Feature Controls

docs/development/security/rbac.asciidoc

@@ -32,9 +32,9 @@ Authorization: Basic kibana changeme
            "actions":[
                "version:7.0.0-alpha1-SNAPSHOT",
                "action:login",
-               "action:saved_objects/dashboard/get",
-               "action:saved_objects/dashboard/bulk_get",
-               "action:saved_objects/dashboard/find",
+               "saved_object:dashboard/get",
+               "saved_object:dashboard/bulk_get",
+               "saved_object:dashboard/find",
                ...
            ],"metadata":{}}
    }
@@ -90,7 +90,7 @@ Authorization: Basic foo_read_only_user password
            "application":"kibana-.kibana",
            "resources":["*"],
            "privileges":[
-             "action:saved_objects/dashboard/save",
+             "saved_object:dashboard/save",
            ]
        }
    ]
@@ -120,7 +120,7 @@ Authorization: Basic foo_legacy_user password
            "application":"kibana-.kibana",
            "resources":["*"],
            "privileges":[
-             "action:saved_objects/dashboard/save"
+             "saved_object:dashboard/save"
            ]
        }
    ],
@@ -152,7 +152,7 @@ Here is an example response if the user does not have application privileges, bu
   "application": {
     "kibana-.kibana": {
       "*": {
-        "action:saved_objects/dashboard/save": false
+        "saved_object:dashboard/save": false
       }
     }
   }

packages/kbn-ui-framework/src/components/table/listing_table/listing_table.js

@@ -47,6 +47,7 @@ export function KuiListingTable({
   toolBarActions,
   onFilter,
   onItemSelectionChanged,
+  enableSelection,
   selectedRowIds,
   filter,
   prompt,
@@ -76,11 +77,12 @@ export function KuiListingTable({
     }
   }
 
-  function renderTableRows() {
+  function renderTableRows(enableSelection) {
     return rows.map((row, rowIndex) => {
       return (
         <KuiListingTableRow
           key={rowIndex}
+          enableSelection={enableSelection}
           isSelected={selectedRowIds.indexOf(row.id) >= 0}
           onSelectionChanged={toggleRow}
           row={row}
@@ -111,15 +113,17 @@ export function KuiListingTable({
     return (
       <KuiTable>
         <KuiTableHeader>
-          <KuiTableHeaderCheckBoxCell
-            isChecked={areAllRowsSelected()}
-            onChange={toggleAll}
-          />
+          {enableSelection &&
+            <KuiTableHeaderCheckBoxCell
+              isChecked={areAllRowsSelected()}
+              onChange={toggleAll}
+            />
+          }
           {renderHeader()}
         </KuiTableHeader>
 
         <KuiTableBody>
-          {renderTableRows()}
+          {renderTableRows(enableSelection)}
         </KuiTableBody>
       </KuiTable>
     );
@@ -171,6 +175,7 @@ KuiListingTable.propTypes = {
   })),
   pager: PropTypes.node,
   onItemSelectionChanged: PropTypes.func.isRequired,
+  enableSelection: PropTypes.bool,
   selectedRowIds: PropTypes.array,
   prompt: PropTypes.node, // If given, will be shown instead of a table with rows.
   onFilter: PropTypes.func,
@@ -181,4 +186,5 @@ KuiListingTable.propTypes = {
 KuiListingTable.defaultProps = {
   rows: [],
   selectedRowIds: [],
+  enableSelection: true,
 };

packages/kbn-ui-framework/src/components/table/listing_table/listing_table_row.js

@@ -57,13 +57,15 @@ export class KuiListingTableRow extends React.PureComponent {
   }
 
   render() {
-    const { isSelected } = this.props;
+    const { enableSelection, isSelected } = this.props;
     return (
       <KuiTableRow>
-        <KuiTableRowCheckBoxCell
-          isChecked={isSelected}
-          onChange={this.onSelectionChanged}
-        />
+        {enableSelection &&
+          <KuiTableRowCheckBoxCell
+            isChecked={isSelected}
+            onChange={this.onSelectionChanged}
+          />
+        }
         {this.renderCells()}
       </KuiTableRow>
     );
@@ -83,6 +85,11 @@ KuiListingTableRow.propTypes = {
       ],
       )),
   }).isRequired,
+  enableSelection: PropTypes.bool,
   onSelectionChanged: PropTypes.func.isRequired,
   isSelected: PropTypes.bool,
 };
+
+KuiListingTableRow.defaultProps = {
+  enableSelection: true,
+};

src/core/public/injected_metadata/injected_metadata_service.ts

@@ -20,7 +20,7 @@
 import { get } from 'lodash';
 import { DiscoveredPlugin, PluginName } from '../../server';
 import { UiSettingsState } from '../ui_settings';
-import { deepFreeze } from './deep_freeze';
+import { deepFreeze } from '../utils/deep_freeze';
 
 export interface InjectedMetadataParams {
   injectedMetadata: {

src/es_archiver/lib/indices/kibana_index.js

@@ -150,6 +150,7 @@ export async function createDefaultSpace({ index, client }) {
       space: {
         name: 'Default Space',
         description: 'This is the default space',
+        disabledFeatures: [],
         _reserved: true
       }
     }

src/legacy/core_plugins/console/index.js

@@ -110,7 +110,12 @@ export default function (kibana) {
       defaultVars = {
         elasticsearchUrl: url.format(
           Object.assign(url.parse(head(legacyEsConfig.hosts)), { auth: false })
-        )
+        ),
+        uiCapabilities: {
+          dev_tools: {
+            show: true
+          },
+        }
       };
 
       server.route(createProxyRoute({

src/legacy/core_plugins/console/public/console.js

@@ -24,6 +24,7 @@ require('brace');
 
 require('ui/tooltip');
 require('ui/autoload/styles');
+require('ui/capabilities/route_setup');
 
 require('./src/controllers/sense_controller');
 require('./src/directives/sense_history');
@@ -34,6 +35,7 @@ require('./src/directives/console_menu_directive');
 
 
 uiRoutes.when('/dev_tools/console', {
+  requireUICapability: 'dev_tools.show',
   controller: 'SenseController',
   template,
 });

src/legacy/core_plugins/console/server/proxy_route.js

@@ -65,6 +65,7 @@ export const createProxyRoute = ({
   path: '/api/console/proxy',
   method: 'POST',
   config: {
+    tags: ['access:console'],
     payload: {
       output: 'stream',
       parse: false

src/legacy/core_plugins/kibana/index.js

@@ -138,9 +138,60 @@ export default function (kibana) {
       },
 
       injectDefaultVars(server, options) {
+        const { savedObjects } = server;
+
         return {
           kbnIndex: options.index,
-          kbnBaseUrl
+          kbnBaseUrl,
+          uiCapabilities: {
+            discover: {
+              show: true,
+              createShortUrl: true,
+              save: true,
+            },
+            visualize: {
+              show: true,
+              createShortUrl: true,
+              save: true,
+            },
+            dashboard: {
+              createNew: true,
+              show: true,
+              showWriteControls: true,
+            },
+            catalogue: {
+              discover: true,
+              dashboard: true,
+              visualize: true,
+              console: true,
+              advanced_settings: true,
+              index_patterns: true,
+            },
+            advancedSettings: {
+              save: true
+            },
+            indexPatterns: {
+              createNew: true,
+            },
+            savedObjectsManagement: savedObjects.types.reduce((acc, type) => ({
+              ...acc,
+              [type]: {
+                delete: true,
+                edit: true,
+                read: true,
+              }
+            }), {}),
+            management: {
+              /*
+               * Management settings correspond to management section/link ids, and should not be changed
+               * without also updating those definitions.
+               */
+              kibana: {
+                settings: true,
+                index_patterns: true,
+              },
+            }
+          }
         };
       },
 

src/legacy/core_plugins/kibana/public/dashboard/dashboard_app.js

@@ -499,6 +499,9 @@ app.directive('dashboardApp', function ($injector) {
         showShareContextMenu({
           anchorElement,
           allowEmbed: true,
+          // allowShortUrl is always set to true at the moment, because the share
+          // menu isn't visible when in "read-only" mode
+          allowShortUrl: true,
           getUnhashableStates,
           objectId: dash.id,
           objectType: 'dashboard',

src/legacy/core_plugins/kibana/public/dashboard/dashboard_config.js

@@ -18,9 +18,11 @@
  */
 
 import { uiModules } from 'ui/modules';
+import { uiCapabilities } from 'ui/capabilities';
+
 uiModules.get('kibana')
   .provider('dashboardConfig', () => {
-    let hideWriteControls = false;
+    let hideWriteControls = !uiCapabilities.dashboard.showWriteControls;
 
     return {
       /**

src/legacy/core_plugins/kibana/public/dashboard/index.js

@@ -37,6 +37,7 @@ import { recentlyAccessed } from 'ui/persisted_log';
 import { SavedObjectRegistryProvider } from 'ui/saved_objects/saved_object_registry';
 import { DashboardListing, EMPTY_FILTER } from './listing/dashboard_listing';
 import { uiModules } from 'ui/modules';
+import 'ui/capabilities/route_setup';
 
 const app = uiModules.get('app/dashboard', [
   'ngRoute',
@@ -55,7 +56,8 @@ function createNewDashboardCtrl($scope, i18n) {
 
 uiRoutes
   .defaults(/dashboard/, {
-    requireDefaultIndex: true
+    requireDefaultIndex: true,
+    requireUICapability: 'dashboard.show'
   })
   .when(DashboardConstants.LANDING_PAGE_PATH, {
     template: dashboardListingTemplate,
@@ -117,6 +119,7 @@ uiRoutes
   .when(DashboardConstants.CREATE_NEW_DASHBOARD_URL, {
     template: dashboardTemplate,
     controller: createNewDashboardCtrl,
+    requireUICapability: 'dashboard.createNew',
     resolve: {
       dash: function (savedDashboards, redirectWhenMissing) {
         return savedDashboards.get()

src/legacy/core_plugins/kibana/public/dashboard/panel/panel_header/panel_actions/get_edit_panel_action.tsx

@@ -42,7 +42,13 @@ export function getEditPanelAction() {
       icon: <EuiIcon type="pencil" />,
       isDisabled: ({ embeddable }) =>
         !embeddable || !embeddable.metadata || !embeddable.metadata.editUrl,
-      isVisible: ({ containerState }) => containerState.viewMode === DashboardViewMode.EDIT,
+      isVisible: ({ containerState, embeddable }) => {
+        const canEditEmbeddable = Boolean(
+          embeddable && embeddable.metadata && embeddable.metadata.editable
+        );
+        const inDashboardEditMode = containerState.viewMode === DashboardViewMode.EDIT;
+        return canEditEmbeddable && inDashboardEditMode;
+      },
       getHref: ({ embeddable }) => {
         if (embeddable && embeddable.metadata.editUrl) {
           return embeddable.metadata.editUrl;

src/legacy/core_plugins/kibana/public/dashboard/top_nav/add_panel.js

@@ -21,6 +21,7 @@ import React from 'react';
 import PropTypes from 'prop-types';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
+import { uiCapabilities } from 'ui/capabilities';
 import { toastNotifications } from 'ui/notify';
 import { SavedObjectFinder } from 'ui/saved_objects/components/saved_object_finder';
 
@@ -87,18 +88,20 @@ export class DashboardAddPanel extends React.Component {
             )}
           />
         </EuiFlyoutBody>
-        <EuiFlyoutFooter>
-          <EuiFlexGroup justifyContent="flexEnd">
-            <EuiFlexItem grow={false}>
-              <EuiButton fill onClick={this.props.addNewVis} data-test-subj="addNewSavedObjectLink">
-                <FormattedMessage
-                  id="kbn.dashboard.topNav.addPanel.createNewVisualizationButtonLabel"
-                  defaultMessage="Create new visualization"
-                />
-              </EuiButton>
-            </EuiFlexItem>
-          </EuiFlexGroup>
-        </EuiFlyoutFooter>
+        { uiCapabilities.visualize.save ? (
+          <EuiFlyoutFooter>
+            <EuiFlexGroup justifyContent="flexEnd">
+              <EuiFlexItem grow={false}>
+                <EuiButton fill onClick={this.props.addNewVis} data-test-subj="addNewSavedObjectLink">
+                  <FormattedMessage
+                    id="kbn.dashboard.topNav.addPanel.createNewVisualizationButtonLabel"
+                    defaultMessage="Create new visualization"
+                  />
+                </EuiButton>
+              </EuiFlexItem>
+            </EuiFlexGroup>
+          </EuiFlyoutFooter>
+        ) : null }
       </EuiFlyout>
     );
   }

src/legacy/core_plugins/kibana/public/dashboard/top_nav/add_panel.test.js

@@ -25,6 +25,17 @@ import {
   DashboardAddPanel,
 } from './add_panel';
 
+jest.mock('ui/chrome',
+  () => ({
+    getInjected(injected) {
+      if (injected === 'uiCapabilities') {
+        return {
+          visualize: { show: true, save: true },
+        };
+      }
+    }
+  }), { virtual: true });
+
 jest.mock('ui/notify',
   () => ({
     toastNotifications: {

src/legacy/core_plugins/kibana/public/discover/components/field_chooser/discover_field.js

@@ -24,6 +24,7 @@ import 'ui/directives/css_truncate';
 import 'ui/directives/field_name';
 import './string_progress_bar';
 import detailsHtml from './lib/detail_views/string.html';
+import { uiCapabilities } from 'ui/capabilities';
 import { uiModules } from 'ui/modules';
 const app = uiModules.get('apps/discover');
 
@@ -76,6 +77,8 @@ app.directive('discoverField', function ($compile, i18n) {
 
       };
 
+      $scope.canVisualize = uiCapabilities.visualize.show;
+
       $scope.toggleDisplay = function (field) {
         if (field.display) {
           $scope.onRemoveField(field.name);

src/legacy/core_plugins/kibana/public/discover/components/field_chooser/lib/detail_views/string.html

@@ -87,7 +87,7 @@
 
   <a
     ng-href="{{field.details.visualizeUrl}}"
-    ng-show="field.visualizable"
+    ng-show="field.visualizable && canVisualize"
     class="kuiButton kuiButton--secondary kuiButton--small kuiVerticalRhythmSmall"
     data-test-subj="fieldVisualize-{{::field.name}}"
   >