Security nav control => NP

x-pack/legacy/plugins/security/index.js

@@ -54,7 +54,7 @@ export const security = kibana =>
     },
 
     uiExports: {
-      chromeNavControls: ['plugins/security/views/nav_control'],
+      chromeNavControls: [],
       managementSections: ['plugins/security/views/management'],
       styleSheetPaths: resolve(__dirname, 'public/index.scss'),
       apps: [
@@ -88,6 +88,7 @@ export const security = kibana =>
       hacks: [
         'plugins/security/hacks/on_session_timeout',
         'plugins/security/hacks/on_unauthorized_response',
+        'plugins/security/hacks/register_account_management_app',
       ],
       home: ['plugins/security/register_feature'],
       injectDefaultVars: server => {

x-pack/legacy/plugins/security/public/views/nav_control/index.js → x-pack/legacy/plugins/security/public/hacks/register_account_management_app.ts

@@ -4,4 +4,4 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import './nav_control';
+import '../views/account/account';

x-pack/plugins/security/server/licensing/index.mock.ts → x-pack/plugins/security/common/licensing/index.mock.ts

@@ -4,11 +4,13 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+import { of } from 'rxjs';
 import { SecurityLicense } from '.';
 
 export const licenseMock = {
   create: (): jest.Mocked<SecurityLicense> => ({
     isEnabled: jest.fn().mockReturnValue(true),
     getFeatures: jest.fn(),
+    features$: of(),
   }),
 };

x-pack/plugins/security/server/licensing/license_service.test.ts → x-pack/plugins/security/common/licensing/license_service.test.ts

@@ -4,7 +4,8 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
-import { ILicense } from '../../../licensing/server';
+import { of, BehaviorSubject } from 'rxjs';
+import { ILicense } from '../../../licensing/public';
 import { SecurityLicenseService } from './license_service';
 
 function getMockRawLicense({ isAvailable = false } = {}) {
@@ -17,7 +18,9 @@ function getMockRawLicense({ isAvailable = false } = {}) {
 
 describe('license features', function() {
   it('should display error when ES is unavailable', () => {
-    const serviceSetup = new SecurityLicenseService().setup();
+    const serviceSetup = new SecurityLicenseService().setup({
+      license$: of((undefined as unknown) as ILicense),
+    });
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: true,
       allowLogin: false,
@@ -30,8 +33,9 @@ describe('license features', function() {
   });
 
   it('should display error when X-Pack is unavailable', () => {
-    const serviceSetup = new SecurityLicenseService().setup();
-    serviceSetup.update(getMockRawLicense({ isAvailable: false }));
+    const serviceSetup = new SecurityLicenseService().setup({
+      license$: of(getMockRawLicense({ isAvailable: false })),
+    });
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: true,
       allowLogin: false,
@@ -43,15 +47,60 @@ describe('license features', function() {
     });
   });
 
+  it('should notify consumers of licensed feature changes', () => {
+    const rawLicense$ = new BehaviorSubject(getMockRawLicense({ isAvailable: false }));
+    const serviceSetup = new SecurityLicenseService().setup({
+      license$: rawLicense$,
+    });
+
+    const subscriptionHandler = jest.fn();
+    const subscription = serviceSetup.license.features$.subscribe(subscriptionHandler);
+    try {
+      expect(subscriptionHandler).toHaveBeenCalledTimes(1);
+      expect(subscriptionHandler.mock.calls[0]).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "allowLogin": false,
+            "allowRbac": false,
+            "allowRoleDocumentLevelSecurity": false,
+            "allowRoleFieldLevelSecurity": false,
+            "layout": "error-xpack-unavailable",
+            "showLinks": false,
+            "showLogin": true,
+          },
+        ]
+      `);
+
+      rawLicense$.next(getMockRawLicense({ isAvailable: true }));
+      expect(subscriptionHandler).toHaveBeenCalledTimes(2);
+      expect(subscriptionHandler.mock.calls[1]).toMatchInlineSnapshot(`
+        Array [
+          Object {
+            "allowLogin": false,
+            "allowRbac": false,
+            "allowRoleDocumentLevelSecurity": false,
+            "allowRoleFieldLevelSecurity": false,
+            "linksMessage": "Access is denied because Security is disabled in Elasticsearch.",
+            "showLinks": false,
+            "showLogin": false,
+          },
+        ]
+      `);
+    } finally {
+      subscription.unsubscribe();
+    }
+  });
+
   it('should show login page and other security elements, allow RBAC but forbid document level security if license is not platinum or trial.', () => {
     const mockRawLicense = getMockRawLicense({ isAvailable: true });
     mockRawLicense.isOneOf.mockImplementation(licenses =>
       Array.isArray(licenses) ? licenses.includes('basic') : licenses === 'basic'
     );
     mockRawLicense.getFeature.mockReturnValue({ isEnabled: true, isAvailable: true });
 
-    const serviceSetup = new SecurityLicenseService().setup();
-    serviceSetup.update(mockRawLicense);
+    const serviceSetup = new SecurityLicenseService().setup({
+      license$: of(mockRawLicense),
+    });
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: true,
       allowLogin: true,
@@ -69,8 +118,9 @@ describe('license features', function() {
     mockRawLicense.isOneOf.mockReturnValue(false);
     mockRawLicense.getFeature.mockReturnValue({ isEnabled: false, isAvailable: true });
 
-    const serviceSetup = new SecurityLicenseService().setup();
-    serviceSetup.update(mockRawLicense);
+    const serviceSetup = new SecurityLicenseService().setup({
+      license$: of(mockRawLicense),
+    });
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: false,
       allowLogin: false,
@@ -94,8 +144,9 @@ describe('license features', function() {
     });
     mockRawLicense.getFeature.mockReturnValue({ isEnabled: true, isAvailable: true });
 
-    const serviceSetup = new SecurityLicenseService().setup();
-    serviceSetup.update(mockRawLicense);
+    const serviceSetup = new SecurityLicenseService().setup({
+      license$: of(mockRawLicense),
+    });
     expect(serviceSetup.license.getFeatures()).toEqual({
       showLogin: true,
       allowLogin: true,

x-pack/plugins/security/common/licensing/license_service.ts

@@ -0,0 +1,106 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Observable, Subscription } from 'rxjs';
+import { map } from 'rxjs/operators';
+import { ILicense } from '../../../licensing/common/types';
+import { SecurityLicenseFeatures } from './license_features';
+
+export interface SecurityLicense {
+  isEnabled(): boolean;
+  getFeatures(): SecurityLicenseFeatures;
+  features$: Observable<SecurityLicenseFeatures>;
+}
+
+interface SetupDeps {
+  license$: Observable<ILicense>;
+}
+
+export class SecurityLicenseService {
+  private licenseSubscription?: Subscription;
+
+  public setup({ license$ }: SetupDeps) {
+    let rawLicense: Readonly<ILicense> | undefined;
+
+    this.licenseSubscription = license$.subscribe(nextRawLicense => {
+      rawLicense = nextRawLicense;
+    });
+
+    return {
+      license: Object.freeze({
+        isEnabled: () => this.isSecurityEnabledFromRawLicense(rawLicense),
+
+        getFeatures: () => this.calculateFeaturesFromRawLicense(rawLicense),
+
+        features$: license$.pipe(
+          map(nextRawLicense => this.calculateFeaturesFromRawLicense(nextRawLicense))
+        ),
+      }),
+    };
+  }
+
+  public stop() {
+    if (this.licenseSubscription) {
+      this.licenseSubscription.unsubscribe();
+      this.licenseSubscription = undefined;
+    }
+  }
+
+  private isSecurityEnabledFromRawLicense(rawLicense: Readonly<ILicense> | undefined) {
+    if (!rawLicense) {
+      return false;
+    }
+
+    const securityFeature = rawLicense.getFeature('security');
+    return (
+      securityFeature !== undefined && securityFeature.isAvailable && securityFeature.isEnabled
+    );
+  }
+
+  private calculateFeaturesFromRawLicense(
+    rawLicense: Readonly<ILicense> | undefined
+  ): SecurityLicenseFeatures {
+    // If, for some reason, we cannot get license information from Elasticsearch,
+    // assume worst-case and lock user at login screen.
+    if (!rawLicense?.isAvailable) {
+      return {
+        showLogin: true,
+        allowLogin: false,
+        showLinks: false,
+        allowRoleDocumentLevelSecurity: false,
+        allowRoleFieldLevelSecurity: false,
+        allowRbac: false,
+        layout:
+          rawLicense !== undefined && !rawLicense?.isAvailable
+            ? 'error-xpack-unavailable'
+            : 'error-es-unavailable',
+      };
+    }
+
+    if (!this.isSecurityEnabledFromRawLicense(rawLicense)) {
+      return {
+        showLogin: false,
+        allowLogin: false,
+        showLinks: false,
+        allowRoleDocumentLevelSecurity: false,
+        allowRoleFieldLevelSecurity: false,
+        allowRbac: false,
+        linksMessage: 'Access is denied because Security is disabled in Elasticsearch.',
+      };
+    }
+
+    const isLicensePlatinumOrBetter = rawLicense.isOneOf(['enterprise', 'platinum', 'trial']);
+    return {
+      showLogin: true,
+      allowLogin: true,
+      showLinks: true,
+      // Only platinum and trial licenses are compliant with field- and document-level security.
+      allowRoleDocumentLevelSecurity: isLicensePlatinumOrBetter,
+      allowRoleFieldLevelSecurity: isLicensePlatinumOrBetter,
+      allowRbac: true,
+    };
+  }
+}

x-pack/plugins/security/public/nav_control/index.ts

@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export { SecurityNavControlService } from './nav_control_service';