[Actions] System actions authorization #161341
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ana into system_actions_registration
|
Pinging @elastic/response-ops (Team:ResponseOps) |
cnasikas
commented
Jul 11, 2023
| */ | ||
| public getSystemActionKibanaPrivileges( | ||
| actionTypeId: string, | ||
| metadata?: Record<string, unknown> |
There was a problem hiding this comment.
cnasikas
commented
Jul 11, 2023
| @@ -730,7 +745,8 @@ export class ActionsClient { | |||
| (await getAuthorizationModeBySource(this.unsecuredSavedObjectsClient, source)) === | |||
| AuthorizationMode.RBAC | |||
| ) { | |||
| await this.authorization.ensureAuthorized('execute'); | |||
| const additionalPrivileges = this.getSystemActionKibanaPrivileges(actionId, params); | |||
There was a problem hiding this comment.
Authorize system actions if needed.
cnasikas
commented
Jul 11, 2023
| execute: (authorization) => [ | ||
| authorization.actions.savedObject.get(ACTION_SAVED_OBJECT_TYPE, 'get'), | ||
| authorization.actions.savedObject.get(ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE, 'create'), | ||
| ], | ||
| list: (authorization) => authorization.actions.savedObject.get(ACTION_SAVED_OBJECT_TYPE, 'find'), | ||
| list: (authorization) => [ |
cnasikas
commented
Jul 11, 2023
| kibana: [ | ||
| { | ||
| feature: { | ||
| generalCases: ['all'], |
There was a problem hiding this comment.
If you want me to register a feature in x-pack/test/alerting_api_integration/common/plugins/actions_simulators/server/plugin.ts and use it instead of using Cases let me know.
2 tasks
💔 Build FailedFailed CI StepsTest Failures
Metrics [docs]Public APIs missing comments
History
To update your PR or re-run it, just comment with: cc @cnasikas |
cnasikas
added a commit
that referenced
this pull request
Jul 28, 2023
## Summary This PR: - Handles the references for system actions in the rule - Forbids the creation of system actions through the `kibana.yml` - Adds telemetry for system actions - Allow system action types to be disabled from the `kibana.yml` Depends on: #160983, #161341 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Kibana Machine <[email protected]>
ThomThomson
pushed a commit
to ThomThomson/kibana
that referenced
this pull request
Aug 1, 2023
## Summary This PR adds the ability for system actions to be able to define their own Kibana privileges that need to be authorized before execution. Depends on: elastic#160983 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Kibana Machine <[email protected]>
ThomThomson
pushed a commit
to ThomThomson/kibana
that referenced
this pull request
Aug 1, 2023
## Summary This PR: - Handles the references for system actions in the rule - Forbids the creation of system actions through the `kibana.yml` - Adds telemetry for system actions - Allow system action types to be disabled from the `kibana.yml` Depends on: elastic#160983, elastic#161341 ### Checklist Delete any items that are not applicable to this PR. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### For maintainers - [x] This was checked for breaking API changes and was [labeled appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) --------- Co-authored-by: Kibana Machine <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds the ability for system actions to be able to define their own Kibana privileges that need to be authorized before execution.
Depends on: #160983
Checklist
Delete any items that are not applicable to this PR.
For maintainers