From 1c3f161b68d1dc0b092e923ac1132d5bcaeda700 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Tue, 10 Dec 2024 02:43:02 +1100
Subject: [PATCH] [8.17] Enhance access query logic to handle user ID and name
 conditions (#202833) (#202929)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Backport

This will backport the following commits from `main` to `8.17`:
- [Enhance access query logic to handle user ID and name conditions
(#202833)](https://github.com/elastic/kibana/pull/202833)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Arturo
Lidueña","email":"arturo.liduena@elastic.co"},"sourceCommit":{"committedDate":"2024-12-04T13:56:28Z","message":"Enhance
access query logic to handle user ID and name conditions
(#202833)\n\n[Obs AI Assistant] Fetch user instructions and conversation
using user\r\nid instead of user name
-\r\nhttps://github.com/elastic/kibana/issues/192701\r\n\r\nTo avoid
potential collisions when fetching data, we should query for\r\nthe user
id instead of the user name when getting instructions
or\r\nconversations.\r\n\r\n**If user.id is provided:**\r\n - Matches
documents with user.id equal to the provided value.\r\n - Falls back to
user.name when user.id does not exist in the document.\r\n \r\n**If
user.id is not provided:**\r\n - Matches only documents with
user.name.\r\n\r\n## Summary\r\n\r\nSummarize your PR. If it involves
visual changes include a screenshot or\r\ngif.\r\n\r\n\r\n###
Checklist\r\n\r\nCheck the PR satisfies following conditions.
\r\n\r\nReviewers should verify this PR satisfies this list as
well.\r\n\r\n- [ ] Any text added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n-
[
]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas
added for features that require explanation or tutorials\r\n- [ ] [Unit
or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [ ] If a plugin
configuration key changed, check if it needs to be\r\nallowlisted in the
cloud and added to the
[docker\r\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\r\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\r\nchanges have been approved by the breaking-change committee.
The\r\n`release_note:breaking` label should be applied in these
situations.\r\n- [ ] [Flaky
Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\r\nused on any tests changed\r\n- [ ] The PR description includes
the appropriate Release Notes section,\r\nand the correct
`release_note:*` label is applied per
the\r\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"720ddd716bda9210ca92d21b0ed7065554118859","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","v9.0.0","backport:prev-minor","backport:prev-major","Team:Obs
AI Assistant","ci:project-deploy-observability"],"title":"Enhance access
query logic to handle user ID and name
conditions","number":202833,"url":"https://github.com/elastic/kibana/pull/202833","mergeCommit":{"message":"Enhance
access query logic to handle user ID and name conditions
(#202833)\n\n[Obs AI Assistant] Fetch user instructions and conversation
using user\r\nid instead of user name
-\r\nhttps://github.com/elastic/kibana/issues/192701\r\n\r\nTo avoid
potential collisions when fetching data, we should query for\r\nthe user
id instead of the user name when getting instructions
or\r\nconversations.\r\n\r\n**If user.id is provided:**\r\n - Matches
documents with user.id equal to the provided value.\r\n - Falls back to
user.name when user.id does not exist in the document.\r\n \r\n**If
user.id is not provided:**\r\n - Matches only documents with
user.name.\r\n\r\n## Summary\r\n\r\nSummarize your PR. If it involves
visual changes include a screenshot or\r\ngif.\r\n\r\n\r\n###
Checklist\r\n\r\nCheck the PR satisfies following conditions.
\r\n\r\nReviewers should verify this PR satisfies this list as
well.\r\n\r\n- [ ] Any text added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n-
[
]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas
added for features that require explanation or tutorials\r\n- [ ] [Unit
or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [ ] If a plugin
configuration key changed, check if it needs to be\r\nallowlisted in the
cloud and added to the
[docker\r\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\r\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\r\nchanges have been approved by the breaking-change committee.
The\r\n`release_note:breaking` label should be applied in these
situations.\r\n- [ ] [Flaky
Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\r\nused on any tests changed\r\n- [ ] The PR description includes
the appropriate Release Notes section,\r\nand the correct
`release_note:*` label is applied per
the\r\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"720ddd716bda9210ca92d21b0ed7065554118859"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/202833","number":202833,"mergeCommit":{"message":"Enhance
access query logic to handle user ID and name conditions
(#202833)\n\n[Obs AI Assistant] Fetch user instructions and conversation
using user\r\nid instead of user name
-\r\nhttps://github.com/elastic/kibana/issues/192701\r\n\r\nTo avoid
potential collisions when fetching data, we should query for\r\nthe user
id instead of the user name when getting instructions
or\r\nconversations.\r\n\r\n**If user.id is provided:**\r\n - Matches
documents with user.id equal to the provided value.\r\n - Falls back to
user.name when user.id does not exist in the document.\r\n \r\n**If
user.id is not provided:**\r\n - Matches only documents with
user.name.\r\n\r\n## Summary\r\n\r\nSummarize your PR. If it involves
visual changes include a screenshot or\r\ngif.\r\n\r\n\r\n###
Checklist\r\n\r\nCheck the PR satisfies following conditions.
\r\n\r\nReviewers should verify this PR satisfies this list as
well.\r\n\r\n- [ ] Any text added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md)\r\n-
[
]\r\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\r\nwas
added for features that require explanation or tutorials\r\n- [ ] [Unit
or
functional\r\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\r\nwere
updated or added to match the most common scenarios\r\n- [ ] If a plugin
configuration key changed, check if it needs to be\r\nallowlisted in the
cloud and added to the
[docker\r\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\r\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\r\nchanges have been approved by the breaking-change committee.
The\r\n`release_note:breaking` label should be applied in these
situations.\r\n- [ ] [Flaky
Test\r\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\r\nused on any tests changed\r\n- [ ] The PR description includes
the appropriate Release Notes section,\r\nand the correct
`release_note:*` label is applied per
the\r\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)","sha":"720ddd716bda9210ca92d21b0ed7065554118859"}}]}]
BACKPORT-->

Co-authored-by: Arturo Lidueña <arturo.liduena@elastic.co>
Co-authored-by: Søren Louv-Jansen <soren.louv@elastic.co>
---
 .../server/service/util/get_access_query.ts   | 27 ++++++++++++++-----
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/util/get_access_query.ts b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/util/get_access_query.ts
index 6b654731a264..b517273630f5 100644
--- a/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/util/get_access_query.ts
+++ b/x-pack/plugins/observability_solution/observability_ai_assistant/server/service/util/get_access_query.ts
@@ -17,12 +17,7 @@ export function getAccessQuery({
         filter: [
           {
             bool: {
-              should: [
-                { term: { public: true } },
-                ...(user
-                  ? [{ term: user.id ? { 'user.id': user.id } : { 'user.name': user.name } }]
-                  : []),
-              ],
+              should: [{ term: { public: true } }, ...getUserAccessFilters(user)],
               minimum_should_match: 1,
             },
           },
@@ -51,3 +46,23 @@ export function getAccessQuery({
     },
   ];
 }
+
+function getUserAccessFilters(user?: { name: string; id?: string }) {
+  if (!user) {
+    return [];
+  }
+
+  if (user.id) {
+    return [
+      { term: { 'user.id': user.id } },
+      {
+        bool: {
+          must_not: { exists: { field: 'user.id' } },
+          must: { term: { 'user.name': user.name } },
+        },
+      },
+    ];
+  }
+
+  return [{ term: { 'user.name': user.name } }];
+}