Adds read_privileges route for lists and list items

x-pack/plugins/lists/common/constants.ts

@@ -10,6 +10,7 @@
 export const LIST_URL = '/api/lists';
 export const LIST_INDEX = `${LIST_URL}/index`;
 export const LIST_ITEM_URL = `${LIST_URL}/items`;
+export const LIST_PRIVILEGES_URL = `${LIST_URL}/privileges`;
 
 /**
  * Exception list routes

x-pack/plugins/lists/server/plugin.ts

@@ -48,7 +48,7 @@ export class ListPlugin
 
  core.http.registerRouteHandlerContext('lists', this.createRouteHandlerContext());
  const router = core.http.createRouter();
- initRoutes(router, config);
+ initRoutes(router, config, plugins.security);
 
  return {
  getExceptionListClient: (savedObjectsClient, user): ExceptionListClient => {

x-pack/plugins/lists/server/routes/init_routes.ts

@@ -6,8 +6,11 @@
 
 import { IRouter } from 'kibana/server';
 
+import { SecurityPluginSetup } from '../../../security/server';
 import { ConfigType } from '../config';
 
+import { readPrivilegesRoute } from './read_privileges_route';
+
 import {
  createExceptionListItemRoute,
  createExceptionListRoute,
@@ -38,14 +41,19 @@ import {
  updateListRoute,
 } from '.';
 
-export const initRoutes = (router: IRouter, config: ConfigType): void => {
+export const initRoutes = (
+ router: IRouter,
+ config: ConfigType,
+ security: SecurityPluginSetup | null | undefined
+): void => {
  // lists
  createListRoute(router);
  readListRoute(router);
  updateListRoute(router);
  deleteListRoute(router);
  patchListRoute(router);
  findListRoute(router);
+ readPrivilegesRoute(router, security);
 
  // list items
  createListItemRoute(router);

x-pack/plugins/lists/server/routes/read_privileges_route.ts

@@ -0,0 +1,60 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IRouter } from 'kibana/server';
+import { merge } from 'lodash/fp';
+
+import { SecurityPluginSetup } from '../../../security/server';
+import { LIST_PRIVILEGES_URL } from '../../common/constants';
+import { buildSiemResponse, readPrivileges, transformError } from '../siem_server_deps';
+
+import { getListClient } from './utils';
+
+export const readPrivilegesRoute = (
+ router: IRouter,
+ security: SecurityPluginSetup | null | undefined
+): void => {
+ router.get(
+ {
+ options: {
+ tags: ['access:lists'],
+ },
+ path: LIST_PRIVILEGES_URL,
+ validate: false,
+ },
+ async (context, request, response) => {
+ const siemResponse = buildSiemResponse(response);
+ try {
+ const clusterClient = context.core.elasticsearch.legacy.client;
+ const lists = getListClient(context);
+ const clusterPrivilegesLists = await readPrivileges(
+ clusterClient.callAsCurrentUser,
+ lists.getListIndex()
+ );
+ const clusterPrivilegesListItems = await readPrivileges(
+ clusterClient.callAsCurrentUser,
+ lists.getListIndex()
+ );
+ const privileges = merge(
+ {
+ listItems: clusterPrivilegesListItems,
+ lists: clusterPrivilegesLists,
+ },
+ {
+ is_authenticated: security?.authc.isAuthenticated(request) ?? false,
+ }
+ );
+ return response.ok({ body: privileges });
+ } catch (err) {
+ const error = transformError(err);
+ return siemResponse.error({
+ body: error.message,
+ statusCode: error.statusCode,
+ });
+ }
+ }
+ );
+};

x-pack/plugins/lists/server/scripts/get_privileges.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+#
+# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+# or more contributor license agreements. Licensed under the Elastic License;
+# you may not use this file except in compliance with the Elastic License.
+#
+
+set -e
+./check_env_variables.sh
+
+# Example: ./get_privileges.sh
+curl -s -k \
+ -u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
+ -X GET ${KIBANA_URL}${SPACE_URL}/api/lists/privileges | jq .

x-pack/plugins/lists/server/siem_server_deps.ts

@@ -17,4 +17,5 @@ export {
  createBootstrapIndex,
  getIndexExists,
  buildRouteValidation,
+ readPrivileges,
 } from '../../security_solution/server';

x-pack/plugins/security_solution/server/index.ts

@@ -54,3 +54,4 @@ export { createBootstrapIndex } from './lib/detection_engine/index/create_bootst
 export { getIndexExists } from './lib/detection_engine/index/get_index_exists';
 export { buildRouteValidation } from './utils/build_validation/route_validation';
 export { transformError, buildSiemResponse } from './lib/detection_engine/routes/utils';
+export { readPrivileges } from './lib/detection_engine/privileges/read_privileges';