[Event Log] adds query support to the Event Log

package.json

@@ -104,7 +104,8 @@
       "examples/*",
       "test/plugin_functional/plugins/*",
       "test/interpreter_functional/plugins/*",
-      "x-pack/test/functional_with_es_ssl/fixtures/plugins/*"
+      "x-pack/test/functional_with_es_ssl/fixtures/plugins/*",
+      "x-pack/test/plugin_api_integration/plugins/*"
     ],
     "nohoist": [
       "**/@types/*",

test/scripts/jenkins_xpack_build_kibana.sh

@@ -7,6 +7,7 @@ echo " -> building kibana platform plugins"
 node scripts/build_kibana_platform_plugins \
   --scan-dir "$XPACK_DIR/test/plugin_functional/plugins" \
   --scan-dir "$XPACK_DIR/test/functional_with_es_ssl/fixtures/plugins" \
+  --scan-dir "$XPACK_DIR/test/plugin_api_integration/plugins" \
   --verbose;
 
 # doesn't persist, also set in kibanaPipeline.groovy

x-pack/plugins/event_log/common/index.ts

@@ -0,0 +1,7 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const BASE_EVENT_LOG_API_PATH = '/api/event_log';

x-pack/plugins/event_log/server/es/cluster_client_adapter.mock.ts

@@ -15,6 +15,7 @@ const createClusterClientMock = () => {
     createIndexTemplate: jest.fn(),
     doesAliasExist: jest.fn(),
     createIndex: jest.fn(),
+    queryEventsBySavedObject: jest.fn(),
   };
   return mock;
 };

x-pack/plugins/event_log/server/es/cluster_client_adapter.test.ts

@@ -195,3 +195,38 @@ describe('createIndex', () => {
     await clusterClientAdapter.createIndex('foo');
   });
 });
+
+describe('queryEventsBySavedObject', () => {
+  test('should call cluster with proper arguments', async () => {
+    clusterClient.callAsInternalUser.mockResolvedValue({
+      hits: {
+        hits: [],
+      },
+    });
+    await clusterClientAdapter.queryEventsBySavedObject(
+      'index-name',
+      'saved-object-type',
+      'saved-object-id',
+      { page: 10, per_page: 10 }
+    );
+    expect(clusterClient.callAsInternalUser).toHaveBeenCalledWith('search', {
+      index: 'index-name',
+      body: {
+        from: 90,
+        size: 10,
+        query: {
+          bool: {
+            must: [
+              { match: { 'kibana.saved_objects.type.keyword': 'saved-object-type' } },
+              {
+                match: {
+                  'kibana.saved_objects.id.keyword': 'saved-object-id',
+                },
+              },
+            ],
+          },
+        },
+      },
+    });
+  });
+});

x-pack/plugins/event_log/server/es/cluster_client_adapter.ts

@@ -5,6 +5,8 @@
  */
 
 import { Logger, ClusterClient } from '../../../../../src/core/server';
+import { IEvent } from '../types';
+import { FindOptionsType } from '../event_log_client';
 
 export type EsClusterClient = Pick<ClusterClient, 'callAsInternalUser' | 'asScoped'>;
 export type IClusterClientAdapter = PublicMethodsOf<ClusterClientAdapter>;
@@ -107,6 +109,42 @@ export class ClusterClientAdapter {
     }
   }
 
+  public async queryEventsBySavedObject(
+    index: string,
+    type: string,
+    id: string,
+    { page, per_page: size }: FindOptionsType
+  ): Promise<any[]> {
+    try {
+      const {
+        hits: { hits },
+      } = await this.callEs('search', {
+        index,
+        body: {
+          size,
+          from: (page - 1) * size,
+          query: {
+            bool: {
+              must: [
+                { match: { 'kibana.saved_objects.type.keyword': type } },
+                {
+                  match: {
+                    'kibana.saved_objects.id.keyword': id,
+                  },
+                },
+              ],
+            },
+          },
+        },
+      });
+      return hits.map((hit: any) => hit._source) as IEvent[];
+    } catch (err) {
+      throw new Error(
+        `querying for Event Log by for type "${type}" and id "${id}" failed with: ${err.message}`
+      );
+    }
+  }
+
   private async callEs(operation: string, body?: any): Promise<any> {
     try {
       this.debug(`callEs(${operation}) calls:`, body);

x-pack/plugins/event_log/server/event_log_client.mock.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEventLogClient } from './types';
+
+const createEventLogClientMock = () => {
+  const mock: jest.Mocked<IEventLogClient> = {
+    findEventsBySavedObject: jest.fn(),
+  };
+  return mock;
+};
+
+export const eventLogClientMock = {
+  create: createEventLogClientMock,
+};

x-pack/plugins/event_log/server/event_log_client.test.ts

@@ -0,0 +1,142 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { EventLogClient } from './event_log_client';
+import { contextMock } from './es/context.mock';
+import { savedObjectsClientMock } from 'src/core/server/mocks';
+import { merge } from 'lodash';
+
+describe('EventLogStart', () => {
+  describe('findEventsBySavedObject', () => {
+    test('verifies that the user can to access the specified saved object', async () => {
+      const esContext = contextMock.create();
+      const savedObjectsClient = savedObjectsClientMock.create();
+      const eventLogClient = new EventLogClient({
+        esContext,
+        savedObjectsClient,
+      });
+
+      savedObjectsClient.get.mockResolvedValueOnce({
+        id: 'saved-object-id',
+        type: 'saved-object-type',
+        attributes: {},
+        references: [],
+      });
+
+      await eventLogClient.findEventsBySavedObject('saved-object-type', 'saved-object-id');
+
+      expect(savedObjectsClient.get).toHaveBeenCalledWith('saved-object-type', 'saved-object-id');
+    });
+
+    test('throws when the user doesnt have permission to access the specified saved object', async () => {
+      const esContext = contextMock.create();
+      const savedObjectsClient = savedObjectsClientMock.create();
+      const eventLogClient = new EventLogClient({
+        esContext,
+        savedObjectsClient,
+      });
+
+      savedObjectsClient.get.mockRejectedValue(new Error('Fail'));
+
+      expect(
+        eventLogClient.findEventsBySavedObject('saved-object-type', 'saved-object-id')
+      ).rejects.toMatchInlineSnapshot(`[Error: Fail]`);
+    });
+
+    test('fetches all event that reference the saved object', async () => {
+      const esContext = contextMock.create();
+      const savedObjectsClient = savedObjectsClientMock.create();
+      const eventLogClient = new EventLogClient({
+        esContext,
+        savedObjectsClient,
+      });
+
+      savedObjectsClient.get.mockResolvedValueOnce({
+        id: 'saved-object-id',
+        type: 'saved-object-type',
+        attributes: {},
+        references: [],
+      });
+
+      const expectedEvents = [
+        fakeEvent({
+          kibana: {
+            saved_objects: [
+              {
+                id: 'saved-object-id',
+                type: 'saved-object-type',
+              },
+              {
+                type: 'action',
+                id: '1',
+              },
+            ],
+          },
+        }),
+        fakeEvent({
+          kibana: {
+            saved_objects: [
+              {
+                id: 'saved-object-id',
+                type: 'saved-object-type',
+              },
+              {
+                type: 'action',
+                id: '2',
+              },
+            ],
+          },
+        }),
+      ];
+
+      esContext.esAdapter.queryEventsBySavedObject.mockResolvedValue(expectedEvents);
+
+      expect(
+        await eventLogClient.findEventsBySavedObject('saved-object-type', 'saved-object-id')
+      ).toEqual(expectedEvents);
+
+      expect(esContext.esAdapter.queryEventsBySavedObject).toHaveBeenCalledWith(
+        esContext.esNames.alias,
+        'saved-object-type',
+        'saved-object-id',
+        {
+          page: 1,
+          per_page: 10,
+        }
+      );
+    });
+  });
+});
+
+function fakeEvent(overrides = {}) {
+  return merge(
+    {
+      event: {
+        provider: 'actions',
+        action: 'execute',
+        start: new Date('2020-03-30T14:55:47.054Z'),
+        end: new Date('2020-03-30T14:55:47.055Z'),
+        duration: 1000000,
+      },
+      kibana: {
+        namespace: 'default',
+        saved_objects: [
+          {
+            type: 'action',
+            id: '968f1b82-0414-4a10-becc-56b6473e4a29',
+          },
+        ],
+        server_uuid: '5b2de169-2785-441b-ae8c-186a1936b17d',
+      },
+      message: 'action executed: .server-log:968f1b82-0414-4a10-becc-56b6473e4a29: logger',
+      '@timestamp': new Date('2020-03-30T14:55:47.055Z'),
+      ecs: {
+        version: '1.3.1',
+      },
+    },
+    overrides
+  );
+}

x-pack/plugins/event_log/server/event_log_client.ts

@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { Observable } from 'rxjs';
+import { ClusterClient, SavedObjectsClientContract } from 'src/core/server';
+
+import { schema, TypeOf } from '@kbn/config-schema';
+import { EsContext } from './es';
+import { IEventLogClient, IEvent } from './types';
+export type PluginClusterClient = Pick<ClusterClient, 'callAsInternalUser' | 'asScoped'>;
+export type AdminClusterClient$ = Observable<PluginClusterClient>;
+
+interface EventLogServiceCtorParams {
+  esContext: EsContext;
+  savedObjectsClient: SavedObjectsClientContract;
+}
+
+export const findOptionsSchema = schema.object({
+  per_page: schema.number({ defaultValue: 10, min: 0 }),
+  page: schema.number({ defaultValue: 1, min: 1 }),
+});
+export type FindOptionsType = TypeOf<typeof findOptionsSchema>;
+
+// note that clusterClient may be null, indicating we can't write to ES
+export class EventLogClient implements IEventLogClient {
+  private esContext: EsContext;
+  private savedObjectsClient: SavedObjectsClientContract;
+
+  constructor({ esContext, savedObjectsClient }: EventLogServiceCtorParams) {
+    this.esContext = esContext;
+    this.savedObjectsClient = savedObjectsClient;
+  }
+
+  async findEventsBySavedObject(
+    type: string,
+    id: string,
+    options?: Partial<FindOptionsType>
+  ): Promise<IEvent[]> {
+    await this.savedObjectsClient.get(type, id);
+    return (await this.esContext.esAdapter.queryEventsBySavedObject(
+      this.esContext.esNames.alias,
+      type,
+      id,
+      findOptionsSchema.validate(options ?? {})
+    )) as IEvent[];
+  }
+}

x-pack/plugins/event_log/server/event_log_client_service.mock.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { IEventLogClientService } from './types';
+
+const createEventLogStartMock = () => {
+  const mock: jest.Mocked<IEventLogClientService> = {
+    getClient: jest.fn(),
+  };
+  return mock;
+};
+
+export const eventLogStartMock = {
+  create: createEventLogStartMock,
+};