Skip to content

[Security Solution] Realign privileges serverless and ess #207258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
semd wants to merge 9 commits into from
Closed

[Security Solution] Realign privileges serverless and ess #207258

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
278d582
migrate endpoint exceptions privilege
semd Jan 20, 2025
b68421f
sub-feature description
semd Jan 20, 2025
f13287d
change include to none
semd Jan 20, 2025
4159c0b
remove unnecessary file
semd Jan 21, 2025
8e2d89d
fix wrong descriptions
semd Jan 21, 2025
356b14a
use same description key and translation
semd Jan 21, 2025
1d4df1d
keep sub-feature aligned with main feature
semd Jan 22, 2025
2d3ef2f
Merge branch 'main' into 207050/realign_serverless_ess_privileges
elasticmachine Jan 22, 2025
bd620a1
keep default unchanged
semd Jan 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 0 additions & 10 deletions x-pack/solutions/security/packages/features/privileges.ts
View file
Open in desktop

This file was deleted.

30 changes: 0 additions & 30 deletions x-pack/solutions/security/packages/features/src/product_features_privileges.ts
View file
Open in desktop

This file was deleted.

4 changes: 4 additions & 0 deletions x-pack/solutions/security/packages/features/src/security/product_feature_config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,10 @@ export const securityDefaultProductFeaturesConfig: DefaultSecurityProductFeature
},
},

[ProductFeatureSecurityKey.endpointExceptions]: {
subFeatureIds: [SecuritySubFeatureId.endpointExceptions],
},

[ProductFeatureSecurityKey.endpointHostManagement]: {
subFeatureIds: [SecuritySubFeatureId.endpointList],
},
Expand Down
7 changes: 3 additions & 4 deletions x-pack/solutions/security/packages/features/src/security/types.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,7 @@ export interface SecurityFeatureParams {
savedObjects: string[];
}

export type DefaultSecurityProductFeaturesConfig = Omit<
Record<ProductFeatureSecurityKey, ProductFeatureKibanaConfig<SecuritySubFeatureId>>,
ProductFeatureSecurityKey.endpointExceptions
// | add not generic security app features here
export type DefaultSecurityProductFeaturesConfig = Record<
ProductFeatureSecurityKey,
ProductFeatureKibanaConfig<SecuritySubFeatureId>
>;
10 changes: 8 additions & 2 deletions x-pack/solutions/security/packages/features/src/security/v1_features/kibana_features.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,10 @@ export const getSecurityBaseKibanaFeature = ({
minimal: [
{ feature: TIMELINE_FEATURE_ID, privileges: ['all'] },
{ feature: NOTES_FEATURE_ID, privileges: ['all'] },
{ feature: SECURITY_FEATURE_ID_V2, privileges: ['minimal_all'] },
{
feature: SECURITY_FEATURE_ID_V2,
privileges: ['minimal_all', 'endpoint_exceptions_all'],
},
],
},
app: [APP_ID, CLOUD_POSTURE_APP_ID, CLOUD_DEFEND_APP_ID, 'kibana'],
Expand Down Expand Up @@ -146,7 +149,10 @@ export const getSecurityBaseKibanaFeature = ({
minimal: [
{ feature: TIMELINE_FEATURE_ID, privileges: ['read'] },
{ feature: NOTES_FEATURE_ID, privileges: ['read'] },
{ feature: SECURITY_FEATURE_ID_V2, privileges: ['minimal_read'] },
{
feature: SECURITY_FEATURE_ID_V2,
privileges: ['minimal_read', 'endpoint_exceptions_read'],
},
],
},
app: [APP_ID, CLOUD_POSTURE_APP_ID, CLOUD_DEFEND_APP_ID, 'kibana'],
Expand Down
12 changes: 5 additions & 7 deletions x-pack/solutions/security/packages/features/src/security/v1_features/kibana_sub_features.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,6 @@
import { i18n } from '@kbn/i18n';
import type { SubFeatureConfig } from '@kbn/features-plugin/common';
import { EXCEPTION_LIST_NAMESPACE_AGNOSTIC } from '@kbn/securitysolution-list-constants';
import {
ProductFeaturesPrivilegeId,
ProductFeaturesPrivileges,
} from '../../product_features_privileges';

import { SecuritySubFeatureId } from '../../product_features_keys';
import { APP_ID, SECURITY_FEATURE_ID_V2 } from '../../constants';
Expand Down Expand Up @@ -645,7 +641,7 @@ const endpointExceptionsSubFeature = (): SubFeatureConfig => ({
description: i18n.translate(
'securitySolutionPackages.features.featureRegistry.subFeatures.endpointExceptions.description',
{
defaultMessage: 'Use Endpoint Exceptions (this is a test sub-feature).',
defaultMessage: 'Use Endpoint Exceptions.',
}
),
privilegeGroups: [
Expand All @@ -663,7 +659,8 @@ const endpointExceptionsSubFeature = (): SubFeatureConfig => ({
all: [],
read: [],
},
...ProductFeaturesPrivileges[ProductFeaturesPrivilegeId.endpointExceptions].all,
api: [`${APP_ID}-showEndpointExceptions`, `${APP_ID}-crudEndpointExceptions`],
ui: ['showEndpointExceptions', 'crudEndpointExceptions'],
},
{
replacedBy: [
Expand All @@ -676,7 +673,8 @@ const endpointExceptionsSubFeature = (): SubFeatureConfig => ({
all: [],
read: [],
},
...ProductFeaturesPrivileges[ProductFeaturesPrivilegeId.endpointExceptions].read,
api: [`${APP_ID}-showEndpointExceptions`],
ui: ['showEndpointExceptions'],
},
],
},
Expand Down
14 changes: 6 additions & 8 deletions x-pack/solutions/security/packages/features/src/security/v2_features/kibana_sub_features.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,6 @@
import { i18n } from '@kbn/i18n';
import type { SubFeatureConfig } from '@kbn/features-plugin/common';
import { EXCEPTION_LIST_NAMESPACE_AGNOSTIC } from '@kbn/securitysolution-list-constants';
import {
ProductFeaturesPrivilegeId,
ProductFeaturesPrivileges,
} from '../../product_features_privileges';

import { SecuritySubFeatureId } from '../../product_features_keys';
import { APP_ID } from '../../constants';
Expand Down Expand Up @@ -665,7 +661,7 @@ const endpointExceptionsSubFeature = (): SubFeatureConfig => ({
description: i18n.translate(
'securitySolutionPackages.features.featureRegistry.subFeatures.endpointExceptions.description',
{
defaultMessage: 'Use Endpoint Exceptions (this is a test sub-feature).',
defaultMessage: 'Use Endpoint Exceptions.',
}
),
privilegeGroups: [
Expand All @@ -680,7 +676,8 @@ const endpointExceptionsSubFeature = (): SubFeatureConfig => ({
all: [],
read: [],
},
...ProductFeaturesPrivileges[ProductFeaturesPrivilegeId.endpointExceptions].all,
api: [`${APP_ID}-showEndpointExceptions`, `${APP_ID}-crudEndpointExceptions`],
ui: ['showEndpointExceptions', 'crudEndpointExceptions'],
},
{
id: 'endpoint_exceptions_read',
Expand All @@ -690,7 +687,8 @@ const endpointExceptionsSubFeature = (): SubFeatureConfig => ({
all: [],
read: [],
},
...ProductFeaturesPrivileges[ProductFeaturesPrivilegeId.endpointExceptions].read,
api: [`${APP_ID}-showEndpointExceptions`],
ui: ['showEndpointExceptions'],
},
],
},
Expand Down Expand Up @@ -723,11 +721,11 @@ export const getSecurityV2SubFeaturesMap = ({
};

const securitySubFeaturesList: Array<[SecuritySubFeatureId, SubFeatureConfig]> = [
[SecuritySubFeatureId.endpointList, enableSpaceAwarenessIfNeeded(endpointListSubFeature())],
[
SecuritySubFeatureId.endpointExceptions,
enableSpaceAwarenessIfNeeded(endpointExceptionsSubFeature()),
],
[SecuritySubFeatureId.endpointList, enableSpaceAwarenessIfNeeded(endpointListSubFeature())],
[
SecuritySubFeatureId.trustedApplications,
enableSpaceAwarenessIfNeeded(trustedApplicationsSubFeature()),
Expand Down
13 changes: 2 additions & 11 deletions ...plugins/security_solution_ess/server/product_features/security_product_features_config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,18 +9,12 @@ import type {
ProductFeatureKibanaConfig,
ProductFeaturesSecurityConfig,
} from '@kbn/security-solution-features';
import {
ProductFeatureSecurityKey,
type SecuritySubFeatureId,
} from '@kbn/security-solution-features/keys';
import type { ProductFeatureSecurityKey } from '@kbn/security-solution-features/keys';
import { type SecuritySubFeatureId } from '@kbn/security-solution-features/keys';
import {
securityDefaultProductFeaturesConfig,
createEnabledProductFeaturesConfigMap,
} from '@kbn/security-solution-features/config';
import {
ProductFeaturesPrivilegeId,
ProductFeaturesPrivileges,
} from '@kbn/security-solution-features/privileges';

export const getSecurityProductFeaturesConfigurator =
(enabledProductFeatureKeys: ProductFeatureKeys) => (): ProductFeaturesSecurityConfig => {
Expand All @@ -44,7 +38,4 @@ const securityProductFeaturesConfig: Record<
ProductFeatureKibanaConfig<SecuritySubFeatureId>
> = {
...securityDefaultProductFeaturesConfig,
[ProductFeatureSecurityKey.endpointExceptions]: {
privileges: ProductFeaturesPrivileges[ProductFeaturesPrivilegeId.endpointExceptions],
},
};
5 changes: 1 addition & 4 deletions .../security_solution_serverless/server/product_features/security_product_features_config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ import {
securityDefaultProductFeaturesConfig,
createEnabledProductFeaturesConfigMap,
} from '@kbn/security-solution-features/config';
import {
import type {
ProductFeatureSecurityKey,
SecuritySubFeatureId,
} from '@kbn/security-solution-features/keys';
Expand Down Expand Up @@ -45,7 +45,4 @@ const securityProductFeaturesConfig: Record<
ProductFeatureKibanaConfig<SecuritySubFeatureId>
> = {
...securityDefaultProductFeaturesConfig,
[ProductFeatureSecurityKey.endpointExceptions]: {
subFeatureIds: [SecuritySubFeatureId.endpointExceptions],
},
};