Make TagClient available to other plugins on server side

[jen-huang]

Describe the feature:
Expose savedObjectTagging client to other plugins for server-side consumption, currently it only exports an UI interface.

Describe a specific use case for the feature:
Fleet needs this in order to add tags to Kibana assets that are installed and managed by Fleet: #123904.

When Fleet installs these assets, there is already an internally-scoped saved object client set up that is used:

kibana/x-pack/plugins/fleet/server/plugin.ts

Lines 421 to 424 in 0082e0c

	await setupFleet(
	new SavedObjectsClient(core.savedObjects.createInternalRepository()),
	core.elasticsearch.client.asInternalUser
	);

So it would be great to be able to pass the same client to instantiate a TagClient.

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[pgayvallet]

currently it only exports an UI interface.

Not exactly. we're exposing the soTagging feature via a request handler context too, e,g ctx.tags.tagsClient. But there's currently no way to access the feature from outside of a request handler on the server-side.

[pgayvallet]

Looking at the code, exposing the TagClient (which allows to create/delete/update tags) from outside of a request handler should not be an issue, as its only dependency is a SavedObjectsClientContract that could be provided by the API consumer.

However, the tagAssignmentService (which allows to assign/unassign tags to saved objects) is more problematic: as we need to make sure that the user performing the operation is allowed to update the target object(s), we are performing an authz check against the assigned types, using security.authorization.checkPrivilegesDynamicallyWithRequest, and this effectively requires to have a request object.

We could lift this authz check when creating the assignmentService from outside of a request handler, but tbh I don't really like this option very much...

@jen-huang what exactly do you need to perform via the SO tagging APIs? Are you only going to create tags, or do you also need to assign them to existing objects?

[jen-huang]

@jen-huang what exactly do you need to perform via the SO tagging APIs? Are you only going to create tags, or do you also need to assign them to existing objects?

We will need to create tags and assign them to objects immediately after the objects are created.

However, the tagAssignmentService (which allows to assign/unassign tags to saved objects) is more problematic: as we need to make sure that the user performing the operation is allowed to update the target object(s), we are performing an authz check against the assigned types, using security.authorization.checkPrivilegesDynamicallyWithRequest, and this effectively requires to have a request object.

Is it possible to instantiate an internal/system user version of a request object that Fleet can pass to tagAssignmentService? Similar to core.elasticsearch.client.asInternalUser or core.savedObjects.createInternalRepository() which is what Fleet uses for as ES and SO clients for all package installations.