Introduce capabilities provider and switcher to file upload plugin #96593

legrego · 2021-04-08T15:46:20Z

Summary

Adds a capabilities provider and switcher to the File Upload plugin. This provides a new fileUpload.show UI Capability, which can be used to tell if the current user should be shown the File Upload feature.

Users with the ability to create index patterns (in the current space) will be shown this feature. Users who are lacking this privilege will not be shown this feature.

^ We have the flexibility to change these privilege checks to whatever we need...I just picked something to start the conversation. Should we also test that the user can create pipelines?

The file upload plugin requires its own capabilities provider & switcher because we don't have the concept of a "composite feature" today, where it relies on both Kibana and Elasticsearch privileges in order to function. This is a limitation of the current authorization model, and is being tracked in #96598

legrego · 2021-04-08T18:26:45Z

@nreese @jgowdyelastic here's a potential solution to the file upload problem we discussed today. Let me know your thoughts!

legrego · 2021-05-06T17:49:11Z

let me know if this is still needed

nreese · 2021-05-10T14:11:23Z

let me know if this is still needed

Thanks @legrego for putting this PR together. This is still something very much that we are interested in. We hope to use this in the current minor sprint to make it possible to have a ingest button in the home application that will work for users without specific access to ML or maps feature privileges. I am not sure on the timing but this will be a requirement for this effort.

…pabilities

legrego · 2021-05-10T19:52:52Z

x-pack/plugins/file_upload/server/capabilities.ts

+    const { hasImportPermission } = await checkFileUploadPrivileges({
+      authorization: security?.authz,
+      request,
+      checkCreateIndexPattern: true,
+      checkHasManagePipeline: false,
+    });


We have the flexibility to change these privilege checks to whatever we need...I just picked something to start the conversation. Should we also test that the user can create pipelines?

azasypkin

LGTM from the security side, left just a few nits and one question about anonymous request.

x-pack/plugins/security/server/index.ts

x-pack/plugins/file_upload/server/capabilities.ts

azasypkin · 2021-05-11T08:56:48Z

x-pack/plugins/file_upload/server/capabilities.ts

+  });
+
+  core.capabilities.registerSwitcher(async (request, capabilities, useDefaultCapabilities) => {
+    const isAnonymousRequest = !request.route.options.authRequired;


question: is there any reason why we cannot use request.auth.isAuthenticated (or request.route.options.authRequired !== true && !request.auth.isAuthenticated) here instead? If authRequired === 'optional' and request is not authenticated, it seems we can treat it as a legitimate anonymous request as well.

I wish I had a better memory -- there used to be a reason we couldn't use request.auth.isAuthenticated with the other capability switchers, but I can't remember the details. That said, it looks like the security switcher is using this very check, so maybe it's safe to do so again.

I'll experiment with this and report back!

I modeled this switcher after the security plugin's switcher, and it appears to be working correctly!

x-pack/plugins/file_upload/server/capabilities.test.ts

jgowdyelastic · 2021-05-11T14:04:37Z

x-pack/plugins/file_upload/server/routes.ts

-
-        const checkPrivileges = authorizationService.checkPrivilegesDynamicallyWithRequest(request);
-        const checkPrivilegesResp = await checkPrivileges(checkPrivilegesPayload);
+        const { hasImportPermission } = await checkFileUploadPrivileges({


this route (/internal/file_upload/has_import_permission) might not be needed now if we can use the capabilities on the client side in the fileDataVisualiser plugin.
but that change can be done in a follow up.

nreese

LGTM

legrego · 2021-05-12T16:40:54Z

@elasticmachine merge upstream

kibanamachine · 2021-05-12T18:33:44Z

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`security`	31	32	+1

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`security`	12	15	+3

Unknown metric groups

API count

id	before	after	diff
`security`	72	73	+1

References to deprecated APIs

id	before	after	diff
`canvas`	29	25	-4
`crossClusterReplication`	8	6	-2
`fleet`	4	2	-2
`globalSearch`	4	2	-2
`indexManagement`	12	7	-5
`infra`	5	3	-2
`licensing`	18	15	-3
`monitoring`	109	56	-53
total			-73

History

💚 Build #125279 succeeded 202485e
💚 Build #125063 succeeded 00f374a
💔 Build #125038 failed 5d10631
💚 Build #118291 succeeded 5d10631

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

jgowdyelastic

LGTM

azasypkin

LGTM

…lastic#96593) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

kibanamachine · 2021-05-14T12:34:29Z

💚 Backport successful

Status	Branch	Result
✅	7.x

This backport PR will be merged automatically after passing CI.

…96593) (#100114) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Larry Gregory <larry.gregory@elastic.co>

…lastic#96593) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Introduce capabilities provider and switcher to file upload plugin

5d10631

legrego closed this May 6, 2021

nreese reopened this May 10, 2021

legrego added 2 commits May 10, 2021 10:33

Merge branch 'master' of github.com:elastic/kibana into fileUpload/ca…

96a0809

…pabilities

Fix merge from master

00f374a

legrego added auto-backport Deprecated: Automatically backport this PR after it's merged Feature:File Upload release_note:skip Skip the PR/issue when compiling release notes v7.14.0 v8.0.0 labels May 10, 2021

legrego commented May 10, 2021

View reviewed changes

legrego marked this pull request as ready for review May 10, 2021 19:54

legrego requested a review from a team as a code owner May 10, 2021 19:54

legrego requested review from jgowdyelastic and nreese May 10, 2021 19:54

azasypkin reviewed May 11, 2021

View reviewed changes

Start addressing PR feedback

202485e

jgowdyelastic reviewed May 11, 2021

View reviewed changes

nreese approved these changes May 12, 2021

View reviewed changes

legrego requested a review from azasypkin May 12, 2021 16:40

Merge branch 'master' into fileUpload/capabilities

ca5fd4b

jgowdyelastic approved these changes May 13, 2021

View reviewed changes

azasypkin approved these changes May 14, 2021

View reviewed changes

legrego merged commit c572ddd into elastic:master May 14, 2021

legrego deleted the fileUpload/capabilities branch May 14, 2021 12:31

kibanamachine added a commit to kibanamachine/kibana that referenced this pull request May 14, 2021

Introduce capabilities provider and switcher to file upload plugin (e…

421229c

…lastic#96593) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

kibanamachine mentioned this pull request May 14, 2021

[7.x] Introduce capabilities provider and switcher to file upload plugin (#96593) #100114

Merged

yctercero pushed a commit to yctercero/kibana that referenced this pull request May 17, 2021

Introduce capabilities provider and switcher to file upload plugin (e…

dd15ba8

…lastic#96593) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

yctercero pushed a commit to yctercero/kibana that referenced this pull request May 25, 2021

Introduce capabilities provider and switcher to file upload plugin (e…

f2aa5b1

…lastic#96593) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Introduce capabilities provider and switcher to file upload plugin #96593

Introduce capabilities provider and switcher to file upload plugin #96593

legrego commented Apr 8, 2021 •

edited

legrego commented Apr 8, 2021

legrego commented May 6, 2021

nreese commented May 10, 2021

legrego May 10, 2021

azasypkin left a comment

azasypkin May 11, 2021

legrego May 11, 2021

legrego May 11, 2021

jgowdyelastic May 11, 2021 •

edited

nreese left a comment

legrego commented May 12, 2021

kibanamachine commented May 12, 2021

API count

References to deprecated APIs

jgowdyelastic left a comment

azasypkin left a comment

kibanamachine commented May 14, 2021

Introduce capabilities provider and switcher to file upload plugin #96593

Introduce capabilities provider and switcher to file upload plugin #96593

Conversation

legrego commented Apr 8, 2021 • edited

Summary

legrego commented Apr 8, 2021

legrego commented May 6, 2021

nreese commented May 10, 2021

legrego May 10, 2021

Choose a reason for hiding this comment

azasypkin left a comment

Choose a reason for hiding this comment

azasypkin May 11, 2021

Choose a reason for hiding this comment

legrego May 11, 2021

Choose a reason for hiding this comment

legrego May 11, 2021

Choose a reason for hiding this comment

jgowdyelastic May 11, 2021 • edited

Choose a reason for hiding this comment

nreese left a comment

Choose a reason for hiding this comment

legrego commented May 12, 2021

kibanamachine commented May 12, 2021

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Public APIs missing exports

API count

References to deprecated APIs

History

jgowdyelastic left a comment

Choose a reason for hiding this comment

azasypkin left a comment

Choose a reason for hiding this comment

kibanamachine commented May 14, 2021

💚 Backport successful

legrego commented Apr 8, 2021 •

edited

jgowdyelastic May 11, 2021 •

edited