[Guided onboarding] Use Kibana features to grant access #155065

yuliacech · 2023-04-17T16:15:36Z

Summary

This PR adds a Kibana feature for the guided onboarding plugin for better permissions handling. By default kibana_admin and editor roles are granted access to guided onboarding. The role viewer on the other hand doesn't have enough permissions to see or use guided onboarding. For any roles that don't have the correct permissions, guided onboarding is completely disabled, the same as it's disabled on-prem.
When creating a new role, the feature "Setup guides" can be enabled or disabled.

How to test

Add xpack.cloud.id: 'testID' to /config/kibana.dev.yml
Start ES with yarn es snapshot and Kibana with `yarn start``
Login as elastic and create a test user with the role viewer
Clear everything from your browser's local storage
Login as the test user and check the following

On the first visit, the "on-prem" welcome message is shown (not the guided onboarding landing page)
The url /app/home#/getting_started is unknown and redirects back to the home page
There is no button "Setup guides" in the header
There is no link "Setup guides" in the help menu

Checklist

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

…dle permissions issues

…fix'

…te/redirection when guided onboarding is disabled

…bled

…fix'

…-fix'

yuliacech · 2023-04-20T17:53:48Z

x-pack/test/ui_capabilities/security_and_spaces/tests/nav_links.ts

@@ -57,7 +57,8 @@ export default function navLinksTests({ getService }: FtrProviderContext) {
 'enterpriseSearchContent',
 'enterpriseSearchAnalytics',
 'appSearch',
- 'workplaceSearch'
+ 'workplaceSearch',
+ 'guidedOnboarding'


I'm not quite sure what is the correct approach to fix these tests

@elastic/kibana-security Another question for the team: if you own these tests, could you please provide some guidance on what is being tested here and what is the best approach to fix those?

Hi @yuliacech Sorry for the delay. The except method matches the feature ID to set the expected value to false. The feature ID is actually 'guidedOnboardingFeature',

kibana/src/plugins/guided_onboarding/common/constants.ts

Line 14 in d09c6cc

export const PLUGIN_FEATURE = 'guidedOnboardingFeature';

This explains why it was still being set to true and those 3 tests were failing. I think you'll want to move the 'everything_space_all at everything_space' case. If I understand the feature/privileges correctly, this case should enable the navlink.

elasticmachine · 2023-04-20T17:57:07Z

Pinging @elastic/platform-onboarding (Team:Journey/Onboarding)

thomheymann

Security changes LGTM!

alisonelizabeth

Thanks for working on this @yuliacech! Changes LGTM. Verified locally. I see some tests are failing, but it looks like you're already aware and looking into it.

I have one question about Kibana features. This is probably more for Kibana Security team, but - do we document the features anywhere? I'm just wondering if users are going to know what "Setup guides" is when it appears in the list.

yuliacech · 2023-04-21T16:32:56Z

Thanks a lot for your review, @alisonelizabeth!
That is great questions about the documentation for features, I haven't thought about that. @elastic/kibana-security What is the recommended way of documenting a new feature when we register it?

lukeelmers

Thanks for jumping on this so quickly @yuliacech!

I'm just wondering if users are going to know what "Setup guides" is when it appears in the list.

Probably something I should know the answer to, but @elastic/kibana-security is there a way to hide this from the privileges UI altogether? I don't think there's a reason someone would ever want/need to remove these permissions?

lukeelmers · 2023-04-21T17:16:02Z

src/plugins/guided_onboarding/common/constants.ts

@@ -10,3 +10,5 @@ export const PLUGIN_ID = 'guidedOnboarding';
 export const PLUGIN_NAME = 'guidedOnboarding';

 export const API_BASE_PATH = '/api/guided_onboarding';


This API really should be /internal/guided_onboarding. I can't think of any reason why a user would need to use this API directly, and by using the /api path prefix, we are indicating it is public, meaning you can't make any breaking changes to it without approvals, a long deprecation period, etc.

Agree @lukeelmers, I opened this issue to change the route's prefix. Our team was not aware of this convention when setting up the plugin.
What do you think, do we have to handle the prefix issue as a breaking change or can we update it in the next minor? The plugin was first released in 8.7

Since it was introduced recently & is undocumented (and also something folks would be unlikely to discover and get much utility out of), then IMO if you fix it quickly, you are probably safe to change it, treat this as a bug, and document it in the release notes.

legrego · 2023-04-24T01:18:00Z

Probably something I should know the answer to, but @elastic/kibana-security is there a way to hide this from the privileges UI altogether? I don't think there's a reason someone would ever want/need to remove these permissions?

@lukeelmers Yes, there are two ways for us to do this, depending on the privileges required: we can either enable this for all users, or we can enable this for users with the kibana_admin or equivalent role. If your needs don't fit into these two categories, then the only way to grant access is to expose it on this screen.

I discussed these options with @yuliacech, and IIUC the product team decided that exposing it was the best approach for their needs. I don't want to put words into their mouths, so perhaps Yulia can confirm this.

legrego · 2023-04-24T01:19:50Z

@elastic/kibana-security What is the recommended way of documenting a new feature when we register it?

@yuliacech we don't document these toggles in a central location. There is a public API that can be called to get the list of available features, but it doesn't offer any additional information than what you see in the UI: https://www.elastic.co/guide/en/kibana/master/features-api-get.html

yuliacech · 2023-04-24T12:20:13Z

@lukeelmers @legrego Yes, I can confirm that we want to show the guided onboarding feature in the capabilities UI. I think it's important for deployment admins to be able to configure this feature for different roles.

jeramysoucy

Sorry for the delay. I found the issue.

jeramysoucy · 2023-04-24T16:00:29Z

x-pack/test/ui_capabilities/security_and_spaces/tests/nav_links.ts

@@ -57,7 +57,8 @@ export default function navLinksTests({ getService }: FtrProviderContext) {
 'enterpriseSearchContent',
 'enterpriseSearchAnalytics',
 'appSearch',
- 'workplaceSearch'
+ 'workplaceSearch',
+ 'guidedOnboarding'


Suggested change

'guidedOnboarding'

'guidedOnboardingFeature'

Alternative - change the ID to 'guidedOnboarding'. This may be more consistent with other feature ID's.

Thanks a lot for this suggestions, @jeramysoucy! I think that should fix the tests.

jeramysoucy · 2023-04-24T16:03:15Z

x-pack/test/ui_capabilities/security_and_spaces/tests/nav_links.ts

@@ -57,7 +57,8 @@ export default function navLinksTests({ getService }: FtrProviderContext) {
 'enterpriseSearchContent',
 'enterpriseSearchAnalytics',
 'appSearch',
- 'workplaceSearch'
+ 'workplaceSearch',
+ 'guidedOnboarding'


Hi @yuliacech Sorry for the delay. The except method matches the feature ID to set the expected value to false. The feature ID is actually 'guidedOnboardingFeature',

kibana/src/plugins/guided_onboarding/common/constants.ts

Line 14 in d09c6cc

export const PLUGIN_FEATURE = 'guidedOnboardingFeature';

This explains why it was still being set to true and those 3 tests were failing. I think you'll want to move the 'everything_space_all at everything_space' case. If I understand the feature/privileges correctly, this case should enable the navlink.

rshen91

Changes LGTM - tested locally

TinaHeiligers

LGTM

kibana-ci · 2023-04-26T11:34:00Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: 98e2564

Failed CI Steps

FTR Configs #52

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`guidedOnboarding`	56	57	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`home`	159.6KB	159.7KB	+128.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`cloudLinks`	3.0KB	3.1KB	+93.0B
`guidedOnboarding`	27.2KB	27.2KB	+50.0B
total			+143.0B

Unknown metric groups

API count

id	before	after	diff
`guidedOnboarding`	57	58	+1

ESLint disabled line counts

id	before	after	diff
`enterpriseSearch`	17	19	+2
`securitySolution`	399	402	+3
total			+5

References to deprecated APIs

id	before	after	diff
`guidedOnboarding`	0	3	+3

Total ESLint disabled count

id	before	after	diff
`enterpriseSearch`	18	20	+2
`securitySolution`	479	482	+3
total			+5

History

💔 Build #123376 failed 17f68ed
💔 Build #123107 failed 57bcef3
💔 Build #123078 failed d58198a
💔 Build #123061 failed 1abaab9
💚 Build #122832 succeeded 6ab8f1d

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* main: (1294 commits) [SecuritySolution] Refactor security packages (elastic#155365) [Discover] Show "Temporary" badge for ad-hoc data views in Alerts flyout (elastic#155717) [RAM] Conditional actions feedback on pr review (elastic#155804) [Files] Adds bulk delete method (elastic#155628) [Lens] Use proper way to generate absolute short URL (elastic#155512) [Guided onboarding] Use Kibana features to grant access (elastic#155065) [Index Management] Fix duped mock (elastic#155844) [Lens] Enhance visualization modifier popup with layer palette (elastic#155280) Fix flaky combobox tests on role management screen (elastic#155711) [Infrastructure UI] Create InventoryViewsService and InventoryViewsClient (elastic#155126) [Fleet] always create agent upload write indices (elastic#155729) [Fleet] [Cloud Security Posture] Add CloudFormation agent install method (elastic#155045) Add tech preview label for search applications (elastic#155649) [ML] AIOps: Stabilize flaky functional tests. (elastic#155710) [ES UI Shared] Migrate JsonEditor to monaco (elastic#155610) [Security Solution] Fixes security_solution storybooks always rendering in a flyout (elastic#155814) [Synthetics] Make error popover disappear `onMouseLeave` of metric item card (elastic#155800) Remove Exploratory View components from Observability (elastic#155629) [Discover] Remove redundant "Filter was added" toast (elastic#155645) [RAM][Security Solution][Alerts] Support the ability to trigger a rule action per alert generated (elastic#153611) (elastic#155384) ...

## Summary This PR fixes a bug introduced in #155065 that I noticed when testing guided onboarding for v8.9.0: the help link was missing from the help menu. I added a functional test for the help link but we also need a test that the link is hidden when the user doesn't have access to guided onboarding (opened an issue for that [here](#156410)). ### How to test 1. Add xpack.cloud.id: 'testID' to /config/kibana.dev.yml 2. Start ES with yarn es snapshot and Kibana with `yarn start`` 3. Check that the help link "Setup guides" is displayed in the help menu ### Screenshot <img width="336" alt="Screenshot 2023-05-02 at 17 27 20" src="https://user-images.githubusercontent.com/6585477/235712599-812b422d-3092-45b3-a726-37f6b90e81c1.png">

## Summary This PR fixes a bug introduced in elastic#155065 that I noticed when testing guided onboarding for v8.9.0: the help link was missing from the help menu. I added a functional test for the help link but we also need a test that the link is hidden when the user doesn't have access to guided onboarding (opened an issue for that [here](elastic#156410)). ### How to test 1. Add xpack.cloud.id: 'testID' to /config/kibana.dev.yml 2. Start ES with yarn es snapshot and Kibana with `yarn start`` 3. Check that the help link "Setup guides" is displayed in the help menu ### Screenshot <img width="336" alt="Screenshot 2023-05-02 at 17 27 20" src="https://user-images.githubusercontent.com/6585477/235712599-812b422d-3092-45b3-a726-37f6b90e81c1.png"> (cherry picked from commit d00e2a3)

# Backport This will backport the following commits from `main` to `8.8`: - [[Guided onboarding] Fix the missing help link (#156399)](#156399)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Yulia Čech <6585477+yuliacech@users.noreply.github.com>

[Guided onboarding] Add a Kibana feature for guided onboarding to han…

f47827c

…dle permissions issues

yuliacech added Team:Journey/Onboarding Platform Journey Onboarding team release_note:skip Skip the PR/issue when compiling release notes v8.8.0 labels Apr 17, 2023

kibanamachine and others added 12 commits April 17, 2023 16:21

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

40b3bab

…fix'

[Guided onboarding] Remove the header button and the landing page rou…

f57bc64

…te/redirection when guided onboarding is disabled

[Guided onboarding] Remove the help link if guided onboarding is disa…

1ba51f7

…bled

[Guided onboarding] Add an error state to the example plugin

16d92f6

[CI] Auto-commit changed files from 'node scripts/lint_ts_projects --…

4d48b58

…fix'

Merge branch 'main' into guided_onboarding/8.8/roles

802bba1

[Guided onboarding] Fix cloud links tests

2c8af74

[Guided onboarding] Fix home plugin tests

72e70d8

[Guided onboarding] Update home plugin snapshots

5e9cee7

[Guided onboarding] Fix security functional tests

50e8d8d

Merge branch 'main' into guided_onboarding/8.8/roles

266697f

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

547f790

…-fix'

yuliacech commented Apr 20, 2023

View reviewed changes

[Guided onboarding] Add a comment to the "read" feature privileges

f8d73b5

yuliacech marked this pull request as ready for review April 20, 2023 17:57

yuliacech requested review from a team as code owners April 20, 2023 17:57

thomheymann approved these changes Apr 21, 2023

View reviewed changes

alisonelizabeth approved these changes Apr 21, 2023

View reviewed changes

lukeelmers reviewed Apr 21, 2023

View reviewed changes

Merge branch 'main' into guided_onboarding/8.8/roles

d09c6cc

yuliacech mentioned this pull request Apr 24, 2023

[Guided onboarding] Change the API routes from /api to /internal #155611

Closed

jeramysoucy reviewed Apr 24, 2023

View reviewed changes

[Guided onboarding] Fix functional tests

77a5b7a

rshen91 approved these changes Apr 24, 2023

View reviewed changes

Merge branch 'main' into guided_onboarding/8.8/roles

6ab8f1d

yuliacech enabled auto-merge (squash) April 25, 2023 08:45

yuliacech added 2 commits April 25, 2023 17:18

Merge branch 'main' into guided_onboarding/8.8/roles

1abaab9

Merge branch 'main' into guided_onboarding/8.8/roles

d58198a

TinaHeiligers approved these changes Apr 25, 2023

View reviewed changes

yuliacech added 3 commits April 25, 2023 18:36

Merge branch 'main' into guided_onboarding/8.8/roles

57bcef3

Merge branch 'main' into guided_onboarding/8.8/roles

17f68ed

Merge branch 'main' into guided_onboarding/8.8/roles

98e2564

yuliacech merged commit b75546f into elastic:main Apr 26, 2023

kibanamachine added the backport:skip This commit does not require backporting label Apr 26, 2023

This was referenced May 2, 2023

[Guided onboarding] Add functional tests for a user with no access #156410

Closed

[Guided onboarding] Fix the missing help link #156399

Merged

claracruz mentioned this pull request Jul 24, 2023

Kibana shows 'Setup guide' button and it is broken #157972

Closed

yuliacech deleted the guided_onboarding/8.8/roles branch February 15, 2024 12:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Guided onboarding] Use Kibana features to grant access #155065

[Guided onboarding] Use Kibana features to grant access #155065

yuliacech commented Apr 17, 2023 •

edited

Loading

yuliacech Apr 20, 2023

yuliacech Apr 21, 2023

jeramysoucy Apr 24, 2023

elasticmachine commented Apr 20, 2023

thomheymann left a comment

alisonelizabeth left a comment •

edited

Loading

yuliacech commented Apr 21, 2023

lukeelmers left a comment

lukeelmers Apr 21, 2023

yuliacech Apr 24, 2023

lukeelmers Apr 24, 2023

legrego commented Apr 24, 2023

legrego commented Apr 24, 2023

yuliacech commented Apr 24, 2023

jeramysoucy left a comment

jeramysoucy Apr 24, 2023

jeramysoucy Apr 24, 2023

yuliacech Apr 24, 2023

jeramysoucy Apr 24, 2023

rshen91 left a comment

TinaHeiligers left a comment

kibana-ci commented Apr 26, 2023

API count

ESLint disabled line counts

References to deprecated APIs

Total ESLint disabled count

		@@ -10,3 +10,5 @@ export const PLUGIN_ID = 'guidedOnboarding';
		export const PLUGIN_NAME = 'guidedOnboarding';

		export const API_BASE_PATH = '/api/guided_onboarding';

[Guided onboarding] Use Kibana features to grant access #155065

[Guided onboarding] Use Kibana features to grant access #155065

Conversation

yuliacech commented Apr 17, 2023 • edited Loading

Summary

How to test

Checklist

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Apr 20, 2023

thomheymann left a comment

Choose a reason for hiding this comment

alisonelizabeth left a comment • edited Loading

Choose a reason for hiding this comment

yuliacech commented Apr 21, 2023

lukeelmers left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

legrego commented Apr 24, 2023

legrego commented Apr 24, 2023

yuliacech commented Apr 24, 2023

jeramysoucy left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rshen91 left a comment

Choose a reason for hiding this comment

TinaHeiligers left a comment

Choose a reason for hiding this comment

kibana-ci commented Apr 26, 2023

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Public APIs missing comments

Async chunks

Page load bundle

API count

ESLint disabled line counts

References to deprecated APIs

Total ESLint disabled count

History

yuliacech commented Apr 17, 2023 •

edited

Loading

alisonelizabeth left a comment •

edited

Loading