Spaces - Hiding management link

src/legacy/server/capabilities/merge_capabilities.ts

@@ -17,23 +17,15 @@
  * under the License.
  */
 
+import { merge } from 'lodash';
 import { Capabilities } from '../../../core/public';
 
 export const mergeCapabilities = (...sources: Array<Partial<Capabilities>>): Capabilities =>
-  sources.reduce(
-    (capabilities: Capabilities, source) => {
-      Object.entries(source).forEach(([key, value = {}]) => {
-        capabilities[key] = {
-          ...value,
-          ...capabilities[key],
-        };
-      });
-
-      return capabilities;
-    },
+  merge(
     {
       navLinks: {},
       management: {},
       catalogue: {},
-    } as Capabilities
+    },
+    ...sources
   );

x-pack/plugins/security/server/lib/authorization/privileges/privileges.test.ts

@@ -318,7 +318,13 @@ describe('features', () => {
           actions.login,
           actions.version,
           ...(expectGetFeatures ? [actions.api.get('features')] : []),
-          ...(expectManageSpaces ? [actions.space.manage, actions.ui.get('spaces', 'manage')] : []),
+          ...(expectManageSpaces
+            ? [
+                actions.space.manage,
+                actions.ui.get('spaces', 'manage'),
+                actions.ui.get('management', 'kibana', 'spaces'),
+              ]
+            : []),
           actions.app.get('app-1'),
           actions.app.get('app-2'),
           actions.ui.get('catalogue', 'catalogue-1'),
@@ -403,7 +409,13 @@ describe('features', () => {
         actions.login,
         actions.version,
         ...(expectGetFeatures ? [actions.api.get('features')] : []),
-        ...(expectManageSpaces ? [actions.space.manage, actions.ui.get('spaces', 'manage')] : []),
+        ...(expectManageSpaces
+          ? [
+              actions.space.manage,
+              actions.ui.get('spaces', 'manage'),
+              actions.ui.get('management', 'kibana', 'spaces'),
+            ]
+          : []),
         actions.ui.get('catalogue', 'bar-catalogue-1'),
         actions.ui.get('catalogue', 'bar-catalogue-2'),
         actions.ui.get('management', 'bar-management', 'bar-management-1'),
@@ -614,7 +626,13 @@ describe('features', () => {
         actions.login,
         actions.version,
         ...(expectGetFeatures ? [actions.api.get('features')] : []),
-        ...(expectManageSpaces ? [actions.space.manage, actions.ui.get('spaces', 'manage')] : []),
+        ...(expectManageSpaces
+          ? [
+              actions.space.manage,
+              actions.ui.get('spaces', 'manage'),
+              actions.ui.get('management', 'kibana', 'spaces'),
+            ]
+          : []),
         actions.allHack,
       ]);
       expect(actual).toHaveProperty(`${group}.read`, [actions.login, actions.version]);

x-pack/plugins/security/server/lib/authorization/privileges/privileges.ts

@@ -65,6 +65,7 @@ export function privilegesFactory(actions: Actions, xpackMainPlugin: XPackMainPl
             actions.api.get('features'),
             actions.space.manage,
             actions.ui.get('spaces', 'manage'),
+            actions.ui.get('management', 'kibana', 'spaces'),
             ...allActions,
             actions.allHack,
           ],

x-pack/plugins/spaces/index.ts

@@ -49,6 +49,11 @@ export const spaces = (kibana: Record<string, any>) =>
         spaces: {
           manage: true,
         },
+        management: {
+          kibana: {
+            spaces: true,
+          },
+        },
       };
     },
 

x-pack/plugins/spaces/public/views/management/edit_space/manage_space_page.tsx

@@ -144,7 +144,7 @@ class ManageSpacePageUI extends Component<Props, State> {
     const { showAlteringActiveSpaceDialog } = this.state;
 
     return (
-      <Fragment>
+      <div data-test-subj="spaces-edit-page">
         {this.getFormHeading()}
 
         <EuiSpacer size={'s'} />
@@ -188,7 +188,7 @@ class ManageSpacePageUI extends Component<Props, State> {
             }}
           />
         )}
-      </Fragment>
+      </div>
     );
   };
 

x-pack/plugins/spaces/public/views/management/index.tsx

@@ -18,7 +18,7 @@ import routes from 'ui/routes';
 import { AdvancedSettingsSubtitle } from './components/advanced_settings_subtitle';
 import { AdvancedSettingsTitle } from './components/advanced_settings_title';
 
-const MANAGE_SPACES_KEY = 'manage_spaces';
+const MANAGE_SPACES_KEY = 'spaces';
 
 routes.defaults(/\/management/, {
   resolve: {

x-pack/plugins/spaces/public/views/management/page_routes.tsx

@@ -21,6 +21,7 @@ const reactRootNodeId = 'manageSpacesReactRoot';
 routes.when('/management/spaces/list', {
   template,
   k7Breadcrumbs: getListBreadcrumbs,
+  requireUICapability: 'spaces.manage',
   controller(
     $scope: any,
     $http: any,
@@ -53,6 +54,7 @@ routes.when('/management/spaces/list', {
 routes.when('/management/spaces/create', {
   template,
   k7Breadcrumbs: getCreateBreadcrumbs,
+  requireUICapability: 'spaces.manage',
   controller(
     $scope: any,
     $http: any,
@@ -89,6 +91,7 @@ routes.when('/management/spaces/edit', {
 routes.when('/management/spaces/edit/:spaceId', {
   template,
   k7Breadcrumbs: () => getEditBreadcrumbs(),
+  requireUICapability: 'spaces.manage',
   controller(
     $scope: any,
     $http: any,

x-pack/plugins/spaces/public/views/management/spaces_grid/spaces_grid_page.tsx

@@ -72,7 +72,7 @@ class SpacesGridPageUI extends Component<Props, State> {
 
   public render() {
     return (
-      <div className="spcGridPage">
+      <div className="spcGridPage" data-test-subj="spaces-grid-page">
         <EuiPageContent horizontalPosition="center">{this.getPageContent()}</EuiPageContent>
         <SecureSpaceMessage />
         {this.getConfirmDeleteModal()}

x-pack/test/functional/apps/spaces/feature_controls/spaces_security.ts

@@ -0,0 +1,175 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import expect from '@kbn/expect';
+import { KibanaFunctionalTestDefaultProviders } from '../../../../types/providers';
+
+// eslint-disable-next-line import/no-default-export
+export default function({ getPageObjects, getService }: KibanaFunctionalTestDefaultProviders) {
+  const esArchiver = getService('esArchiver');
+  const security = getService('security');
+  const PageObjects = getPageObjects(['common', 'settings', 'security']);
+  const appsMenu = getService('appsMenu');
+  const testSubjects = getService('testSubjects');
+
+  describe('security feature controls', () => {
+    before(async () => {
+      await esArchiver.load('empty_kibana');
+    });
+
+    after(async () => {
+      await esArchiver.unload('empty_kibana');
+    });
+
+    describe('global all base privilege', () => {
+      before(async () => {
+        await security.role.create('global_all_role', {
+          kibana: [
+            {
+              base: ['all'],
+              spaces: ['*'],
+            },
+          ],
+        });
+
+        await security.user.create('global_all_user', {
+          password: 'global_all_user-password',
+          roles: ['global_all_role'],
+          full_name: 'test user',
+        });
+
+        await PageObjects.security.logout();
+
+        await PageObjects.security.login('global_all_user', 'global_all_user-password', {
+          expectSpaceSelector: false,
+        });
+      });
+
+      after(async () => {
+        await Promise.all([
+          security.role.delete('global_all_role'),
+          security.user.delete('global_all_user'),
+          PageObjects.security.logout(),
+        ]);
+      });
+
+      it('shows management navlink', async () => {
+        const navLinks = (await appsMenu.readLinks()).map(
+          (link: Record<string, string>) => link.text
+        );
+        expect(navLinks).to.contain('Management');
+      });
+
+      it(`displays Spaces management section`, async () => {
+        await PageObjects.settings.navigateTo();
+        await testSubjects.existOrFail('spaces');
+      });
+
+      it(`can navigate to spaces grid page`, async () => {
+        await PageObjects.common.navigateToActualUrl('kibana', 'management/spaces/list', {
+          ensureCurrentUrl: false,
+          shouldLoginIfPrompted: false,
+        });
+
+        await testSubjects.existOrFail('spaces-grid-page');
+      });
+
+      it(`can navigate to create new space page`, async () => {
+        await PageObjects.common.navigateToActualUrl('kibana', 'management/spaces/create', {
+          ensureCurrentUrl: false,
+          shouldLoginIfPrompted: false,
+        });
+
+        await testSubjects.existOrFail('spaces-edit-page');
+      });
+
+      it(`can navigate to edit space page`, async () => {
+        await PageObjects.common.navigateToActualUrl('kibana', 'management/spaces/edit/default', {
+          ensureCurrentUrl: false,
+          shouldLoginIfPrompted: false,
+        });
+
+        await testSubjects.existOrFail('spaces-edit-page');
+      });
+    });
+
+    describe('default space all base privilege', () => {
+      before(async () => {
+        await security.role.create('default_space_all_role', {
+          kibana: [
+            {
+              base: ['all'],
+              spaces: ['default'],
+            },
+          ],
+        });
+
+        await security.user.create('default_space_all_user', {
+          password: 'default_space_all_user-password',
+          roles: ['default_space_all_role'],
+          full_name: 'test user',
+        });
+
+        await PageObjects.security.logout();
+
+        await PageObjects.security.login(
+          'default_space_all_user',
+          'default_space_all_user-password',
+          {
+            expectSpaceSelector: false,
+          }
+        );
+      });
+
+      after(async () => {
+        await Promise.all([
+          security.role.delete('default_space_all_role'),
+          security.user.delete('default_space_all_user'),
+          PageObjects.security.logout(),
+        ]);
+      });
+
+      it('shows management navlink', async () => {
+        const navLinks = (await appsMenu.readLinks()).map(
+          (link: Record<string, string>) => link.text
+        );
+        expect(navLinks).to.contain('Management');
+      });
+
+      it(`doesn't display Spaces management section`, async () => {
+        await PageObjects.settings.navigateTo();
+        await testSubjects.existOrFail('objects'); // this ensures we've gotten to the management page
+        await testSubjects.missingOrFail('spaces');
+      });
+
+      it(`can't navigate to spaces grid page`, async () => {
+        await PageObjects.common.navigateToActualUrl('kibana', 'management/spaces/list', {
+          ensureCurrentUrl: false,
+          shouldLoginIfPrompted: false,
+        });
+
+        await testSubjects.existOrFail('homeApp');
+      });
+
+      it(`can't navigate to create new space page`, async () => {
+        await PageObjects.common.navigateToActualUrl('kibana', 'management/spaces/create', {
+          ensureCurrentUrl: false,
+          shouldLoginIfPrompted: false,
+        });
+
+        await testSubjects.existOrFail('homeApp');
+      });
+
+      it(`can't navigate to edit space page`, async () => {
+        await PageObjects.common.navigateToActualUrl('kibana', 'management/spaces/edit/default', {
+          ensureCurrentUrl: false,
+          shouldLoginIfPrompted: false,
+        });
+
+        await testSubjects.existOrFail('homeApp');
+      });
+    });
+  });
+}

x-pack/test/functional/apps/spaces/index.ts

@@ -10,6 +10,7 @@ export default function spacesApp({ loadTestFile }: KibanaFunctionalTestDefaultP
   describe('Spaces app', function spacesAppTestSuite() {
     this.tags('ciGroup4');
 
+    loadTestFile(require.resolve('./feature_controls/spaces_security'));
     loadTestFile(require.resolve('./spaces_selection'));
   });
 }