[Security in Core] Exposes apiKeys from core.security.authc

packages/core/security/core-security-common/index.ts

@@ -12,3 +12,24 @@ export type {
   AuthenticatedUser,
   AuthenticationProvider,
 } from './src/authentication';
+
+export type {
+  APIKeysService,
+  CreateAPIKeyParams,
+  CreateAPIKeyResult,
+  InvalidateAPIKeyResult,
+  InvalidateAPIKeysParams,
+  ValidateAPIKeyParams,
+  CreateRestAPIKeyParams,
+  CreateRestAPIKeyWithKibanaPrivilegesParams,
+  CreateCrossClusterAPIKeyParams,
+  GrantAPIKeyResult,
+} from './src/api_keys';
+export {
+  restApiKeySchema,
+  crossClusterApiKeySchema,
+  getRestApiKeyWithKibanaPrivilegesSchema,
+} from './src/api_keys';
+
+export { elasticsearchRoleSchema, getKibanaRoleSchema, GLOBAL_RESOURCE } from './src/roles';
+export type { KibanaPrivilegesType, ElasticsearchPrivilegesType } from './src/roles';

packages/core/security/core-security-common/src/api_keys/api_keys.ts

@@ -0,0 +1,214 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+import type { estypes } from '@elastic/elasticsearch';
+
+import type { KibanaRequest } from '@kbn/core-http-server';
+import { schema, TypeOf } from '@kbn/config-schema';
+import { getKibanaRoleSchema, elasticsearchRoleSchema } from '../roles';
+
+/**
+ * Interface for managing API keys in Elasticsearch, including creation,
+ * validation, and invalidation of API keys,
+ * as well as checking the status of API key features.
+ */
+export interface APIKeys {
+  /**
+   * Determines if API Keys are enabled in Elasticsearch.
+   */
+  areAPIKeysEnabled(): Promise<boolean>;
+
+  /**
+   * Determines if Cross-Cluster API Keys are enabled in Elasticsearch.
+   */
+  areCrossClusterAPIKeysEnabled(): Promise<boolean>;
+
+  /**
+   * Tries to create an API key for the current user.
+   *
+   * Returns newly created API key or `null` if API keys are disabled.
+   *
+   * User needs `manage_api_key` privilege to create REST API keys and `manage_security` for Cross-Cluster API keys.
+   *
+   * @param request Request instance.
+   * @param createParams The params to create an API key
+   */
+  create(
+    request: KibanaRequest,
+    createParams: CreateAPIKeyParams
+  ): Promise<CreateAPIKeyResult | null>;
+
+  /**
+   * Tries to grant an API key for the current user.
+   * @param request Request instance.
+   * @param createParams Create operation parameters.
+   */
+  grantAsInternalUser(
+    request: KibanaRequest,
+    createParams: CreateRestAPIKeyParams | CreateRestAPIKeyWithKibanaPrivilegesParams
+  ): Promise<GrantAPIKeyResult | null>;
+
+  /**
+   * Tries to validate an API key.
+   * @param apiKeyPrams ValidateAPIKeyParams.
+   */
+  validate(apiKeyPrams: ValidateAPIKeyParams): Promise<boolean>;
+
+  /**
+   * Tries to invalidate an API keys.
+   * @param request Request instance.
+   * @param params The params to invalidate an API keys.
+   */
+  invalidate(
+    request: KibanaRequest,
+    params: InvalidateAPIKeysParams
+  ): Promise<InvalidateAPIKeyResult | null>;
+
+  /**
+   * Tries to invalidate the API keys by using the internal user.
+   * @param params The params to invalidate the API keys.
+   */
+  invalidateAsInternalUser(params: InvalidateAPIKeysParams): Promise<InvalidateAPIKeyResult | null>;
+}
+
+export type CreateAPIKeyParams =
+  | CreateRestAPIKeyParams
+  | CreateRestAPIKeyWithKibanaPrivilegesParams
+  | CreateCrossClusterAPIKeyParams;
+
+/**
+ * Response of Kibana Create API key endpoint.
+ */
+export type CreateAPIKeyResult = estypes.SecurityCreateApiKeyResponse;
+
+export type CreateRestAPIKeyParams = TypeOf<typeof restApiKeySchema>;
+export type CreateRestAPIKeyWithKibanaPrivilegesParams = TypeOf<
+  ReturnType<typeof getRestApiKeyWithKibanaPrivilegesSchema>
+>;
+export type CreateCrossClusterAPIKeyParams = TypeOf<typeof crossClusterApiKeySchema>;
+
+export interface GrantAPIKeyResult {
+  /**
+   * Unique id for this API key
+   */
+  id: string;
+  /**
+   * Name for this API key
+   */
+  name: string;
+  /**
+   * Generated API key
+   */
+  api_key: string;
+}
+
+/**
+ * Represents the parameters for validating API Key credentials.
+ */
+export interface ValidateAPIKeyParams {
+  /**
+   * Unique id for this API key
+   */
+  id: string;
+
+  /**
+   * Generated API Key (secret)
+   */
+  api_key: string;
+}
+
+/**
+ * Represents the params for invalidating multiple API keys
+ */
+export interface InvalidateAPIKeysParams {
+  /**
+   * List of unique API key IDs
+   */
+  ids: string[];
+}
+
+/**
+ * The return value when invalidating an API key in Elasticsearch.
+ */
+export interface InvalidateAPIKeyResult {
+  /**
+   * The IDs of the API keys that were invalidated as part of the request.
+   */
+  invalidated_api_keys: string[];
+  /**
+   * The IDs of the API keys that were already invalidated.
+   */
+  previously_invalidated_api_keys: string[];
+  /**
+   * The number of errors that were encountered when invalidating the API keys.
+   */
+  error_count: number;
+  /**
+   * Details about these errors. This field is not present in the response when error_count is 0.
+   */
+  error_details?: Array<{
+    type?: string;
+    reason?: string;
+    caused_by?: {
+      type?: string;
+      reason?: string;
+    };
+  }>;
+}
+
+export const restApiKeySchema = schema.object({
+  type: schema.maybe(schema.literal('rest')),
+  name: schema.string(),
+  expiration: schema.maybe(schema.string()),
+  role_descriptors: schema.recordOf(schema.string(), schema.object({}, { unknowns: 'allow' }), {
+    defaultValue: {},
+  }),
+  metadata: schema.maybe(schema.object({}, { unknowns: 'allow' })),
+});
+
+/** */
+export const getRestApiKeyWithKibanaPrivilegesSchema = (
+  getBasePrivilegeNames: Parameters<typeof getKibanaRoleSchema>[0]
+) =>
+  restApiKeySchema.extends({
+    role_descriptors: null,
+    kibana_role_descriptors: schema.recordOf(
+      schema.string(),
+      schema.object({
+        elasticsearch: elasticsearchRoleSchema.extends({}, { unknowns: 'allow' }),
+        kibana: getKibanaRoleSchema(getBasePrivilegeNames),
+      })
+    ),
+  });
+
+export const crossClusterApiKeySchema = restApiKeySchema.extends({
+  type: schema.literal('cross_cluster'),
+  role_descriptors: null,
+  access: schema.object(
+    {
+      search: schema.maybe(
+        schema.arrayOf(
+          schema.object({
+            names: schema.arrayOf(schema.string()),
+            query: schema.maybe(schema.any()),
+            field_security: schema.maybe(schema.any()),
+            allow_restricted_indices: schema.maybe(schema.boolean()),
+          })
+        )
+      ),
+      replication: schema.maybe(
+        schema.arrayOf(
+          schema.object({
+            names: schema.arrayOf(schema.string()),
+          })
+        )
+      ),
+    },
+    { unknowns: 'allow' }
+  ),
+});

packages/core/security/core-security-common/src/api_keys/index.ts

@@ -0,0 +1,25 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export type {
+  APIKeys as APIKeysService,
+  CreateAPIKeyParams,
+  CreateAPIKeyResult,
+  InvalidateAPIKeyResult,
+  InvalidateAPIKeysParams,
+  ValidateAPIKeyParams,
+  CreateRestAPIKeyParams,
+  CreateRestAPIKeyWithKibanaPrivilegesParams,
+  CreateCrossClusterAPIKeyParams,
+  GrantAPIKeyResult,
+} from './api_keys';
+export {
+  restApiKeySchema,
+  crossClusterApiKeySchema,
+  getRestApiKeyWithKibanaPrivilegesSchema,
+} from './api_keys';

packages/core/security/core-security-common/src/roles/index.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export { getKibanaRoleSchema, elasticsearchRoleSchema, GLOBAL_RESOURCE } from './schema';
+export type { ElasticsearchPrivilegesType, KibanaPrivilegesType } from './schema';

x-pack/packages/security/plugin_types_server/src/authorization/role_schema.ts → packages/core/security/core-security-common/src/roles/schema.ts

@@ -1,16 +1,16 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 import _ from 'lodash';
 
 import type { TypeOf } from '@kbn/config-schema';
 import { schema } from '@kbn/config-schema';
 
-import { GLOBAL_RESOURCE } from './constants';
-
+export const GLOBAL_RESOURCE = '*';
 /**
  * Elasticsearch specific portion of the role definition.
  * See more details at https://www.elastic.co/guide/en/elasticsearch/reference/master/security-api.html#security-role-apis.

packages/core/security/core-security-common/tsconfig.json

@@ -2,18 +2,9 @@
   "extends": "../../../../tsconfig.base.json",
   "compilerOptions": {
     "outDir": "target/types",
-    "types": [
-      "jest",
-      "node",
-      "react"
-    ]
+    "types": ["jest", "node", "react"]
   },
-  "include": [
-    "**/*.ts",
-    "**/*.tsx",
-  ],
-  "exclude": [
-    "target/**/*"
-  ],
-  "kbn_references": []
+  "include": ["**/*.ts", "**/*.tsx"],
+  "exclude": ["target/**/*"],
+  "kbn_references": ["@kbn/config-schema"]
 }

packages/core/security/core-security-server-internal/src/security_route_handler_context.ts

@@ -26,6 +26,7 @@ export class CoreSecurityRouteHandlerContext implements SecurityRequestHandlerCo
     if (this.#authc == null) {
       this.#authc = {
         getCurrentUser: () => this.securityStart.authc.getCurrentUser(this.request),
+        apiKeys: this.securityStart.authc.apiKeys,
       };
     }
     return this.#authc;

packages/core/security/core-security-server-internal/src/utils/convert_security_api.test.ts

@@ -15,6 +15,15 @@ describe('convertSecurityApi', () => {
     const source: CoreSecurityDelegateContract = {
       authc: {
         getCurrentUser: jest.fn(),
+        apiKeys: {
+          areAPIKeysEnabled: jest.fn(),
+          areCrossClusterAPIKeysEnabled: jest.fn(),
+          validate: jest.fn(),
+          invalidate: jest.fn(),
+          invalidateAsInternalUser: jest.fn(),
+          grantAsInternalUser: jest.fn(),
+          create: jest.fn(),
+        },
       },
       audit: {
         asScoped: jest.fn().mockReturnValue(createAuditLoggerMock.create()),
@@ -23,6 +32,7 @@ describe('convertSecurityApi', () => {
     };
     const output = convertSecurityApi(source);
     expect(output.authc.getCurrentUser).toBe(source.authc.getCurrentUser);
+    expect(output.authc.apiKeys).toBe(source.authc.apiKeys);
     expect(output.audit.asScoped).toBe(source.audit.asScoped);
     expect(output.audit.withoutRequest).toBe(source.audit.withoutRequest);
   });

packages/core/security/core-security-server-internal/src/utils/default_implementation.test.ts

@@ -23,6 +23,13 @@ describe('getDefaultSecurityImplementation', () => {
     });
   });
 
+  describe('authc.apiKeys', () => {
+    it('returns null', async () => {
+      const { apiKeys } = implementation.authc;
+      expect(apiKeys).toBeNull();
+    });
+  });
+
   describe('audit.asScoped', () => {
     it('returns null', async () => {
       const logger = implementation.audit.asScoped({} as any);

packages/core/security/core-security-server-internal/src/utils/default_implementation.ts

@@ -12,6 +12,7 @@ export const getDefaultSecurityImplementation = (): CoreSecurityDelegateContract
   return {
     authc: {
       getCurrentUser: () => null,
+      apiKeys: null,
     },
     audit: {
       asScoped: () => {

packages/core/security/core-security-server-mocks/src/api_keys.mock.ts

@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+export const apiKeysServiceMock = {
+  areAPIKeysEnabled: jest.fn(),
+  areCrossClusterAPIKeysEnabled: jest.fn(),
+  validate: jest.fn(),
+  invalidate: jest.fn(),
+  invalidateAsInternalUser: jest.fn(),
+  grantAsInternalUser: jest.fn(),
+  create: jest.fn(),
+};