[Security in Core] Exposes apiKeys from core.security.authc

packages/core/security/core-security-server-internal/src/security_route_handler_context.ts

@@ -26,6 +26,16 @@ export class CoreSecurityRouteHandlerContext implements SecurityRequestHandlerCo
     if (this.#authc == null) {
       this.#authc = {
         getCurrentUser: () => this.securityStart.authc.getCurrentUser(this.request),
+        apiKeys: {
+          areAPIKeysEnabled: () => this.securityStart.authc.apiKeys.areAPIKeysEnabled(),
+          create: (createParams) =>
+            this.securityStart.authc.apiKeys.create(this.request, createParams),
+          update: (updateParams) =>
+            this.securityStart.authc.apiKeys.update(this.request, updateParams),
+          validate: (apiKeyParams) => this.securityStart.authc.apiKeys.validate(apiKeyParams),
+          invalidate: (apiKeyParams) =>
+            this.securityStart.authc.apiKeys.invalidate(this.request, apiKeyParams),
+        },
       };
     }
     return this.#authc;

packages/core/security/core-security-server-internal/src/utils/convert_security_api.test.ts

@@ -15,6 +15,16 @@ describe('convertSecurityApi', () => {
     const source: CoreSecurityDelegateContract = {
       authc: {
         getCurrentUser: jest.fn(),
+        apiKeys: {
+          areAPIKeysEnabled: jest.fn(),
+          areCrossClusterAPIKeysEnabled: jest.fn(),
+          validate: jest.fn(),
+          invalidate: jest.fn(),
+          invalidateAsInternalUser: jest.fn(),
+          grantAsInternalUser: jest.fn(),
+          create: jest.fn(),
+          update: jest.fn(),
+        },
       },
       audit: {
         asScoped: jest.fn().mockReturnValue(createAuditLoggerMock.create()),
@@ -23,6 +33,7 @@ describe('convertSecurityApi', () => {
     };
     const output = convertSecurityApi(source);
     expect(output.authc.getCurrentUser).toBe(source.authc.getCurrentUser);
+    expect(output.authc.apiKeys).toBe(source.authc.apiKeys);
     expect(output.audit.asScoped).toBe(source.audit.asScoped);
     expect(output.audit.withoutRequest).toBe(source.audit.withoutRequest);
   });

packages/core/security/core-security-server-internal/src/utils/default_implementation.test.ts

@@ -23,6 +23,15 @@ describe('getDefaultSecurityImplementation', () => {
     });
   });
 
+  describe('authc.apiKeys', () => {
+    it('returns stub object', async () => {
+      const { apiKeys } = implementation.authc;
+      const areAPIKeysEnabled = await apiKeys.areAPIKeysEnabled();
+
+      expect(areAPIKeysEnabled).toBe(false);
+    });
+  });
+
   describe('audit.asScoped', () => {
     it('returns null', async () => {
       const logger = implementation.audit.asScoped({} as any);

packages/core/security/core-security-server-internal/src/utils/default_implementation.ts

@@ -8,10 +8,23 @@
 
 import type { CoreSecurityDelegateContract } from '@kbn/core-security-server';
 
+const API_KEYS_DISABLED_ERROR = new Error('API keys are disabled');
+const REJECT_WHEN_API_KEYS_DISABLED = () => Promise.reject(API_KEYS_DISABLED_ERROR);
+
 export const getDefaultSecurityImplementation = (): CoreSecurityDelegateContract => {
   return {
     authc: {
       getCurrentUser: () => null,
+      apiKeys: {
+        areAPIKeysEnabled: () => Promise.resolve(false),
+        areCrossClusterAPIKeysEnabled: () => Promise.resolve(false),
+        create: REJECT_WHEN_API_KEYS_DISABLED,
+        update: REJECT_WHEN_API_KEYS_DISABLED,
+        grantAsInternalUser: REJECT_WHEN_API_KEYS_DISABLED,
+        validate: REJECT_WHEN_API_KEYS_DISABLED,
+        invalidate: REJECT_WHEN_API_KEYS_DISABLED,
+        invalidateAsInternalUser: REJECT_WHEN_API_KEYS_DISABLED,
+      },
     },
     audit: {
       asScoped: () => {

packages/core/security/core-security-server-mocks/index.ts

@@ -9,3 +9,4 @@
 export { securityServiceMock } from './src/security_service.mock';
 export type { InternalSecurityStartMock, SecurityStartMock } from './src/security_service.mock';
 export { auditLoggerMock } from './src/audit.mock';
+export { apiKeysMock } from './src/api_keys.mock';

x-pack/plugins/security/server/authentication/api_keys/api_keys.mock.ts → packages/core/security/core-security-server-mocks/src/api_keys.mock.ts

@@ -1,16 +1,15 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
-import type { PublicMethodsOf } from '@kbn/utility-types';
-
-import type { APIKeys } from './api_keys';
+import type { APIKeysService } from '@kbn/core-security-server';
 
 export const apiKeysMock = {
-  create: (): jest.Mocked<PublicMethodsOf<APIKeys>> => ({
+  create: (): jest.MockedObjectDeep<APIKeysService> => ({
     areAPIKeysEnabled: jest.fn(),
     areCrossClusterAPIKeysEnabled: jest.fn(),
     create: jest.fn(),

packages/core/security/core-security-server-mocks/src/security_service.mock.ts

@@ -15,6 +15,7 @@ import type {
   InternalSecurityServiceSetup,
   InternalSecurityServiceStart,
 } from '@kbn/core-security-server-internal';
+import { apiKeysMock } from './api_keys.mock';
 import { auditServiceMock, type MockedAuditService } from './audit.mock';
 import { mockAuthenticatedUser, MockAuthenticatedUserProps } from '@kbn/core-security-common/mocks';
 
@@ -35,6 +36,7 @@ const createStartMock = (): SecurityStartMock => {
   const mock = {
     authc: {
       getCurrentUser: jest.fn(),
+      apiKeys: apiKeysMock.create(),
     },
     audit: auditServiceMock.create(),
   };
@@ -61,6 +63,7 @@ const createInternalStartMock = (): InternalSecurityStartMock => {
   const mock = {
     authc: {
       getCurrentUser: jest.fn(),
+      apiKeys: apiKeysMock.create(),
     },
     audit: auditServiceMock.create(),
   };
@@ -82,6 +85,13 @@ const createRequestHandlerContextMock = () => {
   const mock: jest.MockedObjectDeep<SecurityRequestHandlerContext> = {
     authc: {
       getCurrentUser: jest.fn(),
+      apiKeys: {
+        areAPIKeysEnabled: jest.fn(),
+        create: jest.fn(),
+        update: jest.fn(),
+        validate: jest.fn(),
+        invalidate: jest.fn(),
+      },
     },
     audit: {
       logger: {

packages/core/security/core-security-server/index.ts

@@ -26,4 +26,26 @@ export type {
   AuditRequest,
 } from './src/audit_logging/audit_events';
 export type { AuditLogger } from './src/audit_logging/audit_logger';
+
+export type {
+  APIKeysServiceWithContext,
+  APIKeysService,
+  CreateAPIKeyParams,
+  CreateAPIKeyResult,
+  InvalidateAPIKeyResult,
+  InvalidateAPIKeysParams,
+  ValidateAPIKeyParams,
+  CreateRestAPIKeyParams,
+  CreateRestAPIKeyWithKibanaPrivilegesParams,
+  CreateCrossClusterAPIKeyParams,
+  GrantAPIKeyResult,
+  UpdateAPIKeyParams,
+  UpdateAPIKeyResult,
+  UpdateCrossClusterAPIKeyParams,
+  UpdateRestAPIKeyParams,
+  UpdateRestAPIKeyWithKibanaPrivilegesParams,
+} from './src/authentication/api_keys';
+
+export type { KibanaPrivilegesType, ElasticsearchPrivilegesType } from './src/roles';
+export { isCreateRestAPIKeyParams } from './src/authentication/api_keys';
 export type { CoreFipsService } from './src/fips';

packages/core/security/core-security-server/src/authc.ts

@@ -8,6 +8,7 @@
 
 import type { KibanaRequest } from '@kbn/core-http-server';
 import type { AuthenticatedUser } from '@kbn/core-security-common';
+import type { APIKeysService } from './authentication/api_keys';
 
 /**
  * Core's authentication service
@@ -22,4 +23,5 @@ export interface CoreAuthenticationService {
    * @param request The request to retrieve the authenticated user for.
    */
   getCurrentUser(request: KibanaRequest): AuthenticatedUser | null;
+  apiKeys: APIKeysService;
 }