[Fleet] Add permissions checks

x-pack/legacy/plugins/fleet/index.ts

@@ -61,6 +61,30 @@ export function fleet(kibana: any) {
         attributesToEncrypt: new Set(['token']),
         attributesToExcludeFromAAD: new Set(['enrollment_rules']),
       });
+      server.plugins.xpack_main.registerFeature({
+        id: 'fleet',
+        name: 'Fleet',
+        app: ['fleet', 'kibana'],
+        excludeFromBasePrivileges: true,
+        privileges: {
+          all: {
+            savedObject: {
+              all: ['agents', 'events', 'tokens'],
+              read: [],
+            },
+            ui: ['read', 'write'],
+            api: ['fleet-read', 'fleet-all'],
+          },
+          read: {
+            savedObject: {
+              all: [],
+              read: ['agents', 'events', 'tokens'],
+            },
+            ui: ['read'],
+            api: ['fleet-read'],
+          },
+        },
+      });
       initServerWithKibana(server);
     },
   });

x-pack/legacy/plugins/fleet/public/lib/adapters/framework/adapter_types.ts

@@ -13,6 +13,7 @@ export interface FrameworkAdapter {
   // Instance vars
   info: FrameworkInfo;
   version: string;
+  capabilities: { read: boolean; write: boolean };
   currentUser: FrameworkUser;
   // Methods
   waitUntilFrameworkReady(): Promise<void>;

x-pack/legacy/plugins/fleet/public/lib/adapters/framework/kibana_framework_adapter.ts

@@ -11,6 +11,7 @@ import { isLeft } from 'fp-ts/lib/Either';
 import * as React from 'react';
 import * as ReactDOM from 'react-dom';
 import { UIRoutes } from 'ui/routes';
+import { capabilities } from 'ui/capabilities';
 import { BufferedKibanaServiceCall, KibanaAdapterServiceRefs, KibanaUIConfig } from '../../types';
 import {
   FrameworkAdapter,
@@ -36,6 +37,10 @@ export class KibanaFrameworkAdapter implements FrameworkAdapter {
   public get currentUser() {
     return this.shieldUser!;
   }
+  public get capabilities(): Readonly<{ read: boolean; write: boolean }> {
+    return capabilities.get().fleet as { read: boolean; write: boolean };
+  }
+
   private xpackInfo: FrameworkInfo | null = null;
   private adapterService: KibanaAdapterServiceProvider;
   private shieldUser: FrameworkUser | null = null;

x-pack/legacy/plugins/fleet/public/lib/framework.ts

@@ -21,6 +21,10 @@ export class FrameworkLib {
     return this.adapter.currentUser;
   }
 
+  public get capabilities(): { read: boolean; write: boolean } {
+    return this.adapter.capabilities;
+  }
+
   public get info() {
     return this.adapter.info;
   }

x-pack/legacy/plugins/fleet/public/pages/agent_list/index.tsx

@@ -151,12 +151,16 @@ export const AgentListPage: React.SFC<RouterProps> = ({ libs }) => {
         </h2>
       }
       actions={
-        <EuiButton fill iconType="plusInCircle">
-          <FormattedMessage
-            id="xpack.fleet.agentList.addButton"
-            defaultMessage="Install new agent"
-          />
-        </EuiButton>
+        libs.framework.capabilities.write ? (
+          <EuiButton fill iconType="plusInCircle">
+            <FormattedMessage
+              id="xpack.fleet.agentList.addButton"
+              defaultMessage="Install new agent"
+            />
+          </EuiButton>
+        ) : (
+          null
+        )
       }
     />
   );
@@ -184,14 +188,16 @@ export const AgentListPage: React.SFC<RouterProps> = ({ libs }) => {
           <EuiFlexItem grow={4}>
             <SearchBar libs={libs} value={search} onChange={setSearch} fieldPrefix="agents" />
           </EuiFlexItem>
-          <EuiFlexItem>
-            <EuiButton fill iconType="plusInCircle">
-              <FormattedMessage
-                id="xpack.fleet.agentList.addButton"
-                defaultMessage="Install new agent"
-              />
-            </EuiButton>
-          </EuiFlexItem>
+          {libs.framework.capabilities.write && (
+            <EuiFlexItem>
+              <EuiButton fill iconType="plusInCircle">
+                <FormattedMessage
+                  id="xpack.fleet.agentList.addButton"
+                  defaultMessage="Install new agent"
+                />
+              </EuiButton>
+            </EuiFlexItem>
+          )}
         </EuiFlexGroup>
 
         <EuiSpacer size="m" />

x-pack/legacy/plugins/fleet/public/pages/error/no_access.tsx

@@ -20,7 +20,7 @@ export const NoAccessPage = injectI18n(({ intl }) => (
       <FormattedMessage
         id="xpack.fleet.noAccess.accessDeniedDescription"
         defaultMessage="You are not authorized to access Elastic Fleet. To use Elastic Fleet,
-          you need the privileges granted by the {elasticFleetRole} role."
+          you need a user role that contains read or all permissions for this application."
         values={{ elasticFleetRole: '`elastic_admin`' }}
       />
     </p>

x-pack/legacy/plugins/fleet/public/routes.tsx

@@ -63,6 +63,16 @@ export class AppRoutes extends Component<RouterProps, RouterState> {
             />
           )}
 
+          {!this.props.libs.framework.capabilities.read && (
+            <Route
+              render={props =>
+                !props.location.pathname.includes('/error') ? (
+                  <Redirect to="/error/no_access" />
+                ) : null
+              }
+            />
+          )}
+
           {/* Ensure security is eanabled for elastic and kibana */}
           {/* TODO: Disabled for now as we don't have this info set up on backend yet */}
           {/* {!get(this.props.libs.framework.info, 'security.enabled', true) && (

x-pack/legacy/plugins/fleet/server/routes/agents/enroll.ts

@@ -15,6 +15,7 @@ export const createEnrollAgentsRoute = (libs: FleetServerLib) => ({
   path: '/api/fleet/agents/enroll',
   config: {
     auth: false,
+    tags: ['access:fleet-all'],
     validate: {
       headers: Joi.object({
         'kbn-fleet-enrollment-token': Joi.string().required(),

x-pack/legacy/plugins/fleet/server/routes/agents/events.ts

@@ -14,6 +14,7 @@ export const createGETAgentEventsRoute = (libs: FleetServerLib) => ({
   method: 'GET',
   path: '/api/fleet/agents/{agentId}/events',
   config: {
+    tags: ['access:fleet-read'],
     validate: {
       query: Joi.object({
         kuery: Joi.string()

x-pack/legacy/plugins/fleet/server/routes/agents/get.ts

@@ -14,6 +14,7 @@ export const createGETAgentsRoute = (libs: FleetServerLib) => ({
   method: 'GET',
   path: '/api/fleet/agents/{agentId}',
   config: {
+    tags: ['access:fleet-read'],
     validate: {},
   },
   handler: async (

x-pack/legacy/plugins/fleet/server/routes/agents/list.ts

@@ -15,6 +15,7 @@ export const createListAgentsRoute = (libs: FleetServerLib) => ({
   method: 'GET',
   path: '/api/fleet/agents',
   config: {
+    tags: ['access:fleet-read'],
     validate: {
       query: {
         page: Joi.number().default(1),