elastic · azasypkin · Aug 23, 2023 · Jul 17, 2023 · Jul 17, 2023 · Jul 18, 2023
@@ -79,3 +79,6 @@ console.autocompleteDefinitions.endpointsAvailability: serverless
 
 # Allow authentication via the Elasticsearch JWT realm with the `shared_secret` client authentication type.
 elasticsearch.requestHeadersWhitelist: ["authorization", "es-client-authentication"]
+
+# FOR LOCAL TESTING - AWAITING MERGE OF https://github.com/elastic/kibana/pull/162149
+server.restrictInternalApis: true
diff --git a/x-pack/plugins/spaces/server/config.test.ts b/x-pack/plugins/spaces/server/config.test.ts
@@ -63,7 +63,12 @@ describe('config schema', () => {
 
   it('should not throw error if allowFeatureVisibility is disabled in serverless offering', () => {
     expect(() =>
-      ConfigSchema.validate({ allowFeatureVisibility: false }, { serverless: true })
+      ConfigSchema.validate(
+        {
+          allowFeatureVisibility: false,
+        },
+        { serverless: true }
+      )
     ).not.toThrow();
   });
 
@@ -73,7 +78,12 @@ describe('config schema', () => {
 
   it('should throw error if allowFeatureVisibility is enabled in serverless offering', () => {
     expect(() =>
-      ConfigSchema.validate({ allowFeatureVisibility: true }, { serverless: true })
+      ConfigSchema.validate(
+        {
+          allowFeatureVisibility: true,
+        },
+        { serverless: true }
+      )
     ).toThrow();
   });
 });
@@ -28,7 +28,7 @@ import type { ConfigType } from './config';
 import { DefaultSpaceService } from './default_space';
 import { initSpacesRequestInterceptors } from './lib/request_interceptors';
 import { createSpacesTutorialContextFactory } from './lib/spaces_tutorial_context_factory';
-import { initExternalSpacesApi } from './routes/api/external';
+import { initConfigurableSpacesApi, initPublicSpacesApi } from './routes/api/external';
 import { initInternalSpacesApi } from './routes/api/internal';
 import { initSpacesViewsRoutes } from './routes/views';
 import { SpacesSavedObjectsService } from './saved_objects';
@@ -103,7 +103,7 @@ export class SpacesPlugin
 
   private defaultSpaceService?: DefaultSpaceService;
 
-  constructor(initializerContext: PluginInitializerContext) {
+  constructor(private readonly initializerContext: PluginInitializerContext) {
     this.config$ = initializerContext.config.create<ConfigType>();
     this.log = initializerContext.logger.get();
     this.spacesService = new SpacesService();
@@ -148,18 +148,28 @@ export class SpacesPlugin
       logger: this.log,
     });
 
-    const externalRouter = core.http.createRouter<SpacesRequestHandlerContext>();
-    initExternalSpacesApi({
-      externalRouter,
+    const buildFlavor = this.initializerContext.env.packageInfo.buildFlavor;
+    const router = core.http.createRouter<SpacesRequestHandlerContext>();
+    if (buildFlavor !== 'serverless') {
+      initPublicSpacesApi({
+        router,
+        log: this.log,
+        getStartServices: core.getStartServices,
+        getSpacesService,
+        usageStatsServicePromise,
+      });
+    }
+    const configuredAccess = buildFlavor === 'serverless' ? 'internal' : 'public';
+    initConfigurableSpacesApi({
+      router,
       log: this.log,
       getStartServices: core.getStartServices,
       getSpacesService,
       usageStatsServicePromise,
+      access: configuredAccess,
     });
-
-    const internalRouter = core.http.createRouter<SpacesRequestHandlerContext>();
     initInternalSpacesApi({
-      internalRouter,
+      router,
       getSpacesService,
     });
 

@@ -80,7 +80,7 @@ describe('copy to space', () => {
     });
 
     initCopyToSpacesApi({
-      externalRouter: router,
+      router,
       getStartServices: async () => [coreStart, {}, {}],
       log,
       getSpacesService: () => spacesServiceStart,

@@ -24,10 +24,10 @@ const areObjectsUnique = (objects: SavedObjectIdentifier[]) =>
   _.uniqBy(objects, (o: SavedObjectIdentifier) => `${o.type}:${o.id}`).length === objects.length;
 
 export function initCopyToSpacesApi(deps: ExternalRouteDeps) {
-  const { externalRouter, getSpacesService, usageStatsServicePromise, getStartServices } = deps;
+  const { router, getSpacesService, usageStatsServicePromise, getStartServices } = deps;
   const usageStatsClientPromise = usageStatsServicePromise.then(({ getClient }) => getClient());
 
-  externalRouter.post(
+  router.post(
     {
       path: '/api/spaces/_copy_saved_objects',
       options: {
@@ -137,7 +137,7 @@ export function initCopyToSpacesApi(deps: ExternalRouteDeps) {
     })
   );
 
-  externalRouter.post(
+  router.post(
     {
       path: '/api/spaces/_resolve_copy_saved_objects_errors',
       options: {

@@ -62,7 +62,7 @@ describe('Spaces Public API', () => {
     });
 
     initDeleteSpacesApi({
-      externalRouter: router,
+      router,
       getStartServices: async () => [coreStart, {}, {}],
       log,
       getSpacesService: () => spacesServiceStart,

@@ -15,9 +15,9 @@ import { wrapError } from '../../../lib/errors';
 import { createLicensedRouteHandler } from '../../lib';
 
 export function initDeleteSpacesApi(deps: ExternalRouteDeps) {
-  const { externalRouter, log, getSpacesService } = deps;
+  const { router, log, getSpacesService } = deps;
 
-  externalRouter.delete(
+  router.delete(
     {
       path: '/api/spaces/space/{id}',
       validate: {

@@ -65,7 +65,7 @@ describe('_disable_legacy_url_aliases', () => {
     });
 
     initDisableLegacyUrlAliasesApi({
-      externalRouter: router,
+      router,
       getStartServices: async () => [coreStart, {}, {}],
       log,
       getSpacesService: () => spacesServiceStart,

@@ -12,10 +12,10 @@ import { wrapError } from '../../../lib/errors';
 import { createLicensedRouteHandler } from '../../lib';
 
 export function initDisableLegacyUrlAliasesApi(deps: ExternalRouteDeps) {
-  const { externalRouter, getSpacesService, usageStatsServicePromise } = deps;
+  const { router, getSpacesService, usageStatsServicePromise } = deps;
   const usageStatsClientPromise = usageStatsServicePromise.then(({ getClient }) => getClient());
 
-  externalRouter.post(
+  router.post(
     {
       path: '/api/spaces/_disable_legacy_url_aliases',
       validate: {

@@ -61,11 +61,12 @@ describe('GET space', () => {
     });
 
     initGetSpaceApi({
-      externalRouter: router,
+      router,
       getStartServices: async () => [coreStart, {}, {}],
       log,
       getSpacesService: () => spacesServiceStart,
       usageStatsServicePromise,
+      access: 'public',
     });
 
     return {

@@ -8,21 +8,22 @@
 import { schema } from '@kbn/config-schema';
 import { SavedObjectsErrorHelpers } from '@kbn/core/server';
 
-import type { ExternalRouteDeps } from '.';
+import type { ConfigurableRouteDeps } from '.';
 import { wrapError } from '../../../lib/errors';
 import { createLicensedRouteHandler } from '../../lib';
 
-export function initGetSpaceApi(deps: ExternalRouteDeps) {
-  const { externalRouter, getSpacesService } = deps;
+export function initGetSpaceApi(deps: ConfigurableRouteDeps) {
+  const { router, getSpacesService, access } = deps;
 
-  externalRouter.get(
+  router.get(
     {
       path: '/api/spaces/space/{id}',
       validate: {
         params: schema.object({
           id: schema.string(),
         }),
       },
+      options: { access },
     },
     createLicensedRouteHandler(async (context, request, response) => {
       const spaceId = request.params.id;

@@ -62,11 +62,12 @@ describe('GET /spaces/space', () => {
     });
 
     initGetAllSpacesApi({
-      externalRouter: router,
+      router,
       getStartServices: async () => [coreStart, {}, {}],
       log,
       getSpacesService: () => spacesServiceStart,
       usageStatsServicePromise,
+      access: 'public',
     });
 
     return {

@@ -7,15 +7,15 @@
 
 import { schema } from '@kbn/config-schema';
 
-import type { ExternalRouteDeps } from '.';
+import type { ConfigurableRouteDeps } from '.';
 import type { Space } from '../../../../common';
 import { wrapError } from '../../../lib/errors';
 import { createLicensedRouteHandler } from '../../lib';
 
-export function initGetAllSpacesApi(deps: ExternalRouteDeps) {
-  const { externalRouter, log, getSpacesService } = deps;
+export function initGetAllSpacesApi(deps: ConfigurableRouteDeps) {
+  const { router, log, getSpacesService, access } = deps;
 
-  externalRouter.get(
+  router.get(
     {
       path: '/api/spaces/space',
       validate: {
@@ -35,6 +35,7 @@ export function initGetAllSpacesApi(deps: ExternalRouteDeps) {
           ),
         }),
       },
+      options: { access },
     },
     createLicensedRouteHandler(async (context, request, response) => {
       log.debug(`Inside GET /api/spaces/space`);

@@ -61,7 +61,7 @@ describe('get shareable references', () => {
       spacesClientService: clientServiceStart,
     });
     initGetShareableReferencesApi({
-      externalRouter: router,
+      router,
       getStartServices: async () => [coreStart, {}, {}],
       log,
       getSpacesService: () => spacesServiceStart,

@@ -12,9 +12,9 @@ import { wrapError } from '../../../lib/errors';
 import { createLicensedRouteHandler } from '../../lib';
 
 export function initGetShareableReferencesApi(deps: ExternalRouteDeps) {
-  const { externalRouter, getStartServices } = deps;
+  const { router, getStartServices } = deps;
 
-  externalRouter.post(
+  router.post(
     {
       path: '/api/spaces/_get_shareable_references',
       validate: {

@@ -21,21 +21,28 @@ import { initPutSpacesApi } from './put';
 import { initUpdateObjectsSpacesApi } from './update_objects_spaces';
 
 export interface ExternalRouteDeps {
-  externalRouter: SpacesRouter;
+  router: SpacesRouter;
   getStartServices: CoreSetup['getStartServices'];
   getSpacesService: () => SpacesServiceStart;
   usageStatsServicePromise: Promise<UsageStatsServiceSetup>;
   log: Logger;
 }
 
-export function initExternalSpacesApi(deps: ExternalRouteDeps) {
+export interface ConfigurableRouteDeps extends ExternalRouteDeps {
+  access: 'internal' | 'public';
+}
+
+export function initPublicSpacesApi(deps: ExternalRouteDeps) {
   initDeleteSpacesApi(deps);
-  initGetSpaceApi(deps);
-  initGetAllSpacesApi(deps);
   initPostSpacesApi(deps);
-  initPutSpacesApi(deps);
   initCopyToSpacesApi(deps);
   initUpdateObjectsSpacesApi(deps);
   initGetShareableReferencesApi(deps);
   initDisableLegacyUrlAliasesApi(deps);
 }
+
+export function initConfigurableSpacesApi(deps: ConfigurableRouteDeps) {
+  initGetSpaceApi(deps);
+  initGetAllSpacesApi(deps);
+  initPutSpacesApi(deps);
+}
@@ -62,7 +62,7 @@ describe('Spaces Public API', () => {
     });
 
     initPostSpacesApi({
-      externalRouter: router,
+      router,
       getStartServices: async () => [coreStart, {}, {}],
       log,
       getSpacesService: () => spacesServiceStart,

@@ -15,14 +15,15 @@ import { spaceSchema } from '../../../lib/space_schema';
 import { createLicensedRouteHandler } from '../../lib';
 
 export function initPostSpacesApi(deps: ExternalRouteDeps) {
-  const { externalRouter, log, getSpacesService } = deps;
+  const { router, log, getSpacesService } = deps;
 
-  externalRouter.post(
+  router.post(
     {
       path: '/api/spaces/space',
       validate: {
         body: spaceSchema,
       },
+      options: { access: 'public' },
     },
     createLicensedRouteHandler(async (context, request, response) => {
       log.debug(`Inside POST /api/spaces/space`);

@@ -62,11 +62,12 @@ describe('PUT /api/spaces/space', () => {
     });
 
     initPutSpacesApi({
-      externalRouter: router,
+      router,
       getStartServices: async () => [coreStart, {}, {}],
       log,
       getSpacesService: () => spacesServiceStart,
       usageStatsServicePromise,
+      access: 'public',
     });
 
     const [routeDefinition, routeHandler] = router.put.mock.calls[0];

@@ -8,16 +8,16 @@
 import { schema } from '@kbn/config-schema';
 import { SavedObjectsErrorHelpers } from '@kbn/core/server';
 
-import type { ExternalRouteDeps } from '.';
+import type { ConfigurableRouteDeps } from '.';
 import type { Space } from '../../../../common';
 import { wrapError } from '../../../lib/errors';
 import { spaceSchema } from '../../../lib/space_schema';
 import { createLicensedRouteHandler } from '../../lib';
 
-export function initPutSpacesApi(deps: ExternalRouteDeps) {
-  const { externalRouter, getSpacesService } = deps;
+export function initPutSpacesApi(deps: ConfigurableRouteDeps) {
+  const { router, getSpacesService, access } = deps;
 
-  externalRouter.put(
+  router.put(
     {
       path: '/api/spaces/space/{id}',
       validate: {
@@ -26,6 +26,7 @@ export function initPutSpacesApi(deps: ExternalRouteDeps) {
         }),
         body: spaceSchema,
       },
+      options: { access },
     },
     createLicensedRouteHandler(async (context, request, response) => {
       const spacesClient = getSpacesService().createSpacesClient(request);

@@ -62,7 +62,7 @@ describe('update_objects_spaces', () => {
       spacesClientService: clientServiceStart,
     });
     initUpdateObjectsSpacesApi({
-      externalRouter: router,
+      router,
       getStartServices: async () => [coreStart, {}, {}],
       log,
       getSpacesService: () => spacesServiceStart,

@@ -14,7 +14,7 @@ import { SPACE_ID_REGEX } from '../../../lib/space_schema';
 import { createLicensedRouteHandler } from '../../lib';
 
 export function initUpdateObjectsSpacesApi(deps: ExternalRouteDeps) {
-  const { externalRouter, getStartServices } = deps;
+  const { router, getStartServices } = deps;
 
   const spacesSchema = schema.arrayOf(
     schema.string({
@@ -33,7 +33,7 @@ export function initUpdateObjectsSpacesApi(deps: ExternalRouteDeps) {
     }
   );
 
-  externalRouter.post(
+  router.post(
     {
       path: '/api/spaces/_update_objects_spaces',
       validate: {