* remove unused "paths" from tsconfig
* remove unused test utils, import get-url from kbn/test
* dont pollute globals with jest when importing getUrl
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
* bump query-string version to remove manual type definitions
* remove manual type declaration
* add kibana_utils tsconfig
* add refs to kibana_utils tsconfig
* add kibana_utils to the project list
* add kibana_react project
* add support for x-pack/tsconfig.refs.json
* add ts project for x-pack licensing plugins
* add glob for ts projects in src/plugins & x-pack/plugins
* add refs to projects in examples
* fix ref paths in x-pack/test
* address mistic comments
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
* break dependency on data plugin TS code
* move global typings to @kbn/utility-types
* import types from @kbn/utility-types
* remove type dependency on plugins
* add intermediate js files to break dependency on outter TS code
* temp type declaration for query-string
* declare src/core project
* export types to reference in the built d.ts files
* reference core project
* move jest types out of kbn/utility-types due to a clash with mocha types
* fix wrong es_kuery path and ts project paths
* reference core from packages consuming it
* x-pack & oss should use the same lodash version
* Revert "x-pack & oss should use the same lodash version"
This reverts commit 79cec5781e.
* use the same lodash version
* fix @types/lodash TS2300: Duplicate identifier error
* fix wrong imports
* update docs
* update docs
* add a comment why file is needed
* move test_helpers to the core
* create base tsconfig
* all tsconfigs use the base one
* use test_helpers exposed from the src/core
* move getFieldFormatsRegistry to data plugin
* add test_utils project
* compile types after checkout
* add a stub for platform tsconfig.json
* fix broken import
* fix broken path to the base config
* set tsBuildInfoFile for project without outDir
* do not commit tsbuildinfo file
* do not check output d.ts files
* fix type error
* use separate config to build types
* rollback changes to include paths
* mute import zone error
* rename files to avoid references to tsd
* do not use tsd for type tests
* include all ts files in project
* run buildRefs before type check to ensure the latest version
* store tsbuildinfo locally
* update paths to base config
* comment out core/tsconfig.json
* remove ui path
* fix wrong tsbuildinfo path
* upgrade all babel related modules, and bump lodash minors
* update kbn-pm dist
* update fetch-mock, necessary to use core-js 3
* use regenerator transform in jest tests, as required by EUI
* disable useBuiltIns rather than using regenerator plugin
* remove extra regenerator-runtime import
* Warn in Typescript when using Array.flat() or .flatMap() without polyfill
* Update ecma version provided to babel in eslint
* Update per review comments
* Generate core API docs from TSDoc comments
Uses api-extractor and api-documenter to generate documentation for
the Kibana core API from TSDoc comments in the source code.
Documentation can be generated using `npm run docs:api`.
I used --no-verify to ignore the following pre-commit hook errors:
1. Filenames MUST use snake_case - api-extractor.json
It's possible to specify a different config file, but I prefer to keep the "standard" config file name.
2. UNHANDLED ERROR: Unable to find tsconfig.json file selecting "common/core_api_review/kibana.api.ts". Ensure one exists and it is listed in "src/dev/typescript/projects.ts"
This is not a source file, so safe to ignore.
* Flesh out API docs a little bit
* Ignore snake_case check for api-extractor.json
* Ignore api-extractor's review file from pre-commit check
* Try to fix build failing by using masters yarn.lock
* I'm being stupid
* Found a better home for ignoring common/core_api_review/kibana.api.ts
* Node script for detecting core API changes
I initially wanted to include this as a precommit hook, but it takes
quite long to execute (~12s) so might be better suited as a test or
as part of the release process.
The script currently fails because api-extractor uses an older version
of typescript.
* Fix tslint precommit hook ignore condition
* Write tsdoc-metadata.json into ./build
* Add LogMeta and ElasticSearch to exported types & docs
* Suppress logging when running api-extractor from script
* Improve check_core_api_changes script and run as test
* Inline api-extractor.json config
* Fix check_core_api_changes --help flag
* LogMeta TSDoc comments
* check_core_api_changes: fail if api-extractor produces warnings or errors
And print more useful messages to the console
* Move ignored ts files list into dev/file
* Add back build:types since api-exporter cannot operate on source files
* Upgrade api-exporter/documenter
* api-extractor: independantly analyze core/public and core/server
Becasue of https://github.com/Microsoft/web-build-tools/issues/1029
api-extractor can't use core/index.ts as a single entry point for
analyzing the public and server API's as isolated namespaces.
Instead we analyze these projects separately. This introduces other
problems like the api review files and documentation always being
called "kibana." from the package.json filename.
* Build types as part of build task
* Include types in typescript browser compilation
* Force inclusion of core/public for building types
* Fix api review filename in api-exporter errors
* Update docs and API review files
* Fix api-extractor warnings
* Remove ts file ignored list since it's no longer necessary
* Rename exported api package name
* Review comments
* Export other missing types
* Upgrade api-documenter to latest beta
* Export more missing types
* Fix warnings and add api-exporter to Jenkins tests
* Correctly handle runBuildTypes() exceptions
* Fix another swallowed exception
* Fix api-extractor warnings after master merge
* [@kbn/expect] "fork" expect.js into repo
* [eslint] autofix references to expect.js
* [tslint] autofix all expect.js imports
* now that expect.js is in strict mode, avoid reassigning fn.length
* Expose core api types in /public and /server
* Export CoreStart from core/public
* Export Server and Public from 'kibana'
* Cast frozen object type back to original
The exported type `InjectedMetadataStart` derives it's type from the returned values.
Since it's internal state is frozen the type changes to `ReadOnly<`. However, consumers
of the API shouldn't have to know or care about this type.
* Be more selective with what gets exported
* Fix type imports in tests
* Fix type errors
* Remove src/type_exports.ts
* More remove src/type_exports.ts
* Remove build:types
* Fix bootstrap import
* Expose internal API's at the top level
Exposing the internal API's at the top level of core/public and core/server
makes it obvious that these API's are consumed outside these modules. Marking
these @internal ensures they don't get exported as part of the documentation.
* Fix tests
* Put core/{public/server} in their own namespaces
In https://github.com/elastic/kibana/pull/31234 there were some extra changes that I've reverted, like use of the `tsconfig-paths` package to magically rewrite import statements to defy the standard node module resolution algorithm, the inclusion of several unnecessary options in the `test/tsconfig.json` file, and changes of the line-endings in the config files. This also brings a few enhancements from https://github.com/elastic/kibana/pull/30190 including a modularized version of the expect.js types, and options for explicit mappings for the PageObjects and services used in ftr tests.
This commit accompanies the four that precede it. Rather than squash
them altogether, the four previous commits all do nothing except move
files to help avoid conflicts.
### Review notes
This is generally ready for review. We are awaiting https://github.com/elastic/elasticsearch/issues/32777 to improve handling when users do not have any access to Kibana, but this should not hold up the overall review for this PR.
This PR is massive, there's no denying that. Here's what to focus on:
1) `x-pack/plugins/spaces`: This is, well, the Spaces plugin. Everything in here is brand new. The server code is arguably more important, but feel free to review whatever you see fit.
2) `x-pack/plugins/security`: There are large and significant changes here to allow Spaces to be securable. To save a bit of time, you are free to ignore changes in `x-pack/plugins/security/public`: These are the UI changes for the role management screen, which were previously reviewed by both us and the design team.
3) `x-pack/test/saved_object_api_integration` and `x-pack/test/spaces_api_integration`: These are the API test suites which verify functionality for:
a) Both security and spaces enabled
b) Only security enabled
c) Only spaces enabled
What to ignore:
1) As mentioned above, you are free to ignore changes in `x-pack/plugins/security/public`
2) Changes to `kibana/src/server/*`: These changes are part of a [different PR that we're targeting against master](https://github.com/elastic/kibana/pull/23378) for easier review.
## Saved Objects Client Extensions
A bulk of the changes to the saved objects service are in the namespaces PR, but we have a couple of important changes included here.
### Priority Queue for wrappers
We have implemented a priority queue which allows plugins to specify the order in which their SOC wrapper should be applied: `kibana/src/server/saved_objects/service/lib/priority_collection.ts`. We are leveraging this to ensure that both the security SOC wrapper and the spaces SOC wrapper are applied in the correct order (more details below).
### Spaces SOC Wrapper
This wrapper is very simple, and it is only responsible for two things:
1) Prevent users from interacting with any `space` objects (use the Spaces client instead, described below)
2) Provide a `namespace` to the underlying Saved Objects Client, and ensure that no other wrappers/callers have provided a namespace. In order to accomplish this, the Spaces wrapper uses the priority queue to ensure that it is the last wrapper invoked before calling the underlying client.
### Security SOC Wrapper
This wrapper is responsible for performing authorization checks. It uses the priority queue to ensure that it is the first wrapper invoked. To say another way, if the authorization checks fail, then no other wrappers will be called, and the base client will not be called either. This wrapper authorizes users in one of two ways: RBAC or Legacy. More details on this are below.
### Examples:
`GET /s/marketing/api/saved_objects/index-pattern/foo`
**When both Security and Spaces are enabled:**
1) Saved objects API retrieves an instance of the SOC via `savedObjects.getScopedClient()`, and invokes its `get` function
2) The Security wrapper is invoked.
a) Authorization checks are performed to ensure user can access this particular saved object at this space.
3) The Spaces wrapper is invoked.
a) Spaces applies a `namespace` to be used by the underlying client
4) The underlying client/repository are invoked to retrieve the object from ES.
**When only Spaces are enabled:**
1) Saved objects API retrieves an instance of the SOC via `savedObjects.getScopedClient()`, and invokes its `get` function
2) The Spaces wrapper is invoked.
a) Spaces applies a `namespace` to be used by the underlying client
3) The underlying client/repository are invoked to retrieve the object from ES.
**When only Security is enabled:**
(assume `/s/marketing` is no longer part of the request)
1) Saved objects API retrieves an instance of the SOC via `savedObjects.getScopedClient()`, and invokes its `get` function
2) The Security wrapper is invoked.
a) Authorization checks are performed to ensure user can access this particular saved object globally.
3) The underlying client/repository are invoked to retrieve the object from ES.
## Authorization
Authorization changes for this project are centered around Saved Objects, and builds on the work introduced in RBAC Phase 1.
### Saved objects client
#### Security without spaces
When security is enabled, but spaces is disabled, then the authorization model behaves the same way as before: If the user is taking advantage of Kibana Privileges, then we check their privileges "globally" before proceeding. A "global" privilege check specifies `resources: ['*']` when calling the [ES _has_privileges api.](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-has-privileges.html). Legacy users (non-rbac) will continue to use the underlying index privileges for authorization.
#### Security with spaces
When both plugins are enabled, then the authorization model becomes more fine-tuned. Rather than checking privileges globally, the privileges are checked against a specific resource that matches the user's active space. In order to accomplish this, the Security plugin needs to know if Spaces is enabled, and if so, it needs to ask Spaces for the user's active space. The subsequent call to the `ES _has_privileges api` would use `resources: ['space:marketing']` to verify that the user is authorized at the `marketing` space. Legacy users (non-rbac) will continue to use the underlying index privileges for authorization. **NOTE** The legacy behavior implies that those users will have access to all spaces. The read/write restrictions are still enforced, but there is no way to restrict access to a specific space for legacy auth users.
#### Spaces without security
No authorization performed. Everyone can access everything.
### Spaces client
Spaces, when enabled, prevents saved objects of type `space` from being CRUD'd via the Saved Objects Client. Instead, the only "approved" way to work with these objects is through the new Spaces client (`kibana/x-pack/plugins/spaces/lib/spaces_client.ts`).
When security is enabled, the Spaces client performs its own set of authorization checks before allowing the request to proceed. The Spaces client knows which authorization checks need to happen for a particular request, but it doesn't know _how_ to check privileges. To accomplish this, the spaces client will delegate the check security's authorization service.
#### FAQ: Why oh why can't you used the Saved Objects Client instead!?
That's a great question! We did this primarily to simplify the authorization model (at least for our initial release). Accessing regular saved objects follows a predictible authorization pattern (described above). Spaces themselves inform the authorization model, and this interplay would have greatly increased the complexity. We are brainstorming ideas to obselete the Spaces client in favor of using the Saved Objects Client everywhere, but that's certainly out of scope for this release.
## Test Coverage
### Saved Objects API
A bulk of the changes to enable spaces are centered around saved objects, so we have spent a majority of our time automating tests against the saved objects api.
**`x-pack/test/saved_object_api_integration/`** contains the test suites for the saved objects api. There is a `common/suites` subfolder which contains a bulk of the test logic. The suites defined here are used in the following test configurations:
1) Spaces only: `./spaces_only`
2) Security and spaces: `./security_and_spaces`
3) Security only: `./security_only`
Each of these test configurations will start up ES/Kibana with the appropriate license and plugin set. Each set runs through the entire test suite described in `common/suites`. Each test with in each suite is run multiple times with different inputs, to test the various permutations of authentication, authorization type (legacy vs RBAC), space-level privileges, and the user's active space.
### Spaces API
Spaces provides an experimental public API.
**`x-pack/test/spaces_api_integration`** contains the test suites for the Spaces API. Similar to the Saved Objects API tests described above, there is a `common/suites` folder which contains a bulk of the test logic. The suites defined here are used in the following test configurations:
1) Spaces only: `./spaces_only`
2) Security and spaces: `./security_and_spaces`
### Role Management UI
We did not provide any new functional UI tests for role management, but the existing suite was updated to accomidate the screen rewrite.
We do have a decent suite of jest unit tests for the various components that make up the new role management screen. They're nested within `kibana/x-pack/plugins/security/public/views/management/edit_role`
### Spaces Management UI
We did not provide any new functional UI tests for spaces management, but the components that make up the screens are well-tested, and can be found within `kibana/x-pack/plugins/spaces/public/views/management/edit_space`
### Spaces Functional UI Tests
There are a couple of UI tests that verify _basic_ functionality. They assert that a user can login, select a space, and then choose a different space once inside: `kibana/x-pack/test/functional/apps/spaces`
## Reference
Notable child PRs are listed below for easier digesting. Note that some of these PRs are built on other PRs, so the deltas in the links below may be outdated. Cross reference with this PR when in doubt.
### UI
- Reactify Role Management Screen: https://github.com/elastic/kibana/pull/19035
- Space Aware Privileges UI: https://github.com/elastic/kibana/pull/21049
- Space Selector (in Kibana Nav): https://github.com/elastic/kibana/pull/19497
- Recently viewed Widget: https://github.com/elastic/kibana/pull/22492
- Support Space rename/delete: https://github.com/elastic/kibana/pull/22586
### Saved Objects Client
- ~~Space Aware Saved Objects: https://github.com/elastic/kibana/pull/18862~~
- ~~Add Space ID to document id: https://github.com/elastic/kibana/pull/21372~~
- Saved object namespaces (supercedes #18862 and #21372): https://github.com/elastic/kibana/pull/22357
- Securing saved objects: https://github.com/elastic/kibana/pull/21995
- Dedicated Spaces client (w/ security): https://github.com/elastic/kibana/pull/21995
### Other
- Public Spaces API (experimental): https://github.com/elastic/kibana/pull/22501
- Telemetry: https://github.com/elastic/kibana/pull/20581
- Reporting: https://github.com/elastic/kibana/pull/21457
- Spencer's original Spaces work: https://github.com/elastic/kibana/pull/18664
- Expose `spaceId` to "Add Data" tutorials: https://github.com/elastic/kibana/pull/22760Closes#18948
"Release Note: Create spaces within Kibana to organize dashboards, visualizations, and other saved objects. Secure access to each space when X-Pack Security is enabled"
I was surprised when I tried to spread a `Set` in TypeScript and the browser complained about `Set.slice()` not being defined. This is because TypeScript does not automatically enable support for iterators when targeting earlier ES versions, like we do in the browser, unless you use the `"downlevelIteration": true` compiler option. This injects some helpers into the necessary files for reading/spreading iterators, which can be stuffed behind an import statement with using the `"importHelpers": true` compiler option and include `tslib` in our dependencies. This is already a dependency of several of our packages, so it shouldn't cause any additional modules.
* [typescript] continue to use the default config in development
In #21865 we tried to make a separate config file that would be used for
browser TS files by excluding them from the default config file and
adding a second that included them. This works fine in the build, but
IDE integrations rely on being able to automatically discover a
`tsconfig.json` file in a parent directory of the file being edited,
which doesn't work when the tsconfig.json file is found, but excludes
the file being edited. In this situation IDE integrations silently
fallback to the default TSConfig settings, which don't show the types of
compiler errors that will become issues in CI, like implicit any
warnings.
This implements the original strategy we tried in #21865 of mutating the
tsconfig.json file before we run the tsc in the build so that the config
files select the right files at build time.
* [tslint] remove browser config from default projects list since it is empty
* [build/ts] fix typo
