From f7caefd13a1ab899b151c5d7aa7f39bb6e8e3796 Mon Sep 17 00:00:00 2001 From: Mikhail Shustov Date: Tue, 30 Mar 2021 11:09:41 +0200 Subject: [PATCH 1/8] export type and runtme code separation (#95320) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> --- src/plugins/home/public/index.ts | 12 ++++++---- .../home/public/services/environment/index.ts | 3 ++- .../services/feature_catalogue/index.ts | 6 ++--- src/plugins/home/public/services/index.ts | 23 ++++++++++++++++--- .../home/public/services/tutorials/index.ts | 5 ++-- src/plugins/home/server/index.ts | 9 ++++---- src/plugins/home/server/services/index.ts | 19 +++++++-------- .../home/server/services/sample_data/index.ts | 13 ++++++----- .../home/server/services/tutorials/index.ts | 13 +++++------ src/plugins/home/tsconfig.json | 3 ++- 10 files changed, 66 insertions(+), 40 deletions(-) diff --git a/src/plugins/home/public/index.ts b/src/plugins/home/public/index.ts index b458a07f912dd3..dd02bf65dd8b0b 100644 --- a/src/plugins/home/public/index.ts +++ b/src/plugins/home/public/index.ts @@ -8,24 +8,28 @@ import { PluginInitializerContext } from 'kibana/public'; -export { +export type { FeatureCatalogueSetup, EnvironmentSetup, TutorialSetup, HomePublicPluginSetup, HomePublicPluginStart, } from './plugin'; -export { + +export { FeatureCatalogueCategory } from './services'; + +export type { FeatureCatalogueEntry, FeatureCatalogueSolution, - FeatureCatalogueCategory, Environment, TutorialVariables, TutorialDirectoryNoticeComponent, TutorialDirectoryHeaderLinkComponent, TutorialModuleNoticeComponent, } from './services'; -export * from '../common/instruction_variant'; + +export { INSTRUCTION_VARIANT, getDisplayText } from '../common/instruction_variant'; + import { HomePublicPlugin } from './plugin'; export const plugin = (initializerContext: PluginInitializerContext) => diff --git a/src/plugins/home/public/services/environment/index.ts b/src/plugins/home/public/services/environment/index.ts index ab5297ed0e14c0..6cbfffa1275e2d 100644 --- a/src/plugins/home/public/services/environment/index.ts +++ b/src/plugins/home/public/services/environment/index.ts @@ -6,4 +6,5 @@ * Side Public License, v 1. */ -export { EnvironmentService, Environment, EnvironmentServiceSetup } from './environment'; +export { EnvironmentService } from './environment'; +export type { Environment, EnvironmentServiceSetup } from './environment'; diff --git a/src/plugins/home/public/services/feature_catalogue/index.ts b/src/plugins/home/public/services/feature_catalogue/index.ts index fe1090e15a623d..c89f26c8f89498 100644 --- a/src/plugins/home/public/services/feature_catalogue/index.ts +++ b/src/plugins/home/public/services/feature_catalogue/index.ts @@ -6,10 +6,10 @@ * Side Public License, v 1. */ -export { - FeatureCatalogueCategory, +export { FeatureCatalogueCategory, FeatureCatalogueRegistry } from './feature_catalogue_registry'; + +export type { FeatureCatalogueEntry, FeatureCatalogueSolution, - FeatureCatalogueRegistry, FeatureCatalogueRegistrySetup, } from './feature_catalogue_registry'; diff --git a/src/plugins/home/public/services/index.ts b/src/plugins/home/public/services/index.ts index 29f3dee61537e0..8cd4c8d84e0f78 100644 --- a/src/plugins/home/public/services/index.ts +++ b/src/plugins/home/public/services/index.ts @@ -6,6 +6,23 @@ * Side Public License, v 1. */ -export * from './feature_catalogue'; -export * from './environment'; -export * from './tutorials'; +export { FeatureCatalogueCategory, FeatureCatalogueRegistry } from './feature_catalogue'; + +export type { + FeatureCatalogueEntry, + FeatureCatalogueSolution, + FeatureCatalogueRegistrySetup, +} from './feature_catalogue'; + +export { EnvironmentService } from './environment'; +export type { Environment, EnvironmentServiceSetup } from './environment'; + +export { TutorialService } from './tutorials'; + +export type { + TutorialVariables, + TutorialServiceSetup, + TutorialDirectoryNoticeComponent, + TutorialDirectoryHeaderLinkComponent, + TutorialModuleNoticeComponent, +} from './tutorials'; diff --git a/src/plugins/home/public/services/tutorials/index.ts b/src/plugins/home/public/services/tutorials/index.ts index cbfa95c753f4dd..8de12c31249d80 100644 --- a/src/plugins/home/public/services/tutorials/index.ts +++ b/src/plugins/home/public/services/tutorials/index.ts @@ -6,8 +6,9 @@ * Side Public License, v 1. */ -export { - TutorialService, +export { TutorialService } from './tutorial_service'; + +export type { TutorialVariables, TutorialServiceSetup, TutorialDirectoryNoticeComponent, diff --git a/src/plugins/home/server/index.ts b/src/plugins/home/server/index.ts index fa150b2da8e5de..840a5944a13434 100644 --- a/src/plugins/home/server/index.ts +++ b/src/plugins/home/server/index.ts @@ -6,9 +6,9 @@ * Side Public License, v 1. */ -export { HomeServerPluginSetup, HomeServerPluginStart } from './plugin'; -export { TutorialProvider } from './services'; -export { SampleDatasetProvider, SampleDataRegistrySetup } from './services'; +export type { HomeServerPluginSetup, HomeServerPluginStart } from './plugin'; +export type { TutorialProvider } from './services'; +export type { SampleDatasetProvider, SampleDataRegistrySetup } from './services'; import { PluginInitializerContext, PluginConfigDescriptor } from 'kibana/server'; import { HomeServerPlugin } from './plugin'; import { configSchema, ConfigSchema } from '../config'; @@ -26,4 +26,5 @@ export const config: PluginConfigDescriptor = { export const plugin = (initContext: PluginInitializerContext) => new HomeServerPlugin(initContext); export { INSTRUCTION_VARIANT } from '../common/instruction_variant'; -export { ArtifactsSchema, TutorialsCategory } from './services/tutorials'; +export { TutorialsCategory } from './services/tutorials'; +export type { ArtifactsSchema } from './services/tutorials'; diff --git a/src/plugins/home/server/services/index.ts b/src/plugins/home/server/services/index.ts index 8f41ca0aae00cd..7f26c886ab4b64 100644 --- a/src/plugins/home/server/services/index.ts +++ b/src/plugins/home/server/services/index.ts @@ -9,9 +9,12 @@ // provided to other plugins as APIs // should model the plugin lifecycle -export { TutorialsRegistry, TutorialsRegistrySetup, TutorialsRegistryStart } from './tutorials'; -export { - TutorialsCategory, +export { TutorialsRegistry } from './tutorials'; +export type { TutorialsRegistrySetup, TutorialsRegistryStart } from './tutorials'; + +export { TutorialsCategory } from './tutorials'; + +export type { ParamTypes, InstructionSetSchema, ParamsSchema, @@ -24,10 +27,8 @@ export { ScopedTutorialContextFactory, } from './tutorials'; -export { - SampleDataRegistry, - SampleDataRegistrySetup, - SampleDataRegistryStart, -} from './sample_data'; +export { SampleDataRegistry } from './sample_data'; + +export type { SampleDataRegistrySetup, SampleDataRegistryStart } from './sample_data'; -export { SampleDatasetSchema, SampleDatasetProvider } from './sample_data'; +export type { SampleDatasetSchema, SampleDatasetProvider } from './sample_data'; diff --git a/src/plugins/home/server/services/sample_data/index.ts b/src/plugins/home/server/services/sample_data/index.ts index 8a504291a7262b..30384dad8951d1 100644 --- a/src/plugins/home/server/services/sample_data/index.ts +++ b/src/plugins/home/server/services/sample_data/index.ts @@ -6,10 +6,11 @@ * Side Public License, v 1. */ -export { - SampleDataRegistry, - SampleDataRegistrySetup, - SampleDataRegistryStart, -} from './sample_data_registry'; +export { SampleDataRegistry } from './sample_data_registry'; -export { SampleDatasetSchema, SampleDatasetProvider } from './lib/sample_dataset_registry_types'; +export type { SampleDataRegistrySetup, SampleDataRegistryStart } from './sample_data_registry'; + +export type { + SampleDatasetSchema, + SampleDatasetProvider, +} from './lib/sample_dataset_registry_types'; diff --git a/src/plugins/home/server/services/tutorials/index.ts b/src/plugins/home/server/services/tutorials/index.ts index 89ac528eab06fa..92f6de716185d5 100644 --- a/src/plugins/home/server/services/tutorials/index.ts +++ b/src/plugins/home/server/services/tutorials/index.ts @@ -6,13 +6,12 @@ * Side Public License, v 1. */ -export { - TutorialsRegistry, - TutorialsRegistrySetup, - TutorialsRegistryStart, -} from './tutorials_registry'; -export { - TutorialsCategory, +export { TutorialsRegistry } from './tutorials_registry'; +export type { TutorialsRegistrySetup, TutorialsRegistryStart } from './tutorials_registry'; + +export { TutorialsCategory } from './lib/tutorials_registry_types'; + +export type { ParamTypes, InstructionSetSchema, ParamsSchema, diff --git a/src/plugins/home/tsconfig.json b/src/plugins/home/tsconfig.json index b2613eeecdfb0d..b15e1fc011b926 100644 --- a/src/plugins/home/tsconfig.json +++ b/src/plugins/home/tsconfig.json @@ -5,7 +5,8 @@ "outDir": "./target/types", "emitDeclarationOnly": true, "declaration": true, - "declarationMap": true + "declarationMap": true, + "isolatedModules": true }, "include": [ "common/**/*", From 9931b8bc1d1c1e0e4358a6bcde4312a3195c40f9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alejandro=20Fern=C3=A1ndez=20G=C3=B3mez?= Date: Tue, 30 Mar 2021 11:46:41 +0200 Subject: [PATCH 2/8] [Fleet] Expose permissions as part of the agent policy (#94591) --- .../services/full_agent_policy_to_yaml.ts | 1 + .../fleet/common/types/models/agent_policy.ts | 13 ++++++++ .../fleet/server/services/agent_policy.ts | 24 +++++++++++++-- .../agents/checkin/state_new_actions.test.ts | 7 ++++- .../agents/checkin/state_new_actions.ts | 30 ++++++++++++------- .../fleet/server/services/api_keys/index.ts | 17 ++++------- 6 files changed, 67 insertions(+), 25 deletions(-) diff --git a/x-pack/plugins/fleet/common/services/full_agent_policy_to_yaml.ts b/x-pack/plugins/fleet/common/services/full_agent_policy_to_yaml.ts index e532a90f8839f6..a2c1dcd83dd204 100644 --- a/x-pack/plugins/fleet/common/services/full_agent_policy_to_yaml.ts +++ b/x-pack/plugins/fleet/common/services/full_agent_policy_to_yaml.ts @@ -16,6 +16,7 @@ const POLICY_KEYS_ORDER = [ 'dataset', 'type', 'outputs', + 'output_permissions', 'agent', 'inputs', 'enabled', diff --git a/x-pack/plugins/fleet/common/types/models/agent_policy.ts b/x-pack/plugins/fleet/common/types/models/agent_policy.ts index ec8cc36c507c3e..439d00695a7376 100644 --- a/x-pack/plugins/fleet/common/types/models/agent_policy.ts +++ b/x-pack/plugins/fleet/common/types/models/agent_policy.ts @@ -60,6 +60,16 @@ export interface FullAgentPolicyInput { [key: string]: any; } +export interface FullAgentPolicyOutputPermissions { + [role: string]: { + cluster: string[]; + indices: Array<{ + names: string[]; + privileges: string[]; + }>; + }; +} + export interface FullAgentPolicy { id: string; outputs: { @@ -67,6 +77,9 @@ export interface FullAgentPolicy { [key: string]: any; }; }; + output_permissions?: { + [output: string]: FullAgentPolicyOutputPermissions; + }; fleet?: | { hosts: string[]; diff --git a/x-pack/plugins/fleet/server/services/agent_policy.ts b/x-pack/plugins/fleet/server/services/agent_policy.ts index f2e74534258651..fa71a67025e3ee 100644 --- a/x-pack/plugins/fleet/server/services/agent_policy.ts +++ b/x-pack/plugins/fleet/server/services/agent_policy.ts @@ -694,7 +694,7 @@ class AgentPolicyService { id: agentPolicy.id, outputs: { // TEMPORARY as we only support a default output - ...[defaultOutput].reduce( + ...[defaultOutput].reduce( // eslint-disable-next-line @typescript-eslint/naming-convention (outputs, { config_yaml, name, type, hosts, ca_sha256, api_key }) => { const configJs = config_yaml ? safeLoad(config_yaml) : {}; @@ -714,7 +714,7 @@ class AgentPolicyService { return outputs; }, - {} as FullAgentPolicy['outputs'] + {} ), }, inputs: storedPackagePoliciesToAgentInputs(agentPolicy.package_policies as PackagePolicy[]), @@ -737,6 +737,26 @@ class AgentPolicyService { }), }; + // Only add permissions if output.type is "elasticsearch" + fullAgentPolicy.output_permissions = Object.keys(fullAgentPolicy.outputs).reduce< + NonNullable + >((permissions, outputName) => { + const output = fullAgentPolicy.outputs[outputName]; + if (output && output.type === 'elasticsearch') { + permissions[outputName] = {}; + permissions[outputName]._fallback = { + cluster: ['monitor'], + indices: [ + { + names: ['logs-*', 'metrics-*', 'traces-*', '.logs-endpoint.diagnostic.collection-*'], + privileges: ['auto_configure', 'create_doc'], + }, + ], + }; + } + return permissions; + }, {}); + // only add settings if not in standalone if (!standalone) { let settings: Settings; diff --git a/x-pack/plugins/fleet/server/services/agents/checkin/state_new_actions.test.ts b/x-pack/plugins/fleet/server/services/agents/checkin/state_new_actions.test.ts index daa3992ce5844b..12205f31106144 100644 --- a/x-pack/plugins/fleet/server/services/agents/checkin/state_new_actions.test.ts +++ b/x-pack/plugins/fleet/server/services/agents/checkin/state_new_actions.test.ts @@ -144,6 +144,9 @@ describe('test agent checkin new action services', () => { api_key: undefined, }, }, + output_permissions: { + default: { _fallback: { cluster: [], indices: [] } }, + }, inputs: [], }, }, @@ -159,6 +162,7 @@ describe('test agent checkin new action services', () => { id: 'policy1', inputs: [], outputs: { default: { api_key: 'MOCK_API_KEY', hosts: [], type: 'elasticsearch' } }, + output_permissions: { default: { _fallback: { cluster: [], indices: [] } } }, }, }, id: 'action1', @@ -213,7 +217,7 @@ describe('test agent checkin new action services', () => { ).toEqual(expectedResult); }); - it('should return CONNFIG_CHANGE and data.config for agent version <= 7.9', async () => { + it('should return CONFIG_CHANGE and data.config for agent version <= 7.9', async () => { const expectedResult = [ { agent_id: 'agent1', @@ -223,6 +227,7 @@ describe('test agent checkin new action services', () => { id: 'policy1', inputs: [], outputs: { default: { api_key: 'MOCK_API_KEY', hosts: [], type: 'elasticsearch' } }, + output_permissions: { default: { _fallback: { cluster: [], indices: [] } } }, }, }, id: 'action1', diff --git a/x-pack/plugins/fleet/server/services/agents/checkin/state_new_actions.ts b/x-pack/plugins/fleet/server/services/agents/checkin/state_new_actions.ts index 8810dd6ff1263c..8f0000413471f3 100644 --- a/x-pack/plugins/fleet/server/services/agents/checkin/state_new_actions.ts +++ b/x-pack/plugins/fleet/server/services/agents/checkin/state_new_actions.ts @@ -40,6 +40,7 @@ import { } from '../actions'; import { appContextService } from '../../app_context'; import { updateAgent } from '../crud'; +import type { FullAgentPolicy, FullAgentPolicyOutputPermissions } from '../../../../common'; import { toPromiseAbortable, AbortError, createRateLimiter } from './rxjs_utils'; @@ -113,14 +114,20 @@ async function getAgentDefaultOutputAPIKey( async function getOrCreateAgentDefaultOutputAPIKey( soClient: SavedObjectsClientContract, esClient: ElasticsearchClient, - agent: Agent + agent: Agent, + permissions: FullAgentPolicyOutputPermissions ): Promise { const defaultAPIKey = await getAgentDefaultOutputAPIKey(soClient, esClient, agent); if (defaultAPIKey) { return defaultAPIKey; } - const outputAPIKey = await APIKeysService.generateOutputApiKey(soClient, 'default', agent.id); + const outputAPIKey = await APIKeysService.generateOutputApiKey( + soClient, + 'default', + agent.id, + permissions + ); await updateAgent(esClient, agent.id, { default_api_key: outputAPIKey.key, default_api_key_id: outputAPIKey.id, @@ -167,15 +174,18 @@ export async function createAgentActionFromPolicyAction( } ); + // agent <= 7.9 uses `data.config` instead of `data.policy` + const policyProp = 'policy' in newAgentAction.data ? 'policy' : 'config'; + + // TODO: The null assertion `!` is strictly correct for the current use case + // where the only output is `elasticsearch`, but this might change in the future. + const permissions = (newAgentAction.data[policyProp] as FullAgentPolicy).output_permissions! + .default; + // Mutate the policy to set the api token for this agent - const apiKey = await getOrCreateAgentDefaultOutputAPIKey(soClient, esClient, agent); - if (newAgentAction.data.policy) { - newAgentAction.data.policy.outputs.default.api_key = apiKey; - } - // BWC for agent <= 7.9 - else if (newAgentAction.data.config) { - newAgentAction.data.config.outputs.default.api_key = apiKey; - } + const apiKey = await getOrCreateAgentDefaultOutputAPIKey(soClient, esClient, agent, permissions); + + newAgentAction.data[policyProp].outputs.default.api_key = apiKey; return [newAgentAction]; } diff --git a/x-pack/plugins/fleet/server/services/api_keys/index.ts b/x-pack/plugins/fleet/server/services/api_keys/index.ts index bf229c829fda8f..1f9e77821360c2 100644 --- a/x-pack/plugins/fleet/server/services/api_keys/index.ts +++ b/x-pack/plugins/fleet/server/services/api_keys/index.ts @@ -8,6 +8,8 @@ import type { KibanaRequest } from 'src/core/server'; import type { SavedObjectsClientContract } from 'src/core/server'; +import type { FullAgentPolicyOutputPermissions } from '../../../common'; + import { createAPIKey } from './security'; export { invalidateAPIKeys } from './security'; @@ -16,20 +18,11 @@ export * from './enrollment_api_key'; export async function generateOutputApiKey( soClient: SavedObjectsClientContract, outputId: string, - agentId: string + agentId: string, + permissions: FullAgentPolicyOutputPermissions ): Promise<{ key: string; id: string }> { const name = `${agentId}:${outputId}`; - const key = await createAPIKey(soClient, name, { - 'fleet-output': { - cluster: ['monitor'], - index: [ - { - names: ['logs-*', 'metrics-*', 'traces-*', '.logs-endpoint.diagnostic.collection-*'], - privileges: ['auto_configure', 'create_doc'], - }, - ], - }, - }); + const key = await createAPIKey(soClient, name, permissions); if (!key) { throw new Error('Unable to create an output api key'); From 41e247f29f2ac4eb2d2b652addc6afb4f46c7078 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20S=C3=A1nchez?= Date: Tue, 30 Mar 2021 12:12:33 +0200 Subject: [PATCH 3/8] Fix unit test. Get rid of snapshots and use query element instead (#95656) --- .../trusted_apps_page.test.tsx.snap | 5573 ----------------- .../view/trusted_apps_page.test.tsx | 11 +- 2 files changed, 7 insertions(+), 5577 deletions(-) delete mode 100644 x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/__snapshots__/trusted_apps_page.test.tsx.snap diff --git a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/__snapshots__/trusted_apps_page.test.tsx.snap b/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/__snapshots__/trusted_apps_page.test.tsx.snap deleted file mode 100644 index dbd5a9f2aca87b..00000000000000 --- a/x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/__snapshots__/trusted_apps_page.test.tsx.snap +++ /dev/null @@ -1,5573 +0,0 @@ -// Jest Snapshot v1, https://goo.gl/fbAQLP - -exports[`When on the Trusted Apps Page and the Add Trusted App button is clicked and there is a feature flag for agents policy should display agents policy if feature flag is enabled 1`] = ` -Object { - "asFragment": [Function], - "baseElement": - .c0 { - padding: 24px; -} - -.c0.siemWrapperPage--fullHeight { - height: 100%; - display: -webkit-box; - display: -webkit-flex; - display: -ms-flexbox; - display: flex; - -webkit-flex-direction: column; - -ms-flex-direction: column; - flex-direction: column; - -webkit-flex: 1 1 auto; - -ms-flex: 1 1 auto; - flex: 1 1 auto; -} - -.c0.siemWrapperPage--noPadding { - padding: 0; - display: -webkit-box; - display: -webkit-flex; - display: -ms-flexbox; - display: flex; - -webkit-flex-direction: column; - -ms-flex-direction: column; - flex-direction: column; - -webkit-flex: 1 1 auto; - -ms-flex: 1 1 auto; - flex: 1 1 auto; -} - -.c0.siemWrapperPage--withTimeline { - padding-bottom: 70px; -} - -.c3 { - margin-top: 8px; -} - -.c3 .siemSubtitle__item { - color: #6a717d; - font-size: 12px; - line-height: 1.5; -} - -.c1 { - margin-bottom: 24px; -} - -.c2 { - display: block; -} - -.c4 .euiFlyout { - z-index: 4001; -} - -.c5 .and-badge { - padding-top: 20px; - padding-bottom: calc(32px + (8px * 2) + 3px); -} - -.c5 .group-entries { - margin-bottom: 8px; -} - -.c5 .group-entries > * { - margin-bottom: 8px; -} - -.c5 .group-entries > *:last-child { - margin-bottom: 0; -} - -.c5 .and-button { - min-width: 95px; -} - -.c6 .policy-name .euiSelectableListItem__text { - -webkit-text-decoration: none !important; - text-decoration: none !important; - color: #343741 !important; -} - -.c7 { - background-color: #f5f7fa; - padding: 16px; -} - -.c10 { - padding: 16px; -} - -.c8.c8.c8 { - width: 40%; -} - -.c9.c9.c9 { - width: 60%; -} - -@media only screen and (min-width:575px) { - .c3 .siemSubtitle__item { - display: inline-block; - margin-right: 16px; - } - - .c3 .siemSubtitle__item:last-child { - margin-right: 0; - } -} - -
-
-
-
-
-

- Trusted Applications -

-
-

- Add a trusted application to improve performance or alleviate conflicts with other applications running on your hosts. Trusted applications will be applied to hosts running Endpoint Security. -

-
-
-
- -
-
-
-
- - -
-
-
-
-