[WorkplaceAI][PerUserAuth] Implement Encrypted Saved Objects recommendations

x-pack/platform/plugins/shared/actions/server/saved_objects/index.ts

@@ -34,7 +34,7 @@ import {
 import {
   actionTaskParamsModelVersions,
   connectorModelVersions,
-  connectorTokenModelVersions,
+  getConnectorTokenModelVersions,
   oauthStateModelVersions,
 } from './model_versions';
 
@@ -131,7 +131,7 @@ export function setupSavedObjects(
     management: {
       importableAndExportable: false,
     },
-    modelVersions: connectorTokenModelVersions,
+    modelVersions: getConnectorTokenModelVersions(encryptedSavedObjects),
   });
 
   encryptedSavedObjects.registerType({
@@ -175,12 +175,8 @@ export function setupSavedObjects(
       'state',
       'connectorId',
       'redirectUri',
-      'authorizationUrl',
-      'scope',
       'spaceId',
-      'createdAt',
       'expiresAt',
-      'createdBy',
     ]),
   });
 }

x-pack/platform/plugins/shared/actions/server/saved_objects/mappings.ts

@@ -120,9 +120,6 @@ export const oauthStateMappings: SavedObjectsTypeMappingDefinition = {
     // redirectUri: {
     //   type: 'keyword',
     // },
-    // authorizationUrl: {
-    //   type: 'keyword',
-    // },
     // scope: {
     //   type: 'keyword',
     // },
@@ -135,5 +132,8 @@ export const oauthStateMappings: SavedObjectsTypeMappingDefinition = {
     // kibanaReturnUrl: {
     //   type: 'keyword',
     // },
+    // spaceId: {
+    //   type: 'keyword',
+    // },
   },
 };

x-pack/platform/plugins/shared/actions/server/saved_objects/model_versions/connector_token_model_versions.ts

@@ -6,24 +6,60 @@
  */
 
 import type { SavedObjectsModelVersionMap } from '@kbn/core-saved-objects-server';
+import type { EncryptedSavedObjectsPluginSetup } from '@kbn/encrypted-saved-objects-plugin/server';
 import {
   rawConnectorTokenSchemaV1,
   rawConnectorTokenSchemaV2,
 } from '../schemas/raw_connector_token';
+import { CONNECTOR_TOKEN_SAVED_OBJECT_TYPE } from '../../constants/saved_objects';
 
-export const connectorTokenModelVersions: SavedObjectsModelVersionMap = {
+// ESO type registration for V1 (before refreshToken was added)
+const connectorTokenTypeRegistrationV1 = {
+  type: CONNECTOR_TOKEN_SAVED_OBJECT_TYPE,
+  attributesToEncrypt: new Set(['token']),
+  attributesToIncludeInAAD: new Set([
+    'connectorId',
+    'tokenType',
+    'expiresAt',
+    'createdAt',
+    'updatedAt',
+  ]),
+};
+
+// ESO type registration for V2 (with refreshToken and refreshTokenExpiresAt)
+const connectorTokenTypeRegistrationV2 = {
+  type: CONNECTOR_TOKEN_SAVED_OBJECT_TYPE,
+  attributesToEncrypt: new Set(['token', 'refreshToken']),
+  attributesToIncludeInAAD: new Set([
+    'connectorId',
+    'tokenType',
+    'expiresAt',
+    'createdAt',
+    'updatedAt',
+    'refreshTokenExpiresAt',
+  ]),
+};
+
+export const getConnectorTokenModelVersions = (
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup
+): SavedObjectsModelVersionMap => ({
   '1': {
     changes: [],
     schemas: {
       forwardCompatibility: rawConnectorTokenSchemaV1.extends({}, { unknowns: 'ignore' }),
       create: rawConnectorTokenSchemaV1,
     },
   },
-  '2': {
-    changes: [], // backwards-compatible schema evolution
-    schemas: {
-      forwardCompatibility: rawConnectorTokenSchemaV2.extends({}, { unknowns: 'ignore' }),
-      create: rawConnectorTokenSchemaV2,
+  '2': encryptedSavedObjects.createModelVersion({
+    modelVersion: {
+      changes: [],
+      schemas: {
+        forwardCompatibility: rawConnectorTokenSchemaV2.extends({}, { unknowns: 'ignore' }),
+        create: rawConnectorTokenSchemaV2,
+      },
     },
-  },
-};
+    inputType: connectorTokenTypeRegistrationV1,
+    outputType: connectorTokenTypeRegistrationV2,
+    shouldTransformIfDecryptionFails: true,
+  }),
+});

x-pack/platform/plugins/shared/actions/server/saved_objects/model_versions/index.ts

@@ -6,6 +6,6 @@
  */
 
 export { connectorModelVersions } from './connector_model_versions';
-export { connectorTokenModelVersions } from './connector_token_model_versions';
+export { getConnectorTokenModelVersions } from './connector_token_model_versions';
 export { actionTaskParamsModelVersions } from './action_task_params_model_versions';
 export { oauthStateModelVersions } from './oauth_state_model_versions';

x-pack/platform/plugins/shared/actions/server/saved_objects/schemas/raw_oauth_state/v1.ts

@@ -14,7 +14,7 @@ export const rawOAuthStateSchema = schema.object({
   redirectUri: schema.string(),
   scope: schema.maybe(schema.string()),
   kibanaReturnUrl: schema.string(), // in case of OAuth success, redirect to this URL
-  spaceId: schema.string(), // the space where the connector exists
+  spaceId: schema.string(), // the space where the connector exists and the authz was initiated from
   createdAt: schema.string(),
   expiresAt: schema.string(),
   createdBy: schema.maybe(schema.string()),