diff --git a/x-pack/platform/plugins/shared/actions/server/saved_objects/index.ts b/x-pack/platform/plugins/shared/actions/server/saved_objects/index.ts index 1b340416325a1..53c8cfbda3f42 100644 --- a/x-pack/platform/plugins/shared/actions/server/saved_objects/index.ts +++ b/x-pack/platform/plugins/shared/actions/server/saved_objects/index.ts @@ -140,7 +140,7 @@ export function setupSavedObjects( importableAndExportable: false, }, modelVersions: authorizationCodeEnabled - ? connectorTokenModelVersionsWithRefreshToken + ? connectorTokenModelVersionsWithRefreshToken(encryptedSavedObjects) : connectorTokenModelVersions, }); @@ -217,10 +217,7 @@ export function setupSavedObjects( attributesToIncludeInAAD: new Set([ 'state', 'connectorId', - 'authorizationUrl', - 'scope', 'spaceId', - 'createdAt', 'expiresAt', 'createdBy', ]), diff --git a/x-pack/platform/plugins/shared/actions/server/saved_objects/mappings.ts b/x-pack/platform/plugins/shared/actions/server/saved_objects/mappings.ts index 3354411bbb6c7..a88ac2212eecf 100644 --- a/x-pack/platform/plugins/shared/actions/server/saved_objects/mappings.ts +++ b/x-pack/platform/plugins/shared/actions/server/saved_objects/mappings.ts @@ -135,9 +135,6 @@ export const oauthStateMappings: SavedObjectsTypeMappingDefinition = { // redirectUri: { // type: 'keyword', // }, - // authorizationUrl: { - // type: 'keyword', - // }, // scope: { // type: 'keyword', // }, @@ -150,5 +147,8 @@ export const oauthStateMappings: SavedObjectsTypeMappingDefinition = { // kibanaReturnUrl: { // type: 'keyword', // }, + // spaceId: { + // type: 'keyword', + // }, }, }; diff --git a/x-pack/platform/plugins/shared/actions/server/saved_objects/model_versions/connector_token_model_versions.ts b/x-pack/platform/plugins/shared/actions/server/saved_objects/model_versions/connector_token_model_versions.ts index 6a78d1ab7267b..345b3e349a633 100644 --- a/x-pack/platform/plugins/shared/actions/server/saved_objects/model_versions/connector_token_model_versions.ts +++ b/x-pack/platform/plugins/shared/actions/server/saved_objects/model_versions/connector_token_model_versions.ts @@ -6,10 +6,42 @@ */ import type { SavedObjectsModelVersionMap } from '@kbn/core-saved-objects-server'; +import type { + EncryptedSavedObjectsPluginSetup, + EncryptedSavedObjectTypeRegistration, +} from '@kbn/encrypted-saved-objects-plugin/server'; import { rawConnectorTokenSchemaV1, rawConnectorTokenSchemaV2, } from '../schemas/raw_connector_token'; +import { CONNECTOR_TOKEN_SAVED_OBJECT_TYPE } from '../../constants/saved_objects'; + +// ESO type registration for V1 (before refreshToken was added) +const connectorTokenTypeRegistrationV1: EncryptedSavedObjectTypeRegistration = { + type: CONNECTOR_TOKEN_SAVED_OBJECT_TYPE, + attributesToEncrypt: new Set(['token']), + attributesToIncludeInAAD: new Set([ + 'connectorId', + 'tokenType', + 'expiresAt', + 'createdAt', + 'updatedAt', + ]), +}; + +// ESO type registration for V2 (with refreshToken and refreshTokenExpiresAt) +const connectorTokenTypeRegistrationV2: EncryptedSavedObjectTypeRegistration = { + type: CONNECTOR_TOKEN_SAVED_OBJECT_TYPE, + attributesToEncrypt: new Set(['token', 'refreshToken']), + attributesToIncludeInAAD: new Set([ + 'connectorId', + 'tokenType', + 'expiresAt', + 'createdAt', + 'updatedAt', + 'refreshTokenExpiresAt', + ]), +}; export const connectorTokenModelVersions: SavedObjectsModelVersionMap = { '1': { @@ -21,7 +53,9 @@ export const connectorTokenModelVersions: SavedObjectsModelVersionMap = { }, }; -export const connectorTokenModelVersionsWithRefreshToken: SavedObjectsModelVersionMap = { +export const connectorTokenModelVersionsWithRefreshToken = ( + encryptedSavedObjects: EncryptedSavedObjectsPluginSetup +): SavedObjectsModelVersionMap => ({ '1': { changes: [], schemas: { @@ -29,11 +63,22 @@ export const connectorTokenModelVersionsWithRefreshToken: SavedObjectsModelVersi create: rawConnectorTokenSchemaV1, }, }, - '2': { - changes: [], // backwards-compatible schema evolution - schemas: { - forwardCompatibility: rawConnectorTokenSchemaV2.extends({}, { unknowns: 'ignore' }), - create: rawConnectorTokenSchemaV2, + '2': encryptedSavedObjects.createModelVersion({ + modelVersion: { + changes: [ + { + // no-op backfill to trigger the re-encryption + type: 'data_backfill', + backfillFn: (doc) => doc, + }, + ], + schemas: { + forwardCompatibility: rawConnectorTokenSchemaV2.extends({}, { unknowns: 'ignore' }), + create: rawConnectorTokenSchemaV2, + }, }, - }, -}; + inputType: connectorTokenTypeRegistrationV1, + outputType: connectorTokenTypeRegistrationV2, + shouldTransformIfDecryptionFails: true, + }), +}); diff --git a/x-pack/platform/plugins/shared/actions/server/saved_objects/schemas/raw_oauth_state/v1.ts b/x-pack/platform/plugins/shared/actions/server/saved_objects/schemas/raw_oauth_state/v1.ts index 72881aaca6ad7..ae2038be7f9cc 100644 --- a/x-pack/platform/plugins/shared/actions/server/saved_objects/schemas/raw_oauth_state/v1.ts +++ b/x-pack/platform/plugins/shared/actions/server/saved_objects/schemas/raw_oauth_state/v1.ts @@ -13,7 +13,7 @@ export const rawOAuthStateSchema = schema.object({ connectorId: schema.string(), scope: schema.maybe(schema.string()), kibanaReturnUrl: schema.maybe(schema.string()), // when set, redirect to this URL on OAuth success/error; otherwise show callback page - spaceId: schema.string(), // the space where the connector exists + spaceId: schema.string(), // the space where the connector exists and the authz was initiated from createdAt: schema.string(), expiresAt: schema.string(), createdBy: schema.maybe(schema.string()), diff --git a/x-pack/platform/plugins/shared/encrypted_saved_objects/integration_tests/ci_checks/check_registered_types.test.ts b/x-pack/platform/plugins/shared/encrypted_saved_objects/integration_tests/ci_checks/check_registered_types.test.ts index 00a23e4c3bb03..463120da0c77d 100644 --- a/x-pack/platform/plugins/shared/encrypted_saved_objects/integration_tests/ci_checks/check_registered_types.test.ts +++ b/x-pack/platform/plugins/shared/encrypted_saved_objects/integration_tests/ci_checks/check_registered_types.test.ts @@ -20,7 +20,12 @@ import type { EncryptedSavedObjectsService } from '../../server/crypto'; import * as EncryptedSavedObjectsModule from '../../server/saved_objects'; // This will only change if new ESOs are introduced. This number should never get smaller. -export const ESO_TYPES_COUNT = 21 as const; +// To test for oauth_authorization_code feature flag enabled, bump this value to 21 and update L46 as: +// root = createRootWithCorePlugins( +// { xpack: { actions: { auth: { oauth_authorization_code: { enabled: true } } } } }, +// { oss: false } +// ); +export const ESO_TYPES_COUNT = 19 as const; describe('checking changes on all registered encrypted SO types', () => { let esServer: TestElasticsearchUtils; @@ -70,21 +75,19 @@ describe('checking changes on all registered encrypted SO types', () => { "alert": "878a3b83179bbf2ad9d3862fcba539b7066429869b14c120a1dc7a8d39f4a7fa", "api_key_pending_invalidation": "4dafadadaaca2f2f3f6038ee8363b71b2d101371ca98c34d2b6aa2a96f7e71c5", "cloud-connect-api-key": "8c0ae7a780c411145ae4aaf7a70235672c9ccfb56d011c322da3c4eeb258f32d", - "connector_token": "e446f5ff0fbf516f63398e474f126332b4c31e316daa613c6cb8c863400110c5", + "connector_token": "16ca2154c13c5ee3d3a45b55d4ea6cd33aeaceaef3dc229b002d25470bfc9b3b", "entity-discovery-api-key": "cd3b5230a513d2d3503583223e48362fbbbc7812aa4710579a62acfa5bbc30e6", "fleet-fleet-server-host": "3b8d0809aaf8a133596307bc29328207c7ceee1dc72233da75141ec47ad8d327", "fleet-message-signing-keys": "5cdcf6bf85247267f8876bda4226e871dbfefe01f050e898db7cbc267d57a275", "fleet-uninstall-tokens": "6e7d75921dcce46e566f175eab1b0e3825fe565f20cdb3c984e7037934d61e23", "ingest-download-sources": "b3740796eab0a91736e43bd22f7489cbf6f2ad0241ae370d1c8195b6a8d8ad52", "ingest-outputs": "d66716d5333484a25c57f7917bead5ac2576ec57a4b9eb61701b573f35ab62ad", - "oauth_state": "90050be54da9ef0e0059b14eb634af1165374618055289365f8cfebba24ddcdb", "privmon-api-key": "7d7b76b3bc5287a784518731ba66d4f761052177fc04b1a85e5605846ab9de42", "synthetics-monitor": "f1c060b7be3b30187c4adcb35d74f1fa8a4290bd7faf04fec869de2aa387e21b", "synthetics-monitor-multi-space": "39c4c6abd28c4173f77c1c89306e92b6b92492c0029274e10620a170be4d4a67", "synthetics-param": "747ba9d1b7addf5b131713abe7868bd767af6ce0cf8b6b0f335f4ef34b280c7e", "task": "2d8e9bf532f469805b82051f545b915785d99eabfa050cb1aefbc715c6096b97", "uptime-synthetics-api-key": "5ca81f180763e85397fa8c6508adcd60efd0f916e29bac6dcd5b4564f1db7375", - "user_connector_token": "b443b022b46b79c0ff9fa674aecc64176a5fcbd09c2db2d9f050a6a88435732e", } `); expect(Object.keys(hashMap).length).toEqual(ESO_TYPES_COUNT); @@ -111,7 +114,6 @@ describe('checking changes on all registered encrypted SO types', () => { expect(modelVersionMap).toMatchInlineSnapshot(` Array [ - "action|2", "action|1", "action_task_params|2", "action_task_params|1", @@ -130,7 +132,6 @@ describe('checking changes on all registered encrypted SO types', () => { "api_key_pending_invalidation|2", "api_key_pending_invalidation|1", "cloud-connect-api-key|1", - "connector_token|2", "connector_token|1", "fleet-fleet-server-host|2", "fleet-fleet-server-host|1", @@ -144,7 +145,6 @@ describe('checking changes on all registered encrypted SO types', () => { "ingest-outputs|3", "ingest-outputs|2", "ingest-outputs|1", - "oauth_state|1", "synthetics-monitor|2", "synthetics-monitor|1", "task|7", @@ -154,7 +154,6 @@ describe('checking changes on all registered encrypted SO types', () => { "task|3", "task|2", "task|1", - "user_connector_token|1", ] `); });