Saved objects extensions refactor merge

packages/core/plugins/core-plugins-server-internal/src/plugin_context.ts

@@ -234,7 +234,9 @@ export function createPluginSetupContext<TPlugin, TPluginDependencies>(
     },
     savedObjects: {
       setClientFactoryProvider: deps.savedObjects.setClientFactoryProvider,
-      addClientWrapper: deps.savedObjects.addClientWrapper,
+      addEncryptionExtension: deps.savedObjects.addEncryptionExtension,
+      addSecurityExtension: deps.savedObjects.addSecurityExtension,
+      addSpacesExtension: deps.savedObjects.addSpacesExtension,
       registerType: deps.savedObjects.registerType,
       getKibanaIndex: deps.savedObjects.getKibanaIndex,
     },

packages/core/saved-objects/core-saved-objects-api-server-internal/src/lib/collect_multi_namespace_references.test.ts

@@ -26,6 +26,20 @@ import {
 } from './collect_multi_namespace_references';
 import { collectMultiNamespaceReferences } from './collect_multi_namespace_references';
 import type { CreatePointInTimeFinderFn } from './point_in_time_finder';
+import { AuditAction, ISavedObjectsSecurityExtension } from '@kbn/core-saved-objects-server';
+
+import {
+  authMap,
+  enforceError,
+  typeMapsAreEqual,
+  setsAreEqual,
+  setupCheckAuthorized,
+  setupCheckUnauthorized,
+  setupEnforceFailure,
+  setupEnforceSuccess,
+  setupRedactPassthrough,
+} from '../test_helpers/repository.test.common';
+import { savedObjectsExtensionsMock } from '@kbn/core-saved-objects-api-server-mocks';
 
 const SPACES = ['default', 'another-space'];
 const VERSION_PROPS = { _seq_no: 1, _primary_term: 1 };
@@ -50,7 +64,8 @@ describe('collectMultiNamespaceReferences', () => {
   /** Sets up the type registry, saved objects client, etc. and return the full parameters object to be passed to `collectMultiNamespaceReferences` */
   function setup(
     objects: SavedObjectsCollectMultiNamespaceReferencesObject[],
-    options: SavedObjectsCollectMultiNamespaceReferencesOptions = {}
+    options: SavedObjectsCollectMultiNamespaceReferencesOptions = {},
+    securityExtension?: ISavedObjectsSecurityExtension | undefined
   ): CollectMultiNamespaceReferencesParams {
     const registry = typeRegistryMock.create();
     registry.isMultiNamespace.mockImplementation(
@@ -65,8 +80,8 @@ describe('collectMultiNamespaceReferences', () => {
       (type) => [MULTI_NAMESPACE_OBJ_TYPE_1, MULTI_NAMESPACE_HIDDEN_OBJ_TYPE].includes(type) // MULTI_NAMESPACE_OBJ_TYPE_2 and NON_MULTI_NAMESPACE_TYPE are omitted
     );
     client = elasticsearchClientMock.createElasticsearchClient();
-
     const serializer = new SavedObjectsSerializer(registry);
+
     return {
       registry,
       allowedTypes: [
@@ -78,6 +93,7 @@ describe('collectMultiNamespaceReferences', () => {
       serializer,
       getIndexForType: (type: string) => `index-for-${type}`,
       createPointInTimeFinder: jest.fn() as CreatePointInTimeFinderFn,
+      securityExtension,
       objects,
       options,
     };
@@ -287,6 +303,7 @@ describe('collectMultiNamespaceReferences', () => {
       // obj3 is excluded from the results
     ]);
   });
+
   it(`handles 404 responses that don't come from Elasticsearch`, async () => {
     const createEsUnavailableNotFoundError = () => {
       return SavedObjectsErrorHelpers.createGenericNotFoundEsUnavailableError();
@@ -447,4 +464,213 @@ describe('collectMultiNamespaceReferences', () => {
       );
     });
   });
+
+  describe('with security enabled', () => {
+    const mockSecurityExt = savedObjectsExtensionsMock.createSecurityExtension();
+    const obj1 = { type: MULTI_NAMESPACE_OBJ_TYPE_1, id: 'id-1' };
+    const obj2 = { type: MULTI_NAMESPACE_OBJ_TYPE_1, id: 'id-2' };
+    const obj3 = { type: MULTI_NAMESPACE_OBJ_TYPE_1, id: 'id-3' };
+    const objects = [obj1, obj2];
+    const obj1LegacySpaces = ['space-1', 'space-2', 'space-3', 'space-4'];
+    let params: CollectMultiNamespaceReferencesParams;
+
+    beforeEach(() => {
+      params = setup([obj1, obj2], {}, mockSecurityExt);
+      mockMgetResults({ found: true, references: [obj3] }, { found: true, references: [] }); // results for obj1 and obj2
+      mockMgetResults({ found: true, references: [] }); // results for obj3
+      mockFindLegacyUrlAliases.mockResolvedValue(
+        new Map([
+          [`${obj1.type}:${obj1.id}`, new Set(obj1LegacySpaces)],
+          // the result map does not contain keys for obj2 or obj3 because we did not find any aliases for those objects
+        ])
+      );
+    });
+
+    afterEach(() => {
+      mockSecurityExt.checkAuthorization.mockReset();
+      mockSecurityExt.enforceAuthorization.mockReset();
+      mockSecurityExt.redactNamespaces.mockReset();
+      mockSecurityExt.addAuditEvent.mockReset();
+    });
+
+    describe(`errors`, () => {
+      test(`propagates decorated error when not authorized`, async () => {
+        setupCheckUnauthorized(mockSecurityExt);
+        // Unlike other functions, it doesn't validate the level of authorization first, so we need to
+        // carry on and mock the enforce function as well to create an unauthorized condition
+        setupEnforceFailure(mockSecurityExt);
+
+        await expect(collectMultiNamespaceReferences(params)).rejects.toThrow(enforceError);
+        expect(mockSecurityExt.checkAuthorization).toHaveBeenCalledTimes(1);
+        expect(mockSecurityExt.enforceAuthorization).toHaveBeenCalledTimes(1);
+      });
+
+      test(`adds audit event per object when not successful`, async () => {
+        setupCheckUnauthorized(mockSecurityExt);
+        // Unlike other functions, it doesn't validate the level of authorization first, so we need to
+        // carry on and mock the enforce function as well to create an unauthorized condition
+        setupEnforceFailure(mockSecurityExt);
+
+        await expect(collectMultiNamespaceReferences(params)).rejects.toThrow(enforceError);
+        expect(mockSecurityExt.checkAuthorization).toHaveBeenCalledTimes(1);
+        expect(mockSecurityExt.enforceAuthorization).toHaveBeenCalledTimes(1);
+
+        expect(mockSecurityExt.addAuditEvent).toHaveBeenCalledTimes(objects.length);
+        objects.forEach((obj) => {
+          expect(mockSecurityExt.addAuditEvent).toHaveBeenCalledWith({
+            action: AuditAction.COLLECT_MULTINAMESPACE_REFERENCES,
+            savedObject: { type: obj.type, id: obj.id },
+            error: enforceError,
+          });
+        });
+      });
+    });
+
+    describe('checks privileges', () => {
+      beforeEach(() => {
+        setupCheckUnauthorized(mockSecurityExt);
+        setupEnforceFailure(mockSecurityExt);
+      });
+      test(`in the default state`, async () => {
+        await expect(collectMultiNamespaceReferences(params)).rejects.toThrow(enforceError);
+
+        expect(mockSecurityExt.checkAuthorization).toHaveBeenCalledTimes(1);
+        const expectedSpaces = new Set(['default', ...SPACES, ...obj1LegacySpaces]);
+        const { spaces: actualSpaces } = mockSecurityExt.checkAuthorization.mock.calls[0][0];
+        expect(setsAreEqual(actualSpaces, expectedSpaces)).toBeTruthy();
+
+        expect(mockSecurityExt.enforceAuthorization).toHaveBeenCalledTimes(1);
+        const expectedTypesAndSpaces = new Map([[objects[0].type, new Set(['default'])]]);
+        const { typesAndSpaces: actualTypesAndSpaces } =
+          mockSecurityExt.enforceAuthorization.mock.calls[0][0];
+
+        expect(typeMapsAreEqual(actualTypesAndSpaces, expectedTypesAndSpaces)).toBeTruthy();
+      });
+
+      test(`in a non-default state`, async () => {
+        const namespace = 'space-X';
+        await expect(
+          collectMultiNamespaceReferences({ ...params, options: { namespace } })
+        ).rejects.toThrow(enforceError);
+
+        expect(mockSecurityExt.checkAuthorization).toHaveBeenCalledTimes(1);
+        const expectedSpaces = new Set([namespace, ...SPACES, ...obj1LegacySpaces]);
+        const { spaces: actualSpaces } = mockSecurityExt.checkAuthorization.mock.calls[0][0];
+        expect(setsAreEqual(actualSpaces, expectedSpaces)).toBeTruthy();
+
+        expect(mockSecurityExt.enforceAuthorization).toHaveBeenCalledTimes(1);
+        const expectedTypesAndSpaces = new Map([[objects[0].type, new Set([namespace])]]);
+        const { typesAndSpaces: actualTypesAndSpaces } =
+          mockSecurityExt.enforceAuthorization.mock.calls[0][0];
+
+        expect(typeMapsAreEqual(actualTypesAndSpaces, expectedTypesAndSpaces)).toBeTruthy();
+      });
+
+      test(`with purpose 'collectMultiNamespaceReferences'`, async () => {
+        const options: SavedObjectsCollectMultiNamespaceReferencesOptions = {
+          purpose: 'collectMultiNamespaceReferences',
+        };
+
+        setupCheckUnauthorized(mockSecurityExt);
+        setupEnforceFailure(mockSecurityExt);
+
+        await expect(collectMultiNamespaceReferences({ ...params, options })).rejects.toThrow(
+          enforceError
+        );
+        expect(mockSecurityExt.checkAuthorization).toHaveBeenCalledTimes(1);
+        expect(mockSecurityExt.checkAuthorization).toBeCalledWith(
+          expect.objectContaining({
+            actions: ['bulk_get'],
+          })
+        );
+        expect(mockSecurityExt.enforceAuthorization).toHaveBeenCalledTimes(1);
+      });
+
+      test(`with purpose 'updateObjectsSpaces'`, async () => {
+        const options: SavedObjectsCollectMultiNamespaceReferencesOptions = {
+          purpose: 'updateObjectsSpaces',
+        };
+
+        setupCheckUnauthorized(mockSecurityExt);
+        setupEnforceFailure(mockSecurityExt);
+
+        await expect(collectMultiNamespaceReferences({ ...params, options })).rejects.toThrow(
+          enforceError
+        );
+        expect(mockSecurityExt.checkAuthorization).toHaveBeenCalledTimes(1);
+        expect(mockSecurityExt.checkAuthorization).toBeCalledWith(
+          expect.objectContaining({
+            actions: ['share_to_space'],
+          })
+        );
+        expect(mockSecurityExt.enforceAuthorization).toHaveBeenCalledTimes(1);
+      });
+    });
+
+    describe('success', () => {
+      beforeEach(async () => {
+        setupCheckAuthorized(mockSecurityExt);
+        setupEnforceSuccess(mockSecurityExt);
+        setupRedactPassthrough(mockSecurityExt);
+        await collectMultiNamespaceReferences(params);
+      });
+      test(`calls redactNamespaces with type, spaces, and authorization map`, async () => {
+        expect(mockSecurityExt.checkAuthorization).toHaveBeenCalledTimes(1);
+        const expectedSpaces = new Set(['default', ...SPACES, ...obj1LegacySpaces]);
+        const { spaces: actualSpaces } = mockSecurityExt.checkAuthorization.mock.calls[0][0];
+        expect(setsAreEqual(actualSpaces, expectedSpaces)).toBeTruthy();
+
+        const resultObjects = [obj1, obj2, obj3];
+
+        // enforce is called once for all objects/spaces, then once per object
+        expect(mockSecurityExt.enforceAuthorization).toHaveBeenCalledTimes(
+          1 + resultObjects.length
+        );
+        const expectedTypesAndSpaces = new Map([[objects[0].type, new Set(['default'])]]);
+        const { typesAndSpaces: actualTypesAndSpaces } =
+          mockSecurityExt.enforceAuthorization.mock.calls[0][0];
+        expect(typeMapsAreEqual(actualTypesAndSpaces, expectedTypesAndSpaces)).toBeTruthy();
+
+        // Redact is called once per object, but an additional time for object 1 because it has legacy URL aliases in another set of spaces
+        expect(mockSecurityExt.redactNamespaces).toBeCalledTimes(resultObjects.length + 1);
+        const expectedRedactParams = [
+          { type: obj1.type, spaces: SPACES },
+          { type: obj1.type, spaces: obj1LegacySpaces },
+          { type: obj2.type, spaces: SPACES },
+          { type: obj3.type, spaces: SPACES },
+        ];
+
+        expectedRedactParams.forEach((expected, i) => {
+          const { savedObject, typeMap } = mockSecurityExt.redactNamespaces.mock.calls[i][0];
+          expect(savedObject).toEqual(
+            expect.objectContaining({
+              type: expected.type,
+              namespaces: expected.spaces,
+            })
+          );
+          expect(typeMap).toBe(authMap);
+        });
+      });
+
+      test(`adds audit event per object when successful`, async () => {
+        expect(mockSecurityExt.checkAuthorization).toHaveBeenCalledTimes(1);
+
+        const resultObjects = [obj1, obj2, obj3];
+
+        // enforce is called once for all objects/spaces, then once per object
+        expect(mockSecurityExt.enforceAuthorization).toHaveBeenCalledTimes(
+          1 + resultObjects.length
+        );
+
+        expect(mockSecurityExt.addAuditEvent).toHaveBeenCalledTimes(resultObjects.length);
+        resultObjects.forEach((obj) => {
+          expect(mockSecurityExt.addAuditEvent).toHaveBeenCalledWith({
+            action: AuditAction.COLLECT_MULTINAMESPACE_REFERENCES,
+            savedObject: { type: obj.type, id: obj.id },
+            error: undefined,
+          });
+        });
+      });
+    });
+  });
 });