Optimize bulk actions endpoint & update gaps

x-pack/platform/packages/private/security/authorization_core/src/privileges/feature_privilege_builder/alerting.test.ts

@@ -82,6 +82,7 @@ describe(`feature_privilege_builder`, () => {
         expect(alertingFeaturePrivileges.getActions(privilege, feature)).toMatchInlineSnapshot(`
           Array [
             "alerting:alert-type/my-consumer/rule/get",
+            "alerting:alert-type/my-consumer/rule/bulkGet",
             "alerting:alert-type/my-consumer/rule/getRuleState",
             "alerting:alert-type/my-consumer/rule/getAlertSummary",
             "alerting:alert-type/my-consumer/rule/getExecutionLog",
@@ -170,6 +171,7 @@ describe(`feature_privilege_builder`, () => {
         expect(alertingFeaturePrivileges.getActions(privilege, feature)).toMatchInlineSnapshot(`
           Array [
             "alerting:alert-type/my-consumer/rule/get",
+            "alerting:alert-type/my-consumer/rule/bulkGet",
             "alerting:alert-type/my-consumer/rule/getRuleState",
             "alerting:alert-type/my-consumer/rule/getAlertSummary",
             "alerting:alert-type/my-consumer/rule/getExecutionLog",
@@ -220,6 +222,7 @@ describe(`feature_privilege_builder`, () => {
         expect(alertingFeaturePrivileges.getActions(privilege, feature)).toMatchInlineSnapshot(`
           Array [
             "alerting:alert-type/my-consumer/rule/get",
+            "alerting:alert-type/my-consumer/rule/bulkGet",
             "alerting:alert-type/my-consumer/rule/getRuleState",
             "alerting:alert-type/my-consumer/rule/getAlertSummary",
             "alerting:alert-type/my-consumer/rule/getExecutionLog",
@@ -329,6 +332,7 @@ describe(`feature_privilege_builder`, () => {
         expect(alertingFeaturePrivileges.getActions(privilege, feature)).toMatchInlineSnapshot(`
           Array [
             "alerting:alert-type/my-consumer/rule/get",
+            "alerting:alert-type/my-consumer/rule/bulkGet",
             "alerting:alert-type/my-consumer/rule/getRuleState",
             "alerting:alert-type/my-consumer/rule/getAlertSummary",
             "alerting:alert-type/my-consumer/rule/getExecutionLog",
@@ -399,6 +403,7 @@ describe(`feature_privilege_builder`, () => {
         expect(alertingFeaturePrivileges.getActions(privilege, feature)).toMatchInlineSnapshot(`
           Array [
             "alerting:alert-type/my-consumer/rule/get",
+            "alerting:alert-type/my-consumer/rule/bulkGet",
             "alerting:alert-type/my-consumer/rule/getRuleState",
             "alerting:alert-type/my-consumer/rule/getAlertSummary",
             "alerting:alert-type/my-consumer/rule/getExecutionLog",
@@ -429,6 +434,7 @@ describe(`feature_privilege_builder`, () => {
             "alerting:alert-type/my-consumer/rule/deleteBackfill",
             "alerting:alert-type/my-consumer/rule/fillGaps",
             "alerting:readonly-alert-type/my-consumer/rule/get",
+            "alerting:readonly-alert-type/my-consumer/rule/bulkGet",
             "alerting:readonly-alert-type/my-consumer/rule/getRuleState",
             "alerting:readonly-alert-type/my-consumer/rule/getAlertSummary",
             "alerting:readonly-alert-type/my-consumer/rule/getExecutionLog",
@@ -524,6 +530,7 @@ describe(`feature_privilege_builder`, () => {
         expect(alertingFeaturePrivileges.getActions(privilege, feature)).toMatchInlineSnapshot(`
           Array [
             "alerting:alert-type/my-consumer/rule/get",
+            "alerting:alert-type/my-consumer/rule/bulkGet",
             "alerting:alert-type/my-consumer/rule/getRuleState",
             "alerting:alert-type/my-consumer/rule/getAlertSummary",
             "alerting:alert-type/my-consumer/rule/getExecutionLog",
@@ -554,6 +561,7 @@ describe(`feature_privilege_builder`, () => {
             "alerting:alert-type/my-consumer/rule/deleteBackfill",
             "alerting:alert-type/my-consumer/rule/fillGaps",
             "alerting:readonly-alert-type/my-consumer/rule/get",
+            "alerting:readonly-alert-type/my-consumer/rule/bulkGet",
             "alerting:readonly-alert-type/my-consumer/rule/getRuleState",
             "alerting:readonly-alert-type/my-consumer/rule/getAlertSummary",
             "alerting:readonly-alert-type/my-consumer/rule/getExecutionLog",
@@ -643,6 +651,7 @@ describe(`feature_privilege_builder`, () => {
         expect(alertingFeaturePrivileges.getActions(privilege, feature)).toMatchInlineSnapshot(`
           Array [
             "alerting:alert-type-1/my-consumer-1/rule/get",
+            "alerting:alert-type-1/my-consumer-1/rule/bulkGet",
             "alerting:alert-type-1/my-consumer-1/rule/getRuleState",
             "alerting:alert-type-1/my-consumer-1/rule/getAlertSummary",
             "alerting:alert-type-1/my-consumer-1/rule/getExecutionLog",
@@ -673,6 +682,7 @@ describe(`feature_privilege_builder`, () => {
             "alerting:alert-type-1/my-consumer-1/rule/deleteBackfill",
             "alerting:alert-type-1/my-consumer-1/rule/fillGaps",
             "alerting:alert-type-1/my-consumer-2/rule/get",
+            "alerting:alert-type-1/my-consumer-2/rule/bulkGet",
             "alerting:alert-type-1/my-consumer-2/rule/getRuleState",
             "alerting:alert-type-1/my-consumer-2/rule/getAlertSummary",
             "alerting:alert-type-1/my-consumer-2/rule/getExecutionLog",
@@ -703,6 +713,7 @@ describe(`feature_privilege_builder`, () => {
             "alerting:alert-type-1/my-consumer-2/rule/deleteBackfill",
             "alerting:alert-type-1/my-consumer-2/rule/fillGaps",
             "alerting:alert-type-2/my-consumer-3/rule/get",
+            "alerting:alert-type-2/my-consumer-3/rule/bulkGet",
             "alerting:alert-type-2/my-consumer-3/rule/getRuleState",
             "alerting:alert-type-2/my-consumer-3/rule/getAlertSummary",
             "alerting:alert-type-2/my-consumer-3/rule/getExecutionLog",
@@ -733,6 +744,7 @@ describe(`feature_privilege_builder`, () => {
             "alerting:alert-type-2/my-consumer-3/rule/deleteBackfill",
             "alerting:alert-type-2/my-consumer-3/rule/fillGaps",
             "alerting:readonly-alert-type-1/my-read-consumer-1/rule/get",
+            "alerting:readonly-alert-type-1/my-read-consumer-1/rule/bulkGet",
             "alerting:readonly-alert-type-1/my-read-consumer-1/rule/getRuleState",
             "alerting:readonly-alert-type-1/my-read-consumer-1/rule/getAlertSummary",
             "alerting:readonly-alert-type-1/my-read-consumer-1/rule/getExecutionLog",
@@ -743,6 +755,7 @@ describe(`feature_privilege_builder`, () => {
             "alerting:readonly-alert-type-1/my-read-consumer-1/rule/findBackfill",
             "alerting:readonly-alert-type-1/my-read-consumer-1/rule/findGaps",
             "alerting:readonly-alert-type-1/my-read-consumer-2/rule/get",
+            "alerting:readonly-alert-type-1/my-read-consumer-2/rule/bulkGet",
             "alerting:readonly-alert-type-1/my-read-consumer-2/rule/getRuleState",
             "alerting:readonly-alert-type-1/my-read-consumer-2/rule/getAlertSummary",
             "alerting:readonly-alert-type-1/my-read-consumer-2/rule/getExecutionLog",
@@ -753,6 +766,7 @@ describe(`feature_privilege_builder`, () => {
             "alerting:readonly-alert-type-1/my-read-consumer-2/rule/findBackfill",
             "alerting:readonly-alert-type-1/my-read-consumer-2/rule/findGaps",
             "alerting:readonly-alert-type-2/my-read-consumer-3/rule/get",
+            "alerting:readonly-alert-type-2/my-read-consumer-3/rule/bulkGet",
             "alerting:readonly-alert-type-2/my-read-consumer-3/rule/getRuleState",
             "alerting:readonly-alert-type-2/my-read-consumer-3/rule/getAlertSummary",
             "alerting:readonly-alert-type-2/my-read-consumer-3/rule/getExecutionLog",
@@ -763,6 +777,7 @@ describe(`feature_privilege_builder`, () => {
             "alerting:readonly-alert-type-2/my-read-consumer-3/rule/findBackfill",
             "alerting:readonly-alert-type-2/my-read-consumer-3/rule/findGaps",
             "alerting:readonly-alert-type-2/my-read-consumer-4/rule/get",
+            "alerting:readonly-alert-type-2/my-read-consumer-4/rule/bulkGet",
             "alerting:readonly-alert-type-2/my-read-consumer-4/rule/getRuleState",
             "alerting:readonly-alert-type-2/my-read-consumer-4/rule/getAlertSummary",
             "alerting:readonly-alert-type-2/my-read-consumer-4/rule/getExecutionLog",

x-pack/platform/packages/private/security/authorization_core/src/privileges/feature_privilege_builder/alerting.ts

@@ -20,6 +20,7 @@ enum AlertingEntity {
 const readOperations: Record<AlertingEntity, string[]> = {
   rule: [
     'get',
+    'bulkGet',
     'getRuleState',
     'getAlertSummary',
     'getExecutionLog',

x-pack/platform/packages/private/security/authorization_core/src/privileges/privileges.test.ts

@@ -565,6 +565,7 @@ describe('features', () => {
     const alertingOperations = [
       ...[
         'get',
+        'bulkGet',
         'getRuleState',
         'getAlertSummary',
         'getExecutionLog',
@@ -741,6 +742,7 @@ describe('features', () => {
     const alertingOperations = [
       ...[
         'get',
+        'bulkGet',
         'getRuleState',
         'getAlertSummary',
         'getExecutionLog',

x-pack/platform/plugins/shared/alerting/server/application/rule/methods/bulk_get/bulk_get_rules.test.ts

@@ -0,0 +1,164 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { transformRuleSoToSanitizedRule } from '../../transforms';
+import { bulkGetRulesSo } from '../../../../data/rule';
+import { bulkGetRules } from './bulk_get_rules';
+import { rulesClientContextMock } from '../../../../rules_client/rules_client.mock';
+import type { BulkGetRulesResponse } from './types/bulk_get_rules_response';
+import type { RuleParams } from '../../types';
+import { RuleAuditAction } from '../../../../rules_client/common/audit_events';
+import type { BulkGetRulesParams } from './types';
+import {
+  getAuthorizationFilter,
+  checkAuthorizationAndGetTotal,
+} from '../../../../rules_client/lib';
+
+jest.mock('../../transforms', () => {
+  return {
+    transformRuleSoToSanitizedRule: jest.fn(),
+  };
+});
+
+jest.mock('../../../../data/rule', () => {
+  return {
+    bulkGetRulesSo: jest.fn(),
+  };
+});
+
+jest.mock('../../../../rules_client/lib', () => {
+  return {
+    getAuthorizationFilter: jest.fn(),
+    checkAuthorizationAndGetTotal: jest.fn(),
+  };
+});
+
+const rulesClientContext = rulesClientContextMock.create();
+const transformRuleSoToSanitizedRuleMock = transformRuleSoToSanitizedRule as jest.Mock;
+const bulkGetRulesSoMock = bulkGetRulesSo as jest.Mock;
+const auditLoggerMock = rulesClientContext.auditLogger?.log as jest.Mock;
+const getAuthorizationFilterMock = getAuthorizationFilter as jest.Mock;
+const checkAuthorizationAndGetTotalMock = checkAuthorizationAndGetTotal as jest.Mock;
+
+const getRule = (id: string, alertTypeId: string, consumer: string) => ({
+  id,
+  attributes: { name: `rule-so-${id}`, alertTypeId, consumer },
+});
+const getRuleErroredFetchingSo = (id: string) => ({ id, error: { message: `rule ${id} errored` } });
+const getTestRules = () => {
+  const successful = [
+    getRule('1', 'some-alert-type-1', 'some-consumer-1'),
+    getRule('2', 'some-alert-type-1', 'some-consumer-2'),
+    getRule('3', 'some-alert-type-2', 'some-consumer-1'),
+    getRule('4', 'some-alert-type-2', 'some-consumer-1'),
+  ];
+
+  const erroredFetchingSo = [getRuleErroredFetchingSo('5')];
+
+  return {
+    successful,
+    erroredFetchingSo,
+    all: [...successful, ...erroredFetchingSo],
+  };
+};
+
+describe('bulkGetRules', () => {
+  let ruleIds: string[] = [];
+  let results: BulkGetRulesResponse<RuleParams>;
+  let testRules: ReturnType<typeof getTestRules>;
+  beforeEach(async () => {
+    jest.resetAllMocks();
+    testRules = getTestRules();
+    ruleIds = testRules.all.map(({ id }) => id);
+    transformRuleSoToSanitizedRuleMock.mockImplementation((_, rule) => {
+      return {
+        ...rule,
+        sanitized: true,
+      };
+    });
+
+    bulkGetRulesSoMock.mockResolvedValueOnce({
+      saved_objects: testRules.all,
+    });
+
+    getAuthorizationFilterMock.mockResolvedValue([]);
+
+    checkAuthorizationAndGetTotalMock.mockResolvedValueOnce({ total: 0 });
+
+    results = await bulkGetRules(rulesClientContext, { ids: ruleIds });
+  });
+
+  it('should throw if called with invalid params', async () => {
+    await expect(
+      bulkGetRules(rulesClientContext, {} as unknown as BulkGetRulesParams)
+    ).rejects.toThrowErrorMatchingInlineSnapshot(
+      '"Error validating get rules params - [ids]: expected value of type [array] but got [undefined]"'
+    );
+  });
+
+  it('should throw an error if it fails to verify the user access to the rules', async () => {
+    const authError = new Error('Some auth error');
+    checkAuthorizationAndGetTotalMock.mockRejectedValueOnce(authError);
+    await expect(
+      bulkGetRules(rulesClientContext, { ids: ruleIds } as unknown as BulkGetRulesParams)
+    ).rejects.toThrowError(authError);
+  });
+
+  it('should attempt to resolve rules', () => {
+    expect(bulkGetRulesSoMock).toHaveBeenCalledTimes(1);
+    expect(bulkGetRulesSoMock).toHaveBeenCalledWith({
+      savedObjectsClient: rulesClientContext.unsecuredSavedObjectsClient,
+      ids: ruleIds,
+    });
+  });
+
+  it('should audit log', () => {
+    expect(auditLoggerMock).toHaveBeenCalledTimes(5);
+    const assertAuditLogCall = (id: string, name?: string, errorMsg?: string) => {
+      const errorObj = errorMsg ? expect.objectContaining({ message: errorMsg }) : undefined;
+      const ruleObj: { id: string; name?: string } = { id };
+      if (name) {
+        ruleObj.name = name;
+      }
+      expect(auditLoggerMock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          error: errorObj,
+          event: expect.objectContaining({
+            outcome: errorMsg ? 'failure' : 'success',
+            action: RuleAuditAction.GET,
+          }),
+          kibana: expect.objectContaining({
+            saved_object: expect.objectContaining(ruleObj),
+          }),
+        })
+      );
+    };
+    testRules.successful.forEach(({ id, attributes: { name } }) => {
+      assertAuditLogCall(id, name);
+    });
+
+    testRules.erroredFetchingSo.forEach(({ id, error }) => {
+      assertAuditLogCall(id, undefined, error.message);
+    });
+  });
+
+  it('should attempt to sanitize the rules', () => {
+    expect(transformRuleSoToSanitizedRuleMock).toHaveBeenCalledTimes(testRules.successful.length);
+    testRules.successful.forEach((rule) => {
+      expect(transformRuleSoToSanitizedRuleMock).toHaveBeenCalledWith(rulesClientContext, rule, {});
+    });
+  });
+
+  it('should return the sanitized rules', () => {
+    const expectedReturned = testRules.successful.map((rule) => ({ ...rule, sanitized: true }));
+    expect(results.rules).toEqual(expectedReturned);
+  });
+
+  it('should return any errors that occurred', () => {
+    expect(results.errors).toEqual(testRules.erroredFetchingSo);
+  });
+});