[ML] Adding endpoint capability checks (#64662) (#64811)

* [ML] Adding endpoint capability checks * adding missing capability checks * fixing test * removing commented code * fixing functional test * fixing functional tests * changes based on review Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: Elastic Machine <[email protected]>
elastic · Apr 29, 2020 · 9cbb61b · 9cbb61b
1 parent 61822d8
commit 9cbb61b
Show file tree

Hide file tree

Showing 25 changed files with 456 additions and 87 deletions.
diff --git a/x-pack/plugins/ml/common/types/capabilities.ts b/x-pack/plugins/ml/common/types/capabilities.ts
@@ -7,6 +7,7 @@
 import { KibanaRequest } from 'kibana/server';
 
 export const userMlCapabilities = {
+  canAccessML: false,
   // Anomaly Detection
   canGetJobs: false,
   canGetDatafeeds: false,
@@ -18,6 +19,10 @@ export const userMlCapabilities = {
   canGetFilters: false,
   // Data Frame Analytics
   canGetDataFrameAnalytics: false,
+  // Annotations
+  canGetAnnotations: false,
+  canCreateAnnotation: false,
+  canDeleteAnnotation: false,
 };
 
 export const adminMlCapabilities = {
@@ -26,9 +31,11 @@ export const adminMlCapabilities = {
   canDeleteJob: false,
   canOpenJob: false,
   canCloseJob: false,
+  canUpdateJob: false,
   canForecastJob: false,
+  canCreateDatafeed: false,
+  canDeleteDatafeed: false,
   canStartStopDatafeed: false,
-  canUpdateJob: false,
   canUpdateDatafeed: false,
   canPreviewDatafeed: false,
   // Calendars
@@ -38,16 +45,18 @@ export const adminMlCapabilities = {
   canCreateFilter: false,
   canDeleteFilter: false,
   // Data Frame Analytics
-  canDeleteDataFrameAnalytics: false,
   canCreateDataFrameAnalytics: false,
+  canDeleteDataFrameAnalytics: false,
   canStartStopDataFrameAnalytics: false,
 };
 
 export type UserMlCapabilities = typeof userMlCapabilities;
 export type AdminMlCapabilities = typeof adminMlCapabilities;
 export type MlCapabilities = UserMlCapabilities & AdminMlCapabilities;
 
-export const basicLicenseMlCapabilities = ['canFindFileStructure'] as Array<keyof MlCapabilities>;
+export const basicLicenseMlCapabilities = ['canAccessML', 'canFindFileStructure'] as Array<
+  keyof MlCapabilities
+>;
 
 export function getDefaultCapabilities(): MlCapabilities {
   return {
@@ -56,6 +65,23 @@ export function getDefaultCapabilities(): MlCapabilities {
   };
 }
 
+export function getPluginPrivileges() {
+  const userMlCapabilitiesKeys = Object.keys(userMlCapabilities);
+  const adminMlCapabilitiesKeys = Object.keys(adminMlCapabilities);
+  const allMlCapabilities = [...adminMlCapabilitiesKeys, ...userMlCapabilitiesKeys];
+
+  return {
+    user: {
+      ui: userMlCapabilitiesKeys,
+      api: userMlCapabilitiesKeys.map(k => `ml:${k}`),
+    },
+    admin: {
+      ui: allMlCapabilities,
+      api: allMlCapabilities.map(k => `ml:${k}`),
+    },
+  };
+}
+
 export interface MlCapabilitiesResponse {
   capabilities: MlCapabilities;
   upgradeInProgress: boolean;

diff --git a/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.test.ts b/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.test.ts
@@ -36,7 +36,7 @@ describe('check_capabilities', () => {
       );
       const { capabilities } = await getCapabilities();
       const count = Object.keys(capabilities).length;
-      expect(count).toBe(22);
+      expect(count).toBe(28);
       done();
     });
   });
@@ -49,28 +49,42 @@ describe('check_capabilities', () => {
         mlLicense,
         mlIsEnabled
       );
-      const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
+      const {
+        capabilities,
+        upgradeInProgress,
+        mlFeatureEnabledInSpace,
+        isPlatinumOrTrialLicense,
+      } = await getCapabilities();
       expect(upgradeInProgress).toBe(false);
       expect(mlFeatureEnabledInSpace).toBe(true);
+      expect(isPlatinumOrTrialLicense).toBe(true);
+
+      expect(capabilities.canAccessML).toBe(true);
       expect(capabilities.canGetJobs).toBe(true);
+      expect(capabilities.canGetDatafeeds).toBe(true);
+      expect(capabilities.canGetCalendars).toBe(true);
+      expect(capabilities.canFindFileStructure).toBe(true);
+      expect(capabilities.canGetFilters).toBe(true);
+      expect(capabilities.canGetDataFrameAnalytics).toBe(true);
+      expect(capabilities.canGetAnnotations).toBe(true);
+      expect(capabilities.canCreateAnnotation).toBe(true);
+      expect(capabilities.canDeleteAnnotation).toBe(true);
+
       expect(capabilities.canCreateJob).toBe(false);
       expect(capabilities.canDeleteJob).toBe(false);
       expect(capabilities.canOpenJob).toBe(false);
       expect(capabilities.canCloseJob).toBe(false);
       expect(capabilities.canForecastJob).toBe(false);
-      expect(capabilities.canGetDatafeeds).toBe(true);
       expect(capabilities.canStartStopDatafeed).toBe(false);
       expect(capabilities.canUpdateJob).toBe(false);
+      expect(capabilities.canCreateDatafeed).toBe(false);
+      expect(capabilities.canDeleteDatafeed).toBe(false);
       expect(capabilities.canUpdateDatafeed).toBe(false);
       expect(capabilities.canPreviewDatafeed).toBe(false);
-      expect(capabilities.canGetCalendars).toBe(true);
       expect(capabilities.canCreateCalendar).toBe(false);
       expect(capabilities.canDeleteCalendar).toBe(false);
-      expect(capabilities.canGetFilters).toBe(true);
       expect(capabilities.canCreateFilter).toBe(false);
       expect(capabilities.canDeleteFilter).toBe(false);
-      expect(capabilities.canFindFileStructure).toBe(true);
-      expect(capabilities.canGetDataFrameAnalytics).toBe(true);
       expect(capabilities.canDeleteDataFrameAnalytics).toBe(false);
       expect(capabilities.canCreateDataFrameAnalytics).toBe(false);
       expect(capabilities.canStartStopDataFrameAnalytics).toBe(false);
@@ -84,28 +98,42 @@ describe('check_capabilities', () => {
         mlLicense,
         mlIsEnabled
       );
-      const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
+      const {
+        capabilities,
+        upgradeInProgress,
+        mlFeatureEnabledInSpace,
+        isPlatinumOrTrialLicense,
+      } = await getCapabilities();
       expect(upgradeInProgress).toBe(false);
       expect(mlFeatureEnabledInSpace).toBe(true);
+      expect(isPlatinumOrTrialLicense).toBe(true);
+
+      expect(capabilities.canAccessML).toBe(true);
       expect(capabilities.canGetJobs).toBe(true);
+      expect(capabilities.canGetDatafeeds).toBe(true);
+      expect(capabilities.canGetCalendars).toBe(true);
+      expect(capabilities.canFindFileStructure).toBe(true);
+      expect(capabilities.canGetFilters).toBe(true);
+      expect(capabilities.canGetDataFrameAnalytics).toBe(true);
+      expect(capabilities.canGetAnnotations).toBe(true);
+      expect(capabilities.canCreateAnnotation).toBe(true);
+      expect(capabilities.canDeleteAnnotation).toBe(true);
+
       expect(capabilities.canCreateJob).toBe(true);
       expect(capabilities.canDeleteJob).toBe(true);
       expect(capabilities.canOpenJob).toBe(true);
       expect(capabilities.canCloseJob).toBe(true);
       expect(capabilities.canForecastJob).toBe(true);
-      expect(capabilities.canGetDatafeeds).toBe(true);
       expect(capabilities.canStartStopDatafeed).toBe(true);
       expect(capabilities.canUpdateJob).toBe(true);
+      expect(capabilities.canCreateDatafeed).toBe(true);
+      expect(capabilities.canDeleteDatafeed).toBe(true);
       expect(capabilities.canUpdateDatafeed).toBe(true);
       expect(capabilities.canPreviewDatafeed).toBe(true);
-      expect(capabilities.canGetCalendars).toBe(true);
       expect(capabilities.canCreateCalendar).toBe(true);
       expect(capabilities.canDeleteCalendar).toBe(true);
-      expect(capabilities.canGetFilters).toBe(true);
       expect(capabilities.canCreateFilter).toBe(true);
       expect(capabilities.canDeleteFilter).toBe(true);
-      expect(capabilities.canFindFileStructure).toBe(true);
-      expect(capabilities.canGetDataFrameAnalytics).toBe(true);
       expect(capabilities.canDeleteDataFrameAnalytics).toBe(true);
       expect(capabilities.canCreateDataFrameAnalytics).toBe(true);
       expect(capabilities.canStartStopDataFrameAnalytics).toBe(true);
@@ -119,28 +147,42 @@ describe('check_capabilities', () => {
         mlLicense,
         mlIsEnabled
       );
-      const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
+      const {
+        capabilities,
+        upgradeInProgress,
+        mlFeatureEnabledInSpace,
+        isPlatinumOrTrialLicense,
+      } = await getCapabilities();
       expect(upgradeInProgress).toBe(true);
       expect(mlFeatureEnabledInSpace).toBe(true);
+      expect(isPlatinumOrTrialLicense).toBe(true);
+
+      expect(capabilities.canAccessML).toBe(true);
       expect(capabilities.canGetJobs).toBe(true);
+      expect(capabilities.canGetDatafeeds).toBe(true);
+      expect(capabilities.canGetCalendars).toBe(true);
+      expect(capabilities.canFindFileStructure).toBe(true);
+      expect(capabilities.canGetFilters).toBe(true);
+      expect(capabilities.canGetDataFrameAnalytics).toBe(true);
+      expect(capabilities.canGetAnnotations).toBe(true);
+      expect(capabilities.canCreateAnnotation).toBe(false);
+      expect(capabilities.canDeleteAnnotation).toBe(false);
+
       expect(capabilities.canCreateJob).toBe(false);
       expect(capabilities.canDeleteJob).toBe(false);
       expect(capabilities.canOpenJob).toBe(false);
       expect(capabilities.canCloseJob).toBe(false);
       expect(capabilities.canForecastJob).toBe(false);
-      expect(capabilities.canGetDatafeeds).toBe(true);
       expect(capabilities.canStartStopDatafeed).toBe(false);
       expect(capabilities.canUpdateJob).toBe(false);
+      expect(capabilities.canCreateDatafeed).toBe(false);
+      expect(capabilities.canDeleteDatafeed).toBe(false);
       expect(capabilities.canUpdateDatafeed).toBe(false);
       expect(capabilities.canPreviewDatafeed).toBe(false);
-      expect(capabilities.canGetCalendars).toBe(true);
       expect(capabilities.canCreateCalendar).toBe(false);
       expect(capabilities.canDeleteCalendar).toBe(false);
-      expect(capabilities.canGetFilters).toBe(true);
       expect(capabilities.canCreateFilter).toBe(false);
       expect(capabilities.canDeleteFilter).toBe(false);
-      expect(capabilities.canFindFileStructure).toBe(true);
-      expect(capabilities.canGetDataFrameAnalytics).toBe(true);
       expect(capabilities.canDeleteDataFrameAnalytics).toBe(false);
       expect(capabilities.canCreateDataFrameAnalytics).toBe(false);
       expect(capabilities.canStartStopDataFrameAnalytics).toBe(false);
@@ -154,28 +196,42 @@ describe('check_capabilities', () => {
         mlLicense,
         mlIsEnabled
       );
-      const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
+      const {
+        capabilities,
+        upgradeInProgress,
+        mlFeatureEnabledInSpace,
+        isPlatinumOrTrialLicense,
+      } = await getCapabilities();
       expect(upgradeInProgress).toBe(true);
       expect(mlFeatureEnabledInSpace).toBe(true);
+      expect(isPlatinumOrTrialLicense).toBe(true);
+
+      expect(capabilities.canAccessML).toBe(true);
       expect(capabilities.canGetJobs).toBe(true);
+      expect(capabilities.canGetDatafeeds).toBe(true);
+      expect(capabilities.canGetCalendars).toBe(true);
+      expect(capabilities.canFindFileStructure).toBe(true);
+      expect(capabilities.canGetFilters).toBe(true);
+      expect(capabilities.canGetDataFrameAnalytics).toBe(true);
+      expect(capabilities.canGetAnnotations).toBe(true);
+      expect(capabilities.canCreateAnnotation).toBe(false);
+      expect(capabilities.canDeleteAnnotation).toBe(false);
+
       expect(capabilities.canCreateJob).toBe(false);
       expect(capabilities.canDeleteJob).toBe(false);
       expect(capabilities.canOpenJob).toBe(false);
       expect(capabilities.canCloseJob).toBe(false);
       expect(capabilities.canForecastJob).toBe(false);
-      expect(capabilities.canGetDatafeeds).toBe(true);
       expect(capabilities.canStartStopDatafeed).toBe(false);
       expect(capabilities.canUpdateJob).toBe(false);
+      expect(capabilities.canCreateDatafeed).toBe(false);
+      expect(capabilities.canDeleteDatafeed).toBe(false);
       expect(capabilities.canUpdateDatafeed).toBe(false);
       expect(capabilities.canPreviewDatafeed).toBe(false);
-      expect(capabilities.canGetCalendars).toBe(true);
       expect(capabilities.canCreateCalendar).toBe(false);
       expect(capabilities.canDeleteCalendar).toBe(false);
-      expect(capabilities.canGetFilters).toBe(true);
       expect(capabilities.canCreateFilter).toBe(false);
       expect(capabilities.canDeleteFilter).toBe(false);
-      expect(capabilities.canFindFileStructure).toBe(true);
-      expect(capabilities.canGetDataFrameAnalytics).toBe(true);
       expect(capabilities.canDeleteDataFrameAnalytics).toBe(false);
       expect(capabilities.canCreateDataFrameAnalytics).toBe(false);
       expect(capabilities.canStartStopDataFrameAnalytics).toBe(false);
@@ -189,28 +245,42 @@ describe('check_capabilities', () => {
         mlLicense,
         mlIsNotEnabled
       );
-      const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
+      const {
+        capabilities,
+        upgradeInProgress,
+        mlFeatureEnabledInSpace,
+        isPlatinumOrTrialLicense,
+      } = await getCapabilities();
       expect(upgradeInProgress).toBe(false);
       expect(mlFeatureEnabledInSpace).toBe(false);
+      expect(isPlatinumOrTrialLicense).toBe(true);
+
+      expect(capabilities.canAccessML).toBe(false);
       expect(capabilities.canGetJobs).toBe(false);
+      expect(capabilities.canGetDatafeeds).toBe(false);
+      expect(capabilities.canGetCalendars).toBe(false);
+      expect(capabilities.canFindFileStructure).toBe(false);
+      expect(capabilities.canGetFilters).toBe(false);
+      expect(capabilities.canGetDataFrameAnalytics).toBe(false);
+      expect(capabilities.canGetAnnotations).toBe(false);
+      expect(capabilities.canCreateAnnotation).toBe(false);
+      expect(capabilities.canDeleteAnnotation).toBe(false);
+
       expect(capabilities.canCreateJob).toBe(false);
       expect(capabilities.canDeleteJob).toBe(false);
       expect(capabilities.canOpenJob).toBe(false);
       expect(capabilities.canCloseJob).toBe(false);
       expect(capabilities.canForecastJob).toBe(false);
-      expect(capabilities.canGetDatafeeds).toBe(false);
       expect(capabilities.canStartStopDatafeed).toBe(false);
       expect(capabilities.canUpdateJob).toBe(false);
+      expect(capabilities.canCreateDatafeed).toBe(false);
+      expect(capabilities.canDeleteDatafeed).toBe(false);
       expect(capabilities.canUpdateDatafeed).toBe(false);
       expect(capabilities.canPreviewDatafeed).toBe(false);
-      expect(capabilities.canGetCalendars).toBe(false);
       expect(capabilities.canCreateCalendar).toBe(false);
       expect(capabilities.canDeleteCalendar).toBe(false);
-      expect(capabilities.canGetFilters).toBe(false);
       expect(capabilities.canCreateFilter).toBe(false);
       expect(capabilities.canDeleteFilter).toBe(false);
-      expect(capabilities.canFindFileStructure).toBe(false);
-      expect(capabilities.canGetDataFrameAnalytics).toBe(false);
       expect(capabilities.canDeleteDataFrameAnalytics).toBe(false);
       expect(capabilities.canCreateDataFrameAnalytics).toBe(false);
       expect(capabilities.canStartStopDataFrameAnalytics).toBe(false);
@@ -225,28 +295,43 @@ describe('check_capabilities', () => {
       mlLicenseBasic,
       mlIsNotEnabled
     );
-    const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
+    const {
+      capabilities,
+      upgradeInProgress,
+      mlFeatureEnabledInSpace,
+      isPlatinumOrTrialLicense,
+    } = await getCapabilities();
+
     expect(upgradeInProgress).toBe(false);
     expect(mlFeatureEnabledInSpace).toBe(false);
+    expect(isPlatinumOrTrialLicense).toBe(false);
+
+    expect(capabilities.canAccessML).toBe(false);
     expect(capabilities.canGetJobs).toBe(false);
+    expect(capabilities.canGetDatafeeds).toBe(false);
+    expect(capabilities.canGetCalendars).toBe(false);
+    expect(capabilities.canFindFileStructure).toBe(false);
+    expect(capabilities.canGetFilters).toBe(false);
+    expect(capabilities.canGetDataFrameAnalytics).toBe(false);
+    expect(capabilities.canGetAnnotations).toBe(false);
+    expect(capabilities.canCreateAnnotation).toBe(false);
+    expect(capabilities.canDeleteAnnotation).toBe(false);
+
     expect(capabilities.canCreateJob).toBe(false);
     expect(capabilities.canDeleteJob).toBe(false);
     expect(capabilities.canOpenJob).toBe(false);
     expect(capabilities.canCloseJob).toBe(false);
     expect(capabilities.canForecastJob).toBe(false);
-    expect(capabilities.canGetDatafeeds).toBe(false);
     expect(capabilities.canStartStopDatafeed).toBe(false);
     expect(capabilities.canUpdateJob).toBe(false);
+    expect(capabilities.canCreateDatafeed).toBe(false);
+    expect(capabilities.canDeleteDatafeed).toBe(false);
     expect(capabilities.canUpdateDatafeed).toBe(false);
     expect(capabilities.canPreviewDatafeed).toBe(false);
-    expect(capabilities.canGetCalendars).toBe(false);
     expect(capabilities.canCreateCalendar).toBe(false);
     expect(capabilities.canDeleteCalendar).toBe(false);
-    expect(capabilities.canGetFilters).toBe(false);
     expect(capabilities.canCreateFilter).toBe(false);
     expect(capabilities.canDeleteFilter).toBe(false);
-    expect(capabilities.canFindFileStructure).toBe(false);
-    expect(capabilities.canGetDataFrameAnalytics).toBe(false);
     expect(capabilities.canDeleteDataFrameAnalytics).toBe(false);
     expect(capabilities.canCreateDataFrameAnalytics).toBe(false);
     expect(capabilities.canStartStopDataFrameAnalytics).toBe(false);

diff --git a/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.ts b/x-pack/plugins/ml/server/lib/capabilities/check_capabilities.ts
@@ -44,4 +44,6 @@ function disableAdminPrivileges(capabilities: MlCapabilities) {
   Object.keys(adminMlCapabilities).forEach(k => {
     capabilities[k as keyof MlCapabilities] = false;
   });
+  capabilities.canCreateAnnotation = false;
+  capabilities.canDeleteAnnotation = false;
 }