Feature Controls - Infrastructure and Logging

x-pack/package.json

@@ -70,6 +70,7 @@
     "abab": "^1.0.4",
     "ansi-colors": "^3.0.5",
     "ansicolors": "0.3.2",
+    "apollo-link-context": "^1.0.14",
     "axios": "^0.18.0",
     "babel-jest": "^23.6.0",
     "babel-plugin-inline-react-svg": "^0.5.4",

x-pack/plugins/infra/server/kibana.index.ts

@@ -34,13 +34,15 @@ export const initServerWithKibana = (kbnServer: KbnServer) => {
     catalogue: ['infraops'],
     privileges: {
       all: {
+        api: ['infra/graphql'],
         savedObject: {
           all: ['infrastructure-ui-source'],
           read: ['config'],
         },
         ui: ['show', 'configureSource'],
       },
       read: {
+        api: ['infra/graphql'],
         savedObject: {
           all: [],
           read: ['config', 'infrastructure-ui-source'],
@@ -61,13 +63,15 @@ export const initServerWithKibana = (kbnServer: KbnServer) => {
     catalogue: ['infralogging'],
     privileges: {
       all: {
+        api: ['infra/graphql'],
         savedObject: {
           all: ['infrastructure-ui-source'],
           read: ['config'],
         },
         ui: ['show', 'configureSource'],
       },
       read: {
+        api: ['infra/graphql'],
         savedObject: {
           all: [],
           read: ['config', 'infrastructure-ui-source'],

x-pack/plugins/infra/server/lib/adapters/framework/kibana_framework_adapter.ts

@@ -56,6 +56,9 @@ export class InfraKibanaBackendFrameworkAdapter implements InfraBackendFramework
           schema,
         }),
         path: routePath,
+        route: {
+          tags: ['access:graphql'],
+        },
       },
       plugin: graphqlHapi,
     });
@@ -67,6 +70,9 @@ export class InfraKibanaBackendFrameworkAdapter implements InfraBackendFramework
           passHeader: `'kbn-version': '${this.version}'`,
         }),
         path: `${routePath}/graphiql`,
+        route: {
+          tags: ['access:graphql'],
+        },
       },
       plugin: graphiqlHapi,
     });

x-pack/test/api_integration/apis/infra/feature_controls.ts

@@ -0,0 +1,294 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import expect from 'expect.js';
+import { SecurityService, SpacesService } from 'x-pack/test/common/services';
+import { metadataQuery } from '../../../../plugins/infra/public/containers/metadata/metadata.gql_query';
+import { MetadataQuery } from '../../../../plugins/infra/public/graphql/types';
+import { KbnTestProvider } from './types';
+
+// tslint:disable:no-default-export
+const featureControlsTests: KbnTestProvider = ({ getService }) => {
+  const supertest = getService('supertestWithoutAuth');
+  const security: SecurityService = getService('security');
+  const spaces: SpacesService = getService('spaces');
+  const clientFactory = getService('infraOpsGraphQLClientFactory');
+
+  const expectGraphQL404 = (result: any) => {
+    expect(result.response).to.be(undefined);
+    expect(result.error).not.to.be(undefined);
+    expect(result.error).to.have.property('networkError');
+    expect(result.error.networkError).to.have.property('statusCode', 404);
+  };
+
+  const expectGraphQLResponse = (result: any) => {
+    expect(result.error).to.be(undefined);
+    expect(result.response).to.have.property('data');
+    expect(result.response.data).to.be.an('object');
+  };
+
+  const expectGraphIQL404 = (result: any) => {
+    expect(result.error).to.be(undefined);
+    expect(result.response).not.to.be(undefined);
+    expect(result.response).to.have.property('statusCode', 404);
+  };
+
+  const expectGraphIQLResponse = (result: any) => {
+    expect(result.error).to.be(undefined);
+    expect(result.response).not.to.be(undefined);
+    expect(result.response).to.have.property('statusCode', 200);
+  };
+
+  const executeGraphQLQuery = async (username: string, password: string, spaceId?: string) => {
+    const queryOptions = {
+      query: metadataQuery,
+      variables: {
+        sourceId: 'default',
+        nodeId: 'demo-stack-mysql-01',
+        nodeType: 'host',
+      },
+    };
+
+    const basePath = spaceId ? `/s/${spaceId}` : '';
+
+    const client = clientFactory({ username, password, basePath });
+    let error;
+    let response;
+    try {
+      response = await client.query<MetadataQuery.Query>(queryOptions);
+    } catch (err) {
+      error = err;
+    }
+    return {
+      error,
+      response,
+    };
+  };
+
+  const executeGraphIQLRequest = async (username: string, password: string, spaceId?: string) => {
+    const basePath = spaceId ? `/s/${spaceId}` : '';
+
+    return supertest
+      .get(`${basePath}/api/infra/graphql/graphiql`)
+      .auth(username, password)
+      .then((response: any) => ({ error: undefined, response }))
+      .catch((error: any) => ({ error, response: undefined }));
+  };
+
+  describe('feature controls', () => {
+    it(`APIs can't be accessed by logstash-* read privileges role`, async () => {
+      const username = 'logstash_read';
+      const roleName = 'logstash_read';
+      const password = `${username}-password`;
+      try {
+        await security.role.create(roleName, {
+          elasticsearch: {
+            indices: [
+              {
+                names: ['logstash-*'],
+                privileges: ['read', 'view_index_metadata'],
+              },
+            ],
+          },
+        });
+
+        await security.user.create(username, {
+          password,
+          roles: [roleName],
+          full_name: 'a kibana user',
+        });
+
+        const graphQLResult = await executeGraphQLQuery(username, password);
+        expectGraphQL404(graphQLResult);
+
+        const graphQLIResult = await executeGraphIQLRequest(username, password);
+        expectGraphIQL404(graphQLIResult);
+      } finally {
+        await security.role.delete(roleName);
+        await security.user.delete(username);
+      }
+    });
+
+    it('APIs can be accessed global all with logstash-* read privileges role', async () => {
+      const username = 'global_all';
+      const roleName = 'global_all';
+      const password = `${username}-password`;
+      try {
+        await security.role.create(roleName, {
+          elasticsearch: {
+            indices: [
+              {
+                names: ['logstash-*'],
+                privileges: ['read', 'view_index_metadata'],
+              },
+            ],
+          },
+          kibana: [
+            {
+              base: ['all'],
+              spaces: ['*'],
+            },
+          ],
+        });
+
+        await security.user.create(username, {
+          password,
+          roles: [roleName],
+          full_name: 'a kibana user',
+        });
+
+        const graphQLResult = await executeGraphQLQuery(username, password);
+        expectGraphQLResponse(graphQLResult);
+
+        const graphQLIResult = await executeGraphIQLRequest(username, password);
+        expectGraphIQLResponse(graphQLIResult);
+      } finally {
+        await security.role.delete(roleName);
+        await security.user.delete(username);
+      }
+    });
+
+    // this could be any role which doesn't have access to the infra feature
+    it(`APIs can't be accessed by dashboard all with logstash-* read privileges role`, async () => {
+      const username = 'dashboard_all';
+      const roleName = 'dashboard_all';
+      const password = `${username}-password`;
+      try {
+        await security.role.create(roleName, {
+          elasticsearch: {
+            indices: [
+              {
+                names: ['logstash-*'],
+                privileges: ['read', 'view_index_metadata'],
+              },
+            ],
+          },
+          kibana: [
+            {
+              feature: {
+                dashboard: ['all'],
+              },
+              spaces: ['*'],
+            },
+          ],
+        });
+
+        await security.user.create(username, {
+          password,
+          roles: [roleName],
+          full_name: 'a kibana user',
+        });
+
+        const graphQLResult = await executeGraphQLQuery(username, password);
+        expectGraphQL404(graphQLResult);
+
+        const graphQLIResult = await executeGraphIQLRequest(username, password);
+        expectGraphIQL404(graphQLIResult);
+      } finally {
+        await security.role.delete(roleName);
+        await security.user.delete(username);
+      }
+    });
+
+    describe('spaces', () => {
+      // the following tests create a user_1 which has infrastructure read access to space_1, logs read access to space_2 and dashboard all access to space_3
+      const space1Id = 'space_1';
+      const space2Id = 'space_2';
+      const space3Id = 'space_3';
+
+      const roleName = 'user_1';
+      const username = 'user_1';
+      const password = 'user_1-password';
+
+      before(async () => {
+        await spaces.create({
+          id: space1Id,
+          name: space1Id,
+          disabledFeatures: [],
+        });
+        await spaces.create({
+          id: space2Id,
+          name: space2Id,
+          disabledFeatures: [],
+        });
+        await spaces.create({
+          id: space3Id,
+          name: space3Id,
+          disabledFeatures: [],
+        });
+        await security.role.create(roleName, {
+          elasticsearch: {
+            indices: [
+              {
+                names: ['logstash-*'],
+                privileges: ['read', 'view_index_metadata'],
+              },
+            ],
+          },
+          kibana: [
+            {
+              feature: {
+                infrastructure: ['read'],
+              },
+              spaces: [space1Id],
+            },
+            {
+              feature: {
+                logs: ['read'],
+              },
+              spaces: [space2Id],
+            },
+            {
+              feature: {
+                dashboard: ['all'],
+              },
+              spaces: [space3Id],
+            },
+          ],
+        });
+        await security.user.create(username, {
+          password,
+          roles: [roleName],
+        });
+      });
+
+      after(async () => {
+        await spaces.delete(space1Id);
+        await spaces.delete(space2Id);
+        await spaces.delete(space3Id);
+        await security.role.delete(roleName);
+        await security.user.delete(username);
+      });
+
+      it('user_1 can access APIs in space_1', async () => {
+        const graphQLResult = await executeGraphQLQuery(username, password, space1Id);
+        expectGraphQLResponse(graphQLResult);
+
+        const graphQLIResult = await executeGraphIQLRequest(username, password, space1Id);
+        expectGraphIQLResponse(graphQLIResult);
+      });
+
+      it(`user_1 can access APIs in space_2`, async () => {
+        const graphQLResult = await executeGraphQLQuery(username, password, space2Id);
+        expectGraphQLResponse(graphQLResult);
+
+        const graphQLIResult = await executeGraphIQLRequest(username, password, space2Id);
+        expectGraphIQLResponse(graphQLIResult);
+      });
+
+      it(`user_1 can't access APIs in space_3`, async () => {
+        const graphQLResult = await executeGraphQLQuery(username, password, space3Id);
+        expectGraphQL404(graphQLResult);
+
+        const graphQLIResult = await executeGraphIQLRequest(username, password, space3Id);
+        expectGraphIQL404(graphQLIResult);
+      });
+    });
+  });
+};
+
+// tslint:disable-next-line no-default-export
+export default featureControlsTests;

x-pack/test/api_integration/apis/infra/index.js

@@ -14,5 +14,6 @@ export default function ({ loadTestFile }) {
     loadTestFile(require.resolve('./sources'));
     loadTestFile(require.resolve('./waffle'));
     loadTestFile(require.resolve('./log_item'));
+    loadTestFile(require.resolve('./feature_controls'));
   });
 }

x-pack/test/api_integration/apis/infra/types.ts

@@ -12,10 +12,19 @@ export interface EsArchiver {
   unload(name: string): void;
 }
 
+interface InfraOpsGraphQLClientFactoryOptions {
+  username: string;
+  password: string;
+  basePath: string;
+}
+
 export interface KbnTestProviderOptions {
   getService(name: string): any;
   getService(name: 'esArchiver'): EsArchiver;
   getService(name: 'infraOpsGraphQLClient'): ApolloClient<InMemoryCache>;
+  getService(
+    name: 'infraOpsGraphQLClientFactory'
+  ): (options: InfraOpsGraphQLClientFactoryOptions) => ApolloClient<InMemoryCache>;
 }
 
 export type KbnTestProvider = (options: KbnTestProviderOptions) => void;