[Response Ops][Connectors] Add unsecured actions client to allow system to schedule email action

x-pack/plugins/actions/server/create_unsecured_execute_function.ts

@@ -0,0 +1,160 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { compact } from 'lodash';
+import { ISavedObjectsRepository, SavedObjectsBulkResponse } from '@kbn/core/server';
+import { TaskManagerStartContract } from '@kbn/task-manager-plugin/server';
+import {
+ ActionTypeRegistryContract as ConnectorTypeRegistryContract,
+ PreConfiguredAction as PreconfiguredConnector,
+} from './types';
+import { ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE } from './constants/saved_objects';
+import { ExecuteOptions as ActionExecutorOptions } from './lib/action_executor';
+import { extractSavedObjectReferences, isSavedObjectExecutionSource } from './lib';
+import { RelatedSavedObjects } from './lib/related_saved_objects';
+
+interface CreateBulkUnsecuredExecuteFunctionOptions {
+ taskManager: TaskManagerStartContract;
+ isESOCanEncrypt: boolean;
+ connectorTypeRegistry: ConnectorTypeRegistryContract;
+ preconfiguredConnectors: PreconfiguredConnector[];
+}
+
+export interface ExecuteOptions extends Pick<ActionExecutorOptions, 'params' | 'source'> {
+ id: string;
+ spaceId: string;
+ apiKey: string | null;
+ executionId: string;
+ consumer?: string;
+ relatedSavedObjects?: RelatedSavedObjects;
+}
+
+export interface ActionTaskParams extends Pick<ActionExecutorOptions, 'params'> {
+ actionId: string;
+ apiKey: string | null;
+ executionId: string;
+ consumer?: string;
+ relatedSavedObjects?: RelatedSavedObjects;
+}
+
+export type BulkUnsecuredExecutionEnqueuer<T> = (
+ internalSavedObjectsRepository: ISavedObjectsRepository,
+ actionsToExectute: ExecuteOptions[]
+) => Promise<T>;
+
+export function createBulkUnsecuredExecutionEnqueuerFunction({
+ taskManager,
+ connectorTypeRegistry,
+ isESOCanEncrypt,
+ preconfiguredConnectors,
+}: CreateBulkUnsecuredExecuteFunctionOptions): BulkUnsecuredExecutionEnqueuer<void> {
+ return async function execute(
+ internalSavedObjectsRepository: ISavedObjectsRepository,
+ actionsToExecute: ExecuteOptions[]
+ ) {
+ if (!isESOCanEncrypt) {
+ throw new Error(
+ `Unable to execute actions because the Encrypted Saved Objects plugin is missing encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in the kibana.yml or use the bin/kibana-encryption-keys command.`
+ );
+ }
+
+ const connectorTypeIds: Record<string, string> = {};
+ const spaceIds: Record<string, string> = {};
+ const connectorIds = [...new Set(actionsToExecute.map((action) => action.id))];
+
+ const notPreconfiguredConnectors = connectorIds.filter(
+ (connectorId) =>
+ preconfiguredConnectors.find((connector) => connector.id === connectorId) == null
+ );
+
+ if (notPreconfiguredConnectors.length > 0) {
+ // log warning or throw error?
+ }
+
+ const connectors: PreconfiguredConnector[] = compact(
+ connectorIds.map((connectorId) =>
+ preconfiguredConnectors.find((pConnector) => pConnector.id === connectorId)
+ )
+ );
+
+ connectors.forEach((connector) => {
+ const { id, actionTypeId } = connector;
+ if (!connectorTypeRegistry.isActionExecutable(id, actionTypeId, { notifyUsage: true })) {
+ connectorTypeRegistry.ensureActionTypeEnabled(actionTypeId);
+ }
+
+ connectorTypeIds[id] = actionTypeId;
+ });
+
+ const actions = await Promise.all(
+ actionsToExecute.map(async (actionToExecute) => {
+ // Get saved object references from action ID and relatedSavedObjects
+ const { references, relatedSavedObjectWithRefs } = extractSavedObjectReferences(
+ actionToExecute.id,
+ true,
+ actionToExecute.relatedSavedObjects
+ );
+ const executionSourceReference = executionSourceAsSavedObjectReferences(
+ actionToExecute.source
+ );
+
+ const taskReferences = [];
+ if (executionSourceReference.references) {
+ taskReferences.push(...executionSourceReference.references);
+ }
+ if (references) {
+ taskReferences.push(...references);
+ }
+
+ spaceIds[actionToExecute.id] = actionToExecute.spaceId;
+
+ return {
+ type: ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE,
+ attributes: {
+ actionId: actionToExecute.id,
+ params: actionToExecute.params,
+ apiKey: actionToExecute.apiKey,
+ executionId: actionToExecute.executionId,
+ consumer: actionToExecute.consumer,
+ relatedSavedObjects: relatedSavedObjectWithRefs,
+ },
+ references: taskReferences,
+ };
+ })
+ );
+
+ const actionTaskParamsRecords: SavedObjectsBulkResponse<ActionTaskParams> =
+ await internalSavedObjectsRepository.bulkCreate(actions);
+
+ const taskInstances = actionTaskParamsRecords.saved_objects.map((so) => {
+ const actionId = so.attributes.actionId;
+ return {
+ taskType: `actions:${connectorTypeIds[actionId]}`,
+ params: {
+ spaceId: spaceIds[actionId],
+ actionTaskParamsId: so.id,
+ },
+ state: {},
+ scope: ['actions'],
+ };
+ });
+ await taskManager.bulkSchedule(taskInstances);
+ };
+}
+
+function executionSourceAsSavedObjectReferences(executionSource: ActionExecutorOptions['source']) {
+ return isSavedObjectExecutionSource(executionSource)
+ ? {
+ references: [
+ {
+ name: 'source',
+ ...executionSource.source,
+ },
+ ],
+ }
+ : {};
+}

x-pack/plugins/actions/server/plugin.ts

@@ -101,6 +101,9 @@ import { createSubActionConnectorFramework } from './sub_action_framework';
 import { IServiceAbstract, SubActionConnectorType } from './sub_action_framework/types';
 import { SubActionConnector } from './sub_action_framework/sub_action_connector';
 import { CaseConnector } from './sub_action_framework/case';
+import { UnsecuredActionsClientAccessRegistry } from './unsecured_actions_client/unsecured_actions_client_access_registry';
+import { UnsecuredActionsClient } from './unsecured_actions_client/unsecured_actions_client';
+import { createBulkUnsecuredExecutionEnqueuerFunction } from './create_unsecured_execute_function';
 
 export interface PluginSetupContract {
  registerType<
@@ -117,6 +120,7 @@ export interface PluginSetupContract {
  >(
  connector: SubActionConnectorType<Config, Secrets>
  ): void;
+ registerUnsecuredActionsClientAccess(featureId: string): void;
  isPreconfiguredConnector(connectorId: string): boolean;
  getSubActionConnectorClass: <Config, Secrets>() => IServiceAbstract<Config, Secrets>;
  getCaseConnectorClass: <Config, Secrets>() => IServiceAbstract<Config, Secrets>;
@@ -138,6 +142,8 @@ export interface PluginStartContract {
 
  preconfiguredActions: PreConfiguredAction[];
 
+ getUnsecuredActionsClient(): Promise<PublicMethodsOf<UnsecuredActionsClient>>;
+
  renderActionParameterTemplates<Params extends ActionTypeParams = ActionTypeParams>(
  actionTypeId: string,
  actionId: string,
@@ -188,6 +194,7 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
  private readonly preconfiguredActions: PreConfiguredAction[];
  private inMemoryMetrics: InMemoryMetrics;
  private kibanaIndex?: string;
+ private unsecuredActionsClientAccessRegistry?: UnsecuredActionsClientAccessRegistry;
 
  constructor(initContext: PluginInitializerContext) {
  this.logger = initContext.logger.get();
@@ -266,6 +273,8 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
  this.actionExecutor = actionExecutor;
  this.security = plugins.security;
 
+ this.unsecuredActionsClientAccessRegistry = new UnsecuredActionsClientAccessRegistry();
+
  setupSavedObjects(
  core.savedObjects,
  plugins.encryptedSavedObjects,
@@ -361,6 +370,9 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
  ) => {
  subActionFramework.registerConnector(connector);
  },
+ registerUnsecuredActionsClientAccess: (featureId: string) => {
+ this.unsecuredActionsClientAccessRegistry?.register(featureId);
+ },
  isPreconfiguredConnector: (connectorId: string): boolean => {
  return !!this.preconfiguredActions.find(
  (preconfigured) => preconfigured.id === connectorId
@@ -452,6 +464,29 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
  });
  };
 
+ const getUnsecuredActionsClient = async () => {
+ if (isESOCanEncrypt !== true) {
+ throw new Error(
+ `Unable to create unsecured actions client because the Encrypted Saved Objects plugin is missing encryption key. Please set xpack.encryptedSavedObjects.encryptionKey in the kibana.yml or use the bin/kibana-encryption-keys command.`
+ );
+ }
+
+ const internalSavedObjectsRepository = core.savedObjects.createInternalRepository([
+ ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE,
+ ]);
+
+ return new UnsecuredActionsClient({
+ internalSavedObjectsRepository,
+ unsecuredActionsClientAccessRegistry: this.unsecuredActionsClientAccessRegistry!,
+ executionEnqueuer: createBulkUnsecuredExecutionEnqueuerFunction({
+ taskManager: plugins.taskManager,
+ connectorTypeRegistry: actionTypeRegistry!,
+ isESOCanEncrypt: isESOCanEncrypt!,
+ preconfiguredConnectors: preconfiguredActions,
+ }),
+ });
+ };
+
  // Ensure the public API cannot be used to circumvent authorization
  // using our legacy exemption mechanism by passing in a legacy SO
  // as authorizationContext which would then set a Legacy AuthorizationMode
@@ -532,6 +567,7 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
  return instantiateAuthorization(request);
  },
  getActionsClientWithRequest: secureGetActionsClientWithRequest,
+ getUnsecuredActionsClient,
  preconfiguredActions,
  renderActionParameterTemplates: (...args) =>
  renderActionParameterTemplates(actionTypeRegistry, ...args),

x-pack/plugins/actions/server/unsecured_actions_client/unsecured_actions_client.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ISavedObjectsRepository } from '@kbn/core/server';
+import { UnsecuredActionsClientAccessRegistry } from './unsecured_actions_client_access_registry';
+import {
+ BulkUnsecuredExecutionEnqueuer,
+ ExecuteOptions,
+} from '../create_unsecured_execute_function';
+
+export interface UnsecuredActionsClientOpts {
+ unsecuredActionsClientAccessRegistry: UnsecuredActionsClientAccessRegistry;
+ internalSavedObjectsRepository: ISavedObjectsRepository;
+ executionEnqueuer: BulkUnsecuredExecutionEnqueuer<void>;
+}
+
+export class UnsecuredActionsClient {
+ private readonly unsecuredActionsClientAccessRegistry: UnsecuredActionsClientAccessRegistry;
+ private readonly internalSavedObjectsRepository: ISavedObjectsRepository;
+ private readonly executionEnqueuer: BulkUnsecuredExecutionEnqueuer<void>;
+
+ constructor(params: UnsecuredActionsClientOpts) {
+ this.unsecuredActionsClientAccessRegistry = params.unsecuredActionsClientAccessRegistry;
+ this.executionEnqueuer = params.executionEnqueuer;
+ this.internalSavedObjectsRepository = params.internalSavedObjectsRepository;
+ }
+
+ public async bulkEnqueueExecution(
+ requesterId: string,
+ actionsToExecute: ExecuteOptions[]
+ ): Promise<void> {
+ // Check that requesterId is allowed
+ if (!this.unsecuredActionsClientAccessRegistry.has(requesterId)) {
+ throw new Error(
+ `${requesterId} feature is not registered for UnsecuredActionsClient access.`
+ );
+ }
+ return this.executionEnqueuer(this.internalSavedObjectsRepository, actionsToExecute);
+ }
+}

x-pack/plugins/actions/server/unsecured_actions_client/unsecured_actions_client_access_registry.ts

@@ -0,0 +1,24 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export class UnsecuredActionsClientAccessRegistry {
+ private readonly allowedFeatureIds: Map<string, boolean> = new Map();
+
+ /**
+ * Returns if the access registry has the given feature id registered
+ */
+ public has(id: string) {
+ return this.allowedFeatureIds.has(id);
+ }
+
+ /**
+ * Registers feature id to the access registry
+ */
+ public register(id: string) {
+ this.allowedFeatureIds.set(id, true);
+ }
+}

x-pack/plugins/alerting/server/plugin.ts

@@ -219,6 +219,8 @@ export class AlertingPlugin {
  this.eventLogService = plugins.eventLog;
  plugins.eventLog.registerProviderActions(EVENT_LOG_PROVIDER, Object.values(EVENT_LOG_ACTIONS));
 
+ plugins.actions.registerUnsecuredActionsClientAccess('alerting');
+
  const ruleTypeRegistry = new RuleTypeRegistry({
  logger: this.logger,
  taskManager: plugins.taskManager,
@@ -462,6 +464,21 @@ export class AlertingPlugin {
  scheduleAlertingHealthCheck(this.logger, this.config, plugins.taskManager);
  scheduleApiKeyInvalidatorTask(this.telemetryLogger, this.config, plugins.taskManager);
 
+ plugins.actions.getUnsecuredActionsClient().then((unsecuredActionsClient) => {
+ unsecuredActionsClient.bulkEnqueueExecution('alerting', [
+ {
+ id: 'gmail',
+ params: {
+ to: ['xxxxxx'],
+ subject: 'hello from Kibana!',
+ message: 'does this work??',
+ },
+ spaceId: 'default',
+ apiKey: null,
+ executionId: 'abc',
+ },
+ ]);
+ });
  return {
  listTypes: ruleTypeRegistry!.list.bind(this.ruleTypeRegistry!),
  getAlertingAuthorizationWithRequest,