[Response Ops][Alerting] Adding new alerting actions to allow more fine grained rule privileges

x-pack/platform/packages/private/security/authorization_core/src/privileges/feature_privilege_builder/alerting.ts

@@ -35,33 +35,41 @@ const readOperations: Record<AlertingEntity, string[]> = {
   alert: ['get', 'find', 'getAuthorizedAlertsIndices', 'getAlertSummary'],
 };
 
+const manualRunOperations: Record<AlertingEntity, string[]> = {
+  rule: ['deleteBackfill', 'fillGaps', 'scheduleBackfill'],
+  alert: [],
+};
+
+const enableOperations: Record<AlertingEntity, string[]> = {
+  rule: ['enable', 'disable', 'bulkEnable', 'bulkDisable'],
+  alert: [],
+};
+
 const writeOperations: Record<AlertingEntity, string[]> = {
   rule: [
     'create',
     'delete',
     'update',
     'updateApiKey',
-    'enable',
-    'disable',
     'muteAll',
     'unmuteAll',
     'muteAlert',
     'unmuteAlert',
     'snooze',
     'bulkEdit',
     'bulkDelete',
-    'bulkEnable',
-    'bulkDisable',
     'unsnooze',
     'runSoon',
-    'scheduleBackfill',
-    'deleteBackfill',
-    'fillGaps',
   ],
   alert: ['update'],
 };
 const allOperations: Record<AlertingEntity, string[]> = {
-  rule: [...readOperations.rule, ...writeOperations.rule],
+  rule: [
+    ...readOperations.rule,
+    ...writeOperations.rule,
+    ...enableOperations.rule,
+    ...manualRunOperations.rule,
+  ],
   alert: [...readOperations.alert, ...writeOperations.alert],
 };
 
@@ -85,11 +93,15 @@ export class FeaturePrivilegeAlertingBuilder extends BaseFeaturePrivilegeBuilder
 
     const getPrivilegesForEntity = (entity: AlertingEntity) => {
       const all = get(privilegeDefinition.alerting, `${entity}.all`) ?? [];
+      const enable = get(privilegeDefinition.alerting, `${entity}.enable`) ?? [];
+      const manualRun = get(privilegeDefinition.alerting, `${entity}.manual_run`) ?? [];
       const read = get(privilegeDefinition.alerting, `${entity}.read`) ?? [];
 
       return uniq([
         ...getAlertingPrivilege(allOperations[entity], all, entity),
         ...getAlertingPrivilege(readOperations[entity], read, entity),
+        ...getAlertingPrivilege(enableOperations[entity], enable, entity),
+        ...getAlertingPrivilege(manualRunOperations[entity], manualRun, entity),
       ]);
     };
 

x-pack/platform/packages/private/security/authorization_core/src/privileges/privileges.test.ts

@@ -582,23 +582,18 @@ describe('features', () => {
         'delete',
         'update',
         'updateApiKey',
-        'enable',
-        'disable',
         'muteAll',
         'unmuteAll',
         'muteAlert',
         'unmuteAlert',
         'snooze',
         'bulkEdit',
         'bulkDelete',
-        'bulkEnable',
-        'bulkDisable',
         'unsnooze',
         'runSoon',
-        'scheduleBackfill',
-        'deleteBackfill',
-        'fillGaps',
       ],
+      ...['enable', 'disable', 'bulkEnable', 'bulkDisable'],
+      ...['deleteBackfill', 'fillGaps', 'scheduleBackfill'],
     ];
 
     const expectedAllPrivileges = [
@@ -760,23 +755,18 @@ describe('features', () => {
         'delete',
         'update',
         'updateApiKey',
-        'enable',
-        'disable',
         'muteAll',
         'unmuteAll',
         'muteAlert',
         'unmuteAlert',
         'snooze',
         'bulkEdit',
         'bulkDelete',
-        'bulkEnable',
-        'bulkDisable',
         'unsnooze',
         'runSoon',
-        'scheduleBackfill',
-        'deleteBackfill',
-        'fillGaps',
       ],
+      ...['enable', 'disable', 'bulkEnable', 'bulkDisable'],
+      ...['deleteBackfill', 'fillGaps', 'scheduleBackfill'],
     ];
 
     const expectedAllPrivileges = [

x-pack/platform/plugins/shared/features/common/feature_kibana_privileges.ts

@@ -119,6 +119,26 @@ export interface FeatureKibanaPrivileges {
        * ```
        */
       read?: AlertingKibanaPrivilege;
+      /**
+       * List of rule types and consumers for which users should have the ability to enable and disable rules when granted this privilege.
+       * @example
+       * ```ts
+       *  {
+       *    enable: [{ ruleTypeId: 'my-alert-type-within-my-feature', consumers: ['my-consumer-within-my-feature'] }]
+       *  }
+       * ```
+       */
+      enable?: AlertingKibanaPrivilege;
+      /**
+       * List of rule types and consumers for which users should have the ability to manually run backfills when granted this privilege.
+       * @example
+       * ```ts
+       *  {
+       *    manual_run: [{ ruleTypeId: 'my-alert-type-within-my-feature', consumers: ['my-consumer-within-my-feature'] }]
+       *  }
+       * ```
+       */
+      manual_run?: AlertingKibanaPrivilege;
     };
     alert?: {
       /**