Skip to content

Commit

Permalink
Get rid of integration test changes
Browse files Browse the repository at this point in the history 
The integration test changes can only be applied in 8.0 or later. We can
safely remove that from the 7.x branch.
  • Loading branch information
@jportner
jportner committed Jul 29, 2021
1 parent 9742a52 commit 6c1dd27
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 175 deletions.
15 changes: 1 addition & 14 deletions ...test/encrypted_saved_objects_api_integration/fixtures/api_consumer_plugin/server/index.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -134,8 +134,7 @@ function defineTypeWithMigration(core: CoreSetup<PluginsStart>, deps: PluginsSet
core.savedObjects.registerType({
name: SAVED_OBJECT_WITH_MIGRATION_TYPE,
hidden: false,
namespaceType: 'multiple-isolated', // in data.json, we simulate that existing objects were created with `namespaceType: 'single'`
convertToMultiNamespaceTypeVersion: '8.0.0', // in this version we convert from a single-namespace type to a "share-capable" multi-namespace isolated type
namespaceType: 'single',
mappings: {
properties: {
nonEncryptedAttribute: {
Expand Down Expand Up @@ -200,18 +199,6 @@ function defineTypeWithMigration(core: CoreSetup<PluginsStart>, deps: PluginsSet
},
inputType: typePriorTo790,
}),

// NOTE FOR MAINTAINERS: do not add any more migrations before 8.0.0 unless you regenerate the test data for two of the objects in
// data.json: '362828f0-eef2-11eb-9073-11359682300a' and '36448a90-eef2-11eb-9073-11359682300a. These are used in the test cases 'for
// a saved object that does not need to be migrated before it is converted'.

// This empty migration is necessary to ensure that the saved object is decrypted with its old descriptor/ and re-encrypted with its
// new descriptor, if necessary. This is included because the saved object is being converted to `namespaceType: 'multiple-isolated'`
// in 8.0.0 (see the `convertToMultiNamespaceTypeVersion` field in the saved object type registration process).
'8.0.0': deps.encryptedSavedObjects.createMigration<MigratedType, MigratedType>({
isMigrationNeededPredicate: (doc): doc is SavedObjectUnsanitizedDoc<MigratedType> => true,
migration: (doc) => doc, // no-op
}),
},
});
}
66 changes: 1 addition & 65 deletions ...pted_saved_objects_api_integration/fixtures/es_archiver/encrypted_saved_objects/data.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -223,70 +223,6 @@
}
}

{
"type": "doc",
"value": {
"id": "custom-space:saved-object-with-migration:a67c6950-eed8-11eb-9a62-032b4e4049d1",
"index": ".kibana_1",
"source": {
"saved-object-with-migration": {
"encryptedAttribute": "BIOBsx5SjLq3ZQdOJv06XeCAMY9ZrYj8K5bcGa5+wpd3TeT2sqln1+9AGblnfxT7LXRI3sLWQ900+wRQzBhJYx8PNKH+Yw+GdeESpu73PFHdWt/52cJKr+b4EPALFc00tIMEDHdT9FyQhqJ7nV8UpwtjcuTp9SA=",
"nonEncryptedAttribute": "elastic"
},
"type": "saved-object-with-migration",
"references": [],
"namespace": "custom-space",
"migrationVersion": {
"saved-object-with-migration": "7.7.0"
},
"updated_at": "2021-07-27T12:46:23.881Z"
}
}
}

{
"type": "doc",
"value": {
"id": "saved-object-with-migration:362828f0-eef2-11eb-9073-11359682300a",
"index": ".kibana_1",
"source": {
"saved-object-with-migration": {
"encryptedAttribute": "wWDAtF/5PkCb5BxjfWyRxoIoHbJXlb5cGAKg9ztZ1Bz9Zwo0/xf2yTa3Gq/CbYrvey/F9FZkZOUk03USPaqa5mfFO8FhORkfmNLQaPhgCIDNd6SbIhN8RYkqWVTYSVgcZrwes+VwiTUZ29mCJprVSHwXdyAOy4g=",
"nonEncryptedAttribute": "elastic-migrated",
"additionalEncryptedAttribute": "mszSQj0+Wv7G6kZJQsqf7CWwjJwwyriMlBcUjSHTLlj+tljbLTb7PI7gR07S9l7BXd3Lquc5PeOJifl2HvnTh8s871d/WdtIvt2K/ggwA2ae9NH6ui8A15cuPlXiGO612qccsIyBzhsftFyWJNuLBApmqeEy7HFe"
},
"type": "saved-object-with-migration",
"references": [],
"migrationVersion": {
"saved-object-with-migration": "7.9.0"
},
"updated_at": "2021-07-27T15:49:22.324Z"
}
}
}

{
"type": "doc",
"value": {
"id": "custom-space:saved-object-with-migration:36448a90-eef2-11eb-9073-11359682300a",
"index": ".kibana_1",
"source": {
"saved-object-with-migration": {
"encryptedAttribute": "33lfpnBI136UfkdcQLzovzBXdUaeDouN0Z32qkVutgZJ5SU60hMtaHWXNkaU9DGy9jtr0ptwm6FCYmZbyDrlGMwyZP2n0PzMhwW9fRcBh7he12Cm1mImWTrxgYoRtc1MX20/orbINx5VnuNl1Ide7htAm1oPRjM=",
"nonEncryptedAttribute": "elastic-migrated",
"additionalEncryptedAttribute": "e2rsxBijtMGcdw7A+WAWJNlLOhQCZnEP1sdcHxVO5aQouiUVeI1OTFcOY3h/+iZBlSGvZdGRURgimrSNc0HRicemZx3o4v1gVw0JX3RRatzdl02v3GJoFzBWfQGyf3xhNNWmkweGJrFQqr2kfdKjIHbdVmMt4LZj"
},
"type": "saved-object-with-migration",
"references": [],
"namespace": "custom-space",
"migrationVersion": {
"saved-object-with-migration": "7.9.0"
},
"updated_at": "2021-07-27T15:49:22.509Z"
}
}
}

{
"type": "doc",
"value": {
Expand Down Expand Up @@ -431,4 +367,4 @@
"updated_at": "2020-06-17T16:29:27.563Z"
}
}
}
}
109 changes: 13 additions & 96 deletions x-pack/test/encrypted_saved_objects_api_integration/tests/encrypted_saved_objects_api.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -528,103 +528,20 @@ export default function ({ getService }: FtrProviderContext) {
);
});

function getGetApiUrl({ objectId, spaceId }: { objectId: string; spaceId?: string }) {
const spacePrefix = spaceId ? `/s/${spaceId}` : '';
return `${spacePrefix}/api/saved_objects/get-decrypted-as-internal-user/saved-object-with-migration/${objectId}`;
}

// For brevity, each encrypted saved object has the same decrypted attributes after migrations/conversion.
// An assertion based on this ensures all encrypted fields can still be decrypted after migrations/conversion have been applied.
const expectedDecryptedAttributes = {
encryptedAttribute: 'this is my secret api key',
nonEncryptedAttribute: 'elastic-migrated', // this field was migrated in 7.8.0
additionalEncryptedAttribute: 'elastic-migrated-encrypted', // this field was added in 7.9.0
};

// In these test cases, we simulate a scenario where some existing objects that are migrated when Kibana starts up. Note that when a
// document migration is triggered, the saved object "convert" transform is also applied by the Core migration algorithm.
describe('handles index migration correctly', () => {
describe('in the default space', () => {
it('for a saved object that needs to be migrated before it is converted', async () => {
const getApiUrl = getGetApiUrl({ objectId: '74f3e6d7-b7bb-477d-ac28-92ee22728e6e' });
const { body: decryptedResponse } = await supertest.get(getApiUrl).expect(200);
expect(decryptedResponse.attributes).to.eql(expectedDecryptedAttributes);
});

it('for a saved object that does not need to be migrated before it is converted', async () => {
const getApiUrl = getGetApiUrl({ objectId: '362828f0-eef2-11eb-9073-11359682300a' });
const { body: decryptedResponse } = await supertest.get(getApiUrl).expect(200);
expect(decryptedResponse.attributes).to.eql(expectedDecryptedAttributes);
});
});

describe('in a custom space', () => {
const spaceId = 'custom-space';

it('for a saved object that needs to be migrated before it is converted', async () => {
const getApiUrl = getGetApiUrl({
objectId: 'a98e22f8-530e-5d69-baf7-97526796f3a6', // This ID is not found in the data.json file, it is dynamically generated when the object is converted; the original ID is a67c6950-eed8-11eb-9a62-032b4e4049d1
spaceId,
});
const { body: decryptedResponse } = await supertest.get(getApiUrl).expect(200);
expect(decryptedResponse.attributes).to.eql(expectedDecryptedAttributes);
});

it('for a saved object that does not need to be migrated before it is converted', async () => {
const getApiUrl = getGetApiUrl({
objectId: '41395c74-da7a-5679-9535-412d550a6cf7', // This ID is not found in the data.json file, it is dynamically generated when the object is converted; the original ID is 36448a90-eef2-11eb-9073-11359682300a
spaceId,
});
const { body: decryptedResponse } = await supertest.get(getApiUrl).expect(200);
expect(decryptedResponse.attributes).to.eql(expectedDecryptedAttributes);
});
});
});

// In these test cases, we simulate a scenario where new objects are migrated upon creation. This happens because an outdated
// `migrationVersion` field is included below. Note that when a document migration is triggered, the saved object "convert" transform
// is *not* applied by the Core migration algorithm.
describe('handles document migration correctly', () => {
function getCreateApiUrl({ spaceId }: { spaceId?: string } = {}) {
const spacePrefix = spaceId ? `/s/${spaceId}` : '';
return `${spacePrefix}/api/saved_objects/saved-object-with-migration`;
}

const objectToCreate = {
attributes: {
encryptedAttribute: 'this is my secret api key',
nonEncryptedAttribute: 'elastic',
},
migrationVersion: { 'saved-object-with-migration': '7.7.0' },
};

it('in the default space', async () => {
const createApiUrl = getCreateApiUrl();
const { body: savedObject } = await supertest
.post(createApiUrl)
.set('kbn-xsrf', 'xxx')
.send(objectToCreate)
.expect(200);
const { id: objectId } = savedObject;

const getApiUrl = getGetApiUrl({ objectId });
const { body: decryptedResponse } = await supertest.get(getApiUrl).expect(200);
expect(decryptedResponse.attributes).to.eql(expectedDecryptedAttributes);
});

it('in a custom space', async () => {
const spaceId = 'custom-space';
const createApiUrl = getCreateApiUrl({ spaceId });
const { body: savedObject } = await supertest
.post(createApiUrl)
.set('kbn-xsrf', 'xxx')
.send(objectToCreate)
.expect(200);
const { id: objectId } = savedObject;
it('migrates unencrypted fields on saved objects', async () => {
const { body: decryptedResponse } = await supertest
.get(
`/api/saved_objects/get-decrypted-as-internal-user/saved-object-with-migration/74f3e6d7-b7bb-477d-ac28-92ee22728e6e`
)
.expect(200);

const getApiUrl = getGetApiUrl({ objectId, spaceId });
const { body: decryptedResponse } = await supertest.get(getApiUrl).expect(200);
expect(decryptedResponse.attributes).to.eql(expectedDecryptedAttributes);
expect(decryptedResponse.attributes).to.eql({
// ensures the encrypted field can still be decrypted after the migration
encryptedAttribute: 'this is my secret api key',
// ensures the non-encrypted field has been migrated in 7.8.0
nonEncryptedAttribute: 'elastic-migrated',
// ensures the non-encrypted field has been migrated into a new encrypted field in 7.9.0
additionalEncryptedAttribute: 'elastic-migrated-encrypted',
});
});
});
Expand Down

0 comments on commit 6c1dd27

Please sign in to comment.