-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Actions] Authorize system action when create or editing rules (#180437)
## Summary In this PR we add the ability for system actions to provide required kibana feature privileges for which the user should be authorized when creating or updating a rule. For example, if a user with no permissions to Cases should not be able to create a rule with a case system action. ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- Loading branch information
Showing
18 changed files
with
757 additions
and
28 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
102 changes: 102 additions & 0 deletions
102
...ck/plugins/alerting/server/connector_adapters/get_system_action_kibana_privileges.test.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import { schema } from '@kbn/config-schema'; | ||
| import { ConnectorAdapterRegistry } from './connector_adapter_registry'; | ||
| import { getSystemActionKibanaPrivileges } from './get_system_action_kibana_privileges'; | ||
| import type { ConnectorAdapter } from './types'; | ||
|
|
||
| describe('getSystemActionKibanaPrivileges', () => { | ||
| const connectorAdapter: ConnectorAdapter = { | ||
| connectorTypeId: '.test', | ||
| ruleActionParamsSchema: schema.object({ foo: schema.string() }), | ||
| buildActionParams: jest.fn(), | ||
| getKibanaPrivileges: (args) => [`my-priv:${args.consumer}`], | ||
| }; | ||
|
|
||
| const systemActions = [ | ||
| { id: 'my-id', actionTypeId: '.test', params: {} }, | ||
| { id: 'my-id-2', actionTypeId: '.test-2', params: {} }, | ||
| ]; | ||
|
|
||
| let registry: ConnectorAdapterRegistry; | ||
|
|
||
| beforeEach(() => { | ||
| registry = new ConnectorAdapterRegistry(); | ||
| registry.register(connectorAdapter); | ||
|
|
||
| registry.register({ | ||
| ...connectorAdapter, | ||
| connectorTypeId: '.test-2', | ||
| getKibanaPrivileges: (args) => [`my-priv-2:${args.consumer}`], | ||
| }); | ||
|
|
||
| registry.register({ | ||
| ...connectorAdapter, | ||
| connectorTypeId: '.no-priv', | ||
| }); | ||
| }); | ||
|
|
||
| it('should return an empty array if systemActions are empty', () => { | ||
| const privileges = getSystemActionKibanaPrivileges({ | ||
| connectorAdapterRegistry: registry, | ||
| systemActions: [], | ||
| rule: { consumer: 'stackAlerts' }, | ||
| }); | ||
|
|
||
| expect(privileges).toEqual([]); | ||
| }); | ||
|
|
||
| it('should return an empty array if systemActions are not defined', () => { | ||
| const privileges = getSystemActionKibanaPrivileges({ | ||
| connectorAdapterRegistry: registry, | ||
| rule: { consumer: 'stackAlerts' }, | ||
| }); | ||
|
|
||
| expect(privileges).toEqual([]); | ||
| }); | ||
|
|
||
| it('should return the privileges correctly', () => { | ||
| const privileges = getSystemActionKibanaPrivileges({ | ||
| connectorAdapterRegistry: registry, | ||
| systemActions, | ||
| rule: { consumer: 'stackAlerts' }, | ||
| }); | ||
|
|
||
| expect(privileges).toEqual(['my-priv:stackAlerts', 'my-priv-2:stackAlerts']); | ||
| }); | ||
|
|
||
| it('should return the privileges correctly with system actions without connector adapter', () => { | ||
| const privileges = getSystemActionKibanaPrivileges({ | ||
| connectorAdapterRegistry: registry, | ||
| systemActions: [...systemActions, { id: 'my-id-2', actionTypeId: '.not-valid', params: {} }], | ||
| rule: { consumer: 'stackAlerts' }, | ||
| }); | ||
|
|
||
| expect(privileges).toEqual(['my-priv:stackAlerts', 'my-priv-2:stackAlerts']); | ||
| }); | ||
|
|
||
| it('should return the privileges correctly with system actions without getKibanaPrivileges defined', () => { | ||
| const privileges = getSystemActionKibanaPrivileges({ | ||
| connectorAdapterRegistry: registry, | ||
| systemActions: [...systemActions, { id: 'my-id-2', actionTypeId: '.no-priv', params: {} }], | ||
| rule: { consumer: 'stackAlerts' }, | ||
| }); | ||
|
|
||
| expect(privileges).toEqual(['my-priv:stackAlerts', 'my-priv-2:stackAlerts']); | ||
| }); | ||
|
|
||
| it('should not return duplicated privileges', () => { | ||
| const privileges = getSystemActionKibanaPrivileges({ | ||
| connectorAdapterRegistry: registry, | ||
| systemActions: [systemActions[0], systemActions[0]], | ||
| rule: { consumer: 'stackAlerts' }, | ||
| }); | ||
|
|
||
| expect(privileges).toEqual(['my-priv:stackAlerts']); | ||
| }); | ||
| }); |
Oops, something went wrong.