copy of secured-spaces api tests for translation to unified test suite

packages/kbn-test/src/functional_tests/lib/auth.js

@@ -65,13 +65,54 @@ async function updateCredentials(port, auth, username, password, retries = 10) {
   throw new Error(`${statusCode} response, expected 200 -- ${JSON.stringify(body)}`);
 }
 
+async function getLicense(port, auth, retries = 10) {
+  const result = await fcb(cb =>
+    request(
+      {
+        method: 'GET',
+        uri: formatUrl({
+          protocol: 'http:',
+          auth,
+          hostname: 'localhost',
+          port,
+          pathname: `/_xpack/license`,
+        }),
+        json: true,
+      },
+      (err, httpResponse, body) => {
+        cb(err, { httpResponse, body });
+      }
+    )
+  );
+
+  const { body, httpResponse } = result;
+  const { statusCode } = httpResponse;
+
+  if (statusCode === 200) {
+    return body.license.type;
+  }
+
+  if (retries > 0) {
+    await delay(2500);
+    return await getLicense(port, auth, retries - 1);
+  }
+
+  throw new Error(`${statusCode} response, expected 200 -- ${JSON.stringify(body)}`);
+}
+
 export async function setupUsers(log, config) {
   const esPort = config.get('servers.elasticsearch.port');
 
   // track the current credentials for the `elastic` user as
   // they will likely change as we apply updates
   let auth = `elastic:${DEFAULT_SUPERUSER_PASS}`;
 
+  const license = await getLicense(esPort, auth);
+  if (license !== 'trial') {
+    log.info('not performing user setup, because license is not set to "trial"');
+    return;
+  }
+
   // list of updates we need to apply
   const updates = [config.get('servers.elasticsearch'), config.get('servers.kibana')];
 

x-pack/test/saved_objects_api_integration/apis/es/has_privileges.js

@@ -0,0 +1,141 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from 'expect.js';
+
+const application = 'has_privileges_test';
+
+export default function ({ getService }) {
+
+  describe('has_privileges', () => {
+    before(async () => {
+      const es = getService('es');
+
+      await es.shield.postPrivileges({
+        body: {
+          [application]: {
+            read: {
+              application,
+              name: 'read',
+              actions: ['action:readAction1', 'action:readAction2'],
+              metadata: {},
+            }
+          }
+        }
+      });
+
+      await es.shield.putRole({
+        name: 'hp_read_user',
+        body: {
+          cluster: [],
+          index: [],
+          applications: [{
+            application,
+            privileges: ['read'],
+            resources: ['*']
+          }]
+        }
+      });
+
+      await es.shield.putUser({
+        username: 'testuser',
+        body: {
+          password: 'testpassword',
+          roles: ['hp_read_user'],
+          full_name: 'a kibana user',
+          email: 'a_kibana_rbac_user@elastic.co',
+        }
+      });
+    });
+
+    function createHasPrivilegesRequest(privileges) {
+      const supertest = getService('esSupertestWithoutAuth');
+      return supertest
+        .post(`/_xpack/security/user/_has_privileges`)
+        .auth('testuser', 'testpassword')
+        .send({
+          applications: [{
+            application,
+            privileges,
+            resources: ['*']
+          }]
+        })
+        .expect(200);
+    }
+
+    it('should return true when user has the requested privilege', async () => {
+
+      await createHasPrivilegesRequest(['read'])
+        .then(response => {
+          expect(response.body).to.eql({
+            username: 'testuser',
+            has_all_requested: true,
+            cluster: {},
+            index: {},
+            application: {
+              has_privileges_test: {
+                ['*']: {
+                  read: true
+                }
+              },
+            }
+          });
+        });
+    });
+
+    it('should return true when user has a newly created privilege', async () => {
+      // verify user does not have privilege yet
+      await createHasPrivilegesRequest(['action:a_new_privilege'])
+        .then(response => {
+          expect(response.body).to.eql({
+            username: 'testuser',
+            has_all_requested: false,
+            cluster: {},
+            index: {},
+            application: {
+              has_privileges_test: {
+                ['*']: {
+                  'action:a_new_privilege': false
+                }
+              },
+            }
+          });
+        });
+
+      // Create privilege
+      const es = getService('es');
+      await es.shield.postPrivileges({
+        body: {
+          [application]: {
+            read: {
+              application,
+              name: 'read',
+              actions: ['action:readAction1', 'action:readAction2', 'action:a_new_privilege'],
+              metadata: {},
+            }
+          }
+        }
+      });
+
+      // verify user has new privilege
+      await createHasPrivilegesRequest(['action:a_new_privilege'])
+        .then(response => {
+          expect(response.body).to.eql({
+            username: 'testuser',
+            has_all_requested: true,
+            cluster: {},
+            index: {},
+            application: {
+              has_privileges_test: {
+                ['*']: {
+                  'action:a_new_privilege': true
+                }
+              },
+            }
+          });
+        });
+    });
+  });
+}

x-pack/test/saved_objects_api_integration/apis/es/index.js

@@ -0,0 +1,12 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export default function ({ loadTestFile }) {
+  describe('rbac es', () => {
+    loadTestFile(require.resolve('./has_privileges'));
+    loadTestFile(require.resolve('./post_privileges'));
+  });
+}

x-pack/test/saved_objects_api_integration/apis/es/post_privileges.js

@@ -0,0 +1,98 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from 'expect.js';
+
+export default function ({ getService }) {
+
+  describe('post_privileges', () => {
+    it('should allow privileges to be updated', async () => {
+      const es = getService('es');
+      const application = 'foo';
+      const response = await es.shield.postPrivileges({
+        body: {
+          [application]: {
+            all: {
+              application,
+              name: 'all',
+              actions: ['action:*'],
+              metadata: {},
+            },
+            read: {
+              application,
+              name: 'read',
+              actions: ['action:readAction1', 'action:readAction2'],
+              metadata: {},
+            }
+          }
+        }
+      });
+
+      expect(response).to.eql({
+        foo: {
+          all: { created: true },
+          read: { created: true }
+        }
+      });
+
+
+      // Update privileges:
+      // 1. Not specifying the "all" privilege that we created above
+      // 2. Specifying a different collection of "read" actions
+      // 3. Adding a new "other" privilege
+      const updateResponse = await es.shield.postPrivileges({
+        body: {
+          [application]: {
+            read: {
+              application,
+              name: 'read',
+              actions: ['action:readAction1', 'action:readAction4'],
+              metadata: {}
+            },
+            other: {
+              application,
+              name: 'other',
+              actions: ['action:otherAction1'],
+              metadata: {},
+            }
+          }
+        }
+      });
+
+      expect(updateResponse).to.eql({
+        foo: {
+          other: { created: true },
+          read: { created: false }
+        }
+      });
+
+      const retrievedPrivilege = await es.shield.getPrivilege({ privilege: application });
+      expect(retrievedPrivilege).to.eql({
+        foo: {
+          // "all" is maintained even though the subsequent update did not specify this privilege
+          all: {
+            application,
+            name: 'all',
+            actions: ['action:*'],
+            metadata: {},
+          },
+          read: {
+            application,
+            name: 'read',
+            // actions should only contain what was present in the update. The original actions are not persisted or merged here.
+            actions: ['action:readAction1', 'action:readAction4'],
+            metadata: {},
+          },
+          other: {
+            application,
+            name: 'other',
+            actions: ['action:otherAction1'],
+            metadata: {},
+          }
+        }
+      });
+    });
+  });
+}

x-pack/test/saved_objects_api_integration/apis/lib/authentication.js

@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const AUTHENTICATION = {
+  NOT_A_KIBANA_USER: {
+    USERNAME: 'not_a_kibana_user',
+    PASSWORD: 'password'
+  },
+  SUPERUSER: {
+    USERNAME: 'elastic',
+    PASSWORD: 'changeme'
+  },
+  KIBANA_LEGACY_USER: {
+    USERNAME: 'a_kibana_legacy_user',
+    PASSWORD: 'password'
+  },
+  KIBANA_LEGACY_DASHBOARD_ONLY_USER: {
+    USERNAME: 'a_kibana_legacy_dashboard_only_user',
+    PASSWORD: 'password'
+  },
+  KIBANA_DUAL_PRIVILEGES_USER: {
+    USERNAME: 'a_kibana_dual_privileges_user',
+    PASSWORD: 'password'
+  },
+  KIBANA_DUAL_PRIVILEGES_DASHBOARD_ONLY_USER: {
+    USERNAME: 'a_kibana_dual_privileges_dashboard_only_user',
+    PASSWORD: 'password'
+  },
+  KIBANA_RBAC_USER: {
+    USERNAME: 'a_kibana_rbac_user',
+    PASSWORD: 'password'
+  },
+  KIBANA_RBAC_DASHBOARD_ONLY_USER: {
+    USERNAME: 'a_kibana_rbac_dashboard_only_user',
+    PASSWORD: 'password'
+  },
+  KIBANA_RBAC_DEFAULT_SPACE_USER: {
+    USERNAME: 'a_kibana_rbac_default_space_user',
+    PASSWORD: 'password'
+  },
+  KIBANA_RBAC_SPACE_1_READONLY_USER: {
+    USERNAME: 'a_kibana_rbac_space_1_readonly_user',
+    PASSWORD: 'password'
+  },
+};