[Connector] Adding internal route for requesting ad-hoc ServiceNow access token

x-pack/plugins/actions/server/builtin_action_types/servicenow/utils.test.ts

@@ -436,5 +436,113 @@ describe('utils', () => {
         `Not able to update ServiceNow connector token for connectorId: 123 due to error: updateOrReplace error`
       );
     });
+
+    test('gets access token if connectorId is not provided', async () => {
+      (createJWTAssertion as jest.Mock).mockReturnValueOnce('newassertion');
+      (requestOAuthJWTToken as jest.Mock).mockResolvedValueOnce({
+        tokenType: 'access_token',
+        accessToken: 'brandnewaccesstoken',
+        expiresIn: 1000,
+      });
+
+      const accessToken = await getAccessToken({
+        logger,
+        configurationUtilities,
+        credentials: {
+          config: {
+            apiUrl: 'https://servicenow',
+            usesTableApi: true,
+            isOAuth: true,
+            clientId: 'clientId',
+            jwtKeyId: 'jwtKeyId',
+            userIdentifierValue: 'userIdentifierValue',
+          },
+          secrets: {
+            clientSecret: 'clientSecret',
+            privateKey: 'privateKey',
+            privateKeyPassword: 'privateKeyPassword',
+            username: null,
+            password: null,
+          },
+        },
+        snServiceUrl: 'https://dev23432523.service-now.com',
+        connectorTokenClient,
+      });
+
+      expect(connectorTokenClient.get).not.toHaveBeenCalled();
+      expect(connectorTokenClient.updateOrReplace).not.toHaveBeenCalled();
+      expect(accessToken).toEqual('access_token brandnewaccesstoken');
+      expect(createJWTAssertion as jest.Mock).toHaveBeenCalledWith(
+        logger,
+        'privateKey',
+        'privateKeyPassword',
+        {
+          audience: 'clientId',
+          issuer: 'clientId',
+          subject: 'userIdentifierValue',
+          keyId: 'jwtKeyId',
+        }
+      );
+      expect(requestOAuthJWTToken as jest.Mock).toHaveBeenCalledWith(
+        'https://dev23432523.service-now.com/oauth_token.do',
+        { clientId: 'clientId', clientSecret: 'clientSecret', assertion: 'newassertion' },
+        logger,
+        configurationUtilities
+      );
+    });
+
+    test('gets access token if connectorTokenClient is not provided', async () => {
+      (createJWTAssertion as jest.Mock).mockReturnValueOnce('newassertion');
+      (requestOAuthJWTToken as jest.Mock).mockResolvedValueOnce({
+        tokenType: 'access_token',
+        accessToken: 'brandnewaccesstoken',
+        expiresIn: 1000,
+      });
+
+      const accessToken = await getAccessToken({
+        connectorId: '123',
+        logger,
+        configurationUtilities,
+        credentials: {
+          config: {
+            apiUrl: 'https://servicenow',
+            usesTableApi: true,
+            isOAuth: true,
+            clientId: 'clientId',
+            jwtKeyId: 'jwtKeyId',
+            userIdentifierValue: 'userIdentifierValue',
+          },
+          secrets: {
+            clientSecret: 'clientSecret',
+            privateKey: 'privateKey',
+            privateKeyPassword: 'privateKeyPassword',
+            username: null,
+            password: null,
+          },
+        },
+        snServiceUrl: 'https://dev23432523.service-now.com',
+      });
+
+      expect(connectorTokenClient.get).not.toHaveBeenCalled();
+      expect(connectorTokenClient.updateOrReplace).not.toHaveBeenCalled();
+      expect(accessToken).toEqual('access_token brandnewaccesstoken');
+      expect(createJWTAssertion as jest.Mock).toHaveBeenCalledWith(
+        logger,
+        'privateKey',
+        'privateKeyPassword',
+        {
+          audience: 'clientId',
+          issuer: 'clientId',
+          subject: 'userIdentifierValue',
+          keyId: 'jwtKeyId',
+        }
+      );
+      expect(requestOAuthJWTToken as jest.Mock).toHaveBeenCalledWith(
+        'https://dev23432523.service-now.com/oauth_token.do',
+        { clientId: 'clientId', clientSecret: 'clientSecret', assertion: 'newassertion' },
+        logger,
+        configurationUtilities
+      );
+    });
   });
 });

x-pack/plugins/actions/server/builtin_action_types/servicenow/utils.ts

@@ -20,7 +20,7 @@ import { FIELD_PREFIX } from './config';
 import { addTimeZoneToDate, getErrorMessage } from '../lib/axios_utils';
 import * as i18n from './translations';
 import { ActionsConfigurationUtilities } from '../../actions_config';
-import { ConnectorTokenClientContract } from '../../types';
+import { ConnectorToken, ConnectorTokenClientContract } from '../../types';
 import { createJWTAssertion } from '../lib/create_jwt_assertion';
 import { requestOAuthJWTToken } from '../lib/request_oauth_jwt_token';
 
@@ -84,12 +84,12 @@ export const throwIfSubActionIsNotSupported = ({
 };
 
 export interface GetAccessTokenAndAxiosInstanceOpts {
-  connectorId: string;
+  connectorId?: string;
   logger: Logger;
   configurationUtilities: ActionsConfigurationUtilities;
   credentials: ExternalServiceCredentials;
   snServiceUrl: string;
-  connectorTokenClient: ConnectorTokenClientContract;
+  connectorTokenClient?: ConnectorTokenClientContract;
 }
 
 export const getAxiosInstance = ({
@@ -151,9 +151,17 @@ export const getAccessToken = async ({
     credentials.secrets as ServiceNowSecretConfigurationType;
 
   let accessToken: string;
+  let connectorToken: ConnectorToken | null = null;
+  let hasErrors: boolean = false;
 
-  // Check if there is a token stored for this connector
-  const { connectorToken, hasErrors } = await connectorTokenClient.get({ connectorId });
+  if (connectorId && connectorTokenClient) {
+    // Check if there is a token stored for this connector
+    const { connectorToken: token, hasErrors: errors } = await connectorTokenClient.get({
+      connectorId,
+    });
+    connectorToken = token;
+    hasErrors = errors;
+  }
 
   if (connectorToken === null || Date.parse(connectorToken.expiresAt) <= Date.now()) {
     // generate a new assertion
@@ -189,18 +197,20 @@ export const getAccessToken = async ({
     accessToken = `${tokenResult.tokenType} ${tokenResult.accessToken}`;
 
     // try to update connector_token SO
-    try {
-      await connectorTokenClient.updateOrReplace({
-        connectorId,
-        token: connectorToken,
-        newToken: accessToken,
-        expiresInSec: tokenResult.expiresIn,
-        deleteExisting: hasErrors,
-      });
-    } catch (err) {
-      logger.warn(
-        `Not able to update ServiceNow connector token for connectorId: ${connectorId} due to error: ${err.message}`
-      );
+    if (connectorId && connectorTokenClient) {
+      try {
+        await connectorTokenClient.updateOrReplace({
+          connectorId,
+          token: connectorToken,
+          newToken: accessToken,
+          expiresInSec: tokenResult.expiresIn,
+          deleteExisting: hasErrors,
+        });
+      } catch (err) {
+        logger.warn(
+          `Not able to update ServiceNow connector token for connectorId: ${connectorId} due to error: ${err.message}`
+        );
+      }
     }
   } else {
     // use existing valid token

x-pack/plugins/actions/server/plugin.test.ts

@@ -109,7 +109,7 @@ describe('Actions Plugin', () => {
           httpServerMock.createKibanaRequest(),
           httpServerMock.createResponseFactory()
         )) as unknown as ActionsApiRequestHandlerContext;
-        actionsContextHandler!.getActionsClient();
+        expect(actionsContextHandler!.getActionsClient()).toBeDefined();
       });
 
       it('should throw error when ESO plugin is missing encryption key', async () => {

x-pack/plugins/actions/server/plugin.ts

@@ -311,12 +311,13 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
     }
 
     // Routes
-    defineRoutes(
-      core.http.createRouter<ActionsRequestHandlerContext>(),
-      this.licenseState,
+    defineRoutes({
+      router: core.http.createRouter<ActionsRequestHandlerContext>(),
+      licenseState: this.licenseState,
+      logger: this.logger,
       actionsConfigUtils,
-      this.usageCounter
-    );
+      usageCounter: this.usageCounter,
+    });
 
     // Cleanup failed execution task definition
     if (this.actionsConfig.cleanupFailedExecutionsTask.enabled) {

x-pack/plugins/actions/server/routes/get_service_now_access_token.test.ts

@@ -0,0 +1,173 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { getServiceNowAccessToken } from './get_service_now_access_token';
+import { Logger } from '@kbn/core/server';
+import { httpServiceMock, loggingSystemMock } from '@kbn/core/server/mocks';
+import { licenseStateMock } from '../lib/license_state.mock';
+import { mockHandlerArguments } from './legacy/_mock_handler_arguments';
+import { verifyAccessAndContext } from './verify_access_and_context';
+import { getAccessToken } from '../builtin_action_types/servicenow/utils';
+import { actionsConfigMock } from '../actions_config.mock';
+
+jest.mock('./verify_access_and_context', () => ({
+  verifyAccessAndContext: jest.fn(),
+}));
+jest.mock('../builtin_action_types/servicenow/utils', () => ({
+  getAccessToken: jest.fn(),
+}));
+
+const logger = loggingSystemMock.create().get() as jest.Mocked<Logger>;
+const configurationUtilities = actionsConfigMock.create();
+
+beforeEach(() => {
+  jest.resetAllMocks();
+  (verifyAccessAndContext as jest.Mock).mockImplementation((license, handler) => handler);
+  (getAccessToken as jest.Mock).mockResolvedValue(`Bearer tokentokentoken`);
+});
+
+describe('getServiceNowAccessToken', () => {
+  it('returns access token for given oauth config', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    getServiceNowAccessToken(router, licenseState, logger, configurationUtilities);
+
+    const [config, handler] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(
+      `"/internal/actions/connector/_servicenow_access_token"`
+    );
+
+    const [context, req, res] = mockHandlerArguments(
+      {},
+      {
+        body: {
+          apiUrl: 'https://testurl.service-now.com/',
+          config: {
+            clientId: 'abc',
+            jwtKeyId: 'def',
+            userIdentifierValue: 'userA',
+          },
+          secrets: {
+            clientSecret: 'iamasecret',
+            privateKey: 'xyz',
+          },
+        },
+      },
+      ['ok']
+    );
+
+    expect(await handler(context, req, res)).toMatchInlineSnapshot(`
+      Object {
+        "body": Object {
+          "accessToken": "Bearer tokentokentoken",
+        },
+      }
+    `);
+
+    expect(getAccessToken as jest.Mock).toHaveBeenCalledWith({
+      logger,
+      configurationUtilities,
+      credentials: {
+        config: {
+          clientId: 'abc',
+          jwtKeyId: 'def',
+          userIdentifierValue: 'userA',
+          isOAuth: true,
+        },
+        secrets: {
+          clientSecret: 'iamasecret',
+          privateKey: 'xyz',
+        },
+      },
+      snServiceUrl: 'https://testurl.service-now.com/',
+    });
+
+    expect(res.ok).toHaveBeenCalledWith({
+      body: {
+        accessToken: 'Bearer tokentokentoken',
+      },
+    });
+  });
+
+  it('ensures the license allows getting servicenow access token', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    getServiceNowAccessToken(router, licenseState, logger, configurationUtilities);
+
+    const [config, handler] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(
+      `"/internal/actions/connector/_servicenow_access_token"`
+    );
+
+    const [context, req, res] = mockHandlerArguments(
+      {},
+      {
+        body: {
+          apiUrl: 'https://testurl.service-now.com/',
+          config: {
+            clientId: 'abc',
+            jwtKeyId: 'def',
+            userIdentifierValue: 'userA',
+          },
+          secrets: {
+            clientSecret: 'iamasecret',
+            privateKey: 'xyz',
+          },
+        },
+      },
+      ['ok']
+    );
+
+    await handler(context, req, res);
+
+    expect(verifyAccessAndContext).toHaveBeenCalledWith(licenseState, expect.any(Function));
+  });
+
+  it('ensures the license check prevents getting service now access token', async () => {
+    const licenseState = licenseStateMock.create();
+    const router = httpServiceMock.createRouter();
+
+    (verifyAccessAndContext as jest.Mock).mockImplementation(() => async () => {
+      throw new Error('OMG');
+    });
+
+    getServiceNowAccessToken(router, licenseState, logger, configurationUtilities);
+
+    const [config, handler] = router.post.mock.calls[0];
+
+    expect(config.path).toMatchInlineSnapshot(
+      `"/internal/actions/connector/_servicenow_access_token"`
+    );
+
+    const [context, req, res] = mockHandlerArguments(
+      {},
+      {
+        body: {
+          apiUrl: 'https://testurl.service-now.com/',
+          config: {
+            clientId: 'abc',
+            jwtKeyId: 'def',
+            userIdentifierValue: 'userA',
+          },
+          secrets: {
+            clientSecret: 'iamasecret',
+            privateKey: 'xyz',
+          },
+        },
+      },
+      ['ok']
+    );
+
+    expect(handler(context, req, res)).rejects.toMatchInlineSnapshot(`[Error: OMG]`);
+
+    expect(verifyAccessAndContext).toHaveBeenCalledWith(licenseState, expect.any(Function));
+  });
+});