Feature Controls

docs/development/security/rbac.asciidoc

@@ -32,9 +32,9 @@ Authorization: Basic kibana changeme
            "actions":[
                "version:7.0.0-alpha1-SNAPSHOT",
                "action:login",
-               "action:saved_objects/dashboard/get",
-               "action:saved_objects/dashboard/bulk_get",
-               "action:saved_objects/dashboard/find",
+               "saved_object:dashboard/get",
+               "saved_object:dashboard/bulk_get",
+               "saved_object:dashboard/find",
                ...
            ],"metadata":{}}
    }
@@ -90,7 +90,7 @@ Authorization: Basic foo_read_only_user password
            "application":"kibana-.kibana",
            "resources":["*"],
            "privileges":[
-             "action:saved_objects/dashboard/save",
+             "saved_object:dashboard/save",
            ]
        }
    ]
@@ -120,7 +120,7 @@ Authorization: Basic foo_legacy_user password
            "application":"kibana-.kibana",
            "resources":["*"],
            "privileges":[
-             "action:saved_objects/dashboard/save"
+             "saved_object:dashboard/save"
            ]
        }
    ],
@@ -152,7 +152,7 @@ Here is an example response if the user does not have application privileges, bu
   "application": {
     "kibana-.kibana": {
       "*": {
-        "action:saved_objects/dashboard/save": false
+        "saved_object:dashboard/save": false
       }
     }
   }

packages/kbn-ui-framework/src/components/table/listing_table/listing_table.js

@@ -47,6 +47,7 @@ export function KuiListingTable({
   toolBarActions,
   onFilter,
   onItemSelectionChanged,
+  enableSelection,
   selectedRowIds,
   filter,
   prompt,
@@ -76,11 +77,12 @@ export function KuiListingTable({
     }
   }
 
-  function renderTableRows() {
+  function renderTableRows(enableSelection) {
     return rows.map((row, rowIndex) => {
       return (
         <KuiListingTableRow
           key={rowIndex}
+          enableSelection={enableSelection}
           isSelected={selectedRowIds.indexOf(row.id) >= 0}
           onSelectionChanged={toggleRow}
           row={row}
@@ -111,15 +113,17 @@ export function KuiListingTable({
     return (
       <KuiTable>
         <KuiTableHeader>
-          <KuiTableHeaderCheckBoxCell
-            isChecked={areAllRowsSelected()}
-            onChange={toggleAll}
-          />
+          {enableSelection &&
+            <KuiTableHeaderCheckBoxCell
+              isChecked={areAllRowsSelected()}
+              onChange={toggleAll}
+            />
+          }
           {renderHeader()}
         </KuiTableHeader>
 
         <KuiTableBody>
-          {renderTableRows()}
+          {renderTableRows(enableSelection)}
         </KuiTableBody>
       </KuiTable>
     );
@@ -171,6 +175,7 @@ KuiListingTable.propTypes = {
   })),
   pager: PropTypes.node,
   onItemSelectionChanged: PropTypes.func.isRequired,
+  enableSelection: PropTypes.bool,
   selectedRowIds: PropTypes.array,
   prompt: PropTypes.node, // If given, will be shown instead of a table with rows.
   onFilter: PropTypes.func,
@@ -181,4 +186,5 @@ KuiListingTable.propTypes = {
 KuiListingTable.defaultProps = {
   rows: [],
   selectedRowIds: [],
+  enableSelection: true,
 };

packages/kbn-ui-framework/src/components/table/listing_table/listing_table_row.js

@@ -57,13 +57,15 @@ export class KuiListingTableRow extends React.PureComponent {
   }
 
   render() {
-    const { isSelected } = this.props;
+    const { enableSelection, isSelected } = this.props;
     return (
       <KuiTableRow>
-        <KuiTableRowCheckBoxCell
-          isChecked={isSelected}
-          onChange={this.onSelectionChanged}
-        />
+        {enableSelection &&
+          <KuiTableRowCheckBoxCell
+            isChecked={isSelected}
+            onChange={this.onSelectionChanged}
+          />
+        }
         {this.renderCells()}
       </KuiTableRow>
     );
@@ -83,6 +85,11 @@ KuiListingTableRow.propTypes = {
       ],
       )),
   }).isRequired,
+  enableSelection: PropTypes.bool,
   onSelectionChanged: PropTypes.func.isRequired,
   isSelected: PropTypes.bool,
 };
+
+KuiListingTableRow.defaultProps = {
+  enableSelection: true,
+};

src/core/public/injected_metadata/injected_metadata_service.ts

@@ -19,7 +19,7 @@
 
 import { get } from 'lodash';
 import { UiSettingsState } from '../ui_settings';
-import { deepFreeze } from './deep_freeze';
+import { deepFreeze } from '../utils/deep_freeze';
 
 export interface InjectedMetadataParams {
   injectedMetadata: {

src/es_archiver/lib/indices/kibana_index.js

@@ -150,6 +150,7 @@ export async function createDefaultSpace({ index, client }) {
       space: {
         name: 'Default Space',
         description: 'This is the default space',
+        disabledFeatures: [],
         _reserved: true
       }
     }

src/legacy/core_plugins/console/index.js

@@ -110,7 +110,12 @@ export default function (kibana) {
       defaultVars = {
         elasticsearchUrl: url.format(
           Object.assign(url.parse(head(legacyEsConfig.hosts)), { auth: false })
-        )
+        ),
+        uiCapabilities: {
+          dev_tools: {
+            show: true
+          },
+        }
       };
 
       server.route(createProxyRoute({

src/legacy/core_plugins/console/public/console.js

@@ -26,6 +26,7 @@ require('ui-bootstrap-custom');
 require('ui/modules').get('kibana', ['sense.ui.bootstrap']);
 require('ui/tooltip');
 require('ui/autoload/styles');
+require('ui/capabilities/route_setup');
 
 require('./src/controllers/sense_controller');
 require('./src/directives/sense_history');
@@ -35,6 +36,7 @@ require('./src/directives/sense_welcome');
 
 
 uiRoutes.when('/dev_tools/console', {
+  requireUICapability: 'dev_tools.show',
   controller: 'SenseController',
   template,
 });

src/legacy/core_plugins/console/server/proxy_route.js

@@ -65,6 +65,7 @@ export const createProxyRoute = ({
   path: '/api/console/proxy',
   method: 'POST',
   config: {
+    tags: ['access:execute'],
     payload: {
       output: 'stream',
       parse: false

src/legacy/core_plugins/kibana/index.js

@@ -135,9 +135,55 @@ export default function (kibana) {
       },
 
       injectDefaultVars(server, options) {
+        const { savedObjects } = server;
+
         return {
           kbnIndex: options.index,
-          kbnBaseUrl
+          kbnBaseUrl,
+          uiCapabilities: {
+            discover: {
+              show: true,
+              save: true
+            },
+            visualize: {
+              show: true,
+              save: true
+            },
+            dashboard: {
+              createNew: true,
+              show: true,
+              showWriteControls: true,
+            },
+            catalogue: {
+              discover: true,
+              dashboard: true,
+              visualize: true,
+              console: true,
+              advanced_settings: true,
+              index_patterns: true,
+            },
+            advancedSettings: {
+              save: true
+            },
+            savedObjectsManagement: savedObjects.types.reduce((acc, type) => ({
+              ...acc,
+              [type]: {
+                delete: true,
+                edit: true,
+                read: true,
+              }
+            }), {}),
+            management: {
+              /*
+               * Management settings correspond to management section/link ids, and should not be changed
+               * without also updating those definitions.
+               */
+              kibana: {
+                settings: true,
+                indices: true,
+              },
+            }
+          }
         };
       },
 

src/legacy/core_plugins/kibana/public/dashboard/dashboard_config.js

@@ -18,9 +18,11 @@
  */
 
 import { uiModules } from 'ui/modules';
+import { uiCapabilities } from 'ui/capabilities';
+
 uiModules.get('kibana')
   .provider('dashboardConfig', () => {
-    let hideWriteControls = false;
+    let hideWriteControls = !uiCapabilities.dashboard.showWriteControls;
 
     return {
       /**

src/legacy/core_plugins/kibana/public/dashboard/index.js

@@ -36,6 +36,7 @@ import { recentlyAccessed } from 'ui/persisted_log';
 import { SavedObjectRegistryProvider } from 'ui/saved_objects/saved_object_registry';
 import { DashboardListing, EMPTY_FILTER } from './listing/dashboard_listing';
 import { uiModules } from 'ui/modules';
+import 'ui/capabilities/route_setup';
 
 const app = uiModules.get('app/dashboard', [
   'ngRoute',
@@ -54,7 +55,8 @@ function createNewDashboardCtrl($scope, i18n) {
 
 uiRoutes
   .defaults(/dashboard/, {
-    requireDefaultIndex: true
+    requireDefaultIndex: true,
+    requireUICapability: 'dashboard.show'
   })
   .when(DashboardConstants.LANDING_PAGE_PATH, {
     template: dashboardListingTemplate,
@@ -116,6 +118,7 @@ uiRoutes
   .when(DashboardConstants.CREATE_NEW_DASHBOARD_URL, {
     template: dashboardTemplate,
     controller: createNewDashboardCtrl,
+    requireUICapability: 'dashboard.createNew',
     resolve: {
       dash: function (savedDashboards, redirectWhenMissing) {
         return savedDashboards.get()

src/legacy/core_plugins/kibana/public/dashboard/listing/dashboard_listing.test.js

@@ -130,7 +130,7 @@ describe('after fetch', () => {
     expect(component).toMatchSnapshot();
   });
 
-  test('hideWriteControls', async () => {
+  test('hideWriteControls with no dashboards', async () => {
     const component = shallowWithIntl(<DashboardListing.WrappedComponent
       findItems={find.bind(null, 0)}
       deleteItems={() => {}}
@@ -149,6 +149,25 @@ describe('after fetch', () => {
     expect(component).toMatchSnapshot();
   });
 
+  test('hideWriteControls with dashboards', async () => {
+    const component = shallowWithIntl(<DashboardListing.WrappedComponent
+      findItems={find.bind(null, 1)}
+      deleteItems={() => {}}
+      createItem={() => {}}
+      editItem={() => {}}
+      getViewUrl={() => {}}
+      listingLimit={1}
+      hideWriteControls={true}
+    />);
+
+    // Ensure all promises resolve
+    await new Promise(resolve => process.nextTick(resolve));
+    // Ensure the state changes are reflected
+    component.update();
+
+    expect(component).toMatchSnapshot();
+  });
+
   test('renders warning when listingLimit is exceeded', async () => {
     const component = shallowWithIntl(<DashboardListing.WrappedComponent
       findItems={find.bind(null, 2)}

src/legacy/core_plugins/kibana/public/dashboard/panel/panel_header/panel_actions/get_edit_panel_action.tsx

@@ -42,7 +42,13 @@ export function getEditPanelAction() {
       icon: <EuiIcon type="pencil" />,
       isDisabled: ({ embeddable }) =>
         !embeddable || !embeddable.metadata || !embeddable.metadata.editUrl,
-      isVisible: ({ containerState }) => containerState.viewMode === DashboardViewMode.EDIT,
+      isVisible: ({ containerState, embeddable }) => {
+        const canEditEmbeddable = Boolean(
+          embeddable && embeddable.metadata && embeddable.metadata.editable
+        );
+        const inDashboardEditMode = containerState.viewMode === DashboardViewMode.EDIT;
+        return canEditEmbeddable && inDashboardEditMode;
+      },
       getHref: ({ embeddable }) => {
         if (embeddable && embeddable.metadata.editUrl) {
           return embeddable.metadata.editUrl;