update docs

docs/development/core/server/kibana-plugin-server.destructiveroutemethod.md

@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [DestructiveRouteMethod](./kibana-plugin-server.destructiveroutemethod.md)
+
+## DestructiveRouteMethod type
+
+Set of HTTP methods changing the state of the server.
+
+<b>Signature:</b>
+
+```typescript
+export declare type DestructiveRouteMethod = 'post' | 'put' | 'delete' | 'patch';
+```

docs/development/core/server/kibana-plugin-server.md

@@ -183,6 +183,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [ConfigDeprecationLogger](./kibana-plugin-server.configdeprecationlogger.md) | Logger interface used when invoking a [ConfigDeprecation](./kibana-plugin-server.configdeprecation.md) |
 |  [ConfigDeprecationProvider](./kibana-plugin-server.configdeprecationprovider.md) | A provider that should returns a list of [ConfigDeprecation](./kibana-plugin-server.configdeprecation.md)<!-- -->.<!-- -->See [ConfigDeprecationFactory](./kibana-plugin-server.configdeprecationfactory.md) for more usage examples. |
 |  [ConfigPath](./kibana-plugin-server.configpath.md) |  |
+|  [DestructiveRouteMethod](./kibana-plugin-server.destructiveroutemethod.md) | Set of HTTP methods changing the state of the server. |
 |  [ElasticsearchClientConfig](./kibana-plugin-server.elasticsearchclientconfig.md) |  |
 |  [GetAuthHeaders](./kibana-plugin-server.getauthheaders.md) | Get headers to authenticate a user against Elasticsearch. |
 |  [GetAuthState](./kibana-plugin-server.getauthstate.md) | Gets authentication state for a request. Returned by <code>auth</code> interceptor. |
@@ -227,6 +228,7 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [RouteValidationFunction](./kibana-plugin-server.routevalidationfunction.md) | The custom validation function if @<!-- -->kbn/config-schema is not a valid solution for your specific plugin requirements. |
 |  [RouteValidationSpec](./kibana-plugin-server.routevalidationspec.md) | Allowed property validation options: either @<!-- -->kbn/config-schema validations or custom validation functions<!-- -->See [RouteValidationFunction](./kibana-plugin-server.routevalidationfunction.md) for custom validation. |
 |  [RouteValidatorFullConfig](./kibana-plugin-server.routevalidatorfullconfig.md) | Route validations config and options merged into one object |
+|  [SafeRouteMethod](./kibana-plugin-server.saferoutemethod.md) | Set of HTTP methods not changing the state of the server. |
 |  [SavedObjectAttribute](./kibana-plugin-server.savedobjectattribute.md) | Type definition for a Saved Object attribute value |
 |  [SavedObjectAttributeSingle](./kibana-plugin-server.savedobjectattributesingle.md) | Don't use this type, it's simply a helper type for [SavedObjectAttribute](./kibana-plugin-server.savedobjectattribute.md) |
 |  [SavedObjectMigrationFn](./kibana-plugin-server.savedobjectmigrationfn.md) | A migration function for a [saved object type](./kibana-plugin-server.savedobjectstype.md) used to migrate it to a given version |

docs/development/core/server/kibana-plugin-server.routeconfigoptions.md

@@ -19,5 +19,5 @@ export interface RouteConfigOptions<Method extends RouteMethod>
 |  [authRequired](./kibana-plugin-server.routeconfigoptions.authrequired.md) | <code>boolean</code> | A flag shows that authentication for a route: <code>enabled</code> when true <code>disabled</code> when false<!-- -->Enabled by default. |
 |  [body](./kibana-plugin-server.routeconfigoptions.body.md) | <code>Method extends 'get' &#124; 'options' ? undefined : RouteConfigOptionsBody</code> | Additional body options [RouteConfigOptionsBody](./kibana-plugin-server.routeconfigoptionsbody.md)<!-- -->. |
 |  [tags](./kibana-plugin-server.routeconfigoptions.tags.md) | <code>readonly string[]</code> | Additional metadata tag strings to attach to the route. |
-|  [xsrfRequired](./kibana-plugin-server.routeconfigoptions.xsrfrequired.md) | <code>boolean</code> | Defines xsrf protection requirements for a route: - true. Requires an incoming request to contain <code>kbn-xsrf</code> header. - false. Disables xsrf protection.<!-- -->Set to true by default |
+|  [xsrfRequired](./kibana-plugin-server.routeconfigoptions.xsrfrequired.md) | <code>Method extends 'get' ? never : boolean</code> | Defines xsrf protection requirements for a route: - true. Requires an incoming POST/PUT/DELETE request to contain <code>kbn-xsrf</code> header. - false. Disables xsrf protection.<!-- -->Set to true by default |
 

docs/development/core/server/kibana-plugin-server.routeconfigoptions.xsrfrequired.md

@@ -4,12 +4,12 @@
 
 ## RouteConfigOptions.xsrfRequired property
 
-Defines xsrf protection requirements for a route: - true. Requires an incoming request to contain `kbn-xsrf` header. - false. Disables xsrf protection.
+Defines xsrf protection requirements for a route: - true. Requires an incoming POST/PUT/DELETE request to contain `kbn-xsrf` header. - false. Disables xsrf protection.
 
 Set to true by default
 
 <b>Signature:</b>
 
 ```typescript
-xsrfRequired?: boolean;
+xsrfRequired?: Method extends 'get' ? never : boolean;
 ```

docs/development/core/server/kibana-plugin-server.routemethod.md

@@ -9,5 +9,5 @@ The set of common HTTP methods supported by Kibana routing.
 <b>Signature:</b>
 
 ```typescript
-export declare type RouteMethod = 'get' | 'post' | 'put' | 'delete' | 'patch' | 'options';
+export declare type RouteMethod = SafeRouteMethod | DestructiveRouteMethod;
 ```

docs/development/core/server/kibana-plugin-server.saferoutemethod.md

@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SafeRouteMethod](./kibana-plugin-server.saferoutemethod.md)
+
+## SafeRouteMethod type
+
+Set of HTTP methods not changing the state of the server.
+
+<b>Signature:</b>
+
+```typescript
+export declare type SafeRouteMethod = 'get' | 'options';
+```

src/core/server/http/index.ts

@@ -58,6 +58,8 @@ export {
   RouteValidationError,
   RouteValidatorFullConfig,
   RouteValidationResultFactory,
+  DestructiveRouteMethod,
+  SafeRouteMethod,
 } from './router';
 export { BasePathProxyServer } from './base_path_proxy_server';
 export { OnPreAuthHandler, OnPreAuthToolkit } from './lifecycle/on_pre_auth';

src/core/server/http/router/index.ts

@@ -30,12 +30,14 @@ export {
   ensureRawRequest,
 } from './request';
 export {
+  DestructiveRouteMethod,
   isSafeMethod,
   RouteMethod,
   RouteConfig,
   RouteConfigOptions,
   RouteContentType,
   RouteConfigOptionsBody,
+  SafeRouteMethod,
   validBodyOutput,
 } from './route';
 export { HapiResponseAdapter } from './response_adapter';

src/core/server/http/router/route.ts

@@ -23,8 +23,18 @@ export function isSafeMethod(method: RouteMethod): method is SafeRouteMethod {
   return method === 'get' || method === 'options';
 }
 
+/**
+ * Set of HTTP methods changing the state of the server.
+ * @public
+ */
 export type DestructiveRouteMethod = 'post' | 'put' | 'delete' | 'patch';
+
+/**
+ * Set of HTTP methods not changing the state of the server.
+ * @public
+ */
 export type SafeRouteMethod = 'get' | 'options';
+
 /**
  * The set of common HTTP methods supported by Kibana routing.
  * @public

src/core/server/index.ts

@@ -159,6 +159,8 @@ export {
   SessionStorageCookieOptions,
   SessionCookieValidationResult,
   SessionStorageFactory,
+  DestructiveRouteMethod,
+  SafeRouteMethod,
 } from './http';
 export { RenderingServiceSetup, IRenderOptions } from './rendering';
 export { Logger, LoggerFactory, LogMeta, LogRecord, LogLevel } from './logging';

src/core/server/server.api.md

@@ -685,6 +685,9 @@ export interface DeprecationSettings {
     message: string;
 }
 
+// @public
+export type DestructiveRouteMethod = 'post' | 'put' | 'delete' | 'patch';
+
 // @public
 export interface DiscoveredPlugin {
     readonly configPath: ConfigPath;
@@ -1397,7 +1400,7 @@ export interface RouteConfigOptions<Method extends RouteMethod> {
     authRequired?: boolean;
     body?: Method extends 'get' | 'options' ? undefined : RouteConfigOptionsBody;
     tags?: readonly string[];
-    xsrfRequired?: boolean;
+    xsrfRequired?: Method extends 'get' ? never : boolean;
 }
 
 // @public
@@ -1412,7 +1415,7 @@ export interface RouteConfigOptionsBody {
 export type RouteContentType = 'application/json' | 'application/*+json' | 'application/octet-stream' | 'application/x-www-form-urlencoded' | 'multipart/form-data' | 'text/*';
 
 // @public
-export type RouteMethod = 'get' | 'post' | 'put' | 'delete' | 'patch' | 'options';
+export type RouteMethod = SafeRouteMethod | DestructiveRouteMethod;
 
 // @public
 export type RouteRegistrar<Method extends RouteMethod> = <P, Q, B>(route: RouteConfig<P, Q, B, Method>, handler: RequestHandler<P, Q, B, Method>) => void;
@@ -1465,6 +1468,9 @@ export interface RouteValidatorOptions {
     };
 }
 
+// @public
+export type SafeRouteMethod = 'get' | 'options';
+
 // @public (undocumented)
 export interface SavedObject<T = unknown> {
     attributes: T;