-
Notifications
You must be signed in to change notification settings - Fork 8.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[Reporting] Use the deprecations service to advise critical config ch…
…anges (#100427) (#100750) Co-authored-by: Kibana Machine <[email protected]> # Conflicts: # x-pack/plugins/reporting/server/core.ts # x-pack/plugins/reporting/server/plugin.ts
- Loading branch information
Showing
6 changed files
with
174 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,107 @@ | ||
/* | ||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
* or more contributor license agreements. Licensed under the Elastic License | ||
* 2.0; you may not use this file except in compliance with the Elastic License | ||
* 2.0. | ||
*/ | ||
|
||
import { ReportingCore } from '.'; | ||
import { registerDeprecations } from './deprecations'; | ||
import { createMockConfigSchema, createMockReportingCore } from './test_helpers'; | ||
import { coreMock, elasticsearchServiceMock } from 'src/core/server/mocks'; | ||
import { GetDeprecationsContext, IScopedClusterClient } from 'kibana/server'; | ||
|
||
let reportingCore: ReportingCore; | ||
let context: GetDeprecationsContext; | ||
let esClient: jest.Mocked<IScopedClusterClient>; | ||
|
||
beforeEach(async () => { | ||
const mockReportingConfig = createMockConfigSchema({ roles: { enabled: false } }); | ||
reportingCore = await createMockReportingCore(mockReportingConfig); | ||
esClient = elasticsearchServiceMock.createScopedClusterClient(); | ||
esClient.asCurrentUser.security.getUser = jest.fn().mockResolvedValue({ | ||
body: { xyz: { username: 'normal_user', roles: ['data_analyst'] } }, | ||
}); | ||
context = ({ esClient } as unknown) as GetDeprecationsContext; | ||
}); | ||
|
||
test('logs no deprecations when setup has no issues', async () => { | ||
const { getDeprecations } = await registerDeprecations(reportingCore, coreMock.createSetup()); | ||
expect(await getDeprecations(context)).toMatchInlineSnapshot(`Array []`); | ||
}); | ||
|
||
test('logs a plain message when only a reporting_user role issue is found', async () => { | ||
esClient.asCurrentUser.security.getUser = jest.fn().mockResolvedValue({ | ||
body: { reportron: { username: 'reportron', roles: ['kibana_admin', 'reporting_user'] } }, | ||
}); | ||
|
||
const { getDeprecations } = await registerDeprecations(reportingCore, coreMock.createSetup()); | ||
expect(await getDeprecations(context)).toMatchInlineSnapshot(` | ||
Array [ | ||
Object { | ||
"correctiveActions": Object { | ||
"manualSteps": Array [ | ||
"Create one or more custom roles that provide Kibana application privileges to reporting features in **Management > Security > Roles**.", | ||
"Assign the custom role(s) as desired, and remove the \\"reporting_user\\" role from the user(s).", | ||
], | ||
}, | ||
"documentationUrl": "https://www.elastic.co/guide/en/kibana/current/secure-reporting.html", | ||
"level": "critical", | ||
"message": "The deprecated \\"reporting_user\\" role has been found for 1 user(s): \\"reportron\\"", | ||
}, | ||
] | ||
`); | ||
}); | ||
|
||
test('logs multiple entries when multiple reporting_user role issues are found', async () => { | ||
esClient.asCurrentUser.security.getUser = jest.fn().mockResolvedValue({ | ||
body: { | ||
reportron: { username: 'reportron', roles: ['kibana_admin', 'reporting_user'] }, | ||
supercooluser: { username: 'supercooluser', roles: ['kibana_admin', 'reporting_user'] }, | ||
}, | ||
}); | ||
|
||
const { getDeprecations } = await registerDeprecations(reportingCore, coreMock.createSetup()); | ||
expect(await getDeprecations(context)).toMatchInlineSnapshot(` | ||
Array [ | ||
Object { | ||
"correctiveActions": Object { | ||
"manualSteps": Array [ | ||
"Create one or more custom roles that provide Kibana application privileges to reporting features in **Management > Security > Roles**.", | ||
"Assign the custom role(s) as desired, and remove the \\"reporting_user\\" role from the user(s).", | ||
], | ||
}, | ||
"documentationUrl": "https://www.elastic.co/guide/en/kibana/current/secure-reporting.html", | ||
"level": "critical", | ||
"message": "The deprecated \\"reporting_user\\" role has been found for 2 user(s): \\"reportron\\", \\"supercooluser\\"", | ||
}, | ||
] | ||
`); | ||
}); | ||
|
||
test('logs an expanded message when a config issue and a reporting_user role issue is found', async () => { | ||
esClient.asCurrentUser.security.getUser = jest.fn().mockResolvedValue({ | ||
body: { reportron: { username: 'reportron', roles: ['kibana_admin', 'reporting_user'] } }, | ||
}); | ||
|
||
const mockReportingConfig = createMockConfigSchema({ roles: { enabled: true } }); | ||
reportingCore = await createMockReportingCore(mockReportingConfig); | ||
|
||
const { getDeprecations } = await registerDeprecations(reportingCore, coreMock.createSetup()); | ||
expect(await getDeprecations(context)).toMatchInlineSnapshot(` | ||
Array [ | ||
Object { | ||
"correctiveActions": Object { | ||
"manualSteps": Array [ | ||
"Set \\"xpack.reporting.roles.enabled: false\\" in kibana.yml", | ||
"Create one or more custom roles that provide Kibana application privileges to reporting features in **Management > Security > Roles**.", | ||
"Assign the custom role(s) as desired, and remove the \\"reporting_user\\" role from the user(s).", | ||
], | ||
}, | ||
"documentationUrl": "https://www.elastic.co/guide/en/kibana/current/secure-reporting.html", | ||
"level": "critical", | ||
"message": "The deprecated \\"reporting_user\\" role has been found for 1 user(s): \\"reportron\\"", | ||
}, | ||
] | ||
`); | ||
}); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,52 @@ | ||
/* | ||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
* or more contributor license agreements. Licensed under the Elastic License | ||
* 2.0; you may not use this file except in compliance with the Elastic License | ||
* 2.0. | ||
*/ | ||
|
||
import type { CoreSetup, DeprecationsDetails, RegisterDeprecationsConfig } from 'src/core/server'; | ||
import { ReportingCore } from '.'; | ||
|
||
const deprecatedRole = 'reporting_user'; | ||
const upgradableConfig = 'xpack.reporting.roles.enabled: false'; | ||
|
||
export async function registerDeprecations( | ||
reporting: ReportingCore, | ||
{ deprecations: deprecationsService }: CoreSetup | ||
) { | ||
const deprecationsConfig: RegisterDeprecationsConfig = { | ||
getDeprecations: async ({ esClient }) => { | ||
const usingDeprecatedConfig = !reporting.getContract().usesUiCapabilities(); | ||
const deprecations: DeprecationsDetails[] = []; | ||
const { body: users } = await esClient.asCurrentUser.security.getUser(); | ||
|
||
const reportingUsers = Object.entries(users) | ||
.filter(([username, user]) => user.roles.includes(deprecatedRole)) | ||
.map(([, user]) => user.username); | ||
const numReportingUsers = reportingUsers.length; | ||
|
||
if (numReportingUsers > 0) { | ||
const usernames = reportingUsers.join('", "'); | ||
deprecations.push({ | ||
message: `The deprecated "${deprecatedRole}" role has been found for ${numReportingUsers} user(s): "${usernames}"`, | ||
documentationUrl: 'https://www.elastic.co/guide/en/kibana/current/secure-reporting.html', | ||
level: 'critical', | ||
correctiveActions: { | ||
manualSteps: [ | ||
...(usingDeprecatedConfig ? [`Set "${upgradableConfig}" in kibana.yml`] : []), | ||
`Create one or more custom roles that provide Kibana application privileges to reporting features in **Management > Security > Roles**.`, | ||
`Assign the custom role(s) as desired, and remove the "${deprecatedRole}" role from the user(s).`, | ||
], | ||
}, | ||
}); | ||
} | ||
|
||
return deprecations; | ||
}, | ||
}; | ||
|
||
deprecationsService.registerDeprecations(deprecationsConfig); | ||
|
||
return deprecationsConfig; | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters