-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Security Solution][Detections] Handle RBAC edge case for Related Int…
…egration on the FE side (#134299) ## Summary Some users won't be able to get additional information about rule's related integrations, such as which of them are installed, enabled, etc. In order to have access to integrations' data in Fleet, a user needs either of these 3 Kibana privileges: - `Integrations`: `Read` or `All` - `Fleet`: `All` - `Saved Objects Management`: `Read` or `All` If all of them are `None`, the Related Integrations feature incorrectly shows all integrations as `Not Installed` even if some of them may be: <img width="1549" alt="Screenshot 2022-06-14 at 04 41 35" src="https://user-images.githubusercontent.com/7359339/173484715-291fa9dd-a1f1-4b91-a752-b7eb64bba2d4.png"> This PR adds a client-side privilege check and falls back to the basic UI that just shows the integration name+link and not any install information. ## Test instructions To test, configure a role with the 3 mentioned privileges as `None`, e.g. <p align="center"> <img width="500" src="https://user-images.githubusercontent.com/2946766/173156872-dfaece7e-a6ef-4774-b01d-e2fa7b66a068.png" /> </p> Then UI should fall back to no installed information: **Rule Details** <p align="center"> <img width="500" src="https://user-images.githubusercontent.com/2946766/173156901-572c4eb3-661f-4edf-974d-ec8ee13d849c.png" /> </p> **Rule Management** <p align="center"> <img width="500" src="https://user-images.githubusercontent.com/2946766/173156924-fbfec8ef-cbff-4966-8bee-bf3e29678cb9.png" /> </p> ## TODO In follow-up PRs: - [ ] Handle the same RBAC edge case for Related Integration on the BE side. Return 403 from the endpoint. - [ ] A test to exercise this fallback (either unit or cypress w/ specific role should do) - [ ] Ensure docs mention the required privileges for this feature ### Checklist Delete any items that are not applicable to this PR. - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
- Loading branch information
Showing
15 changed files
with
497 additions
and
329 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
195 changes: 195 additions & 0 deletions
195
...y_solution/public/detections/components/rules/related_integrations/integration_details.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,195 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| import { capitalize } from 'lodash'; | ||
| import semver from 'semver'; | ||
| import { | ||
| InstalledIntegration, | ||
| InstalledIntegrationArray, | ||
| RelatedIntegration, | ||
| RelatedIntegrationArray, | ||
| } from '../../../../../common/detection_engine/schemas/common'; | ||
| import { IntegrationPrivileges } from './integration_privileges'; | ||
|
|
||
| export interface IntegrationDetails { | ||
| packageName: string; | ||
| integrationName: string | null; | ||
| integrationTitle: string; | ||
|
|
||
| requiredVersion: string; | ||
| targetVersion: string; | ||
| targetUrl: string; | ||
|
|
||
| installationStatus: KnownInstallationStatus | UnknownInstallationStatus; | ||
| } | ||
|
|
||
| export interface KnownInstallationStatus { | ||
| isKnown: true; | ||
| isInstalled: boolean; | ||
| isEnabled: boolean; | ||
| isVersionMismatch: boolean; | ||
| installedVersion: string; | ||
| } | ||
|
|
||
| export interface UnknownInstallationStatus { | ||
| isKnown: false; | ||
| } | ||
|
|
||
| /** | ||
| * Given an array of integrations and an array of installed integrations this will return an | ||
| * array of integrations augmented with install details like targetVersion, and `version_satisfied` | ||
| * has. | ||
| */ | ||
| export const calculateIntegrationDetails = ( | ||
| privileges: IntegrationPrivileges, | ||
| relatedIntegrations: RelatedIntegrationArray, | ||
| installedIntegrations: InstalledIntegrationArray | undefined | ||
| ): IntegrationDetails[] => { | ||
| const integrationMatches = findIntegrationMatches(relatedIntegrations, installedIntegrations); | ||
| const integrationDetails = integrationMatches.map((integration) => { | ||
| return createIntegrationDetails(integration, privileges); | ||
| }); | ||
|
|
||
| return integrationDetails.sort((a, b) => { | ||
| return a.integrationTitle.localeCompare(b.integrationTitle); | ||
| }); | ||
| }; | ||
|
|
||
| interface IntegrationMatch { | ||
| related: RelatedIntegration; | ||
| installed: InstalledIntegration | null; | ||
| isLoaded: boolean; | ||
| } | ||
|
|
||
| const findIntegrationMatches = ( | ||
| relatedIntegrations: RelatedIntegrationArray, | ||
| installedIntegrations: InstalledIntegrationArray | undefined | ||
| ): IntegrationMatch[] => { | ||
| return relatedIntegrations.map((ri: RelatedIntegration) => { | ||
| if (installedIntegrations == null) { | ||
| return { | ||
| related: ri, | ||
| installed: null, | ||
| isLoaded: false, | ||
| }; | ||
| } else { | ||
| const match = installedIntegrations.find( | ||
| (ii: InstalledIntegration) => | ||
| ii.package_name === ri.package && ii?.integration_name === ri?.integration | ||
| ); | ||
| return { | ||
| related: ri, | ||
| installed: match ?? null, | ||
| isLoaded: true, | ||
| }; | ||
| } | ||
| }); | ||
| }; | ||
|
|
||
| const createIntegrationDetails = ( | ||
| integration: IntegrationMatch, | ||
| privileges: IntegrationPrivileges | ||
| ): IntegrationDetails => { | ||
| const { related, installed, isLoaded } = integration; | ||
| const { canReadInstalledIntegrations } = privileges; | ||
|
|
||
| const packageName = related.package; | ||
| const integrationName = related.integration ?? null; | ||
| const requiredVersion = related.version; | ||
|
|
||
| // We don't know whether the integration is installed or not. | ||
| if (!canReadInstalledIntegrations || !isLoaded) { | ||
| const integrationTitle = getCapitalizedTitle(packageName, integrationName); | ||
| const targetVersion = getMinimumConcreteVersionMatchingSemver(requiredVersion); | ||
| const targetUrl = buildTargetUrl(packageName, integrationName, targetVersion); | ||
|
|
||
| return { | ||
| packageName, | ||
| integrationName, | ||
| integrationTitle, | ||
| requiredVersion, | ||
| targetVersion, | ||
| targetUrl, | ||
| installationStatus: { | ||
| isKnown: false, | ||
| }, | ||
| }; | ||
| } | ||
|
|
||
| // We know that the integration is not installed | ||
| if (installed == null) { | ||
| const integrationTitle = getCapitalizedTitle(packageName, integrationName); | ||
| const targetVersion = getMinimumConcreteVersionMatchingSemver(requiredVersion); | ||
| const targetUrl = buildTargetUrl(packageName, integrationName, targetVersion); | ||
|
|
||
| return { | ||
| packageName, | ||
| integrationName, | ||
| integrationTitle, | ||
| requiredVersion, | ||
| targetVersion, | ||
| targetUrl, | ||
| installationStatus: { | ||
| isKnown: true, | ||
| isInstalled: false, | ||
| isEnabled: false, | ||
| isVersionMismatch: false, | ||
| installedVersion: '', | ||
| }, | ||
| }; | ||
| } | ||
|
|
||
| // We know that the integration is installed | ||
| { | ||
| const integrationTitle = installed.integration_title ?? installed.package_title; | ||
|
|
||
| // Version check e.g. installed version `1.2.3` satisfies required version `~1.2.1` | ||
| const installedVersion = installed.package_version; | ||
| const isVersionSatisfied = semver.satisfies(installedVersion, requiredVersion); | ||
| const targetVersion = isVersionSatisfied | ||
| ? installedVersion | ||
| : getMinimumConcreteVersionMatchingSemver(requiredVersion); | ||
|
|
||
| const targetUrl = buildTargetUrl(packageName, integrationName, targetVersion); | ||
|
|
||
| return { | ||
| packageName, | ||
| integrationName, | ||
| integrationTitle, | ||
| requiredVersion, | ||
| targetVersion, | ||
| targetUrl, | ||
| installationStatus: { | ||
| isKnown: true, | ||
| isInstalled: true, | ||
| isEnabled: installed.is_enabled, | ||
| isVersionMismatch: !isVersionSatisfied, | ||
| installedVersion, | ||
| }, | ||
| }; | ||
| } | ||
| }; | ||
|
|
||
| const getCapitalizedTitle = (packageName: string, integrationName: string | null): string => { | ||
| return integrationName == null | ||
| ? `${capitalize(packageName)}` | ||
| : `${capitalize(packageName)} ${capitalize(integrationName)}`; | ||
| }; | ||
|
|
||
| const getMinimumConcreteVersionMatchingSemver = (semverString: string): string => { | ||
| return semver.valid(semver.coerce(semverString)) ?? ''; | ||
| }; | ||
|
|
||
| const buildTargetUrl = ( | ||
| packageName: string, | ||
| integrationName: string | null, | ||
| targetVersion: string | ||
| ): string => { | ||
| const packageSegment = targetVersion ? `${packageName}-${targetVersion}` : packageName; | ||
| const query = integrationName ? `?integration=${integrationName}` : ''; | ||
| return `app/integrations/detail/${packageSegment}/overview${query}`; | ||
| }; |
10 changes: 10 additions & 0 deletions
10
...olution/public/detections/components/rules/related_integrations/integration_privileges.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License | ||
| * 2.0; you may not use this file except in compliance with the Elastic License | ||
| * 2.0. | ||
| */ | ||
|
|
||
| export interface IntegrationPrivileges { | ||
| canReadInstalledIntegrations: boolean; | ||
| } |
Oops, something went wrong.