[Cases] RBAC Refactoring audit logging #100952

jonathan-buttner · 2021-05-28T21:12:24Z

This is to address a couple issue with the audit logging implementation discussed here: #95058

We are currently logging two events that have a lot of overlap, so this combines them into a single event
- The message now includes both the saved object ID and owner information (the owner is part of the message field's string)
- I removed the username portion of the audit event because that's taken care of by the audit logger automatically because we use a scopedAs() when initializing it from the security plugin
- I removed the logSuccessfulAuthorization because it created a duplicate successful log message
The Authorization class wasn't called directly but through some utility functions, so I moved the utility functions into the Authorization class
The outcome of an event is inferred by the type of operation so it not longer needs to be passed. Write operations are either unknown or failure, Read operations are success or failure

Testing

Add these to your kibana.dev.yml

xpack.security.audit.enabled: true
xpack.security.audit.appender.type: 'console'
xpack.security.audit.appender.layout.type: 'pattern'
xpack.security.audit.appender.layout.highlight: true

I created two cases and issued a find request after each creation. The find request duplicates the accessed message because it internally is doing two saved object field requests (one to find the actual IDs and one to calculate the stats).

[2021-06-02T15:37:37.967-04:00][INFO ][plugins.security.audit.ecs] User is creating cases [id=fcaedd50-c3d9-11eb-8ed2-c3d5ba03d28e] as owner "securitySolution"
[2021-06-02T15:38:27.468-04:00][INFO ][plugins.security.audit.ecs] User is requesting [/api/cases/_find] endpoint
[2021-06-02T15:38:27.475-04:00][INFO ][plugins.security.audit.ecs] User has accessed space [id=default]
[2021-06-02T15:38:27.520-04:00][INFO ][plugins.security.audit.ecs] User has accessed cases [id=fcaedd50-c3d9-11eb-8ed2-c3d5ba03d28e] as owner "securitySolution"
[2021-06-02T15:38:27.542-04:00][INFO ][plugins.security.audit.ecs] User has accessed cases [id=fcaedd50-c3d9-11eb-8ed2-c3d5ba03d28e] as owner "securitySolution"
[2021-06-02T15:38:45.560-04:00][INFO ][plugins.security.audit.ecs] User is requesting [/api/cases] endpoint
[2021-06-02T15:38:45.567-04:00][INFO ][plugins.security.audit.ecs] User has accessed space [id=default]
[2021-06-02T15:38:45.578-04:00][INFO ][plugins.security.audit.ecs] User is creating cases [id=24fbf130-c3da-11eb-8ed2-c3d5ba03d28e] as owner "securitySolution"
[2021-06-02T15:38:51.840-04:00][INFO ][plugins.security.audit.ecs] User is requesting [/api/cases/_find] endpoint
[2021-06-02T15:38:51.847-04:00][INFO ][plugins.security.audit.ecs] User has accessed space [id=default]
[2021-06-02T15:38:51.880-04:00][INFO ][plugins.security.audit.ecs] User has accessed cases [id=fcaedd50-c3d9-11eb-8ed2-c3d5ba03d28e] as owner "securitySolution"
[2021-06-02T15:38:51.881-04:00][INFO ][plugins.security.audit.ecs] User has accessed cases [id=24fbf130-c3da-11eb-8ed2-c3d5ba03d28e] as owner "securitySolution"
[2021-06-02T15:38:51.902-04:00][INFO ][plugins.security.audit.ecs] User has accessed cases [id=fcaedd50-c3d9-11eb-8ed2-c3d5ba03d28e] as owner "securitySolution"
[2021-06-02T15:38:51.903-04:00][INFO ][plugins.security.audit.ecs] User has accessed cases [id=24fbf130-c3da-11eb-8ed2-c3d5ba03d28e] as owner "securitySolution"

Example ECS

kibana.dev.yml

xpack.security.audit.enabled: true
xpack.security.audit.appender:
  type: rolling-file
  fileName: ./audit.log
  policy:
    type: time-interval
    interval: 24h
  strategy:
    type: numeric
    max: 10
  layout:
    type: json

{
   "event":{
      "action":"case_find",
      "category":[
         "database"
      ],
      "type":[
         "access"
      ],
      "outcome":"success"
   },
   "kibana":{
      "space_id":"default",
      "saved_object":{
         "type":"cases",
         "id":"fcaedd50-c3d9-11eb-8ed2-c3d5ba03d28e"
      }
   },
   "user":{
      "name":"elastic",
      "roles":[
         "superuser"
      ]
   },
   "trace":{
      "id":"5d703583-36f8-4fe4-bdad-fbdcb8caf6b6"
   },
   "ecs":{
      "version":"1.9.0"
   },
   "@timestamp":"2021-06-02T15:49:51.252-04:00",
   "message":"User has accessed cases [id=fcaedd50-c3d9-11eb-8ed2-c3d5ba03d28e] as owner \"securitySolution\"",
   "log":{
      "level":"INFO",
      "logger":"plugins.security.audit.ecs"
   },
   "process":{
      "pid":81951
   }
}{
   "event":{
      "action":"case_find",
      "category":[
         "database"
      ],
      "type":[
         "access"
      ],
      "outcome":"success"
   },
   "kibana":{
      "space_id":"default",
      "saved_object":{
         "type":"cases",
         "id":"24fbf130-c3da-11eb-8ed2-c3d5ba03d28e"
      }
   },
   "user":{
      "name":"elastic",
      "roles":[
         "superuser"
      ]
   },
   "trace":{
      "id":"5d703583-36f8-4fe4-bdad-fbdcb8caf6b6"
   },
   "ecs":{
      "version":"1.9.0"
   },
   "@timestamp":"2021-06-02T15:49:51.253-04:00",
   "message":"User has accessed cases [id=24fbf130-c3da-11eb-8ed2-c3d5ba03d28e] as owner \"securitySolution\"",
   "log":{
      "level":"INFO",
      "logger":"plugins.security.audit.ecs"
   },
   "process":{
      "pid":81951
   }
}{
   "event":{
      "action":"case_find",
      "category":[
         "database"
      ],
      "type":[
         "access"
      ],
      "outcome":"success"
   },
   "kibana":{
      "space_id":"default",
      "saved_object":{
         "type":"cases",
         "id":"fcaedd50-c3d9-11eb-8ed2-c3d5ba03d28e"
      }
   },
   "user":{
      "name":"elastic",
      "roles":[
         "superuser"
      ]
   },
   "trace":{
      "id":"5d703583-36f8-4fe4-bdad-fbdcb8caf6b6"
   },
   "ecs":{
      "version":"1.9.0"
   },
   "@timestamp":"2021-06-02T15:49:51.263-04:00",
   "message":"User has accessed cases [id=fcaedd50-c3d9-11eb-8ed2-c3d5ba03d28e] as owner \"securitySolution\"",
   "log":{
      "level":"INFO",
      "logger":"plugins.security.audit.ecs"
   },
   "process":{
      "pid":81951
   }
}{
   "event":{
      "action":"case_find",
      "category":[
         "database"
      ],
      "type":[
         "access"
      ],
      "outcome":"success"
   },
   "kibana":{
      "space_id":"default",
      "saved_object":{
         "type":"cases",
         "id":"24fbf130-c3da-11eb-8ed2-c3d5ba03d28e"
      }
   },
   "user":{
      "name":"elastic",
      "roles":[
         "superuser"
      ]
   },
   "trace":{
      "id":"5d703583-36f8-4fe4-bdad-fbdcb8caf6b6"
   },
   "ecs":{
      "version":"1.9.0"
   },
   "@timestamp":"2021-06-02T15:49:51.263-04:00",
   "message":"User has accessed cases [id=24fbf130-c3da-11eb-8ed2-c3d5ba03d28e] as owner \"securitySolution\"",
   "log":{
      "level":"INFO",
      "logger":"plugins.security.audit.ecs"
   },
   "process":{
      "pid":81951
   }
}

…-rbac-audit-log-refactor

legrego · 2021-06-01T18:04:04Z

Thanks for opening these changes as its own PR, that makes it much easier to review! I will try to take a look tomorrow (today has been a bunch of catch up for me unfortunately)

jonathan-buttner · 2021-06-01T19:18:06Z

Thanks for opening these changes as its own PR, that makes it much easier to review! I will try to take a look tomorrow (today has been a bunch of catch up for me unfortunately)

Yeah no worries @legrego ! I'm working on creating the unit tests, should have a good portion of them pushed up by COB today 👍

jonathan-buttner · 2021-06-01T19:20:38Z

x-pack/plugins/cases/server/authorization/types.ts

-   * Logs a successful audit message for the request
-   */
-  logSuccessfulAuthorization: () => void;
+  ensureSavedObjectsAreAuthorized: EnsureSOAuthCallback;


Just wanted to call this out: The Authorization class is no longer returning logSuccessfulAuthorization since that produced a duplicate message for read operations (these helpers are used for read operations).

legrego

These changes are great, thanks! Just a couple minor comments from me below.

legrego · 2021-06-02T10:12:57Z

x-pack/plugins/cases/server/authorization/audit_logger.ts

@@ -19,106 +22,80 @@ enum AuthorizationResult {
 export class AuthorizationAuditLogger {


👏 this looks much better!

legrego · 2021-06-02T10:16:06Z

x-pack/plugins/cases/server/authorization/audit_logger.test.ts

+
+    beforeEach(() => {
+      mockLogger.log.mockReset();
+      logger = new AuthorizationAuditLogger(mockLogger);


Can we add a test ensuring that we can call logger.log without consequence if the mockLogger is undefined?

legrego · 2021-06-02T10:17:43Z

x-pack/plugins/cases/server/authorization/authorization.ts

+        operation
+      );
+
+      logSavedObjects();


nit: in the very unlikely event that this call to logSavedObjects throws an exception, we will end up with both success and failure events in the audit logs. If we move logSavedObjects below this try block, then we will prevent this from happening

legrego · 2021-06-02T10:23:09Z

x-pack/plugins/cases/server/authorization/authorization.test.ts

+
+      auth = await Authorization.create({
+        request,
+        securityAuth: securityStart.authz,


Looks like security is enabled for this test suite, but the description says it shouldn't be.

Thanks for catching that. I switch the test description to say enabled because we need security enabled otherwise it won't hit the if condition to make it throw an error.

legrego · 2021-06-02T10:24:57Z

x-pack/plugins/cases/server/authorization/authorization.test.ts

+import { AuditLogger, SecurityPluginStart } from '../../../security/server';
+import { PluginStartContract as FeaturesPluginStart } from '../../../features/server';
+
+describe('authorization', () => {


🏅 great job on these tests! Thanks for taking the time to write these.

legrego · 2021-06-02T10:26:34Z

x-pack/plugins/cases/server/client/attachments/add.ts

-      auditLogger,
-      owners: [comment.owner],
-      savedObjectIDs: [savedObjectID],
+    await authorization.ensureAuthorized({


This is so much nicer to consume/read!

legrego · 2021-06-02T10:28:44Z

x-pack/plugins/cases/server/authorization/index.ts

    name: WriteOperations.PushCase,
    action: 'case_push',
    verbs: updateVerbs,
    docType: 'case',
    savedObjectType: CASE_SAVED_OBJECT,
  },
  [WriteOperations.CreateConfiguration]: {
-    type: EVENT_TYPES.creation,
+    ecsType: EVENT_TYPES.creation,
    name: WriteOperations.CreateConfiguration,
    action: 'configuration_create',


question For the configuration and comment operations, would it make sense to prefix these with case, so that we can distinguish these from other types of configuration/comments in the audit log? For example, case_configuration_create?

Yeah good point, I'll update them 👍

legrego · 2021-06-02T11:29:21Z

x-pack/plugins/cases/server/client/attachments/get.ts

-    authorization,
-    auditLogger,
-  } = clientArgs;
+  const { unsecuredSavedObjectsClient: soClient, caseService, logger, authorization } = clientArgs;


I understand it's not part of this PR, and we can do this in a followup, but I'd really like to see the unsecuredSavedObjectsClient name propogated everywhere, instead of renaming it to soClient or similar. The rename hides the fact that we are dealing with an unsecured SO client, which is dangerous IMO

Sounds good! I added it as a line item here: #100804 we'll make sure it's completed in the RBAC PR as well.

cnasikas · 2021-06-02T15:15:12Z

x-pack/plugins/cases/server/authorization/index.test.ts

+    expect(isWriteOperation(Operations.createCase)).toBeTruthy();
+  });
+
+  it('should identify a read operation', () => {


nit: should identify a read operation. That's the purpose of the this test, right?

yeah good point, I guess it doesn't necessarily mean that it is a read operation just that it's not a write operation 😆 I'll switch it to say should return false when the operation is not a write operation

cnasikas · 2021-06-02T15:22:04Z

x-pack/plugins/cases/server/authorization/index.ts

+ * @param operation an OperationDetails object describing the operation that occurred
+ * @returns true if the passed in operation was a write operation
+ */
+export function isWriteOperation(operation: OperationDetails): boolean {


nit:

Suggested change

export function isWriteOperation(operation: OperationDetails): boolean {

export function isWriteOperation(operation: OperationDetails): operation is WriteOperations {

hmm when I try to make it an official type guard I get this error

I think it's because the parameter isn't operation: WriteOperations | ReadOperations

Yes, I think because if there is no relationship between the value's type and the type in the type predicate, the guard do not make sense. A solution would be to change the argument to string. I see that you don't use it as a typeguard but as a helper function so it is ok as it is :)

cnasikas · 2021-06-02T15:32:10Z

x-pack/plugins/cases/server/authorization/authorization.ts

+    }
+  }
+
+  private async ensureAuthorizedHelper(owners: string[], operation: OperationDetails) {


nit: What do you think about _ensureAuthorized?

elasticmachine · 2021-06-02T19:29:51Z

Pinging @elastic/security-threat-hunting (Team:Threat Hunting)

cnasikas · 2021-06-03T07:27:29Z

x-pack/plugins/cases/server/authorization/utils.test.ts

+      `);
+    });
+
+    it("returns a single KueryNode and'ing together the passed in parameters", () => {


nit: and'ing ? 😄

haha yeah, I'm just trying to convey that the action is the and so I hacked it into a verb 😆

cnasikas · 2021-06-03T07:28:48Z

x-pack/plugins/cases/server/authorization/utils.test.ts

+              "type": "literal",
+              "value": "hello",
+            },
+            Object {


I am curious, do you know what tis extra object is?

Not sure actually 🤔 seems like it comes from here: https://github.com/elastic/kibana/blob/master/src/plugins/data/common/es_query/kuery/node_types/node_builder.ts#L16

Perfect! I asked if case we where doing something wrong.

cnasikas · 2021-06-03T07:34:14Z

x-pack/plugins/cases/server/authorization/utils.test.ts

+      `);
+    });
+
+    it("constructs a KueryNode or'ing together two filters", () => {


What will happen if we pass an empty array?

Great point. We should probably return undefined 👍 . I'll add that and a test.

legrego

LGTM, thanks!

…-rbac-audit-log-refactor

kibanamachine · 2021-06-03T17:09:40Z

💚 Build Succeeded

History

💔 Build #128920 failed e69c1cf
💚 Build #128745 succeeded 95f2f58
💚 Build #128519 succeeded 83146b3
💚 Build #128340 succeeded 20e49ed
💔 Build #128096 failed 294c99e

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* Adding feature flag for auth * Hiding SOs and adding consumer field * First pass at adding security changes * Consumer as the app's plugin ID * Create addConsumerToSO migration helper * Fix mapping's SO consumer * Add test for CasesActions * Declare hidden types on SO client * Restructure integration tests * Init spaces_only integration tests * Implementing the cases security string * Adding security plugin tests for cases * Rough concept for authorization class * Adding comments * Fix merge * Get requiredPrivileges for classes * Check privillages * Ensure that all classes are available * Success if hasAllRequested is true * Failure if hasAllRequested is false * Adding schema updates for feature plugin * Seperate basic from trial * Enable SIR on integration tests * Starting the plumbing for authorization in plugin * Unit tests working * Move find route logic to case client * Create integration test helper functions * Adding auth to create call * Create getClassFilter helper * Add class attribute to find request * Create getFindAuthorizationFilter * Ensure savedObject is authorized in find method * Include fields for authorization * Combine authorization filter with cases & subcases filter * Fix isAuthorized flag * Fix merge issue * Create/delete spaces & users before and after tests * Add more user and roles * [Cases] Convert filters from strings to KueryNode (#95288) * [Cases] RBAC: Rename class to scope (#95535) * [Cases][RBAC] Rename scope to owner (#96035) * [Cases] RBAC: Create & Find integration tests (#95511) * [Cases] Cases client enchantment (#95923) * [Cases] Authorization and Client Audit Logger (#95477) * Starting audit logger * Finishing auth audit logger * Fixing tests and types * Adding audit event creator * Renaming class to scope * Adding audit logger messages to create and find * Adding comments and fixing import issue * Fixing type errors * Fixing tests and adding username to message * Addressing PR feedback * Removing unneccessary log and generating id * Fixing module issue and remove expect.anything * [Cases] Migrate sub cases routes to a client (#96461) * Adding sub cases client * Move sub case routes to case client * Throw when attempting to access the sub cases client * Fixing throw and removing user ans soclients * [Cases] RBAC: Migrate routes' unit tests to integration tests (#96374) Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co> * [Cases] Move remaining HTTP functionality to client (#96507) * Moving deletes and find for attachments * Moving rest of comment apis * Migrating configuration routes to client * Finished moving routes, starting utils refactor * Refactoring utilites and fixing integration tests * Addressing PR feedback * Fixing mocks and types * Fixing integration tests * Renaming status_stats * Fixing test type errors * Adding plugins to kibana.json * Adding cases to required plugin * [Cases] Refactoring authorization (#97483) * Refactoring authorization * Wrapping auth calls in helper for try catch * Reverting name change * Hardcoding the saved object types * Switching ensure to owner array * [Cases] Add authorization to configuration & cases routes (#97228) * [Cases] Attachments RBAC (#97756) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Addressing PR comments * Reducing operations * [Cases] Add RBAC to remaining Cases APIs (#98762) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Working case update tests * Addressing PR comments * Reducing operations * Working rbac push case tests * Starting stats apis * Working status tests * User action tests and fixing migration errors * Fixing type errors * including error in message * Addressing pr feedback * Fixing some type errors * [Cases] Add space only tests (#99409) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * [Cases] Add security only tests (#99679) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * Starting security only tests * Adding remainder security only tests * Using helper objects * Fixing type error for null space * Renaming utility variables * Refactoring users and roles for security only tests * Adding sub feature * [Cases] Cleaning up the services and TODOs (#99723) * Cleaning up the service intialization * Fixing type errors * Adding comments for the api * Working test for cases client * Fix type error * Adding generated docs * Adding more docs and cleaning up types * Cleaning up readme * More clean up and links * Changing some file names * Renaming docs * Integration tests for cases privs and fixes (#100038) * [Cases] RBAC on UI (#99478) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Fixing case ids by alert id route call * [Cases] Fixing UI feature permissions and adding UI tests (#100074) * Integration tests for cases privs and fixes * Fixing ui cases permissions and adding tests * Adding test for collection failure and fixing jest * Renaming variables * Fixing type error * Adding some comments * Validate cases features * Fix new schema * Adding owner param for the status stats * Fix get case status tests * Adjusting permissions text and fixing status * Address PR feedback * Adding top level feature back * Fixing feature privileges * Renaming * Removing uneeded else * Fixing tests and adding cases merge tests * [Cases][Security Solution] Basic license security solution API tests (#100925) * Cleaning up the fixture plugins * Adding basic feature test * renaming to unsecuredSavedObjectsClient (#101215) * [Cases] RBAC Refactoring audit logging (#100952) * Refactoring audit logging * Adding unit tests for authorization classes * Addressing feedback and adding util tests * return undefined on empty array * fixing eslint * [Cases] Cleaning up RBAC integration tests (#101324) * Adding tests for space permissions * Adding tests for testing a disable feature Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

* Adding feature flag for auth * Hiding SOs and adding consumer field * First pass at adding security changes * Consumer as the app's plugin ID * Create addConsumerToSO migration helper * Fix mapping's SO consumer * Add test for CasesActions * Declare hidden types on SO client * Restructure integration tests * Init spaces_only integration tests * Implementing the cases security string * Adding security plugin tests for cases * Rough concept for authorization class * Adding comments * Fix merge * Get requiredPrivileges for classes * Check privillages * Ensure that all classes are available * Success if hasAllRequested is true * Failure if hasAllRequested is false * Adding schema updates for feature plugin * Seperate basic from trial * Enable SIR on integration tests * Starting the plumbing for authorization in plugin * Unit tests working * Move find route logic to case client * Create integration test helper functions * Adding auth to create call * Create getClassFilter helper * Add class attribute to find request * Create getFindAuthorizationFilter * Ensure savedObject is authorized in find method * Include fields for authorization * Combine authorization filter with cases & subcases filter * Fix isAuthorized flag * Fix merge issue * Create/delete spaces & users before and after tests * Add more user and roles * [Cases] Convert filters from strings to KueryNode (elastic#95288) * [Cases] RBAC: Rename class to scope (elastic#95535) * [Cases][RBAC] Rename scope to owner (elastic#96035) * [Cases] RBAC: Create & Find integration tests (elastic#95511) * [Cases] Cases client enchantment (elastic#95923) * [Cases] Authorization and Client Audit Logger (elastic#95477) * Starting audit logger * Finishing auth audit logger * Fixing tests and types * Adding audit event creator * Renaming class to scope * Adding audit logger messages to create and find * Adding comments and fixing import issue * Fixing type errors * Fixing tests and adding username to message * Addressing PR feedback * Removing unneccessary log and generating id * Fixing module issue and remove expect.anything * [Cases] Migrate sub cases routes to a client (elastic#96461) * Adding sub cases client * Move sub case routes to case client * Throw when attempting to access the sub cases client * Fixing throw and removing user ans soclients * [Cases] RBAC: Migrate routes' unit tests to integration tests (elastic#96374) Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co> * [Cases] Move remaining HTTP functionality to client (elastic#96507) * Moving deletes and find for attachments * Moving rest of comment apis * Migrating configuration routes to client * Finished moving routes, starting utils refactor * Refactoring utilites and fixing integration tests * Addressing PR feedback * Fixing mocks and types * Fixing integration tests * Renaming status_stats * Fixing test type errors * Adding plugins to kibana.json * Adding cases to required plugin * [Cases] Refactoring authorization (elastic#97483) * Refactoring authorization * Wrapping auth calls in helper for try catch * Reverting name change * Hardcoding the saved object types * Switching ensure to owner array * [Cases] Add authorization to configuration & cases routes (elastic#97228) * [Cases] Attachments RBAC (elastic#97756) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Addressing PR comments * Reducing operations * [Cases] Add RBAC to remaining Cases APIs (elastic#98762) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Working case update tests * Addressing PR comments * Reducing operations * Working rbac push case tests * Starting stats apis * Working status tests * User action tests and fixing migration errors * Fixing type errors * including error in message * Addressing pr feedback * Fixing some type errors * [Cases] Add space only tests (elastic#99409) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * [Cases] Add security only tests (elastic#99679) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * Starting security only tests * Adding remainder security only tests * Using helper objects * Fixing type error for null space * Renaming utility variables * Refactoring users and roles for security only tests * Adding sub feature * [Cases] Cleaning up the services and TODOs (elastic#99723) * Cleaning up the service intialization * Fixing type errors * Adding comments for the api * Working test for cases client * Fix type error * Adding generated docs * Adding more docs and cleaning up types * Cleaning up readme * More clean up and links * Changing some file names * Renaming docs * Integration tests for cases privs and fixes (elastic#100038) * [Cases] RBAC on UI (elastic#99478) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Fixing case ids by alert id route call * [Cases] Fixing UI feature permissions and adding UI tests (elastic#100074) * Integration tests for cases privs and fixes * Fixing ui cases permissions and adding tests * Adding test for collection failure and fixing jest * Renaming variables * Fixing type error * Adding some comments * Validate cases features * Fix new schema * Adding owner param for the status stats * Fix get case status tests * Adjusting permissions text and fixing status * Address PR feedback * Adding top level feature back * Fixing feature privileges * Renaming * Removing uneeded else * Fixing tests and adding cases merge tests * [Cases][Security Solution] Basic license security solution API tests (elastic#100925) * Cleaning up the fixture plugins * Adding basic feature test * renaming to unsecuredSavedObjectsClient (elastic#101215) * [Cases] RBAC Refactoring audit logging (elastic#100952) * Refactoring audit logging * Adding unit tests for authorization classes * Addressing feedback and adding util tests * return undefined on empty array * fixing eslint * [Cases] Cleaning up RBAC integration tests (elastic#101324) * Adding tests for space permissions * Adding tests for testing a disable feature Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> # Conflicts: # x-pack/plugins/cases/server/client/client.ts # x-pack/plugins/cases/server/client/mocks.ts # x-pack/plugins/cases/server/client/types.ts # x-pack/plugins/cases/server/index.ts # x-pack/plugins/cases/server/plugin.ts # x-pack/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts # x-pack/plugins/security_solution/server/endpoint/mocks.ts # x-pack/plugins/security_solution/server/endpoint/routes/actions/isolation.ts

* [Cases] RBAC (#95058) * Adding feature flag for auth * Hiding SOs and adding consumer field * First pass at adding security changes * Consumer as the app's plugin ID * Create addConsumerToSO migration helper * Fix mapping's SO consumer * Add test for CasesActions * Declare hidden types on SO client * Restructure integration tests * Init spaces_only integration tests * Implementing the cases security string * Adding security plugin tests for cases * Rough concept for authorization class * Adding comments * Fix merge * Get requiredPrivileges for classes * Check privillages * Ensure that all classes are available * Success if hasAllRequested is true * Failure if hasAllRequested is false * Adding schema updates for feature plugin * Seperate basic from trial * Enable SIR on integration tests * Starting the plumbing for authorization in plugin * Unit tests working * Move find route logic to case client * Create integration test helper functions * Adding auth to create call * Create getClassFilter helper * Add class attribute to find request * Create getFindAuthorizationFilter * Ensure savedObject is authorized in find method * Include fields for authorization * Combine authorization filter with cases & subcases filter * Fix isAuthorized flag * Fix merge issue * Create/delete spaces & users before and after tests * Add more user and roles * [Cases] Convert filters from strings to KueryNode (#95288) * [Cases] RBAC: Rename class to scope (#95535) * [Cases][RBAC] Rename scope to owner (#96035) * [Cases] RBAC: Create & Find integration tests (#95511) * [Cases] Cases client enchantment (#95923) * [Cases] Authorization and Client Audit Logger (#95477) * Starting audit logger * Finishing auth audit logger * Fixing tests and types * Adding audit event creator * Renaming class to scope * Adding audit logger messages to create and find * Adding comments and fixing import issue * Fixing type errors * Fixing tests and adding username to message * Addressing PR feedback * Removing unneccessary log and generating id * Fixing module issue and remove expect.anything * [Cases] Migrate sub cases routes to a client (#96461) * Adding sub cases client * Move sub case routes to case client * Throw when attempting to access the sub cases client * Fixing throw and removing user ans soclients * [Cases] RBAC: Migrate routes' unit tests to integration tests (#96374) Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co> * [Cases] Move remaining HTTP functionality to client (#96507) * Moving deletes and find for attachments * Moving rest of comment apis * Migrating configuration routes to client * Finished moving routes, starting utils refactor * Refactoring utilites and fixing integration tests * Addressing PR feedback * Fixing mocks and types * Fixing integration tests * Renaming status_stats * Fixing test type errors * Adding plugins to kibana.json * Adding cases to required plugin * [Cases] Refactoring authorization (#97483) * Refactoring authorization * Wrapping auth calls in helper for try catch * Reverting name change * Hardcoding the saved object types * Switching ensure to owner array * [Cases] Add authorization to configuration & cases routes (#97228) * [Cases] Attachments RBAC (#97756) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Addressing PR comments * Reducing operations * [Cases] Add RBAC to remaining Cases APIs (#98762) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Working case update tests * Addressing PR comments * Reducing operations * Working rbac push case tests * Starting stats apis * Working status tests * User action tests and fixing migration errors * Fixing type errors * including error in message * Addressing pr feedback * Fixing some type errors * [Cases] Add space only tests (#99409) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * [Cases] Add security only tests (#99679) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * Starting security only tests * Adding remainder security only tests * Using helper objects * Fixing type error for null space * Renaming utility variables * Refactoring users and roles for security only tests * Adding sub feature * [Cases] Cleaning up the services and TODOs (#99723) * Cleaning up the service intialization * Fixing type errors * Adding comments for the api * Working test for cases client * Fix type error * Adding generated docs * Adding more docs and cleaning up types * Cleaning up readme * More clean up and links * Changing some file names * Renaming docs * Integration tests for cases privs and fixes (#100038) * [Cases] RBAC on UI (#99478) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Fixing case ids by alert id route call * [Cases] Fixing UI feature permissions and adding UI tests (#100074) * Integration tests for cases privs and fixes * Fixing ui cases permissions and adding tests * Adding test for collection failure and fixing jest * Renaming variables * Fixing type error * Adding some comments * Validate cases features * Fix new schema * Adding owner param for the status stats * Fix get case status tests * Adjusting permissions text and fixing status * Address PR feedback * Adding top level feature back * Fixing feature privileges * Renaming * Removing uneeded else * Fixing tests and adding cases merge tests * [Cases][Security Solution] Basic license security solution API tests (#100925) * Cleaning up the fixture plugins * Adding basic feature test * renaming to unsecuredSavedObjectsClient (#101215) * [Cases] RBAC Refactoring audit logging (#100952) * Refactoring audit logging * Adding unit tests for authorization classes * Addressing feedback and adding util tests * return undefined on empty array * fixing eslint * [Cases] Cleaning up RBAC integration tests (#101324) * Adding tests for space permissions * Adding tests for testing a disable feature Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> # Conflicts: # x-pack/plugins/cases/server/client/client.ts # x-pack/plugins/cases/server/client/mocks.ts # x-pack/plugins/cases/server/client/types.ts # x-pack/plugins/cases/server/index.ts # x-pack/plugins/cases/server/plugin.ts # x-pack/plugins/security_solution/server/endpoint/endpoint_app_context_services.ts # x-pack/plugins/security_solution/server/endpoint/mocks.ts # x-pack/plugins/security_solution/server/endpoint/routes/actions/isolation.ts * Fixing type errors * Addressing plugin type errors

* Adding feature flag for auth * Hiding SOs and adding consumer field * First pass at adding security changes * Consumer as the app's plugin ID * Create addConsumerToSO migration helper * Fix mapping's SO consumer * Add test for CasesActions * Declare hidden types on SO client * Restructure integration tests * Init spaces_only integration tests * Implementing the cases security string * Adding security plugin tests for cases * Rough concept for authorization class * Adding comments * Fix merge * Get requiredPrivileges for classes * Check privillages * Ensure that all classes are available * Success if hasAllRequested is true * Failure if hasAllRequested is false * Adding schema updates for feature plugin * Seperate basic from trial * Enable SIR on integration tests * Starting the plumbing for authorization in plugin * Unit tests working * Move find route logic to case client * Create integration test helper functions * Adding auth to create call * Create getClassFilter helper * Add class attribute to find request * Create getFindAuthorizationFilter * Ensure savedObject is authorized in find method * Include fields for authorization * Combine authorization filter with cases & subcases filter * Fix isAuthorized flag * Fix merge issue * Create/delete spaces & users before and after tests * Add more user and roles * [Cases] Convert filters from strings to KueryNode (#95288) * [Cases] RBAC: Rename class to scope (#95535) * [Cases][RBAC] Rename scope to owner (#96035) * [Cases] RBAC: Create & Find integration tests (#95511) * [Cases] Cases client enchantment (#95923) * [Cases] Authorization and Client Audit Logger (#95477) * Starting audit logger * Finishing auth audit logger * Fixing tests and types * Adding audit event creator * Renaming class to scope * Adding audit logger messages to create and find * Adding comments and fixing import issue * Fixing type errors * Fixing tests and adding username to message * Addressing PR feedback * Removing unneccessary log and generating id * Fixing module issue and remove expect.anything * [Cases] Migrate sub cases routes to a client (#96461) * Adding sub cases client * Move sub case routes to case client * Throw when attempting to access the sub cases client * Fixing throw and removing user ans soclients * [Cases] RBAC: Migrate routes' unit tests to integration tests (#96374) Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co> * [Cases] Move remaining HTTP functionality to client (#96507) * Moving deletes and find for attachments * Moving rest of comment apis * Migrating configuration routes to client * Finished moving routes, starting utils refactor * Refactoring utilites and fixing integration tests * Addressing PR feedback * Fixing mocks and types * Fixing integration tests * Renaming status_stats * Fixing test type errors * Adding plugins to kibana.json * Adding cases to required plugin * [Cases] Refactoring authorization (#97483) * Refactoring authorization * Wrapping auth calls in helper for try catch * Reverting name change * Hardcoding the saved object types * Switching ensure to owner array * [Cases] Add authorization to configuration & cases routes (#97228) * [Cases] Attachments RBAC (#97756) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Addressing PR comments * Reducing operations * [Cases] Add RBAC to remaining Cases APIs (#98762) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Working case update tests * Addressing PR comments * Reducing operations * Working rbac push case tests * Starting stats apis * Working status tests * User action tests and fixing migration errors * Fixing type errors * including error in message * Addressing pr feedback * Fixing some type errors * [Cases] Add space only tests (#99409) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * [Cases] Add security only tests (#99679) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * Starting security only tests * Adding remainder security only tests * Using helper objects * Fixing type error for null space * Renaming utility variables * Refactoring users and roles for security only tests * Adding sub feature * [Cases] Cleaning up the services and TODOs (#99723) * Cleaning up the service intialization * Fixing type errors * Adding comments for the api * Working test for cases client * Fix type error * Adding generated docs * Adding more docs and cleaning up types * Cleaning up readme * More clean up and links * Changing some file names * Renaming docs * Integration tests for cases privs and fixes (#100038) * [Cases] RBAC on UI (#99478) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Fixing case ids by alert id route call * [Cases] Fixing UI feature permissions and adding UI tests (#100074) * Integration tests for cases privs and fixes * Fixing ui cases permissions and adding tests * Adding test for collection failure and fixing jest * Renaming variables * Fixing type error * Adding some comments * Validate cases features * Fix new schema * Adding owner param for the status stats * Fix get case status tests * Adjusting permissions text and fixing status * Address PR feedback * Adding top level feature back * Fixing feature privileges * Renaming * Removing uneeded else * Fixing tests and adding cases merge tests * [Cases][Security Solution] Basic license security solution API tests (#100925) * Cleaning up the fixture plugins * Adding basic feature test * renaming to unsecuredSavedObjectsClient (#101215) * [Cases] RBAC Refactoring audit logging (#100952) * Refactoring audit logging * Adding unit tests for authorization classes * Addressing feedback and adding util tests * return undefined on empty array * fixing eslint * conditional rendering the recently created cases * Remove unnecessary Array.from * Cleaning up overview page for permissions * Fixing log message for attachments * hiding add to cases button * Disable the Cases app from the global nav * Hide the add to cases button from detections * Fixing merge * Making progress on removing icons * Hding edit icons on detail view * Trying to get connector error msg tests working * Removing test * Disable error callouts * Fixing spacing and removing cases tab one no read * Adding read only badge * Cleaning up and adding badge * Wrapping in use effect * Default toasting permissions errors * Removing actions icon on comments * Addressing feedback * Fixing type Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

* Adding feature flag for auth * Hiding SOs and adding consumer field * First pass at adding security changes * Consumer as the app's plugin ID * Create addConsumerToSO migration helper * Fix mapping's SO consumer * Add test for CasesActions * Declare hidden types on SO client * Restructure integration tests * Init spaces_only integration tests * Implementing the cases security string * Adding security plugin tests for cases * Rough concept for authorization class * Adding comments * Fix merge * Get requiredPrivileges for classes * Check privillages * Ensure that all classes are available * Success if hasAllRequested is true * Failure if hasAllRequested is false * Adding schema updates for feature plugin * Seperate basic from trial * Enable SIR on integration tests * Starting the plumbing for authorization in plugin * Unit tests working * Move find route logic to case client * Create integration test helper functions * Adding auth to create call * Create getClassFilter helper * Add class attribute to find request * Create getFindAuthorizationFilter * Ensure savedObject is authorized in find method * Include fields for authorization * Combine authorization filter with cases & subcases filter * Fix isAuthorized flag * Fix merge issue * Create/delete spaces & users before and after tests * Add more user and roles * [Cases] Convert filters from strings to KueryNode (#95288) * [Cases] RBAC: Rename class to scope (#95535) * [Cases][RBAC] Rename scope to owner (#96035) * [Cases] RBAC: Create & Find integration tests (#95511) * [Cases] Cases client enchantment (#95923) * [Cases] Authorization and Client Audit Logger (#95477) * Starting audit logger * Finishing auth audit logger * Fixing tests and types * Adding audit event creator * Renaming class to scope * Adding audit logger messages to create and find * Adding comments and fixing import issue * Fixing type errors * Fixing tests and adding username to message * Addressing PR feedback * Removing unneccessary log and generating id * Fixing module issue and remove expect.anything * [Cases] Migrate sub cases routes to a client (#96461) * Adding sub cases client * Move sub case routes to case client * Throw when attempting to access the sub cases client * Fixing throw and removing user ans soclients * [Cases] RBAC: Migrate routes' unit tests to integration tests (#96374) Co-authored-by: Jonathan Buttner <jonathan.buttner@elastic.co> * [Cases] Move remaining HTTP functionality to client (#96507) * Moving deletes and find for attachments * Moving rest of comment apis * Migrating configuration routes to client * Finished moving routes, starting utils refactor * Refactoring utilites and fixing integration tests * Addressing PR feedback * Fixing mocks and types * Fixing integration tests * Renaming status_stats * Fixing test type errors * Adding plugins to kibana.json * Adding cases to required plugin * [Cases] Refactoring authorization (#97483) * Refactoring authorization * Wrapping auth calls in helper for try catch * Reverting name change * Hardcoding the saved object types * Switching ensure to owner array * [Cases] Add authorization to configuration & cases routes (#97228) * [Cases] Attachments RBAC (#97756) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Addressing PR comments * Reducing operations * [Cases] Add RBAC to remaining Cases APIs (#98762) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Working case update tests * Addressing PR comments * Reducing operations * Working rbac push case tests * Starting stats apis * Working status tests * User action tests and fixing migration errors * Fixing type errors * including error in message * Addressing pr feedback * Fixing some type errors * [Cases] Add space only tests (#99409) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * [Cases] Add security only tests (#99679) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * Starting security only tests * Adding remainder security only tests * Using helper objects * Fixing type error for null space * Renaming utility variables * Refactoring users and roles for security only tests * Adding sub feature * [Cases] Cleaning up the services and TODOs (#99723) * Cleaning up the service intialization * Fixing type errors * Adding comments for the api * Working test for cases client * Fix type error * Adding generated docs * Adding more docs and cleaning up types * Cleaning up readme * More clean up and links * Changing some file names * Renaming docs * Integration tests for cases privs and fixes (#100038) * [Cases] RBAC on UI (#99478) Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> * Fixing case ids by alert id route call * [Cases] Fixing UI feature permissions and adding UI tests (#100074) * Integration tests for cases privs and fixes * Fixing ui cases permissions and adding tests * Adding test for collection failure and fixing jest * Renaming variables * Fixing type error * Adding some comments * Validate cases features * Fix new schema * Adding owner param for the status stats * Fix get case status tests * Adjusting permissions text and fixing status * Address PR feedback * Adding top level feature back * Fixing feature privileges * Renaming * Removing uneeded else * Fixing tests and adding cases merge tests * [Cases][Security Solution] Basic license security solution API tests (#100925) * Cleaning up the fixture plugins * Adding basic feature test * renaming to unsecuredSavedObjectsClient (#101215) * [Cases] RBAC Refactoring audit logging (#100952) * Refactoring audit logging * Adding unit tests for authorization classes * Addressing feedback and adding util tests * return undefined on empty array * fixing eslint * conditional rendering the recently created cases * Remove unnecessary Array.from * Cleaning up overview page for permissions * Fixing log message for attachments * hiding add to cases button * Disable the Cases app from the global nav * Hide the add to cases button from detections * Fixing merge * Making progress on removing icons * Hding edit icons on detail view * Trying to get connector error msg tests working * Removing test * Disable error callouts * Fixing spacing and removing cases tab one no read * Adding read only badge * Cleaning up and adding badge * Wrapping in use effect * Default toasting permissions errors * Removing actions icon on comments * Addressing feedback * Fixing type Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Christos Nasikas <christos.nasikas@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>

Refactoring audit logging

6878922

jonathan-buttner added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Threat Hunting Security Solution Threat Hunting Team Feature:Cases Cases feature v7.14.0 Feature:Cases-RAC-RBAC labels May 28, 2021

jonathan-buttner requested review from legrego and cnasikas May 28, 2021 21:12

jonathan-buttner added 2 commits May 28, 2021 21:57

Merge branch 'cases-rbac-poc' of github.com:elastic/kibana into cases…

294c99e

…-rbac-audit-log-refactor

Merge branch 'cases-rbac-poc' of github.com:elastic/kibana into cases…

20e49ed

…-rbac-audit-log-refactor

jonathan-buttner commented Jun 1, 2021

View reviewed changes

Adding unit tests for authorization classes

83146b3

legrego reviewed Jun 2, 2021

View reviewed changes

cnasikas reviewed Jun 2, 2021

View reviewed changes

Addressing feedback and adding util tests

95f2f58

jonathan-buttner marked this pull request as ready for review June 2, 2021 19:29

jonathan-buttner requested a review from a team as a code owner June 2, 2021 19:29

jonathan-buttner mentioned this pull request Jun 2, 2021

[Cases] Renaming all saved object variables to unsecuredSavedObjectsClient #101215

Merged

cnasikas reviewed Jun 3, 2021

View reviewed changes

cnasikas approved these changes Jun 3, 2021

View reviewed changes

legrego approved these changes Jun 3, 2021

View reviewed changes

return undefined on empty array

2829509

jonathan-buttner requested a review from a team as a code owner June 3, 2021 13:39

Merge branch 'cases-rbac-poc' of github.com:elastic/kibana into cases…

e69c1cf

…-rbac-audit-log-refactor

jonathan-buttner mentioned this pull request Jun 3, 2021

[Cases] RBAC #95058

Merged

jonathan-buttner added 2 commits June 3, 2021 11:05

Merge branch 'cases-rbac-poc' of github.com:elastic/kibana into cases…

f5ee7dc

…-rbac-audit-log-refactor

fixing eslint

aa3bc6a

jonathan-buttner merged commit 739fd6f into elastic:cases-rbac-poc Jun 3, 2021

jonathan-buttner deleted the cases-rbac-audit-log-refactor branch June 3, 2021 17:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Cases] RBAC Refactoring audit logging #100952

[Cases] RBAC Refactoring audit logging #100952

jonathan-buttner commented May 28, 2021 •

edited

Loading

legrego commented Jun 1, 2021

jonathan-buttner commented Jun 1, 2021

jonathan-buttner Jun 1, 2021

legrego left a comment

legrego Jun 2, 2021

legrego Jun 2, 2021

legrego Jun 2, 2021

legrego Jun 2, 2021

jonathan-buttner Jun 2, 2021

legrego Jun 2, 2021

legrego Jun 2, 2021

legrego Jun 2, 2021

jonathan-buttner Jun 2, 2021

legrego Jun 2, 2021

jonathan-buttner Jun 2, 2021

cnasikas Jun 2, 2021

jonathan-buttner Jun 2, 2021

cnasikas Jun 2, 2021 •

edited

Loading

jonathan-buttner Jun 2, 2021

cnasikas Jun 3, 2021

cnasikas Jun 2, 2021 •

edited

Loading

elasticmachine commented Jun 2, 2021

cnasikas Jun 3, 2021

jonathan-buttner Jun 3, 2021

cnasikas Jun 3, 2021

jonathan-buttner Jun 3, 2021

cnasikas Jun 3, 2021

cnasikas Jun 3, 2021

jonathan-buttner Jun 3, 2021

legrego left a comment

kibanamachine commented Jun 3, 2021

		@@ -19,106 +22,80 @@ enum AuthorizationResult {
		export class AuthorizationAuditLogger {

	export function isWriteOperation(operation: OperationDetails): boolean {
	export function isWriteOperation(operation: OperationDetails): operation is WriteOperations {

[Cases] RBAC Refactoring audit logging #100952

[Cases] RBAC Refactoring audit logging #100952

Conversation

jonathan-buttner commented May 28, 2021 • edited Loading

Testing

legrego commented Jun 1, 2021

jonathan-buttner commented Jun 1, 2021

Choose a reason for hiding this comment

legrego left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cnasikas Jun 2, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cnasikas Jun 2, 2021 • edited Loading

Choose a reason for hiding this comment

elasticmachine commented Jun 2, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

legrego left a comment

Choose a reason for hiding this comment

kibanamachine commented Jun 3, 2021

💚 Build Succeeded

History

jonathan-buttner commented May 28, 2021 •

edited

Loading

cnasikas Jun 2, 2021 •

edited

Loading

cnasikas Jun 2, 2021 •

edited

Loading