[Advanced settings] Add settings allowlist

.github/CODEOWNERS

@@ -628,6 +628,7 @@ x-pack/plugins/serverless @elastic/appex-sharedux
 x-pack/plugins/serverless_observability @elastic/appex-sharedux @elastic/apm-ui
 packages/serverless/project_switcher @elastic/appex-sharedux
 x-pack/plugins/serverless_search @elastic/enterprise-search-frontend
+packages/serverless/settings @elastic/appex-sharedux @elastic/platform-deployment-management
 packages/serverless/storybook/config @elastic/appex-sharedux
 packages/serverless/types @elastic/appex-sharedux
 test/plugin_functional/plugins/session_notifications @elastic/kibana-core

config/serverless.yml

@@ -46,7 +46,7 @@ management.deeplinks.navLinkStatus: visible
 xpack.canvas.enabled: false
 xpack.cloud_integrations.data_migration.enabled: false
 data.search.sessions.enabled: false
-advanced_settings.enabled: false
+advanced_settings.enabled: true
 
 # Disable UI of security management plugins
 xpack.security.ui.userManagementEnabled: false

package.json

@@ -631,6 +631,7 @@
     "@kbn/serverless-observability": "link:x-pack/plugins/serverless_observability",
     "@kbn/serverless-project-switcher": "link:packages/serverless/project_switcher",
     "@kbn/serverless-search": "link:x-pack/plugins/serverless_search",
+    "@kbn/serverless-settings": "link:packages/serverless/settings",
     "@kbn/serverless-types": "link:packages/serverless/types",
     "@kbn/session-notifications-plugin": "link:test/plugin_functional/plugins/session_notifications",
     "@kbn/session-view-plugin": "link:x-pack/plugins/session_view",

packages/core/lifecycle/core-lifecycle-server-mocks/src/core_setup.mock.ts

@@ -48,6 +48,7 @@ export function createCoreSetupMock({
   const uiSettingsMock = {
     register: uiSettingsServiceMock.createSetupContract().register,
     registerGlobal: uiSettingsServiceMock.createSetupContract().registerGlobal,
+    setAllowlist: uiSettingsServiceMock.createSetupContract().setAllowlist,
   };
 
   const mock: CoreSetupMockType = {

packages/core/plugins/core-plugins-server-internal/src/plugin_context.ts

@@ -259,6 +259,7 @@ export function createPluginSetupContext<TPlugin, TPluginDependencies>(
     uiSettings: {
       register: deps.uiSettings.register,
       registerGlobal: deps.uiSettings.registerGlobal,
+      setAllowlist: deps.uiSettings.setAllowlist,
     },
     userSettings: {
       setUserProfileSettings: deps.userSettings.setUserProfileSettings,

packages/core/ui-settings/core-ui-settings-browser-internal/src/ui_settings_client_common.ts

@@ -116,6 +116,10 @@ You can use \`IUiSettingsClient.get("${key}", defaultValue)\`, which will just r
     return this.isDeclared(key) && Boolean(this.cache[key].isOverridden);
   }
 
+  isStrictReadonly(key: string) {
+    return this.isDeclared(key) && Boolean(this.cache[key].readonly === 'strict');
+  }
+
   getUpdate$() {
     return this.update$.asObservable();
   }
@@ -130,6 +134,9 @@ You can use \`IUiSettingsClient.get("${key}", defaultValue)\`, which will just r
         `Unable to update "${key}" because its value is overridden by the Kibana server`
       );
     }
+    if (this.isStrictReadonly(key)) {
+      throw new Error(`Unable to update "${key}" because this setting is not in the allowlist.`);
+    }
   }
 
   protected abstract update(key: string, newVal: any): Promise<boolean>;

packages/core/ui-settings/core-ui-settings-common/src/ui_settings.ts

@@ -55,8 +55,12 @@ export interface UiSettingsParams<T = unknown> {
   optionLabels?: Record<string, string>;
   /** a flag indicating whether new value applying requires page reloading */
   requiresPageReload?: boolean;
-  /** a flag indicating that value cannot be changed */
-  readonly?: boolean;
+  /**
+   * a flag indicating that value cannot be changed
+   * 'strict' indicates that the value cannot be changed through API and is not displayed in the UI
+   * 'ui' indicates that the value is just not displayed in the UI
+   * */
+  readonly?: 'strict' | 'ui';
   /**
    * a flag indicating that value might contain user sensitive data.
    * used by telemetry to mask the value of the setting when sent.

packages/core/ui-settings/core-ui-settings-server-internal/src/settings/misc.ts

@@ -12,7 +12,7 @@ import type { UiSettingsParams } from '@kbn/core-ui-settings-common';
 export const getMiscUiSettings = (): Record<string, UiSettingsParams> => {
   return {
     buildNum: {
-      readonly: true,
+      readonly: 'ui',
       schema: schema.maybe(schema.number()),
     },
   };

packages/core/ui-settings/core-ui-settings-server-internal/src/settings/theme.ts

@@ -62,7 +62,7 @@ export const getThemeSettings = (
         defaultMessage: 'Theme version',
       }),
       value: 'v8' as ThemeVersion,
-      readonly: true,
+      readonly: 'ui',
       schema: schema.literal('v8'),
     },
   };

packages/core/ui-settings/core-ui-settings-server-internal/src/ui_settings_service.ts

@@ -50,6 +50,7 @@ export class UiSettingsService
   private readonly uiSettingsDefaults = new Map<string, UiSettingsParams>();
   private readonly uiSettingsGlobalDefaults = new Map<string, UiSettingsParams>();
   private overrides: Record<string, any> = {};
+  private allowlist: string[] | null = null;
 
   constructor(private readonly coreContext: CoreContext) {
     this.log = coreContext.logger.get('ui-settings-service');
@@ -94,10 +95,14 @@ export class UiSettingsService
     return {
       register: this.register,
       registerGlobal: this.registerGlobal,
+      setAllowlist: this.setAllowlist,
     };
   }
 
   public async start(): Promise<InternalUiSettingsServiceStart> {
+    if (this.allowlist) {
+      this.applyAllowlist(this.allowlist);
+    }
     this.validatesDefinitions();
     this.validatesOverrides();
 
@@ -148,6 +153,27 @@ export class UiSettingsService
     });
   };
 
+  private setAllowlist = (keys: string[]) => {
+    if (!this.allowlist) {
+      this.allowlist = keys;
+    } else {
+      this.allowlist = this.allowlist.concat(keys);
+    }
+  };
+
+  private applyAllowlist(keys: string[]) {
+    for (const [key, definition] of this.uiSettingsDefaults) {
+      if (!keys.includes(key)) {
+        definition.readonly = 'strict';
+      }
+    }
+    for (const [key, definition] of this.uiSettingsGlobalDefaults) {
+      if (!keys.includes(key)) {
+        definition.readonly = 'strict';
+      }
+    }
+  }
+
   private validatesDefinitions() {
     for (const [key, definition] of this.uiSettingsDefaults) {
       if (!definition.schema) {

packages/core/ui-settings/core-ui-settings-server-mocks/src/ui_settings_service.mock.ts

@@ -49,6 +49,7 @@ const createSetupMock = () => {
   const mocked: jest.Mocked<InternalUiSettingsServiceSetup> = {
     register: jest.fn(),
     registerGlobal: jest.fn(),
+    setAllowlist: jest.fn(),
   };
 
   return mocked;

packages/core/ui-settings/core-ui-settings-server/src/contracts.ts

@@ -48,6 +48,19 @@ export interface UiSettingsServiceSetup {
    * ```
    */
   registerGlobal(settings: Record<string, UiSettingsParams>): void;
+
+  /**
+   * Sets an allowlist of setting keys.
+   * @param keys
+   *
+   * @example
+   * ```ts
+   * setup(core: CoreSetup){
+   *  core.uiSettings.setAllowlist(['csv:quoteValues', 'dateFormat:dow']);
+   * }
+   * ```
+   */
+  setAllowlist(keys: string[]): void;
 }
 
 /** @public */

packages/serverless/settings/README.mdx

@@ -0,0 +1,10 @@
+---
+id: serverless/packages/settings
+slug: /serverless/packages/settings
+title: Serverless Advanced Settings
+description: A package of common settings for Serverless projects.
+tags: ['serverless', 'package']
+date: 2023-08-24
+---
+
+This package contains common settings for Serverless projects.

packages/serverless/settings/index.ts

@@ -0,0 +1,62 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
+ */
+
+const GENERAL_SETTINGS = [
+  'csv:quoteValues',
+  'dateFormat:dow',
+  'dateFormat:scaled',
+  'dateFormat:tz',
+  'dateNanosFormat',
+  'defaultIndex',
+  'filters:pinnedByDefault',
+  'format:bytes:defaultPattern',
+  'format:currency:defaultPattern',
+  'format:number:defaultLocale',
+  'format:number:defaultPattern',
+  'format:percent:defaultPattern',
+  'metaFields',
+  'state:storeInSessionStorage',
+  'timepicker:quickRanges',
+  'timepicker:timeDefaults',
+];
+
+const PRESENTATION_LABS_SETTINGS = ['labs:dashboard:deferBelowFold'];
+
+const ACCESSIBILITY_SETTINGS = ['accessibility:disableAnimations'];
+
+const AUTOCOMPLETE_SETTINGS = ['autocomplete:valueSuggestionMethod'];
+
+const BANNER_SETTINGS = [
+  'banners:placement',
+  'banners:textContent',
+  'banners:textColor',
+  'banners:backgroundColor',
+];
+
+const DISCOVER_SETTINGS = ['defaultColumns'];
+
+const NOTIFICATION_SETTINGS = [
+  'notifications:banner',
+  'notifications:lifetime:banner',
+  'notifications:lifetime:error',
+  'notifications:lifetime:info',
+  'notifications:lifetime:warning',
+];
+
+const SEARCH_SETTINGS = ['courier:ignoreFilterIfFieldNotInIndex', 'search:timeout'];
+
+export const ALL_ALLOWLIST_SETTINGS = [
+  ...GENERAL_SETTINGS,
+  ...PRESENTATION_LABS_SETTINGS,
+  ...ACCESSIBILITY_SETTINGS,
+  ...AUTOCOMPLETE_SETTINGS,
+  ...BANNER_SETTINGS,
+  ...DISCOVER_SETTINGS,
+  ...NOTIFICATION_SETTINGS,
+  ...SEARCH_SETTINGS,
+];

packages/serverless/settings/kibana.jsonc

@@ -0,0 +1,5 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/serverless-settings",
+  "owner": "@elastic/appex-sharedux @elastic/platform-deployment-management"
+}

packages/serverless/settings/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/serverless-settings",
+  "private": true,
+  "version": "1.0.0",
+  "license": "SSPL-1.0 OR Elastic License 2.0"
+}

packages/serverless/settings/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+    "types": [
+      "jest",
+      "node"
+    ]
+  },
+  "include": [
+    "**/*.ts",
+  ],
+  "exclude": [
+    "target/**/*"
+  ],
+  "kbn_references": []
+}

tsconfig.base.json

@@ -1250,6 +1250,8 @@
       "@kbn/serverless-project-switcher/*": ["packages/serverless/project_switcher/*"],
       "@kbn/serverless-search": ["x-pack/plugins/serverless_search"],
       "@kbn/serverless-search/*": ["x-pack/plugins/serverless_search/*"],
+      "@kbn/serverless-settings": ["packages/serverless/settings"],
+      "@kbn/serverless-settings/*": ["packages/serverless/settings/*"],
       "@kbn/serverless-storybook-config": ["packages/serverless/storybook/config"],
       "@kbn/serverless-storybook-config/*": ["packages/serverless/storybook/config/*"],
       "@kbn/serverless-types": ["packages/serverless/types"],

x-pack/plugins/serverless/server/plugin.ts

@@ -13,6 +13,7 @@ import { schema, TypeOf } from '@kbn/config-schema';
 import { getConfigDirectory } from '@kbn/utils';
 import { ProjectType } from '@kbn/serverless-types';
 
+import { ALL_ALLOWLIST_SETTINGS } from '@kbn/serverless-settings';
 import { ServerlessPluginSetup, ServerlessPluginStart } from './types';
 import { ServerlessConfig } from './config';
 import { API_SWITCH_PROJECT } from '../common';
@@ -75,6 +76,8 @@ export class ServerlessPlugin implements Plugin<ServerlessPluginSetup, Serverles
       );
     }
 
+    core.uiSettings.setAllowlist(ALL_ALLOWLIST_SETTINGS);
+
     return {};
   }
 

x-pack/plugins/serverless/tsconfig.json

@@ -25,5 +25,6 @@
     "@kbn/core-chrome-browser-internal",
     "@kbn/i18n-react",
     "@kbn/cloud-plugin",
+    "@kbn/serverless-settings",
   ]
 }

yarn.lock

@@ -4748,6 +4748,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/lens-embeddable-utils@link:packages/kbn-lens-embeddable-utils":
+  version "0.0.0"
+  uid ""
+
 "@kbn/lens-plugin@link:x-pack/plugins/lens":
   version "0.0.0"
   uid ""
@@ -5412,6 +5416,10 @@
   version "0.0.0"
   uid ""
 
+"@kbn/serverless-settings@link:packages/serverless/settings":
+  version "0.0.0"
+  uid ""
+
 "@kbn/serverless-storybook-config@link:packages/serverless/storybook/config":
   version "0.0.0"
   uid ""
@@ -6020,10 +6028,6 @@
   version "0.0.0"
   uid ""
 
-"@kbn/lens-embeddable-utils@link:packages/kbn-lens-embeddable-utils":
-  version "0.0.0"
-  uid ""
-
 "@kbn/visualizations-plugin@link:src/plugins/visualizations":
   version "0.0.0"
   uid ""