poc

src/core/server/capabilities/merge_capabilities.ts

@@ -21,7 +21,7 @@ import { mergeWith } from 'lodash';
 import { Capabilities } from './types';
 
 export const mergeCapabilities = (...sources: Array<Partial<Capabilities>>): Capabilities =>
- mergeWith({}, ...sources, (a: any, b: any) => {
+ mergeWith({}, ...sources, (a: any, b: any, key: any) => {
  if (
  (typeof a === 'boolean' && typeof b === 'object') ||
  (typeof a === 'object' && typeof b === 'boolean')
@@ -32,4 +32,9 @@ export const mergeCapabilities = (...sources: Array<Partial<Capabilities>>): Cap
  if (typeof a === 'boolean' && typeof b === 'boolean' && a !== b) {
  throw new Error(`conflict trying to merge booleans with different values`);
  }
+
+ // if (typeof a === 'object' && typeof b === 'object' && key === 'management') {
+ // console.log('INSIDE MANAGEMENT FOR MERGING');
+ // return merge({}, a, b);
+ // }
  });

src/plugins/management/public/plugin.ts

@@ -18,6 +18,7 @@
  */
 
 import { i18n } from '@kbn/i18n';
+import { BehaviorSubject } from 'rxjs';
 import { ManagementSetup, ManagementStart } from './types';
 import { FeatureCatalogueCategory, HomePublicPluginSetup } from '../../home/public';
 import {
@@ -26,6 +27,9 @@ import {
  Plugin,
  DEFAULT_APP_CATEGORIES,
  PluginInitializerContext,
+ AppUpdater,
+ AppStatus,
+ AppNavLinkStatus,
 } from '../../../core/public';
 
 import { ManagementSectionsService } from './management_sections_service';
@@ -37,6 +41,8 @@ interface ManagementSetupDependencies {
 export class ManagementPlugin implements Plugin<ManagementSetup, ManagementStart> {
  private readonly managementSections = new ManagementSectionsService();
 
+ private readonly appUpdater = new BehaviorSubject<AppUpdater>(() => ({}));
+
  constructor(private initializerContext: PluginInitializerContext) {}
 
  public setup(core: CoreSetup, { home }: ManagementSetupDependencies) {
@@ -64,6 +70,7 @@ export class ManagementPlugin implements Plugin<ManagementSetup, ManagementStart
  order: 9003,
  euiIconType: 'managementApp',
  category: DEFAULT_APP_CATEGORIES.management,
+ updater$: this.appUpdater,
  async mount(context, params) {
  const { renderApp } = await import('./application');
  const selfStart = (await core.getStartServices())[2] as ManagementStart;
@@ -81,8 +88,22 @@ export class ManagementPlugin implements Plugin<ManagementSetup, ManagementStart
  }
 
  public start(core: CoreStart) {
+ const sections = this.managementSections.start({ capabilities: core.application.capabilities });
+ const hasAnyEnabledApps = sections
+ .getSectionsEnabled()
+ .some((section) => section.getAppsEnabled().length > 0);
+
+ if (!hasAnyEnabledApps) {
+ this.appUpdater.next(() => {
+ return {
+ status: AppStatus.inaccessible,
+ navLinkStatus: AppNavLinkStatus.hidden,
+ };
+ });
+ }
+
  return {
- sections: this.managementSections.start({ capabilities: core.application.capabilities }),
+ sections,
  };
  }
 }

x-pack/plugins/apm/server/plugin.ts

@@ -125,7 +125,7 @@ export class APMPlugin implements Plugin<APMPluginSetup> {
  };
  });
 
- plugins.features.registerFeature(APM_FEATURE);
+ plugins.features.registerKibanaFeature(APM_FEATURE);
  plugins.licensing.featureUsage.register(
  APM_SERVICE_MAPS_FEATURE_NAME,
  APM_SERVICE_MAPS_LICENSE_TYPE

x-pack/plugins/beats_management/kibana.json

@@ -7,7 +7,8 @@
  "requiredPlugins": [
  "data",
  "licensing",
- "management"
+ "management",
+ "features"
  ],
  "optionalPlugins": [
  "security"

x-pack/plugins/beats_management/server/plugin.ts

@@ -10,12 +10,14 @@ import {
  Plugin,
  PluginInitializerContext,
 } from '../../../../src/core/server';
+import { PluginSetupContract as FeaturesPluginSetup } from '../../features/server';
 import { SecurityPluginSetup } from '../../security/server';
 import { LicensingPluginStart } from '../../licensing/server';
 import { BeatsManagementConfigType } from '../common';
 
 interface SetupDeps {
  security?: SecurityPluginSetup;
+ features: FeaturesPluginSetup;
 }
 
 interface StartDeps {
@@ -30,6 +32,20 @@ export class BeatsManagementPlugin implements Plugin<{}, {}, SetupDeps, StartDep
  public async setup(core: CoreSetup<StartDeps>, plugins: SetupDeps) {
  this.initializerContext.config.create();
 
+ plugins.features.registerElasticsearchFeature({
+ id: 'beats_management',
+ management: {
+ ingest: ['beats_management'],
+ },
+ privileges: [
+ {
+ ui: [],
+ requiredClusterPrivileges: [],
+ requiredRoles: ['beats_admin'],
+ },
+ ],
+ });
+
  return {};
  }
 

x-pack/plugins/canvas/server/plugin.ts

@@ -35,7 +35,7 @@ export class CanvasPlugin implements Plugin {
  coreSetup.savedObjects.registerType(workpadType);
  coreSetup.savedObjects.registerType(workpadTemplateType);
 
- plugins.features.registerFeature({
+ plugins.features.registerKibanaFeature({
  id: 'canvas',
  name: 'Canvas',
  order: 400,

x-pack/plugins/cross_cluster_replication/kibana.json

@@ -8,7 +8,8 @@
  "licensing",
  "management",
  "remoteClusters",
- "indexManagement"
+ "indexManagement",
+ "features"
  ],
  "optionalPlugins": [
  "usageCollection"

x-pack/plugins/cross_cluster_replication/server/plugin.ts

@@ -87,7 +87,7 @@ export class CrossClusterReplicationServerPlugin implements Plugin<void, void, a
 
  setup(
  { http, getStartServices }: CoreSetup,
- { licensing, indexManagement, remoteClusters }: Dependencies
+ { features, licensing, indexManagement, remoteClusters }: Dependencies
  ) {
  this.config$
  .pipe(first())
@@ -124,6 +124,19 @@ export class CrossClusterReplicationServerPlugin implements Plugin<void, void, a
  }
  );
 
+ features.registerElasticsearchFeature({
+ id: 'cross_cluster_replication',
+ management: {
+ data: ['cross_cluster_replication'],
+ },
+ privileges: [
+ {
+ requiredClusterPrivileges: ['manage', 'manage_ccr'],
+ ui: [],
+ },
+ ],
+ });
+
  http.registerRouteHandlerContext('crossClusterReplication', async (ctx, request) => {
  this.ccrEsClient = this.ccrEsClient ?? (await getCustomEsClient(getStartServices));
  return {

x-pack/plugins/cross_cluster_replication/server/types.ts

@@ -5,6 +5,7 @@
  */
 
 import { IRouter } from 'src/core/server';
+import { PluginSetupContract as FeaturesPluginSetup } from '../../features/server';
 import { LicensingPluginSetup } from '../../licensing/server';
 import { IndexManagementPluginSetup } from '../../index_management/server';
 import { RemoteClustersPluginSetup } from '../../remote_clusters/server';
@@ -16,6 +17,7 @@ export interface Dependencies {
  licensing: LicensingPluginSetup;
  indexManagement: IndexManagementPluginSetup;
  remoteClusters: RemoteClustersPluginSetup;
+ features: FeaturesPluginSetup;
 }
 
 export interface RouteDependencies {

x-pack/plugins/enterprise_search/server/plugin.ts

@@ -58,7 +58,7 @@ export class EnterpriseSearchPlugin implements Plugin {
  /**
  * Register space/feature control
  */
- features.registerFeature({
+ features.registerKibanaFeature({
  id: 'enterpriseSearch',
  name: 'Enterprise Search',
  order: 0,

x-pack/plugins/features/common/es_feature.ts

@@ -0,0 +1,82 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { RecursiveReadonly } from '@kbn/utility-types';
+import { FeatureElasticsearchPrivileges } from './feature_elasticsearch_privileges';
+
+/**
+ * Interface for registering an Elasticsearch feature.
+ * Feature registration allows plugins to hide their applications based
+ * on configured cluster privileges.
+ */
+export interface ElasticsearchFeatureConfig {
+ /**
+ * Unique identifier for this feature.
+ * This identifier is also used when generating UI Capabilities.
+ *
+ * @see UICapabilities
+ */
+ id: string;
+
+ /**
+ * Management sections associated with this feature.
+ *
+ * @example
+ * ```ts
+ * // Enables access to the "Advanced Settings" management page within the Kibana section
+ * management: {
+ * kibana: ['settings']
+ * }
+ * ```
+ */
+ management?: {
+ [sectionId: string]: string[];
+ };
+
+ /**
+ * If this feature includes a catalogue entry, you can specify them here to control visibility based on the current space.
+ *
+ */
+ catalogue?: string[];
+
+ /**
+ * Feature privilege definition.
+ *
+ * @example
+ * ```ts
+ * {
+ * all: {...},
+ * read: {...}
+ * }
+ * ```
+ * @see FeatureElasticsearchPrivileges
+ */
+ privileges: FeatureElasticsearchPrivileges[];
+}
+
+export class ElasticsearchFeature {
+ constructor(protected readonly config: RecursiveReadonly<ElasticsearchFeatureConfig>) {}
+
+ public get id() {
+ return this.config.id;
+ }
+
+ public get catalogue() {
+ return this.config.catalogue;
+ }
+
+ public get management() {
+ return this.config.management;
+ }
+
+ public get privileges() {
+ return this.config.privileges;
+ }
+
+ public toRaw() {
+ return { ...this.config } as ElasticsearchFeatureConfig;
+ }
+}

x-pack/plugins/features/common/feature.ts

@@ -6,15 +6,15 @@
 
 import { RecursiveReadonly } from '@kbn/utility-types';
 import { FeatureKibanaPrivileges } from './feature_kibana_privileges';
-import { SubFeatureConfig, SubFeature } from './sub_feature';
+import { SubFeatureConfig, SubFeature as KibanaSubFeature } from './sub_feature';
 import { ReservedKibanaPrivilege } from './reserved_kibana_privilege';
 
 /**
  * Interface for registering a feature.
  * Feature registration allows plugins to hide their applications with spaces,
  * and secure access when configured for security.
  */
-export interface FeatureConfig {
+export interface KibanaFeatureConfig {
  /**
  * Unique identifier for this feature.
  * This identifier is also used when generating UI Capabilities.
@@ -130,12 +130,12 @@ export interface FeatureConfig {
  };
 }
 
-export class Feature {
- public readonly subFeatures: SubFeature[];
+export class KibanaFeature {
+ public readonly subFeatures: KibanaSubFeature[];
 
- constructor(protected readonly config: RecursiveReadonly<FeatureConfig>) {
+ constructor(protected readonly config: RecursiveReadonly<KibanaFeatureConfig>) {
  this.subFeatures = (config.subFeatures ?? []).map(
- (subFeatureConfig) => new SubFeature(subFeatureConfig)
+ (subFeatureConfig) => new KibanaSubFeature(subFeatureConfig)
  );
  }
 
@@ -188,6 +188,6 @@ export class Feature {
  }
 
  public toRaw() {
- return { ...this.config } as FeatureConfig;
+ return { ...this.config } as KibanaFeatureConfig;
  }
 }

x-pack/plugins/features/common/feature_elasticsearch_privileges.ts

@@ -0,0 +1,42 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+/**
+ * Elasticsearch Feature privilege definition
+ */
+export interface FeatureElasticsearchPrivileges {
+ requiredClusterPrivileges: string[];
+ requiredIndexPrivileges?: {
+ [indexName: string]: string[];
+ };
+
+ /**
+ * @deprecated do not rely on hard-coded role names
+ */
+ requiredRoles?: string[];
+
+ /**
+ * A list of UI Capabilities that should be granted to users with this privilege.
+ * These capabilities will automatically be namespaces within your feature id.
+ *
+ * @example
+ * ```ts
+ * {
+ * ui: ['show', 'save']
+ * }
+ *
+ * This translates in the UI to the following (assuming a feature id of "foo"):
+ * import { uiCapabilities } from 'ui/capabilities';
+ *
+ * const canShowApp = uiCapabilities.foo.show;
+ * const canSave = uiCapabilities.foo.save;
+ * ```
+ * Note: Since these are automatically namespaced, you are free to use generic names like "show" and "save".
+ *
+ * @see UICapabilities
+ */
+ ui: string[];
+}

x-pack/plugins/features/common/index.ts

@@ -4,8 +4,10 @@
  * you may not use this file except in compliance with the Elastic License.
  */
 
+export { FeatureElasticsearchPrivileges } from './feature_elasticsearch_privileges';
 export { FeatureKibanaPrivileges } from './feature_kibana_privileges';
-export { Feature, FeatureConfig } from './feature';
+export { ElasticsearchFeature, ElasticsearchFeatureConfig } from './es_feature';
+export { KibanaFeature as Feature, KibanaFeatureConfig as FeatureConfig } from './feature';
 export {
  SubFeature,
  SubFeatureConfig,