[Fleet][RBAC v2] Add tests for fleet API changes

x-pack/test/fleet_api_integration/apis/package_policy/get.ts

@@ -8,10 +8,12 @@
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { skipIfNoDockerRegistry } from '../../helpers';
+import { testUsers } from '../test_users';
 
 export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
   const supertest = getService('supertest');
+  const superTestWithoutAuth = getService('supertestWithoutAuth');
   const dockerServers = getService('dockerServers');
 
   const server = dockerServers.get('registry');
@@ -96,6 +98,22 @@ export default function (providerContext: FtrProviderContext) {
         await supertest.get(`/api/fleet/package_policies/${packagePolicyId}`).expect(200);
       });
 
+      it('should return 403 for requests with authenticated role but not allowed packages', async function () {
+        await superTestWithoutAuth
+          .get(`/api/fleet/package_policies/${packagePolicyId}`)
+          .set('kbn-xsrf', 'xxxx')
+          .auth(
+            testUsers.endpoint_integr_read_policy.username,
+            testUsers.endpoint_integr_read_policy.password
+          )
+          .expect(403, {
+            statusCode: 403,
+            error: 'Forbidden',
+            message:
+              "Authorization denied to [package.name=filetest]. Allowed package.name's: endpoint",
+          });
+      });
+
       it('should return a 404 with an invalid id', async function () {
         await supertest.get(`/api/fleet/package_policies/IS_NOT_PRESENT`).expect(404);
       });
@@ -176,6 +194,23 @@ export default function (providerContext: FtrProviderContext) {
           .expect(404);
       });
 
+      it('should return 403 without allowed package names', async function () {
+        await superTestWithoutAuth
+          .post(`/api/fleet/package_policies/_bulk_get`)
+          .set('kbn-xsrf', 'xxxx')
+          .auth(
+            testUsers.endpoint_integr_read_policy.username,
+            testUsers.endpoint_integr_read_policy.password
+          )
+          .send({ ids: [packagePolicyId] })
+          .expect(403, {
+            error: 'Forbidden',
+            message:
+              "Authorization denied to [package.name=filetest]. Allowed package.name's: endpoint",
+            statusCode: 403,
+          });
+      });
+
       it('should succeed with mixed valid ids and invalid ids and ignoreMissing flag ', async function () {
         const {
           body: { items },

x-pack/test/fleet_api_integration/apis/package_policy/update.ts

@@ -7,10 +7,12 @@
 import expect from '@kbn/expect';
 import { FtrProviderContext } from '../../../api_integration/ftr_provider_context';
 import { skipIfNoDockerRegistry } from '../../helpers';
+import { testUsers } from '../test_users';
 
 export default function (providerContext: FtrProviderContext) {
   const { getService } = providerContext;
   const supertest = getService('supertest');
+  const superTestWithoutAuth = getService('supertestWithoutAuth');
   const dockerServers = getService('dockerServers');
   const kibanaServer = getService('kibanaServer');
 
@@ -209,6 +211,34 @@ export default function (providerContext: FtrProviderContext) {
         });
     });
 
+    it('should return a 403 with package names that are not allowed', async function () {
+      await superTestWithoutAuth
+        .put(`/api/fleet/package_policies/${packagePolicyId}`)
+        .set('kbn-xsrf', 'xxxx')
+        .auth(
+          testUsers.endpoint_integr_write_policy.username,
+          testUsers.endpoint_integr_write_policy.password
+        )
+        .send({
+          name: 'updated_name',
+          description: '',
+          namespace: 'updated_namespace',
+          policy_id: managedAgentPolicyId,
+          enabled: true,
+          inputs: [],
+          package: {
+            name: 'filetest',
+            title: 'For File Tests',
+            version: '0.1.0',
+          },
+        })
+        .expect(403, {
+          error: 'Forbidden',
+          message: 'Update for package name filetest is not authorized.',
+          statusCode: 403,
+        });
+    });
+
     it('should return a 400 if there is another package policy with the same name', async function () {
       await supertest
         .put(`/api/fleet/package_policies/${packagePolicyId2}`)

x-pack/test/fleet_api_integration/apis/test_users.ts

@@ -73,6 +73,37 @@ export const testUsers: {
     username: 'integr_all',
     password: 'changeme',
   },
+  // for package_policy get one, bulk get with ids, get list
+  endpoint_integr_read_policy: {
+    permissions: {
+      feature: {
+        fleet: ['read'],
+        siem: [
+          'minimal_all',
+          'trusted_applications_read',
+          'host_isolation_exceptions_read',
+          'blocklist_read',
+          'event_filters_read',
+          'policy_management_read',
+        ],
+      },
+      spaces: ['*'],
+    },
+    username: 'endpoint_integr_read_policy',
+    password: 'changeme',
+  },
+  // for package_policy update API
+  endpoint_integr_write_policy: {
+    permissions: {
+      feature: {
+        fleet: ['all'],
+        siem: ['minimal_all', 'policy_management_all'],
+      },
+      spaces: ['*'],
+    },
+    username: 'endpoint_integr_write_policy',
+    password: 'changeme',
+  },
 };
 
 export const setupTestUsers = async (security: SecurityService) => {

x-pack/test/fleet_api_integration/config.ts

@@ -72,6 +72,7 @@ export default async function ({ readConfigFile }: FtrConfigProviderContext) {
         `--xpack.fleet.packageVerification.gpgKeyPath=${getFullPath(
           './apis/fixtures/package_verification/signatures/fleet_test_key_public.asc'
         )}`,
+        `--xpack.securitySolution.enableExperimental=${JSON.stringify(['endpointRbacEnabled'])}`,
         `--logging.loggers=${JSON.stringify([
           ...getKibanaCliLoggers(xPackAPITestsConfig.get('kbnTestServer.serverArgs')),