- counterType: 'alertingFieldsUsage',
- incrementBy: 1,
+ router.handleLegacyErrors(
+ verifyAccessAndContext(licenseState, async function (context, req, res) {
+ const rulesClient = (await context.alerting).getRulesClient();
+
+ const query: FindRulesRequestQueryV1 = req.query;
+
+ trackLegacyTerminology(
+ [query.search, query.search_fields, query.sort_field].filter(Boolean) as string[],
+ usageCounter
+ );
+
+ const options = transformFindRulesBodyV1({
+ ...query,
+ has_reference: query.has_reference || undefined,
+ search_fields: searchFieldsAsArray(query.search_fields),
  });
- }
-
- const findResult = await rulesClient.find({
- options,
- excludeFromPublicApi,
- includeSnoozeData: true,
- });
-
- const responseBody: FindRulesResponseV1<RuleParamsV1>['body'] =
- transformFindRulesResponseV1<RuleParamsV1>(findResult, options.fields);
-
- return res.ok({
- body: responseBody,
- });
- })
- )
- );
- if (path === INTERNAL_ALERTING_API_FIND_RULES_PATH) {
+
+ if (req.query.fields) {
+ usageCounter?.incrementCounter({
+ counterName: `alertingFieldsUsage`,
+ counterType: 'alertingFieldsUsage',
+ incrementBy: 1,
+ });
+ }
+
+ const findResult = await rulesClient.find({
+ options,
+ excludeFromPublicApi,
+ includeSnoozeData: true,
+ });
+
+ const responseBody: FindRulesResponseV1<RuleParamsV1>['body'] =
+ transformFindRulesResponseV1<RuleParamsV1>(findResult, options.fields);
+
+ return res.ok({
+ body: responseBody,
+ });
+ })
+ )
+ );
+ } else {
  router.post(
  {
  path,
@@ -168,6 +167,11 @@ export const findRulesRoute = (
  path: `${BASE_ALERTING_API_PATH}/rules/_find`,
  router,
  usageCounter,
+ options: {
+ access: 'public',
+ summary: 'Get information about rules',
+ tags: ['oas-tag:alerting'],
+ },
  });
 };
 

x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/find.ts

@@ -662,6 +662,5 @@ export default function createFindTests({ getService }: FtrProviderContext) {
  });
 
  findTestUtils('public', objectRemover, supertest, supertestWithoutAuth);
- findTestUtils('internal', objectRemover, supertest, supertestWithoutAuth);
  });
 }

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/create.ts

@@ -340,7 +340,7 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
  )
  .expect(200);
 
- const response = await supertest.get(
+ const response = await supertest.post(
  `${getUrlPrefix(
  Spaces.space1.id
  )}/internal/alerting/rules/_find?filter=alert.attributes.params.risk_score:40`

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group1/find.ts

@@ -332,7 +332,6 @@ export default function createFindTests({ getService }: FtrProviderContext) {
  afterEach(() => objectRemover.removeAll());
 
  findTestUtils('public', supertest, objectRemover);
- findTestUtils('internal', supertest, objectRemover);
 
  describe('legacy', function () {
  this.tags('skipFIPS');

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/group2/update.ts

@@ -85,7 +85,7 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
  expect(Date.parse(response.body.next_run)).to.be.greaterThan(0);
  }
 
- response = await supertest.get(
+ response = await supertest.post(
  `${getUrlPrefix(
  Spaces.space1.id
  )}/internal/alerting/rules/_find?filter=alert.attributes.params.risk_score:40`

x-pack/test/observability_functional/apps/observability/pages/alerts/custom_threshold.ts

@@ -209,7 +209,7 @@ export default ({ getService }: FtrProviderContext) => {
  });
 
  it('saved the rule correctly', async () => {
- const { body: rules } = await supertest.get('/internal/alerting/rules/_find');
+ const { body: rules } = await supertest.post('/internal/alerting/rules/_find');
 
  expect(rules.data.length).toEqual(1);
  expect(rules.data[0]).toEqual(