Security - Reorder Saved Objects Client wrappers

docs/development/core/server/kibana-plugin-server.md

@@ -83,4 +83,5 @@ The plugin integrates with the core system via lifecycle events: `setup`<!-- -->
 |  [RouteMethod](./kibana-plugin-server.routemethod.md) | The set of common HTTP methods supported by Kibana routing. |
 |  [SavedObjectsClientContract](./kibana-plugin-server.savedobjectsclientcontract.md) | \#\# SavedObjectsClient errors<!-- -->Since the SavedObjectsClient has its hands in everything we are a little paranoid about the way we present errors back to to application code. Ideally, all errors will be either:<!-- -->1. Caused by bad implementation (ie. undefined is not a function) and as such unpredictable 2. An error that has been classified and decorated appropriately by the decorators in [SavedObjectsErrorHelpers](./kibana-plugin-server.savedobjectserrorhelpers.md)<!-- -->Type 1 errors are inevitable, but since all expected/handle-able errors should be Type 2 the <code>isXYZError()</code> helpers exposed at <code>SavedObjectsErrorHelpers</code> should be used to understand and manage error responses from the <code>SavedObjectsClient</code>.<!-- -->Type 2 errors are decorated versions of the source error, so if the elasticsearch client threw an error it will be decorated based on its type. That means that rather than looking for <code>error.body.error.type</code> or doing substring checks on <code>error.body.error.reason</code>, just use the helpers to understand the meaning of the error:<!-- -->\`\`\`<!-- -->js if (SavedObjectsErrorHelpers.isNotFoundError(error)) { // handle 404 }<!-- -->if (SavedObjectsErrorHelpers.isNotAuthorizedError(error)) { // 401 handling should be automatic, but in case you wanted to know }<!-- -->// always rethrow the error unless you handle it throw error; \`\`\`<!-- -->\#\#\# 404s from missing index<!-- -->From the perspective of application code and APIs the SavedObjectsClient is a black box that persists objects. One of the internal details that users have no control over is that we use an elasticsearch index for persistance and that index might be missing.<!-- -->At the time of writing we are in the process of transitioning away from the operating assumption that the SavedObjects index is always available. Part of this transition is handling errors resulting from an index missing. These used to trigger a 500 error in most cases, and in others cause 404s with different error messages.<!-- -->From my (Spencer) perspective, a 404 from the SavedObjectsApi is a 404; The object the request/call was targeting could not be found. This is why \#14141 takes special care to ensure that 404 errors are generic and don't distinguish between index missing or document missing.<!-- -->\#\#\# 503s from missing index<!-- -->Unlike all other methods, create requests are supposed to succeed even when the Kibana index does not exist because it will be automatically created by elasticsearch. When that is not the case it is because Elasticsearch's <code>action.auto_create_index</code> setting prevents it from being created automatically so we throw a special 503 with the intention of informing the user that their Elasticsearch settings need to be updated.<!-- -->See [SavedObjectsErrorHelpers](./kibana-plugin-server.savedobjectserrorhelpers.md) |
 |  [SavedObjectsClientWrapperFactory](./kibana-plugin-server.savedobjectsclientwrapperfactory.md) |  |
+|  [SavedObjectsNamespace](./kibana-plugin-server.savedobjectsnamespace.md) | Saved Objects Namespace. |
 

docs/development/core/server/kibana-plugin-server.savedobjectsbaseoptions.md

@@ -15,5 +15,5 @@ export interface SavedObjectsBaseOptions
 
 |  Property | Type | Description |
 |  --- | --- | --- |
-|  [namespace](./kibana-plugin-server.savedobjectsbaseoptions.namespace.md) | <code>string</code> | Specify the namespace for this operation |
+|  [namespace](./kibana-plugin-server.savedobjectsbaseoptions.namespace.md) | <code>SavedObjectsNamespace</code> | Specify the namespace for this operation |
 

docs/development/core/server/kibana-plugin-server.savedobjectsbaseoptions.namespace.md

@@ -9,5 +9,5 @@ Specify the namespace for this operation
 <b>Signature:</b>
 
 ```typescript
-namespace?: string;
+namespace?: SavedObjectsNamespace;
 ```

docs/development/core/server/kibana-plugin-server.savedobjectsnamespace.md

@@ -0,0 +1,13 @@
+<!-- Do not edit this file. It is automatically generated by API Documenter. -->
+
+[Home](./index.md) &gt; [kibana-plugin-server](./kibana-plugin-server.md) &gt; [SavedObjectsNamespace](./kibana-plugin-server.savedobjectsnamespace.md)
+
+## SavedObjectsNamespace type
+
+Saved Objects Namespace.
+
+<b>Signature:</b>
+
+```typescript
+export declare type SavedObjectsNamespace = string | undefined;
+```

src/core/server/index.ts

@@ -97,6 +97,7 @@ export {
   SavedObjectsFindOptions,
   SavedObjectsFindResponse,
   SavedObjectsMigrationVersion,
+  SavedObjectsNamespace,
   SavedObjectsService,
   SavedObjectsUpdateOptions,
   SavedObjectsUpdateResponse,

src/core/server/saved_objects/serialization/index.ts

@@ -25,6 +25,7 @@
 /* eslint-disable @typescript-eslint/camelcase */
 
 import uuid from 'uuid';
+import { SavedObjectsNamespace } from 'src/core/server/saved_objects';
 import { SavedObjectsSchema } from '../schema';
 import { decodeVersion, encodeVersion } from '../version';
 import {
@@ -53,7 +54,7 @@ interface SavedObjectDoc {
   attributes: object;
   id?: string; // NOTE: SavedObjectDoc is used for uncreated objects where `id` is optional
   type: string;
-  namespace?: string;
+  namespace?: SavedObjectsNamespace;
   migrationVersion?: SavedObjectsMigrationVersion;
   version?: string;
   updated_at?: string;
@@ -167,18 +168,18 @@ export class SavedObjectsSerializer {
    * @param {string} type - The saved object type
    * @param {string} id - The id of the saved object
    */
-  public generateRawId(namespace: string | undefined, type: string, id?: string) {
+  public generateRawId(namespace: SavedObjectsNamespace, type: string, id?: string) {
     const namespacePrefix =
-      namespace && !this.schema.isNamespaceAgnostic(type) ? `${namespace}:` : '';
+      namespace && !this.schema.isNamespaceAgnostic(type) ? `${String(namespace)}:` : '';
     return `${namespacePrefix}${type}:${id || uuid.v1()}`;
   }
 
-  private trimIdPrefix(namespace: string | undefined, type: string, id: string) {
+  private trimIdPrefix(namespace: SavedObjectsNamespace, type: string, id: string) {
     assertNonEmptyString(id, 'document id');
     assertNonEmptyString(type, 'saved object type');
 
     const namespacePrefix =
-      namespace && !this.schema.isNamespaceAgnostic(type) ? `${namespace}:` : '';
+      namespace && !this.schema.isNamespaceAgnostic(type) ? `${String(namespace)}:` : '';
     const prefix = `${namespacePrefix}${type}:`;
 
     if (!id.startsWith(prefix)) {

src/core/server/saved_objects/service/index.ts

@@ -39,6 +39,7 @@ export {
   ScopedSavedObjectsClientProvider,
   SavedObjectsClientWrapperFactory,
   SavedObjectsClientWrapperOptions,
+  SavedObjectsNamespace,
   SavedObjectsErrorHelpers,
 } from './lib';
 

src/core/server/saved_objects/service/lib/index.ts

@@ -24,4 +24,8 @@ export {
   ScopedSavedObjectsClientProvider,
 } from './scoped_client_provider';
 
+export { SavedObjectsNamespace } from './namespace';
+
+import * as errors from './errors';
+export { errors };
 export { SavedObjectsErrorHelpers } from './errors';

src/core/server/saved_objects/service/lib/namespace.ts

@@ -0,0 +1,24 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+/**
+ * Saved Objects Namespace.
+ * @public
+ */
+export type SavedObjectsNamespace = string | undefined;

src/core/server/saved_objects/service/lib/repository.test.js

@@ -548,6 +548,19 @@ describe('SavedObjectsRepository', () => {
       );
       expect(onBeforeWrite).toHaveBeenCalledTimes(1);
     });
+
+    it(`doesn't support namespaces which aren't undefined or strings`, async () => {
+      expect(savedObjectsRepository.create(
+        'index-pattern',
+        {
+          title: 'Logstash',
+        },
+        {
+          id: 'foo-id',
+          namespace: Symbol('foo-namespace'),
+        }
+      )).rejects.toThrowErrorMatchingSnapshot();
+    });
   });
 
   describe('#bulkCreate', () => {
@@ -993,6 +1006,15 @@ describe('SavedObjectsRepository', () => {
       expect(onBeforeWrite).toHaveBeenCalledTimes(1);
     });
 
+    it(`doesn't support namespaces which aren't undefined or strings`, async () => {
+      expect(savedObjectsRepository.bulkCreate(
+        [{ type: 'globaltype', id: 'one', attributes: { title: 'Test One' } }],
+        {
+          namespace: Symbol('foo-namespace'),
+        }
+      )).rejects.toThrowErrorMatchingSnapshot();
+    });
+
     it('should return objects in the same order regardless of type', () => {});
   });
 
@@ -1071,6 +1093,12 @@ describe('SavedObjectsRepository', () => {
 
       expect(onBeforeWrite).toHaveBeenCalledTimes(1);
     });
+
+    it(`doesn't support namespaces which aren't undefined or strings`, async () => {
+      expect(savedObjectsRepository.delete('globaltype', 'logstash-*', {
+        namespace: Symbol('foo-namespace'),
+      })).rejects.toThrowErrorMatchingSnapshot();
+    });
   });
 
   describe('#deleteByNamespace', () => {
@@ -1090,6 +1118,15 @@ describe('SavedObjectsRepository', () => {
       expect(onBeforeWrite).not.toHaveBeenCalled();
     });
 
+    it(`doesn't support Symbol namespaces`, async () => {
+      callAdminCluster.mockReturnValue(deleteByQueryResults);
+      expect(
+        savedObjectsRepository.deleteByNamespace(Symbol('namespace-1'))
+      ).rejects.toThrowErrorMatchingSnapshot();
+      expect(callAdminCluster).not.toHaveBeenCalled();
+      expect(onBeforeWrite).not.toHaveBeenCalled();
+    });
+
     it('constructs a deleteByQuery call using all types that are namespace aware', async () => {
       callAdminCluster.mockReturnValue(deleteByQueryResults);
       const result = await savedObjectsRepository.deleteByNamespace('my-namespace');
@@ -1283,6 +1320,11 @@ describe('SavedObjectsRepository', () => {
       expect(callAdminCluster).toHaveBeenCalledTimes(1);
       expect(callAdminCluster.mock.calls[0][1]).toHaveProperty('rest_total_hits_as_int', true);
     });
+
+    it(`doesn't support namespaces which aren't undefined or strings`, async () => {
+      expect(savedObjectsRepository.find({ type: 'foo', namespace: Symbol('foo') }))
+        .rejects.toThrowErrorMatchingSnapshot();
+    });
   });
 
   describe('#get', () => {
@@ -1404,6 +1446,12 @@ describe('SavedObjectsRepository', () => {
         })
       );
     });
+
+    it(`doesn't support Symbol namespaces`, async () => {
+      expect(savedObjectsRepository.get('globaltype', 'logstash-*', {
+        namespace: Symbol('foo-namespace'),
+      })).rejects.toThrowErrorMatchingSnapshot();
+    });
   });
 
   describe('#bulkGet', () => {
@@ -1645,6 +1693,17 @@ describe('SavedObjectsRepository', () => {
         },
       ]);
     });
+
+    it(`doesn't support namespaces which aren't undefined or strings`, async () => {
+      expect(savedObjectsRepository.bulkGet([
+        { id: 'one', type: 'config' },
+        { id: 'two', type: 'invalidtype' },
+        { id: 'three', type: 'config' },
+        { id: 'four', type: 'invalidtype' },
+        { id: 'five', type: 'config' },
+      ], { namespace: Symbol('foo') }))
+        .rejects.toThrowErrorMatchingSnapshot();
+    });
   });
 
   describe('#update', () => {
@@ -1857,6 +1916,26 @@ describe('SavedObjectsRepository', () => {
 
       expect(onBeforeWrite).toHaveBeenCalledTimes(1);
     });
+
+    it(`doesn't support namespaces which aren't undefined or strings`, async () => {
+      expect(savedObjectsRepository.update(
+        'index-pattern',
+        'foo',
+        {
+          name: 'bar',
+        },
+        {
+          namespace: Symbol('foo-namespace'),
+          references: [
+            {
+              name: 'ref_0',
+              type: 'test',
+              id: '1',
+            },
+          ],
+        }
+      )).rejects.toThrowErrorMatchingSnapshot();
+    });
   });
 
   describe('#incrementCounter', () => {
@@ -2053,6 +2132,14 @@ describe('SavedObjectsRepository', () => {
         )
       ).rejects.toEqual(new Error('"counterFieldName" argument must be a string'));
     });
+
+    it(`doesn't supports namespaces which aren't undefined or strings`, async () => {
+      expect(
+        savedObjectsRepository.incrementCounter('globaltype', 'foo', 'counter', {
+          namespace: Symbol('foo-namespace'),
+        })
+      ).rejects.toThrowErrorMatchingSnapshot();
+    });
   });
 
   describe('onBeforeWrite', () => {