[Actions] System actions authorization (elastic#161341)

## Summary

This PR adds the ability for system actions to be able to define their
own Kibana privileges that need to be authorized before execution.

Depends on: elastic#160983

### Checklist

Delete any items that are not applicable to this PR.

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

### For maintainers

- [x] This was checked for breaking API changes and was [labeled
appropriately](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)

---------

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

x-pack/plugins/actions/server/action_type_registry.mock.ts

@@ -19,6 +19,7 @@ const createActionTypeRegistryMock = () => {
  isActionExecutable: jest.fn(),
  isSystemActionType: jest.fn(),
  getUtils: jest.fn(),
+ getSystemActionKibanaPrivileges: jest.fn(),
  };
  return mocked;
 };

x-pack/plugins/actions/server/action_type_registry.test.ts

@@ -248,6 +248,29 @@ describe('actionTypeRegistry', () => {
  })
  ).not.toThrow();
  });
+
+ test('throws if the kibana privileges are defined but the action type is not a system action type', () => {
+ const actionTypeRegistry = new ActionTypeRegistry(actionTypeRegistryParams);
+
+ expect(() =>
+ actionTypeRegistry.register({
+ id: 'my-action-type',
+ name: 'My action type',
+ minimumLicenseRequired: 'basic',
+ supportedFeatureIds: ['alerting'],
+ getKibanaPrivileges: jest.fn(),
+ isSystemActionType: false,
+ validate: {
+ config: { schema: schema.object({}) },
+ secrets: { schema: schema.object({}) },
+ params: { schema: schema.object({}) },
+ },
+ executor,
+ })
+ ).toThrowErrorMatchingInlineSnapshot(
+ `"Kibana privilege authorization is only supported for system action types"`
+ );
+ });
  });
 
  describe('get()', () => {
@@ -691,4 +714,92 @@ describe('actionTypeRegistry', () => {
  expect(result).toBe(false);
  });
  });
+
+ describe('getSystemActionKibanaPrivileges()', () => {
+ it('should get the kibana privileges correctly for system actions', () => {
+ const registry = new ActionTypeRegistry(actionTypeRegistryParams);
+
+ registry.register({
+ id: '.cases',
+ name: 'Cases',
+ minimumLicenseRequired: 'platinum',
+ supportedFeatureIds: ['alerting'],
+ getKibanaPrivileges: () => ['test/create'],
+ validate: {
+ config: { schema: schema.object({}) },
+ secrets: { schema: schema.object({}) },
+ params: { schema: schema.object({}) },
+ },
+ isSystemActionType: true,
+ executor,
+ });
+
+ const result = registry.getSystemActionKibanaPrivileges('.cases');
+ expect(result).toEqual(['test/create']);
+ });
+
+ it('should return an empty array if the system action does not define any kibana privileges', () => {
+ const registry = new ActionTypeRegistry(actionTypeRegistryParams);
+
+ registry.register({
+ id: '.cases',
+ name: 'Cases',
+ minimumLicenseRequired: 'platinum',
+ supportedFeatureIds: ['alerting'],
+ validate: {
+ config: { schema: schema.object({}) },
+ secrets: { schema: schema.object({}) },
+ params: { schema: schema.object({}) },
+ },
+ isSystemActionType: true,
+ executor,
+ });
+
+ const result = registry.getSystemActionKibanaPrivileges('.cases');
+ expect(result).toEqual([]);
+ });
+
+ it('should return an empty array if the action type is not a system action', () => {
+ const registry = new ActionTypeRegistry(actionTypeRegistryParams);
+
+ registry.register({
+ id: 'foo',
+ name: 'Foo',
+ minimumLicenseRequired: 'basic',
+ supportedFeatureIds: ['alerting'],
+ validate: {
+ config: { schema: schema.object({}) },
+ secrets: { schema: schema.object({}) },
+ params: { schema: schema.object({}) },
+ },
+ executor,
+ });
+
+ const result = registry.getSystemActionKibanaPrivileges('foo');
+ expect(result).toEqual([]);
+ });
+
+ it('should pass the params correctly', () => {
+ const registry = new ActionTypeRegistry(actionTypeRegistryParams);
+ const getKibanaPrivileges = jest.fn().mockReturnValue(['test/create']);
+
+ registry.register({
+ id: '.cases',
+ name: 'Cases',
+ minimumLicenseRequired: 'platinum',
+ supportedFeatureIds: ['alerting'],
+ getKibanaPrivileges,
+ validate: {
+ config: { schema: schema.object({}) },
+ secrets: { schema: schema.object({}) },
+ params: { schema: schema.object({}) },
+ },
+ isSystemActionType: true,
+ executor,
+ });
+
+ registry.getSystemActionKibanaPrivileges('.cases', { foo: 'bar' });
+ expect(getKibanaPrivileges).toHaveBeenCalledWith({ params: { foo: 'bar' } });
+ });
+ });
 });

x-pack/plugins/actions/server/action_type_registry.ts

@@ -101,6 +101,22 @@ export class ActionTypeRegistry {
  public isSystemActionType = (actionTypeId: string): boolean =>
  Boolean(this.actionTypes.get(actionTypeId)?.isSystemActionType);
 
+ /**
+ * Returns the kibana privileges of a system action type
+ */
+ public getSystemActionKibanaPrivileges<Params extends ActionTypeParams = ActionTypeParams>(
+ actionTypeId: string,
+ params?: Params
+ ): string[] {
+ const actionType = this.actionTypes.get(actionTypeId);
+
+ if (!actionType?.isSystemActionType) {
+ return [];
+ }
+
+ return actionType?.getKibanaPrivileges?.({ params }) ?? [];
+ }
+
  /**
  * Registers an action type to the action type registry
  */
@@ -148,6 +164,15 @@ export class ActionTypeRegistry {
  );
  }
 
+ if (!actionType.isSystemActionType && actionType.getKibanaPrivileges) {
+ throw new Error(
+ i18n.translate('xpack.actions.actionTypeRegistry.register.invalidKibanaPrivileges', {
+ defaultMessage:
+ 'Kibana privilege authorization is only supported for system action types',
+ })
+ );
+ }
+
  const maxAttempts = this.actionsConfigUtils.getMaxAttempts({
  actionTypeId: actionType.id,
  actionTypeMaxAttempts: actionType.maxAttempts,