* Adding feature flag for auth * Hiding SOs and adding consumer field * First pass at adding security changes * Consumer as the app's plugin ID * Create addConsumerToSO migration helper * Fix mapping's SO consumer * Add test for CasesActions * Declare hidden types on SO client * Restructure integration tests * Init spaces_only integration tests * Implementing the cases security string * Adding security plugin tests for cases * Rough concept for authorization class * Adding comments * Fix merge * Get requiredPrivileges for classes * Check privillages * Ensure that all classes are available * Success if hasAllRequested is true * Failure if hasAllRequested is false * Adding schema updates for feature plugin * Seperate basic from trial * Enable SIR on integration tests * Starting the plumbing for authorization in plugin * Unit tests working * Move find route logic to case client * Create integration test helper functions * Adding auth to create call * Create getClassFilter helper * Add class attribute to find request * Create getFindAuthorizationFilter * Ensure savedObject is authorized in find method * Include fields for authorization * Combine authorization filter with cases & subcases filter * Fix isAuthorized flag * Fix merge issue * Create/delete spaces & users before and after tests * Add more user and roles * [Cases] Convert filters from strings to KueryNode (#95288) * [Cases] RBAC: Rename class to scope (#95535) * [Cases][RBAC] Rename scope to owner (#96035) * [Cases] RBAC: Create & Find integration tests (#95511) * [Cases] Cases client enchantment (#95923) * [Cases] Authorization and Client Audit Logger (#95477) * Starting audit logger * Finishing auth audit logger * Fixing tests and types * Adding audit event creator * Renaming class to scope * Adding audit logger messages to create and find * Adding comments and fixing import issue * Fixing type errors * Fixing tests and adding username to message * Addressing PR feedback * Removing unneccessary log and generating id * Fixing module issue and remove expect.anything * [Cases] Migrate sub cases routes to a client (#96461) * Adding sub cases client * Move sub case routes to case client * Throw when attempting to access the sub cases client * Fixing throw and removing user ans soclients * [Cases] RBAC: Migrate routes' unit tests to integration tests (#96374) Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co> * [Cases] Move remaining HTTP functionality to client (#96507) * Moving deletes and find for attachments * Moving rest of comment apis * Migrating configuration routes to client * Finished moving routes, starting utils refactor * Refactoring utilites and fixing integration tests * Addressing PR feedback * Fixing mocks and types * Fixing integration tests * Renaming status_stats * Fixing test type errors * Adding plugins to kibana.json * Adding cases to required plugin * [Cases] Refactoring authorization (#97483) * Refactoring authorization * Wrapping auth calls in helper for try catch * Reverting name change * Hardcoding the saved object types * Switching ensure to owner array * [Cases] Add authorization to configuration & cases routes (#97228) * [Cases] Attachments RBAC (#97756) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Addressing PR comments * Reducing operations * [Cases] Add RBAC to remaining Cases APIs (#98762) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Working case update tests * Addressing PR comments * Reducing operations * Working rbac push case tests * Starting stats apis * Working status tests * User action tests and fixing migration errors * Fixing type errors * including error in message * Addressing pr feedback * Fixing some type errors * [Cases] Add space only tests (#99409) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * [Cases] Add security only tests (#99679) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * Starting security only tests * Adding remainder security only tests * Using helper objects * Fixing type error for null space * Renaming utility variables * Refactoring users and roles for security only tests * Adding sub feature * [Cases] Cleaning up the services and TODOs (#99723) * Cleaning up the service intialization * Fixing type errors * Adding comments for the api * Working test for cases client * Fix type error * Adding generated docs * Adding more docs and cleaning up types * Cleaning up readme * More clean up and links * Changing some file names * Renaming docs * Integration tests for cases privs and fixes (#100038) * [Cases] RBAC on UI (#99478) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Fixing case ids by alert id route call * [Cases] Fixing UI feature permissions and adding UI tests (#100074) * Integration tests for cases privs and fixes * Fixing ui cases permissions and adding tests * Adding test for collection failure and fixing jest * Renaming variables * Fixing type error * Adding some comments * Validate cases features * Fix new schema * Adding owner param for the status stats * Fix get case status tests * Adjusting permissions text and fixing status * Address PR feedback * Adding top level feature back * Fixing feature privileges * Renaming * Removing uneeded else * Fixing tests and adding cases merge tests * [Cases][Security Solution] Basic license security solution API tests (#100925) * Cleaning up the fixture plugins * Adding basic feature test * renaming to unsecuredSavedObjectsClient (#101215) * [Cases] RBAC Refactoring audit logging (#100952) * Refactoring audit logging * Adding unit tests for authorization classes * Addressing feedback and adding util tests * return undefined on empty array * fixing eslint * [Cases] Cleaning up RBAC integration tests (#101324) * Adding tests for space permissions * Adding tests for testing a disable feature Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
193 lines
4.4 KiB
TypeScript
193 lines
4.4 KiB
TypeScript
/*
|
|
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
|
* or more contributor license agreements. Licensed under the Elastic License
|
|
* 2.0; you may not use this file except in compliance with the Elastic License
|
|
* 2.0.
|
|
*/
|
|
|
|
import {
|
|
CommentSchemaType,
|
|
ContextTypeGeneratedAlertType,
|
|
createAlertsString,
|
|
isCommentGeneratedAlert,
|
|
transformConnectorComment,
|
|
} from '../../../../plugins/cases/server/connectors';
|
|
import {
|
|
CasePostRequest,
|
|
CaseResponse,
|
|
CasesFindResponse,
|
|
CommentResponse,
|
|
ConnectorTypes,
|
|
CommentRequestUserType,
|
|
CommentRequestAlertType,
|
|
CommentType,
|
|
CaseStatuses,
|
|
CaseType,
|
|
CasesClientPostRequest,
|
|
SubCaseResponse,
|
|
AssociationType,
|
|
SubCasesFindResponse,
|
|
CommentRequest,
|
|
} from '../../../../plugins/cases/common/api';
|
|
|
|
export const defaultUser = { email: null, full_name: null, username: 'elastic' };
|
|
/**
|
|
* A null filled user will occur when the security plugin is disabled
|
|
*/
|
|
export const nullUser = { email: null, full_name: null, username: null };
|
|
|
|
export const postCaseReq: CasePostRequest = {
|
|
description: 'This is a brand new case of a bad meanie defacing data',
|
|
title: 'Super Bad Security Issue',
|
|
tags: ['defacement'],
|
|
connector: {
|
|
id: 'none',
|
|
name: 'none',
|
|
type: ConnectorTypes.none,
|
|
fields: null,
|
|
},
|
|
settings: {
|
|
syncAlerts: true,
|
|
},
|
|
owner: 'securitySolutionFixture',
|
|
};
|
|
|
|
/**
|
|
* Return a request for creating a case.
|
|
*/
|
|
export const getPostCaseRequest = (req?: Partial<CasePostRequest>): CasePostRequest => ({
|
|
...postCaseReq,
|
|
...req,
|
|
});
|
|
|
|
/**
|
|
* The fields for creating a collection style case.
|
|
*/
|
|
export const postCollectionReq: CasePostRequest = {
|
|
...postCaseReq,
|
|
type: CaseType.collection,
|
|
};
|
|
|
|
/**
|
|
* This is needed because the post api does not allow specifying the case type. But the response will include the type.
|
|
*/
|
|
export const userActionPostResp: CasesClientPostRequest = {
|
|
...postCaseReq,
|
|
type: CaseType.individual,
|
|
};
|
|
|
|
export const postCommentUserReq: CommentRequestUserType = {
|
|
comment: 'This is a cool comment',
|
|
type: CommentType.user,
|
|
owner: 'securitySolutionFixture',
|
|
};
|
|
|
|
export const postCommentAlertReq: CommentRequestAlertType = {
|
|
alertId: 'test-id',
|
|
index: 'test-index',
|
|
rule: { id: 'test-rule-id', name: 'test-index-id' },
|
|
type: CommentType.alert,
|
|
owner: 'securitySolutionFixture',
|
|
};
|
|
|
|
export const postCommentGenAlertReq: ContextTypeGeneratedAlertType = {
|
|
alerts: createAlertsString([
|
|
{ _id: 'test-id', _index: 'test-index', ruleId: 'rule-id', ruleName: 'rule name' },
|
|
{ _id: 'test-id2', _index: 'test-index', ruleId: 'rule-id', ruleName: 'rule name' },
|
|
]),
|
|
type: CommentType.generatedAlert,
|
|
owner: 'securitySolutionFixture',
|
|
};
|
|
|
|
export const postCaseResp = (
|
|
id?: string | null,
|
|
req: CasePostRequest = postCaseReq
|
|
): Partial<CaseResponse> => ({
|
|
...req,
|
|
...(id != null ? { id } : {}),
|
|
comments: [],
|
|
totalAlerts: 0,
|
|
totalComment: 0,
|
|
type: req.type ?? CaseType.individual,
|
|
closed_by: null,
|
|
created_by: defaultUser,
|
|
external_service: null,
|
|
status: CaseStatuses.open,
|
|
updated_by: null,
|
|
});
|
|
|
|
interface CommentRequestWithID {
|
|
id: string;
|
|
comment: CommentSchemaType | CommentRequest;
|
|
}
|
|
|
|
export const commentsResp = ({
|
|
comments,
|
|
associationType,
|
|
}: {
|
|
comments: CommentRequestWithID[];
|
|
associationType: AssociationType;
|
|
}): Array<Partial<CommentResponse>> => {
|
|
return comments.map(({ comment, id }) => {
|
|
const baseFields = {
|
|
id,
|
|
created_by: defaultUser,
|
|
pushed_at: null,
|
|
pushed_by: null,
|
|
updated_by: null,
|
|
};
|
|
|
|
if (isCommentGeneratedAlert(comment)) {
|
|
return {
|
|
associationType,
|
|
...transformConnectorComment(comment),
|
|
...baseFields,
|
|
};
|
|
} else {
|
|
return {
|
|
associationType,
|
|
...comment,
|
|
...baseFields,
|
|
};
|
|
}
|
|
});
|
|
};
|
|
|
|
export const subCaseResp = ({
|
|
id,
|
|
totalAlerts,
|
|
totalComment,
|
|
status = CaseStatuses.open,
|
|
}: {
|
|
id: string;
|
|
status?: CaseStatuses;
|
|
totalAlerts: number;
|
|
totalComment: number;
|
|
}): Partial<SubCaseResponse> => ({
|
|
status,
|
|
id,
|
|
totalAlerts,
|
|
totalComment,
|
|
closed_by: null,
|
|
created_by: defaultUser,
|
|
updated_by: defaultUser,
|
|
});
|
|
|
|
const findCommon = {
|
|
page: 1,
|
|
per_page: 20,
|
|
total: 0,
|
|
count_open_cases: 0,
|
|
count_closed_cases: 0,
|
|
count_in_progress_cases: 0,
|
|
};
|
|
|
|
export const findCasesResp: CasesFindResponse = {
|
|
...findCommon,
|
|
cases: [],
|
|
};
|
|
|
|
export const findSubCasesResp: SubCasesFindResponse = {
|
|
...findCommon,
|
|
subCases: [],
|
|
};
|