[Security solution][Endpoint] API error when edit/create TA by policy and license under platinum

x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/errors.ts

@@ -25,6 +25,15 @@ export class TrustedAppPolicyNotExistsError extends Error {
     );
   }
 }
+export class TrustedAppPolicyPermissionsError extends Error {
+  public readonly type = 'TrustedApps/PolicyPermissionError';
+
+  constructor() {
+    super(
+      'Your Kibana license has been downgraded. As such, individual policy configuration is no longer supported.'
+    );
+  }
+}
 
 export class TrustedAppVersionConflictError extends Error {
   constructor(id: string, public sourceError: Error) {

x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.test.ts

@@ -6,6 +6,7 @@
  */
 
 import { KibanaResponseFactory } from 'kibana/server';
+import { Subject } from 'rxjs';
 
 import { xpackMocks } from '../../../fixtures';
 import { loggingSystemMock, httpServerMock } from '../../../../../../../src/core/server/mocks';
@@ -20,6 +21,9 @@ import {
   OperatingSystem,
   TrustedApp,
 } from '../../../../common/endpoint/types';
+import { LicenseService } from '../../../../common/license';
+import { ILicense } from '../../../../../licensing/common/types';
+import { licenseMock } from '../../../../../licensing/common/licensing.mock';
 import { parseExperimentalConfigValue } from '../../../../common/experimental_features';
 import { EndpointAppContextService } from '../../endpoint_app_context_services';
 import { createConditionEntry, createEntryMatch } from './mapping';
@@ -36,6 +40,7 @@ import {
   TrustedAppNotFoundError,
   TrustedAppVersionConflictError,
   TrustedAppPolicyNotExistsError,
+  TrustedAppPolicyPermissionsError,
 } from './errors';
 import { updateExceptionListItemImplementationMock } from './test_utils';
 import { Logger } from '@kbn/logging';
@@ -95,13 +100,19 @@ const TRUSTED_APP: TrustedApp = {
   ],
 };
 
+const Platinum = licenseMock.createLicense({ license: { type: 'platinum', mode: 'platinum' } });
+const Gold = licenseMock.createLicense({ license: { type: 'gold', mode: 'gold' } });
+
 const packagePolicyClient =
   createPackagePolicyServiceMock() as jest.Mocked<PackagePolicyServiceInterface>;
 
 describe('handlers', () => {
   beforeEach(() => {
     packagePolicyClient.getByIDs.mockReset();
   });
+  const licenseEmitter: Subject<ILicense> = new Subject();
+  const licenseService = new LicenseService();
+  licenseService.start(licenseEmitter);
 
   const createAppContextMock = () => {
     const context = {
@@ -112,6 +123,7 @@ describe('handlers', () => {
     };
 
     context.service.getPackagePolicyService = () => packagePolicyClient;
+    context.service.getLicenseService = () => licenseService;
 
     // Ensure that `logFactory.get()` always returns the same instance for the same given prefix
     const instances = new Map<string, ReturnType<typeof context.logFactory.get>>();
@@ -151,6 +163,7 @@ describe('handlers', () => {
   beforeEach(() => {
     appContextMock = createAppContextMock();
     exceptionsListClient = listMock.getExceptionListClient() as jest.Mocked<ExceptionListClient>;
+    licenseEmitter.next(Platinum);
   });
 
   describe('getTrustedAppsDeleteRouteHandler', () => {
@@ -261,6 +274,27 @@ describe('handlers', () => {
         body: { message: error.message, attributes: { type: error.type } },
       });
     });
+
+    it('should return error when license under platinum and by policy', async () => {
+      licenseEmitter.next(Gold);
+      const mockResponse = httpServerMock.createResponseFactory();
+      packagePolicyClient.getByIDs.mockReset();
+      packagePolicyClient.getByIDs.mockResolvedValueOnce(getPackagePoliciesResponse());
+
+      const trustedAppByPolicy = getTrustedAppByPolicy();
+      await createTrustedAppHandler(
+        createHandlerContextMock(),
+        httpServerMock.createKibanaRequest({ body: trustedAppByPolicy }),
+        mockResponse
+      );
+
+      const error = new TrustedAppPolicyPermissionsError();
+
+      expect(appContextMock.logFactory.get('trusted_apps').error).toHaveBeenCalledWith(error);
+      expect(mockResponse.badRequest).toHaveBeenCalledWith({
+        body: { message: error.message, attributes: { type: error.type } },
+      });
+    });
   });
 
   describe('getTrustedAppsListRouteHandler', () => {
@@ -591,5 +625,22 @@ describe('handlers', () => {
         ])
       );
     });
+
+    it('should return error when license under platinum and by policy', async () => {
+      licenseEmitter.next(Gold);
+      packagePolicyClient.getByIDs.mockReset();
+      packagePolicyClient.getByIDs.mockResolvedValueOnce(getPackagePoliciesResponse());
+
+      const trustedAppByPolicy = getTrustedAppByPolicy();
+      await updateHandler(
+        createHandlerContextMock(),
+        httpServerMock.createKibanaRequest({ body: trustedAppByPolicy }),
+        mockResponse
+      );
+
+      expect(appContextMock.logFactory.get('trusted_apps').error).toHaveBeenCalledWith(
+        new TrustedAppPolicyPermissionsError()
+      );
+    });
   });
 });

x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/handlers.ts

@@ -33,6 +33,7 @@ import {
   TrustedAppNotFoundError,
   TrustedAppVersionConflictError,
   TrustedAppPolicyNotExistsError,
+  TrustedAppPolicyPermissionsError,
 } from './errors';
 import { PackagePolicyServiceInterface } from '../../../../../fleet/server';
 
@@ -87,6 +88,11 @@ const errorHandler = <E extends Error>(
     return res.badRequest({ body: { message: error.message, attributes: { type: error.type } } });
   }
 
+  if (error instanceof TrustedAppPolicyPermissionsError) {
+    logger.error(error);
+    return res.badRequest({ body: { message: error.message, attributes: { type: error.type } } });
+  }
+
   if (error instanceof TrustedAppVersionConflictError) {
     logger.error(error);
     return res.conflict({ body: error });
@@ -177,7 +183,8 @@ export const getTrustedAppsCreateRouteHandler = (
           exceptionListClientFromContext(context),
           context.core.savedObjects.client,
           packagePolicyClientFromEndpointContext(endpointAppContext),
-          body
+          body,
+          endpointAppContext.service.getLicenseService().isAtLeast('platinum')
         ),
       });
     } catch (error) {
@@ -206,7 +213,8 @@ export const getTrustedAppsUpdateRouteHandler = (
           context.core.savedObjects.client,
           packagePolicyClientFromEndpointContext(endpointAppContext),
           req.params.id,
-          body
+          body,
+          endpointAppContext.service.getLicenseService().isAtLeast('platinum')
         ),
       });
     } catch (error) {

x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/service.test.ts

@@ -31,6 +31,7 @@ import {
   TrustedAppNotFoundError,
   TrustedAppVersionConflictError,
   TrustedAppPolicyNotExistsError,
+  TrustedAppPolicyPermissionsError,
 } from './errors';
 import { toUpdateTrustedApp } from '../../../../common/endpoint/service/trusted_apps/to_update_trusted_app';
 import { updateExceptionListItemImplementationMock } from './test_utils';
@@ -135,7 +136,8 @@ describe('service', () => {
               '1234234659af249ddf3e40864e9fb241'
             ),
           ],
-        }
+        },
+        true
       );
 
       expect(result).toEqual({ data: TRUSTED_APP });
@@ -163,7 +165,8 @@ describe('service', () => {
               '1234234659af249ddf3e40864e9fb241'
             ),
           ],
-        }
+        },
+        true
       );
 
       expect(result).toEqual({ data: TRUSTED_APP });
@@ -175,28 +178,67 @@ describe('service', () => {
       packagePolicyClient.getByIDs.mockReset();
       packagePolicyClient.getByIDs.mockResolvedValueOnce(getPackagePoliciesResponse());
       await expect(
-        createTrustedApp(exceptionsListClient, savedObjectClient, packagePolicyClient, {
-          name: 'linux trusted app 1',
-          description: 'Linux trusted app 1',
-          effectScope: {
-            type: 'policy',
-            policies: [
-              'e5cbb9cf-98aa-4303-a04b-6a1165915079',
-              '9da95be9-9bee-4761-a8c4-28d6d9bd8c71',
+        createTrustedApp(
+          exceptionsListClient,
+          savedObjectClient,
+          packagePolicyClient,
+          {
+            name: 'linux trusted app 1',
+            description: 'Linux trusted app 1',
+            effectScope: {
+              type: 'policy',
+              policies: [
+                'e5cbb9cf-98aa-4303-a04b-6a1165915079',
+                '9da95be9-9bee-4761-a8c4-28d6d9bd8c71',
+              ],
+            },
+            os: OperatingSystem.LINUX,
+            entries: [
+              createConditionEntry(ConditionEntryField.PATH, 'wildcard', '/bin/malware'),
+              createConditionEntry(
+                ConditionEntryField.HASH,
+                'wildcard',
+                '1234234659af249ddf3e40864e9fb241'
+              ),
             ],
           },
-          os: OperatingSystem.LINUX,
-          entries: [
-            createConditionEntry(ConditionEntryField.PATH, 'wildcard', '/bin/malware'),
-            createConditionEntry(
-              ConditionEntryField.HASH,
-              'wildcard',
-              '1234234659af249ddf3e40864e9fb241'
-            ),
-          ],
-        })
+          true
+        )
       ).rejects.toBeInstanceOf(TrustedAppPolicyNotExistsError);
     });
+
+    it('should throw wwhen license under platinum and by policy', async () => {
+      packagePolicyClient.getByIDs.mockReset();
+      packagePolicyClient.getByIDs.mockResolvedValueOnce(getPackagePoliciesResponse());
+      await expect(
+        createTrustedApp(
+          exceptionsListClient,
+          savedObjectClient,
+          packagePolicyClient,
+          {
+            name: 'linux trusted app 1',
+            description: 'Linux trusted app 1',
+            effectScope: {
+              type: 'policy',
+              policies: [
+                'e5cbb9cf-98aa-4303-a04b-6a1165915079',
+                '9da95be9-9bee-4761-a8c4-28d6d9bd8c71',
+              ],
+            },
+            os: OperatingSystem.LINUX,
+            entries: [
+              createConditionEntry(ConditionEntryField.PATH, 'wildcard', '/bin/malware'),
+              createConditionEntry(
+                ConditionEntryField.HASH,
+                'wildcard',
+                '1234234659af249ddf3e40864e9fb241'
+              ),
+            ],
+          },
+          false
+        )
+      ).rejects.toBeInstanceOf(TrustedAppPolicyPermissionsError);
+    });
   });
 
   describe('getTrustedAppsList', () => {
@@ -321,7 +363,8 @@ describe('service', () => {
           savedObjectClient,
           packagePolicyClient,
           TRUSTED_APP.id,
-          trustedAppForUpdate
+          trustedAppForUpdate,
+          true
         )
       ).resolves.toEqual({
         data: {
@@ -357,7 +400,8 @@ describe('service', () => {
           savedObjectClient,
           packagePolicyClient,
           TRUSTED_APP.id,
-          toUpdateTrustedApp(TRUSTED_APP)
+          toUpdateTrustedApp(TRUSTED_APP),
+          true
         )
       ).rejects.toBeInstanceOf(TrustedAppNotFoundError);
     });
@@ -374,7 +418,8 @@ describe('service', () => {
           savedObjectClient,
           packagePolicyClient,
           TRUSTED_APP.id,
-          toUpdateTrustedApp(TRUSTED_APP)
+          toUpdateTrustedApp(TRUSTED_APP),
+          true
         )
       ).rejects.toBeInstanceOf(TrustedAppVersionConflictError);
     });
@@ -393,12 +438,13 @@ describe('service', () => {
           savedObjectClient,
           packagePolicyClient,
           TRUSTED_APP.id,
-          toUpdateTrustedApp(TRUSTED_APP)
+          toUpdateTrustedApp(TRUSTED_APP),
+          true
         )
       ).rejects.toBeInstanceOf(TrustedAppNotFoundError);
     });
 
-    it("should throw wrong policy error if some policy doesn't exists", async () => {
+    it("should throw wrong policy error if some policy doesn't exists during update", async () => {
       packagePolicyClient.getByIDs.mockReset();
       packagePolicyClient.getByIDs.mockResolvedValueOnce(getPackagePoliciesResponse());
       const trustedAppByPolicy = getTrustedAppByPolicy();
@@ -408,10 +454,27 @@ describe('service', () => {
           savedObjectClient,
           packagePolicyClient,
           trustedAppByPolicy.id,
-          toUpdateTrustedApp(trustedAppByPolicy as MaybeImmutable<TrustedApp>)
+          toUpdateTrustedApp(trustedAppByPolicy as MaybeImmutable<TrustedApp>),
+          true
         )
       ).rejects.toBeInstanceOf(TrustedAppPolicyNotExistsError);
     });
+
+    it('should throw when license under platinum and by policy', async () => {
+      packagePolicyClient.getByIDs.mockReset();
+      packagePolicyClient.getByIDs.mockResolvedValueOnce(getPackagePoliciesResponse());
+      const trustedAppByPolicy = getTrustedAppByPolicy();
+      await expect(
+        updateTrustedApp(
+          exceptionsListClient,
+          savedObjectClient,
+          packagePolicyClient,
+          trustedAppByPolicy.id,
+          toUpdateTrustedApp(trustedAppByPolicy as MaybeImmutable<TrustedApp>),
+          false
+        )
+      ).rejects.toBeInstanceOf(TrustedAppPolicyPermissionsError);
+    });
   });
 
   describe('getTrustedApp', () => {