GAP - Role API Structure

x-pack/plugins/security/server/lib/authorization/__snapshots__/privilege_serializer.test.ts.snap

@@ -1,11 +1,21 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`#deserializePrivilegeAssignedAtSpace throws Error if not prefixed with space_ 1`] = `"Unable to deserialize all, should have started with space_ or feature_"`;
+exports[`#deserializeFeaturePrivilege throws error when deserializing feature_.privilege-1 1`] = `"Feature privilege 'feature_.privilege-1' didn't match pattern"`;
 
-exports[`#deserializePrivilegeAssignedAtSpace throws Error if prefixed with space_ but not a reserved privilege 1`] = `"Unrecognized privilege assigned at space"`;
+exports[`#deserializeFeaturePrivilege throws error when deserializing feature_foo. 1`] = `"Feature privilege 'feature_foo.' didn't match pattern"`;
 
-exports[`#deserializePrivilegeAssignedGlobally throws Error if not prefixed with feature_ and isn't a reserved privilege 1`] = `"Unrecognized privilege assigned globally"`;
+exports[`#deserializeFeaturePrivilege throws error when deserializing feature_foo_privilege-1 1`] = `"Feature privilege 'feature_foo_privilege-1' didn't match pattern"`;
 
-exports[`#serializeGlobalPrivilege throws Error if unrecognized privilege used 1`] = `"Unrecognized global reserved privilege"`;
+exports[`#deserializeFeaturePrivilege throws error when deserializing feature-foo.privilege-1 1`] = `"Feature privilege 'feature-foo.privilege-1' didn't match pattern"`;
 
-exports[`#serializeSpaceReservedPrivilege throws Error if unrecognized privilege used 1`] = `"Unrecognized space reserved privilege"`;
+exports[`#deserializeFeaturePrivilege throws error when deserializing foo_feature_foo.privilege-1 1`] = `"Feature privilege 'foo_feature_foo.privilege-1' didn't match pattern"`;
+
+exports[`#deserializeGlobalMinimumPrivilege throws Error if isn't a minimum privilege 1`] = `"Unrecognized global minimum privilege"`;
+
+exports[`#deserializeSpaceMinimumPrivilege throws Error if prefixed with space_ but not a reserved privilege 1`] = `"Unrecognized space minimum privilege"`;
+
+exports[`#deserializeSpaceMinimumPrivilege throws Error if provided 'all' 1`] = `"Unrecognized space minimum privilege"`;
+
+exports[`#serializeGlobalMinimumPrivilege throws Error if unrecognized privilege used 1`] = `"Unrecognized global minimum privilege"`;
+
+exports[`#serializeSpaceMinimumPrivilege throws Error if unrecognized privilege used 1`] = `"Unrecognized space minimum privilege"`;

x-pack/plugins/security/server/lib/authorization/privilege_serializer.test.ts

@@ -6,131 +6,155 @@
 
 import { PrivilegeSerializer } from './privilege_serializer';
 
-describe('#serializeGlobalPrivilege', () => {
+describe(`#isGlobalMinimumPrivilege`, () => {
+  ['all', 'read'].forEach(validValue => {
+    test(`returns true for '${validValue}'`, () => {
+      expect(PrivilegeSerializer.isGlobalMinimumPrivilege(validValue)).toBe(true);
+    });
+  });
+
+  ['space_all', 'space_read', 'foo', 'bar', 'feature_foo', 'feature_foo.privilege1'].forEach(
+    validValue => {
+      test(`returns true for '${validValue}'`, () => {
+        expect(PrivilegeSerializer.isGlobalMinimumPrivilege(validValue)).toBe(false);
+      });
+    }
+  );
+});
+
+describe(`#isSpaceMinimumPrivilege`, () => {
+  ['space_all', 'space_read'].forEach(validValue => {
+    test(`returns true for '${validValue}'`, () => {
+      expect(PrivilegeSerializer.isSpaceMinimumPrivilege(validValue)).toBe(true);
+    });
+  });
+
+  ['all', 'read', 'foo', 'bar', 'feature_foo', 'feature_foo.privilege1'].forEach(validValue => {
+    test(`returns true for '${validValue}'`, () => {
+      expect(PrivilegeSerializer.isSpaceMinimumPrivilege(validValue)).toBe(false);
+    });
+  });
+});
+
+describe('#serializeGlobalMinimumPrivilege', () => {
   test('throws Error if unrecognized privilege used', () => {
     expect(() =>
-      PrivilegeSerializer.serializeGlobalReservedPrivilege('foo')
+      PrivilegeSerializer.serializeGlobalMinimumPrivilege('foo')
     ).toThrowErrorMatchingSnapshot();
   });
 
   test('returns all unmodified', () => {
-    const allResult = PrivilegeSerializer.serializeGlobalReservedPrivilege('all');
+    const allResult = PrivilegeSerializer.serializeGlobalMinimumPrivilege('all');
     expect(allResult).toBe('all');
   });
 
   test('returns read unmodified', () => {
-    const readResult = PrivilegeSerializer.serializeGlobalReservedPrivilege('read');
+    const readResult = PrivilegeSerializer.serializeGlobalMinimumPrivilege('read');
     expect(readResult).toBe('read');
   });
 });
 
-describe('#serializeSpaceReservedPrivilege', () => {
+describe('#serializeSpaceMinimumPrivilege', () => {
   test('throws Error if unrecognized privilege used', () => {
     expect(() =>
-      PrivilegeSerializer.serializeSpaceReservedPrivilege('foo')
+      PrivilegeSerializer.serializeSpaceMinimumPrivilege('foo')
     ).toThrowErrorMatchingSnapshot();
   });
 
   test('returns all prefixed with space_', () => {
-    const allResult = PrivilegeSerializer.serializeSpaceReservedPrivilege('all');
+    const allResult = PrivilegeSerializer.serializeSpaceMinimumPrivilege('all');
     expect(allResult).toBe('space_all');
   });
 
   test('returns read prefixed with space_', () => {
-    const readResult = PrivilegeSerializer.serializeSpaceReservedPrivilege('read');
+    const readResult = PrivilegeSerializer.serializeSpaceMinimumPrivilege('read');
     expect(readResult).toBe('space_read');
   });
 });
 
 describe('#serializeFeaturePrivilege', () => {
-  test('returns `feature_${featureName}_${privilegeName}`', () => {
+  test('returns `feature_${featureName}.${privilegeName}`', () => {
     const result = PrivilegeSerializer.serializeFeaturePrivilege('foo', 'bar');
-    expect(result).toBe('feature_foo_bar');
-  });
-});
-
-describe('#serializePrivilegeAssignedGlobally', () => {
-  test(`returns 'all' when 'all' is provided`, () => {
-    const result = PrivilegeSerializer.serializePrivilegeAssignedGlobally('all');
-    expect(result).toBe('all');
-  });
-
-  test(`returns 'read' when 'read' is provided`, () => {
-    const result = PrivilegeSerializer.serializePrivilegeAssignedGlobally('read');
-    expect(result).toBe('read');
-  });
-
-  test('returns `feature_${privilege}` otherwise', () => {
-    const result = PrivilegeSerializer.serializePrivilegeAssignedGlobally('foo');
-    expect(result).toBe('feature_foo');
+    expect(result).toBe('feature_foo.bar');
   });
 });
 
-describe('#serializePrivilegeAssignedAtSpace', () => {
-  test(`returns 'space_all' when 'all' is provided`, () => {
-    const result = PrivilegeSerializer.serializePrivilegeAssignedAtSpace('all');
-    expect(result).toBe('space_all');
-  });
-
-  test(`returns 'space_read' when 'read' is provided`, () => {
-    const result = PrivilegeSerializer.serializePrivilegeAssignedAtSpace('read');
-    expect(result).toBe('space_read');
-  });
-
-  test('returns `feature_${privilege}` otherwise', () => {
-    const result = PrivilegeSerializer.serializePrivilegeAssignedAtSpace('foo');
-    expect(result).toBe('feature_foo');
+describe('#deserializeFeaturePrivilege', () => {
+  [
+    {
+      privilege: 'feature_foo.privilege-1',
+      expectedResult: {
+        featureId: 'foo',
+        privilege: 'privilege-1',
+      },
+    },
+    {
+      privilege: 'feature_foo_bar.foo_privilege-1',
+      expectedResult: {
+        featureId: 'foo_bar',
+        privilege: 'foo_privilege-1',
+      },
+    },
+  ].forEach(({ privilege, expectedResult }) => {
+    test(`deserializes '${privilege}' to ${JSON.stringify(expectedResult)}`, () => {
+      const result = PrivilegeSerializer.deserializeFeaturePrivilege(privilege);
+      expect(result).toEqual(expectedResult);
+    });
+  });
+
+  [
+    'feature-foo.privilege-1', // doesn't start with feature_
+    'foo_feature_foo.privilege-1', // also doesn't start with feature_
+    'feature_foo_privilege-1', // no '.'
+    'feature_foo.', // has a '.' but nothing after it
+    'feature_.privilege-1', // nothing before the '.'
+  ].forEach(privilege => {
+    test(`throws error when deserializing ${privilege}`, () => {
+      expect(() =>
+        PrivilegeSerializer.deserializeFeaturePrivilege(privilege)
+      ).toThrowErrorMatchingSnapshot();
+    });
   });
 });
 
-describe('#deserializePrivilegeAssignedGlobally', () => {
-  test(`if prefixed with 'feature_' removes the prefix`, () => {
-    const result = PrivilegeSerializer.deserializePrivilegeAssignedGlobally('feature_foo');
-    expect(result).toBe('foo');
-  });
-
-  test(`throws Error if not prefixed with feature_ and isn't a reserved privilege`, () => {
+describe('#deserializeGlobalMinimumPrivilege', () => {
+  test(`throws Error if isn't a minimum privilege`, () => {
     expect(() =>
-      PrivilegeSerializer.deserializePrivilegeAssignedGlobally('foo')
+      PrivilegeSerializer.deserializeGlobalMinimumPrivilege('foo')
     ).toThrowErrorMatchingSnapshot();
   });
 
   test(`returns 'all' unprefixed if provided 'all'`, () => {
-    const result = PrivilegeSerializer.deserializePrivilegeAssignedGlobally('all');
+    const result = PrivilegeSerializer.deserializeGlobalMinimumPrivilege('all');
     expect(result).toBe('all');
   });
 
   test(`returns 'read' unprefixed if provided 'read'`, () => {
-    const result = PrivilegeSerializer.deserializePrivilegeAssignedGlobally('read');
+    const result = PrivilegeSerializer.deserializeGlobalMinimumPrivilege('read');
     expect(result).toBe('read');
   });
 });
 
-describe('#deserializePrivilegeAssignedAtSpace', () => {
-  test(`if prefixed with 'feature_' removes the prefix`, () => {
-    const result = PrivilegeSerializer.deserializePrivilegeAssignedAtSpace('feature_foo');
-    expect(result).toBe('foo');
-  });
-
-  test(`throws Error if not prefixed with space_`, () => {
+describe('#deserializeSpaceMinimumPrivilege', () => {
+  test(`throws Error if provided 'all'`, () => {
     expect(() =>
-      PrivilegeSerializer.deserializePrivilegeAssignedAtSpace('all')
+      PrivilegeSerializer.deserializeSpaceMinimumPrivilege('all')
     ).toThrowErrorMatchingSnapshot();
   });
 
   test(`throws Error if prefixed with space_ but not a reserved privilege`, () => {
     expect(() =>
-      PrivilegeSerializer.deserializePrivilegeAssignedAtSpace('space_foo')
+      PrivilegeSerializer.deserializeSpaceMinimumPrivilege('space_foo')
     ).toThrowErrorMatchingSnapshot();
   });
 
   test(`returns 'all' unprefixed if provided 'space_all'`, () => {
-    const result = PrivilegeSerializer.deserializePrivilegeAssignedAtSpace('space_all');
+    const result = PrivilegeSerializer.deserializeSpaceMinimumPrivilege('space_all');
     expect(result).toBe('all');
   });
 
   test(`returns 'read' unprefixed if provided 'space_read'`, () => {
-    const result = PrivilegeSerializer.deserializePrivilegeAssignedAtSpace('space_read');
+    const result = PrivilegeSerializer.deserializeSpaceMinimumPrivilege('space_read');
     expect(result).toBe('read');
   });
 });

x-pack/plugins/security/server/lib/authorization/privilege_serializer.ts

@@ -6,73 +6,73 @@
 
 const featurePrefix = 'feature_';
 const spacePrefix = 'space_';
-const reservedPrivilegeNames = ['all', 'read'];
+const minimumPrivilegeNames = ['all', 'read'];
+const spaceMinimumPrivilegeNames = minimumPrivilegeNames.map(
+  privilegeName => `${spacePrefix}${privilegeName}`
+);
+const deserializeFeaturePrivilegeRegexp = new RegExp(
+  `^${featurePrefix}([a-zA-Z0-9_-]+)\\.([a-zA-Z0-9_-]+)$`
+);
+
+interface FeaturePrivilege {
+  featureId: string;
+  privilege: string;
+}
 
 export class PrivilegeSerializer {
-  public static serializeGlobalReservedPrivilege(privilegeName: string) {
-    if (!reservedPrivilegeNames.includes(privilegeName)) {
-      throw new Error('Unrecognized global reserved privilege');
+  public static isGlobalMinimumPrivilege(privilegeName: string) {
+    return minimumPrivilegeNames.includes(privilegeName);
+  }
+
+  public static isSpaceMinimumPrivilege(privilegeName: string) {
+    return spaceMinimumPrivilegeNames.includes(privilegeName);
+  }
+
+  public static serializeGlobalMinimumPrivilege(privilegeName: string) {
+    if (!minimumPrivilegeNames.includes(privilegeName)) {
+      throw new Error('Unrecognized global minimum privilege');
     }
 
     return privilegeName;
   }
 
-  public static serializeSpaceReservedPrivilege(privilegeName: string) {
-    if (!reservedPrivilegeNames.includes(privilegeName)) {
-      throw new Error('Unrecognized space reserved privilege');
+  public static serializeSpaceMinimumPrivilege(privilegeName: string) {
+    if (!minimumPrivilegeNames.includes(privilegeName)) {
+      throw new Error('Unrecognized space minimum privilege');
     }
 
     return `${spacePrefix}${privilegeName}`;
   }
 
   public static serializeFeaturePrivilege(featureName: string, privilegeName: string) {
-    return `${featurePrefix}${featureName}_${privilegeName}`;
-  }
-
-  public static serializePrivilegeAssignedGlobally(privilege: string) {
-    if (reservedPrivilegeNames.includes(privilege)) {
-      return privilege;
-    }
-
-    return `${featurePrefix}${privilege}`;
+    return `${featurePrefix}${featureName}.${privilegeName}`;
   }
 
-  public static serializePrivilegeAssignedAtSpace(privilege: string) {
-    if (reservedPrivilegeNames.includes(privilege)) {
-      return `${spacePrefix}${privilege}`;
+  public static deserializeFeaturePrivilege(privilege: string): FeaturePrivilege {
+    const match = privilege.match(deserializeFeaturePrivilegeRegexp);
+    if (!match) {
+      throw new Error(`Feature privilege '${privilege}' didn't match pattern`);
     }
 
-    return `${featurePrefix}${privilege}`;
+    return {
+      featureId: match[1],
+      privilege: match[2],
+    };
   }
 
-  public static deserializePrivilegeAssignedGlobally(privilege: string) {
-    if (privilege.startsWith(featurePrefix)) {
-      return privilege.slice(featurePrefix.length);
-    }
-
-    if (reservedPrivilegeNames.includes(privilege)) {
+  public static deserializeGlobalMinimumPrivilege(privilege: string) {
+    if (PrivilegeSerializer.isGlobalMinimumPrivilege(privilege)) {
       return privilege;
     }
 
-    throw new Error('Unrecognized privilege assigned globally');
+    throw new Error('Unrecognized global minimum privilege');
   }
 
-  public static deserializePrivilegeAssignedAtSpace(privilege: string) {
-    if (privilege.startsWith(featurePrefix)) {
-      return privilege.slice(featurePrefix.length);
-    }
-
-    if (!privilege.startsWith(spacePrefix)) {
-      throw new Error(
-        `Unable to deserialize ${privilege}, should have started with ${spacePrefix} or ${featurePrefix}`
-      );
-    }
-
-    const privilegeName = privilege.slice(spacePrefix.length);
-    if (reservedPrivilegeNames.includes(privilegeName)) {
-      return privilegeName;
+  public static deserializeSpaceMinimumPrivilege(privilege: string) {
+    if (!PrivilegeSerializer.isSpaceMinimumPrivilege(privilege)) {
+      throw new Error('Unrecognized space minimum privilege');
     }
 
-    throw new Error('Unrecognized privilege assigned at space');
+    return privilege.slice(spacePrefix.length);
   }
 }

x-pack/plugins/security/server/lib/authorization/privileges_serializer.ts

@@ -30,7 +30,7 @@ export const serializePrivileges = (
     [application]: {
       ...Object.entries(privilegeMap.global).reduce(
         (acc, [privilegeName, privilegeActions]) => {
-          const name = PrivilegeSerializer.serializeGlobalReservedPrivilege(privilegeName);
+          const name = PrivilegeSerializer.serializeGlobalMinimumPrivilege(privilegeName);
           acc[name] = {
             application,
             name: privilegeName,
@@ -43,7 +43,7 @@ export const serializePrivileges = (
       ),
       ...Object.entries(privilegeMap.space).reduce(
         (acc, [privilegeName, privilegeActions]) => {
-          const name = PrivilegeSerializer.serializeSpaceReservedPrivilege(privilegeName);
+          const name = PrivilegeSerializer.serializeSpaceMinimumPrivilege(privilegeName);
           acc[name] = {
             application,
             name,