[RAM] Apply maintenance windows privilege to UI

[XavierM]

Summary

We will have three scenarios with kibana privileges

NONE

Kibana privileges form maintenance window:

The expected result is to not see maintenance window at all

READ

Kibana privileges form maintenance window:

The expected result is to only see the table with window maintenance and you can not edit them

ALL

Kibana privileges form maintenance window:

The expected result is to be able to create/edit/etc on any maintenance windows

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/response-ops (Team:ResponseOps)

[spong]

Checked out, tested locally, code reviewed Detection Rules changes and everything LGTM! 🚀 🙌 🔐

Left a few nits if you'd like to take care of those but not necessary.

To test I did the following:

Create three roles, one for each all/read/none maintenance privileges (via Dev Tools):

PUT /_security/role/maintenance_window_all

PUT /_security/role/maintenance_window_all
{
  "cluster": [
    "all"
  ],
  "indices": [
    {
      "names": [
        "*"
      ],
      "privileges": [
        "all"
      ],
      "field_security": {
        "grant": [
          "*"
        ],
        "except": []
      },
      "allow_restricted_indices": false
    }
  ],
  "applications": [
    {
      "application": "kibana-.kibana",
      "privileges": [
        "feature_filesManagement.all",
        "feature_indexPatterns.all",
        "feature_advancedSettings.all",
        "feature_dev_tools.all",
        "feature_securitySolutionCases.all",
        "feature_siem.all",
        "feature_discover.all",
        "feature_dashboard.all",
        "feature_canvas.all",
        "feature_maps.all",
        "feature_ml.all",
        "feature_graph.all",
        "feature_visualize.all",
        "feature_filesSharedImage.all",
        "feature_savedObjectsManagement.all",
        "feature_savedObjectsTagging.all",
        "feature_osquery.all",
        "feature_actions.all",
        "feature_generalCases.all",
        "feature_guidedOnboardingFeature.all",
        "feature_rulesSettings.all",
        "feature_stackAlerts.all",
        "feature_fleetv2.all",
        "feature_fleet.all",
        "feature_maintenanceWindow.all",
        "feature_logs.all",
        "feature_infrastructure.all",
        "feature_apm.all",
        "feature_uptime.all",
        "feature_observabilityCases.all",
        "feature_slo.all"
      ],
      "resources": [
        "*"
      ]
    }
  ],
  "run_as": [],
  "metadata": {},
  "transient_metadata": {
    "enabled": true
  }
}

PUT /_security/role/maintenance_window_read

PUT /_security/role/maintenance_window_read
{
  "cluster": [
    "all"
  ],
  "indices": [
    {
      "names": [
        "*"
      ],
      "privileges": [
        "all"
      ],
      "field_security": {
        "grant": [
          "*"
        ],
        "except": []
      },
      "allow_restricted_indices": false
    }
  ],
  "applications": [
    {
      "application": "kibana-.kibana",
      "privileges": [
        "feature_filesManagement.all",
        "feature_indexPatterns.all",
        "feature_advancedSettings.all",
        "feature_dev_tools.all",
        "feature_securitySolutionCases.all",
        "feature_siem.all",
        "feature_discover.all",
        "feature_dashboard.all",
        "feature_canvas.all",
        "feature_maps.all",
        "feature_ml.all",
        "feature_graph.all",
        "feature_visualize.all",
        "feature_filesSharedImage.all",
        "feature_savedObjectsManagement.all",
        "feature_savedObjectsTagging.all",
        "feature_osquery.all",
        "feature_actions.all",
        "feature_generalCases.all",
        "feature_guidedOnboardingFeature.all",
        "feature_rulesSettings.all",
        "feature_stackAlerts.all",
        "feature_fleetv2.all",
        "feature_fleet.all",
        "feature_maintenanceWindow.read",
        "feature_logs.all",
        "feature_infrastructure.all",
        "feature_apm.all",
        "feature_uptime.all",
        "feature_observabilityCases.all",
        "feature_slo.all"
      ],
      "resources": [
        "*"
      ]
    }
  ],
  "run_as": [],
  "metadata": {},
  "transient_metadata": {
    "enabled": true
  }
}

PUT /_security/role/maintenance_window_none

PUT /_security/role/maintenance_window_none
{
  "cluster": [
    "all"
  ],
  "indices": [
    {
      "names": [
        "*"
      ],
      "privileges": [
        "all"
      ],
      "field_security": {
        "grant": [
          "*"
        ],
        "except": []
      },
      "allow_restricted_indices": false
    }
  ],
  "applications": [
    {
      "application": "kibana-.kibana",
      "privileges": [
        "feature_filesManagement.all",
        "feature_indexPatterns.all",
        "feature_advancedSettings.all",
        "feature_dev_tools.all",
        "feature_securitySolutionCases.all",
        "feature_siem.all",
        "feature_discover.all",
        "feature_dashboard.all",
        "feature_canvas.all",
        "feature_maps.all",
        "feature_ml.all",
        "feature_graph.all",
        "feature_visualize.all",
        "feature_filesSharedImage.all",
        "feature_savedObjectsManagement.all",
        "feature_savedObjectsTagging.all",
        "feature_osquery.all",
        "feature_actions.all",
        "feature_generalCases.all",
        "feature_guidedOnboardingFeature.all",
        "feature_rulesSettings.all",
        "feature_stackAlerts.all",
        "feature_fleetv2.all",
        "feature_fleet.all",
        "feature_maintenanceWindow.none",
        "feature_logs.all",
        "feature_infrastructure.all",
        "feature_apm.all",
        "feature_uptime.all",
        "feature_observabilityCases.all",
        "feature_slo.all"
      ],
      "resources": [
        "*"
      ]
    }
  ],
  "run_as": [],
  "metadata": {},
  "transient_metadata": {
    "enabled": true
  }
}

Create a new maintenance_user (assigned all three roles), create an active maintenance window, then remove one role at a time testing each:

POST /_security/user/maintenance_user (ALL)

POST /_security/user/maintenance_user
{
    "username": "maintenance_user",
    "password": "changeme",
    "roles": [
      "maintenance_window_all",
      "maintenance_window_read",
      "maintenance_window_none"
    ],
    "full_name": "Main",
    "email": "Tenance",
    "metadata": {},
    "enabled": true
}

PUT /_security/user/maintenance_user (READ)

PUT /_security/user/maintenance_user
{
    "username": "maintenance_user",
    "roles": [
      "maintenance_window_read",
      "maintenance_window_none"
    ],
    "full_name": "Main",
    "email": "Tenance",
    "metadata": {},
    "enabled": true
}

PUT /_security/user/maintenance_user (NONE)

PUT /_security/user/maintenance_user
{
    "username": "maintenance_user",
    "roles": [
      "maintenance_window_none"
    ],
    "full_name": "Main",
    "email": "Tenance",
    "metadata": {},
    "enabled": true
}

Each scenario worked as expected from within the Security App Rules Page when an active maintenance was configured. all/read privileges showed the maintenance callout, and none did not.

Also tested the API direct via GET kbn:/internal/alerting/rules/maintenance_window/_active in Dev tools, and all/read returned the window as expected, and none returned a 403 Forbidden.

[spong]

nit: extract to mock so it can be imported ala the toasts mock above

let appToastsMock: jest.Mocked<ReturnType<typeof useAppToastsMock.create>>;

[spong]

nit: encapsulate in useFetchActiveMaintenanceWindows as capabilities aren't needed elsewhere here and it keeps the hook self-contained

[maximpn]

@XavierM I've looked through the changes and it LGTM. I also tested it locally and it works as expected 👍

I left only one nit comment.

[ymao1]

LGTM, verified each role behaved as expected.

[JiaweiWu]

LGTM. I tested the read-only role, and the edit popover no longer shows up, I tested the no privilege role, and nothing shows up in the sidebar.

I just have 1 comment, up to you if we want to fix it here or somewhere else.

[JiaweiWu]

I didn't catch this earlier, and it's a bit unrelated to privileges, but I think we should rename this file to MaintenanceWindowsPage instead of index, since it's not really an index file, same for the test.

[XavierM]

will do that in follow up PR

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: ccee13b

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
alerting	182.4KB	183.2KB	+849.0B
securitySolution	9.1MB	9.1MB	+182.0B
total			+1.0KB

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
enterpriseSearch	19	21	+2
securitySolution	399	402	+3
total			+5

Total ESLint disabled count

id	before	after	diff
enterpriseSearch	20	22	+2
securitySolution	479	482	+3
total			+5

History

• 💔 Build #124611 failed e71ad02
• 💔 Build #124560 failed 2d30475
• 💔 Build #124385 failed c86fb95
• 💔 Build #124362 failed 74b9279
• 💔 Build #124358 failed 6f6d61e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.8

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation