[Actions] System actions authorization (elastic#161341)

## Summary This PR adds the ability for system actions to be able to define their own Kibana privileges that need to be authorized before execution. Depends on: elastic#160983 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Kibana Machine <[email protected]>
ThomThomson · Aug 1, 2023 · fc71fba · fc71fba
1 parent 768a14a
commit fc71fba
Show file tree

Hide file tree

Showing 45 changed files with 1,623 additions and 119 deletions.
diff --git a/x-pack/plugins/actions/server/action_type_registry.mock.ts b/x-pack/plugins/actions/server/action_type_registry.mock.ts
@@ -19,6 +19,7 @@ const createActionTypeRegistryMock = () => {
     isActionExecutable: jest.fn(),
     isSystemActionType: jest.fn(),
     getUtils: jest.fn(),
+    getSystemActionKibanaPrivileges: jest.fn(),
   };
   return mocked;
 };

diff --git a/x-pack/plugins/actions/server/action_type_registry.test.ts b/x-pack/plugins/actions/server/action_type_registry.test.ts
@@ -248,6 +248,29 @@ describe('actionTypeRegistry', () => {
         })
       ).not.toThrow();
     });
+
+    test('throws if the kibana privileges are defined but the action type is not a system action type', () => {
+      const actionTypeRegistry = new ActionTypeRegistry(actionTypeRegistryParams);
+
+      expect(() =>
+        actionTypeRegistry.register({
+          id: 'my-action-type',
+          name: 'My action type',
+          minimumLicenseRequired: 'basic',
+          supportedFeatureIds: ['alerting'],
+          getKibanaPrivileges: jest.fn(),
+          isSystemActionType: false,
+          validate: {
+            config: { schema: schema.object({}) },
+            secrets: { schema: schema.object({}) },
+            params: { schema: schema.object({}) },
+          },
+          executor,
+        })
+      ).toThrowErrorMatchingInlineSnapshot(
+        `"Kibana privilege authorization is only supported for system action types"`
+      );
+    });
   });
 
   describe('get()', () => {
@@ -691,4 +714,92 @@ describe('actionTypeRegistry', () => {
       expect(result).toBe(false);
     });
   });
+
+  describe('getSystemActionKibanaPrivileges()', () => {
+    it('should get the kibana privileges correctly for system actions', () => {
+      const registry = new ActionTypeRegistry(actionTypeRegistryParams);
+
+      registry.register({
+        id: '.cases',
+        name: 'Cases',
+        minimumLicenseRequired: 'platinum',
+        supportedFeatureIds: ['alerting'],
+        getKibanaPrivileges: () => ['test/create'],
+        validate: {
+          config: { schema: schema.object({}) },
+          secrets: { schema: schema.object({}) },
+          params: { schema: schema.object({}) },
+        },
+        isSystemActionType: true,
+        executor,
+      });
+
+      const result = registry.getSystemActionKibanaPrivileges('.cases');
+      expect(result).toEqual(['test/create']);
+    });
+
+    it('should return an empty array if the system action does not define any kibana privileges', () => {
+      const registry = new ActionTypeRegistry(actionTypeRegistryParams);
+
+      registry.register({
+        id: '.cases',
+        name: 'Cases',
+        minimumLicenseRequired: 'platinum',
+        supportedFeatureIds: ['alerting'],
+        validate: {
+          config: { schema: schema.object({}) },
+          secrets: { schema: schema.object({}) },
+          params: { schema: schema.object({}) },
+        },
+        isSystemActionType: true,
+        executor,
+      });
+
+      const result = registry.getSystemActionKibanaPrivileges('.cases');
+      expect(result).toEqual([]);
+    });
+
+    it('should return an empty array if the action type is not a system action', () => {
+      const registry = new ActionTypeRegistry(actionTypeRegistryParams);
+
+      registry.register({
+        id: 'foo',
+        name: 'Foo',
+        minimumLicenseRequired: 'basic',
+        supportedFeatureIds: ['alerting'],
+        validate: {
+          config: { schema: schema.object({}) },
+          secrets: { schema: schema.object({}) },
+          params: { schema: schema.object({}) },
+        },
+        executor,
+      });
+
+      const result = registry.getSystemActionKibanaPrivileges('foo');
+      expect(result).toEqual([]);
+    });
+
+    it('should pass the params correctly', () => {
+      const registry = new ActionTypeRegistry(actionTypeRegistryParams);
+      const getKibanaPrivileges = jest.fn().mockReturnValue(['test/create']);
+
+      registry.register({
+        id: '.cases',
+        name: 'Cases',
+        minimumLicenseRequired: 'platinum',
+        supportedFeatureIds: ['alerting'],
+        getKibanaPrivileges,
+        validate: {
+          config: { schema: schema.object({}) },
+          secrets: { schema: schema.object({}) },
+          params: { schema: schema.object({}) },
+        },
+        isSystemActionType: true,
+        executor,
+      });
+
+      registry.getSystemActionKibanaPrivileges('.cases', { foo: 'bar' });
+      expect(getKibanaPrivileges).toHaveBeenCalledWith({ params: { foo: 'bar' } });
+    });
+  });
 });
diff --git a/x-pack/plugins/actions/server/action_type_registry.ts b/x-pack/plugins/actions/server/action_type_registry.ts
@@ -101,6 +101,22 @@ export class ActionTypeRegistry {
   public isSystemActionType = (actionTypeId: string): boolean =>
     Boolean(this.actionTypes.get(actionTypeId)?.isSystemActionType);
 
+  /**
+   * Returns the kibana privileges of a system action type
+   */
+  public getSystemActionKibanaPrivileges<Params extends ActionTypeParams = ActionTypeParams>(
+    actionTypeId: string,
+    params?: Params
+  ): string[] {
+    const actionType = this.actionTypes.get(actionTypeId);
+
+    if (!actionType?.isSystemActionType) {
+      return [];
+    }
+
+    return actionType?.getKibanaPrivileges?.({ params }) ?? [];
+  }
+
   /**
    * Registers an action type to the action type registry
    */
@@ -148,6 +164,15 @@ export class ActionTypeRegistry {
       );
     }
 
+    if (!actionType.isSystemActionType && actionType.getKibanaPrivileges) {
+      throw new Error(
+        i18n.translate('xpack.actions.actionTypeRegistry.register.invalidKibanaPrivileges', {
+          defaultMessage:
+            'Kibana privilege authorization is only supported for system action types',
+        })
+      );
+    }
+
     const maxAttempts = this.actionsConfigUtils.getMaxAttempts({
       actionTypeId: actionType.id,
       actionTypeMaxAttempts: actionType.maxAttempts,