Skip to content

[Response Ops][Task Manager] Update functions do not handle API key invalidation #249109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
doakalexi merged 13 commits into from
Jan 29, 2026
Merged

[Response Ops][Task Manager] Update functions do not handle API key invalidation #249109

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
99f771a
Adding logic to regenerate api keys on task update
doakalexi Jan 14, 2026
804c2bb
Adding tests
doakalexi Jan 15, 2026
cfa9f74
Merge branch 'main' into alerting/244918
doakalexi Jan 15, 2026
5b75791
Merge branch 'main' into alerting/244918
doakalexi Jan 20, 2026
9164f7e
Merge branch 'main' into alerting/244918
doakalexi Jan 20, 2026
f4b9dd3
Merge branch 'main' into alerting/244918
doakalexi Jan 21, 2026
5099223
Merge branch 'main' into alerting/244918
doakalexi Jan 26, 2026
48d89c0
Moving around invalidate code
doakalexi Jan 27, 2026
abde4ef
Merge branch 'main' into alerting/244918
doakalexi Jan 27, 2026
fb51512
Moving some code around
doakalexi Jan 28, 2026
fbd88c9
Merge branch 'alerting/244918' of github.com:doakalexi/kibana into al…
doakalexi Jan 28, 2026
0b83b97
Making another format change
doakalexi Jan 28, 2026
99f34d3
Merge branch 'main' into alerting/244918
doakalexi Jan 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions x-pack/platform/plugins/shared/task_manager/server/task.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -571,6 +571,7 @@ export type PartialSerializedConcreteTaskInstance = Partial<SerializedConcreteTa

export interface ApiKeyOptions {
request?: KibanaRequest;
regenerateApiKey?: boolean;
}

export type ScheduleOptions = Record<string, unknown> & ApiKeyOptions;
248 changes: 222 additions & 26 deletions x-pack/platform/plugins/shared/task_manager/server/task_store.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1489,7 +1489,173 @@ describe('TaskStore', () => {
expect(savedObjectsClient.bulkUpdate).not.toHaveBeenCalled();
});

test('uses regular repository when request is provided but docs have no apiKey', async () => {
test('bulk update task with regenerated API key when api key, user scope, request, and regenerate api key flag are available', async () => {
const mockScopedClient = {
bulkUpdate: jest.fn().mockResolvedValue({
saved_objects: [],
}),
};
mockGetScopedClient.mockReturnValue(mockScopedClient);

const mockUpdatedApiKey = Buffer.from('apiKeyIdUpdated:apiKey').toString('base64');

const mockUpdatedUserScope = {
apiKeyId: 'apiKeyIdUpdated',
apiKeyCreatedByUser: false,
spaceId: 'testSpace',
};

const apiKeyAndUserScopeMap = new Map();
apiKeyAndUserScopeMap.set('task:324242', {
apiKey: mockUpdatedApiKey,
userScope: mockUpdatedUserScope,
});
(getApiKeyAndUserScope as jest.Mock).mockResolvedValueOnce(apiKeyAndUserScopeMap);

await store.bulkUpdate(
[{ ...bulkUpdateTask, apiKey: mockApiKey, userScope: mockUserScope }],
{
validate: false,
mergeAttributes: false,
options: { request: mockRequest, regenerateApiKey: true },
}
);

expect(mockGetValidatedTaskInstanceForUpdating).toHaveBeenCalledWith(
{ ...bulkUpdateTask, apiKey: mockApiKey, userScope: mockUserScope },
{
validate: false,
}
);

expect(mockGetScopedClient).toHaveBeenCalledWith(mockRequest, {
includedHiddenTypes: ['task'],
excludedExtensions: ['security', 'spaces'],
});

expect(bulkMarkApiKeysForInvalidation).toHaveBeenCalledWith({
apiKeyIds: ['apiKeyId'],
logger,
savedObjectsClient,
});
expect(getApiKeyAndUserScope).toHaveBeenCalledWith(
[{ ...bulkUpdateTask, apiKey: mockApiKey, userScope: mockUserScope }],
mockRequest,
coreStart.security,
basePathMock
);

expect(mockScopedClient.bulkUpdate).toHaveBeenCalledWith(
[
{
id: bulkUpdateTask.id,
mergeAttributes: false,
type: 'task',
version: bulkUpdateTask.version,
attributes: {
...taskInstanceToAttributes(bulkUpdateTask, bulkUpdateTask.id),
apiKey: mockUpdatedApiKey,
userScope: mockUpdatedUserScope,
},
},
],
{ refresh: false }
);

expect(logger.debug).not.toHaveBeenCalled();
expect(savedObjectsClient.bulkUpdate).not.toHaveBeenCalled();
});

test('bulk update task with regenerated API key when api key but do not invalidate user created api keys', async () => {
const mockScopedClient = {
bulkUpdate: jest.fn().mockResolvedValue({
saved_objects: [],
}),
};
mockGetScopedClient.mockReturnValue(mockScopedClient);

const mockUpdatedApiKey = Buffer.from('apiKeyIdUpdated:apiKey').toString('base64');

const mockUpdatedUserScope = {
apiKeyId: 'apiKeyIdUpdated',
apiKeyCreatedByUser: true,
spaceId: 'testSpace',
};

const apiKeyAndUserScopeMap = new Map();
apiKeyAndUserScopeMap.set('task:324242', {
apiKey: mockUpdatedApiKey,
userScope: mockUpdatedUserScope,
});
(getApiKeyAndUserScope as jest.Mock).mockResolvedValueOnce(apiKeyAndUserScopeMap);

await store.bulkUpdate(
[
{
...bulkUpdateTask,
apiKey: mockApiKey,
userScope: { ...mockUserScope, apiKeyCreatedByUser: true },
},
],
{
validate: false,
mergeAttributes: false,
options: { request: mockRequest, regenerateApiKey: true },
}
);

expect(mockGetValidatedTaskInstanceForUpdating).toHaveBeenCalledWith(
{
...bulkUpdateTask,
apiKey: mockApiKey,
userScope: { ...mockUserScope, apiKeyCreatedByUser: true },
},
{
validate: false,
}
);

expect(mockGetScopedClient).toHaveBeenCalledWith(mockRequest, {
includedHiddenTypes: ['task'],
excludedExtensions: ['security', 'spaces'],
});

expect(bulkMarkApiKeysForInvalidation).not.toHaveBeenCalled();
expect(getApiKeyAndUserScope).toHaveBeenCalledWith(
[
{
...bulkUpdateTask,
apiKey: mockApiKey,
userScope: { ...mockUserScope, apiKeyCreatedByUser: true },
},
],
mockRequest,
coreStart.security,
basePathMock
);

expect(mockScopedClient.bulkUpdate).toHaveBeenCalledWith(
[
{
id: bulkUpdateTask.id,
mergeAttributes: false,
type: 'task',
version: bulkUpdateTask.version,
attributes: {
...taskInstanceToAttributes(bulkUpdateTask, bulkUpdateTask.id),
apiKey: mockUpdatedApiKey,
userScope: mockUpdatedUserScope,
},
},
],
{ refresh: false }
);

expect(logger.debug).not.toHaveBeenCalled();
expect(savedObjectsClient.bulkUpdate).not.toHaveBeenCalled();
});

test('bulk update task with no API key changes when api key, user scope are not available and request and regenerate api key flag are available', async () => {
savedObjectsClient.bulkUpdate.mockResolvedValue({
saved_objects: [
{
Expand All @@ -1509,42 +1675,44 @@ describe('TaskStore', () => {
await store.bulkUpdate([bulkUpdateTask], {
validate: false,
mergeAttributes: false,
options: { request: mockRequest },
options: { request: mockRequest, regenerateApiKey: true },
});

expect(logger.debug).toHaveBeenCalledWith(
expect.stringContaining(
'Request is defined but none of the tasks have API key or user scope. Using regular saved objects repository to bulk update tasks.'
)
);
expect(mockGetValidatedTaskInstanceForUpdating).toHaveBeenCalledWith(bulkUpdateTask, {
validate: false,
});

expect(mockGetScopedClient).not.toHaveBeenCalled();

expect(bulkMarkApiKeysForInvalidation).not.toHaveBeenCalled();
expect(getApiKeyAndUserScope).not.toHaveBeenCalled();

expect(savedObjectsClient.bulkUpdate).toHaveBeenCalledWith(
[
{
id: bulkUpdateTask.id,
mergeAttributes: false,
type: 'task',
version: bulkUpdateTask.version,
attributes: {
...taskInstanceToAttributes(bulkUpdateTask, bulkUpdateTask.id),
},
attributes: taskInstanceToAttributes(bulkUpdateTask, bulkUpdateTask.id),
},
],
{ refresh: false }
);

expect(logger.debug).toHaveBeenCalledWith(
'Request is defined but none of the tasks have API key or user scope. Using regular saved objects repository to bulk update tasks.'
);
});

test('uses regular repository when request is provided but docs have no userScope', async () => {
test('uses regular repository when request is provided but docs have no apiKey', async () => {
savedObjectsClient.bulkUpdate.mockResolvedValue({
saved_objects: [
{
id: '324242',
type: 'task',
attributes: {
...bulkUpdateTask,
apiKey: mockApiKey,
state: '{"foo":"bar"}',
params: '{"hello":"world"}',
},
Expand All @@ -1554,7 +1722,7 @@ describe('TaskStore', () => {
],
});

await store.bulkUpdate([{ ...bulkUpdateTask, apiKey: mockApiKey }], {
await store.bulkUpdate([bulkUpdateTask], {
validate: false,
mergeAttributes: false,
options: { request: mockRequest },
Expand All @@ -1577,15 +1745,14 @@ describe('TaskStore', () => {
version: bulkUpdateTask.version,
attributes: {
...taskInstanceToAttributes(bulkUpdateTask, bulkUpdateTask.id),
apiKey: mockApiKey,
},
},
],
{ refresh: false }
);
});

test('uses regular repository when no request is provided even if docs have apiKey and userScope', async () => {

@doakalexi doakalexi Jan 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I updated this test to throw an error, but the changes make it seem like I changed the other tests too.

test('uses regular repository when request is provided but docs have no userScope', async () => {
savedObjectsClient.bulkUpdate.mockResolvedValue({
saved_objects: [
{
Expand All @@ -1594,7 +1761,6 @@ describe('TaskStore', () => {
attributes: {
...bulkUpdateTask,
apiKey: mockApiKey,
userScope: mockUserScope,
state: '{"foo":"bar"}',
params: '{"hello":"world"}',
},
Expand All @@ -1604,16 +1770,17 @@ describe('TaskStore', () => {
],
});

await store.bulkUpdate(
[{ ...bulkUpdateTask, apiKey: mockApiKey, userScope: mockUserScope }],
{
validate: false,
mergeAttributes: false,
options: {},
}
);
await store.bulkUpdate([{ ...bulkUpdateTask, apiKey: mockApiKey }], {
validate: false,
mergeAttributes: false,
options: { request: mockRequest },
});

expect(logger.debug).not.toHaveBeenCalled();
expect(logger.debug).toHaveBeenCalledWith(
expect.stringContaining(
'Request is defined but none of the tasks have API key or user scope. Using regular saved objects repository to bulk update tasks.'
)
);

expect(mockGetScopedClient).not.toHaveBeenCalled();

Expand All @@ -1627,14 +1794,43 @@ describe('TaskStore', () => {
attributes: {
...taskInstanceToAttributes(bulkUpdateTask, bulkUpdateTask.id),
apiKey: mockApiKey,
userScope: mockUserScope,
},
},
],
{ refresh: false }
);
});

test('throws an error when no request is provided but docs have apiKey and userScope', async () => {
savedObjectsClient.bulkUpdate.mockResolvedValue({
saved_objects: [
{
id: '324242',
type: 'task',
attributes: {
...bulkUpdateTask,
apiKey: mockApiKey,
userScope: mockUserScope,
state: '{"foo":"bar"}',
params: '{"hello":"world"}',
},
references: [],
version: '123',
},
],
});

await expect(
store.bulkUpdate([{ ...bulkUpdateTask, apiKey: mockApiKey, userScope: mockUserScope }], {
validate: false,
mergeAttributes: false,
options: {},
})
).rejects.toThrowErrorMatchingInlineSnapshot(
`"Request is not defined but some of the tasks have API key or user scope. Cannot get the encrypted saved objects repository to bulk update tasks."`
);
});

test('uses regular repository when security is disabled even with request and encrypted fields', async () => {
// Create store with security disabled
const storeWithoutSecurity = new TaskStore({
Expand Down
Loading