[Task Manager] Use strategy pattern for API key management

packages/kbn-check-saved-objects-cli/current_fields.json

@@ -1420,7 +1420,8 @@
     "status",
     "taskType",
     "userScope",
-    "userScope.apiKeyId"
+    "userScope.apiKeyId",
+    "userScope.uiamApiKeyId"
   ],
   "telemetry": [],
   "threshold-explorer-view": [],

packages/kbn-check-saved-objects-cli/current_mappings.json

@@ -4734,6 +4734,9 @@
         "properties": {
           "apiKeyId": {
             "type": "keyword"
+          },
+          "uiamApiKeyId": {
+            "type": "keyword"
           }
         }
       }

packages/kbn-check-saved-objects-cli/src/migrations/__fixtures__/task/10.9.0.json

@@ -0,0 +1,59 @@
+{
+  "10.8.0": [
+    {
+      "taskType": "string",
+      "scheduledAt": "string",
+      "startedAt": "string?|null",
+      "retryAt": "string?|null",
+      "runAt": "string",
+      "params": "string",
+      "state": "string",
+      "stateVersion": "number?",
+      "traceparent": "string",
+      "user": "string?",
+      "scope": "array?",
+      "ownerId": "string?|null",
+      "enabled": "boolean?",
+      "timeoutOverride": "string?",
+      "attempts": "number",
+      "status": "idle|claiming|running|failed|unrecognized|dead_letter",
+      "version": "string?",
+      "partition": "number?",
+      "priority": "number?",
+      "interval": "string",
+      "apiKey": "string?",
+      "userScope": "object?",
+      "schedule": "object?",
+      "cost": "tiny?|normal?|extralarge?"
+    }
+  ],
+  "10.9.0": [
+    {
+      "taskType": "string",
+      "scheduledAt": "string",
+      "startedAt": "string?|null",
+      "retryAt": "string?|null",
+      "runAt": "string",
+      "params": "string",
+      "state": "string",
+      "stateVersion": "number?",
+      "traceparent": "string",
+      "user": "string?",
+      "scope": "array?",
+      "ownerId": "string?|null",
+      "enabled": "boolean?",
+      "timeoutOverride": "string?",
+      "attempts": "number",
+      "status": "idle|claiming|running|failed|unrecognized|dead_letter",
+      "version": "string?",
+      "partition": "number?",
+      "priority": "number?",
+      "interval": "string",
+      "apiKey": "string?",
+      "uiamApiKey": "string?",
+      "userScope": "object?",
+      "schedule": "object?",
+      "cost": "tiny?|normal?|extralarge?"
+    }
+  ]
+}

src/core/server/integration_tests/ci_checks/saved_objects/check_registered_types.test.ts

@@ -194,7 +194,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "synthetics-private-location": "f5efabeefafbb12ed0809db3cd04f893ff9099ead8f526be82a9b0348e444f65",
         "synthetics-privates-locations": "42aebb3aa4f3710a3e270d54bf33718a4d1d7a983556a51f75bd96b1e4fdf048",
         "tag": "03a522e92aed789a4bbf1a5dd19159c3ec061cb052337df9270728def4b3bbe0",
-        "task": "52bb9355724d6546a8e485c161c7f039493acb79e913b31ce1d0b9839fe38117",
+        "task": "4e6f0a8e825e3159959f1dc0fd4d6c5d9b15707863a741905b183dc6d1144f44",
         "telemetry": "fb5e3ce0b2955f10aa8cd75fdafdd0559bf5d77eaf6e2c228079684f01f28fbd",
         "threshold-explorer-view": "9b0a770f5444531f92dd50832dcf655cb0c9cd7f18af205338e0c9d73c6df6a6",
         "trial-companion-nba-milestone": "83f29f99e2ffaf00ed8e05f3366ed0df1fb36a77193aeb151e13bae8b1d9692f",
@@ -1274,8 +1274,9 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "tag|schemas: da39a3ee5e6b4b0d3255bfef95601890afd80709",
         "=====================================================",
         "task|global: 8277e4031824bb161fa73897294701786c15eb9a",
-        "task|mappings: 02ff4224787d1516899101bacf1c411fa0149383",
+        "task|mappings: a4616c952ab46648bba6f807a339d76b1388078e",
         "task|schemas: da39a3ee5e6b4b0d3255bfef95601890afd80709",
+        "task|10.9.0: 2c8f74c9a9d07540f767ad8e99174474da9bec93ab858ae1e005a301f620c39b",
         "task|10.8.0: deed2eb105aa3f19fa1827868c6b5569523624614fb73a8fcb8600d86c0dface",
         "task|10.7.0: 6afacb50669e4a3ebd48d5790d1677c138885b1540acf5e832dbe8dc82e7cd5c",
         "task|10.6.0: a554a701424daf84a260b61390464deb9296c7372ac3438301c2fb046ded11f9",
@@ -1537,7 +1538,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "synthetics-private-location": "10.0.0",
         "synthetics-privates-locations": "10.1.0",
         "tag": "10.0.0",
-        "task": "10.8.0",
+        "task": "10.9.0",
         "telemetry": "10.0.0",
         "threshold-explorer-view": "10.0.0",
         "trial-companion-nba-milestone": "10.1.0",
@@ -1702,7 +1703,7 @@ describe('checking migration metadata changes on all registered SO types', () =>
         "synthetics-private-location": "0.0.0",
         "synthetics-privates-locations": "10.1.0",
         "tag": "0.0.0",
-        "task": "10.8.0",
+        "task": "10.9.0",
         "telemetry": "0.0.0",
         "threshold-explorer-view": "0.0.0",
         "trial-companion-nba-milestone": "10.1.0",

x-pack/platform/plugins/private/task_manager_dependencies/server/plugin.ts

@@ -34,7 +34,7 @@ export class TaskManagerDependenciesPlugin {
   public setup(_: CoreSetup, plugin: TaskManagerDependenciesPluginSetup) {
     plugin.encryptedSavedObjects.registerType({
       type: 'task',
-      attributesToEncrypt: new Set(['apiKey']),
+      attributesToEncrypt: new Set(['apiKey', 'uiamApiKey']),
       attributesToIncludeInAAD: new Set(['id', 'taskType']),
       enforceRandomId: false,
     });
@@ -47,7 +47,7 @@ export class TaskManagerDependenciesPlugin {
     );
   }
 
-  public start(_: CoreStart, plugin: TaskManagerDependenciesPluginStart) {
+  public start(core: CoreStart, plugin: TaskManagerDependenciesPluginStart) {
     plugin.taskManager.registerEncryptedSavedObjectsClient(
       plugin.encryptedSavedObjects.getClient({
         includedHiddenTypes: ['task'],
@@ -56,5 +56,6 @@ export class TaskManagerDependenciesPlugin {
     plugin.taskManager.registerApiKeyInvalidateFn(
       plugin.security?.authc.apiKeys.invalidateAsInternalUser
     );
+    plugin.taskManager.registerUiamApiKeyInvalidateFn(core.security.authc.apiKeys.uiam?.invalidate);
   }
 }

x-pack/platform/plugins/shared/encrypted_saved_objects/integration_tests/ci_checks/check_registered_types.test.ts

@@ -83,7 +83,7 @@ describe('checking changes on all registered encrypted SO types', () => {
         "synthetics-monitor": "f1c060b7be3b30187c4adcb35d74f1fa8a4290bd7faf04fec869de2aa387e21b",
         "synthetics-monitor-multi-space": "39c4c6abd28c4173f77c1c89306e92b6b92492c0029274e10620a170be4d4a67",
         "synthetics-param": "747ba9d1b7addf5b131713abe7868bd767af6ce0cf8b6b0f335f4ef34b280c7e",
-        "task": "2d8e9bf532f469805b82051f545b915785d99eabfa050cb1aefbc715c6096b97",
+        "task": "d6cc30871dc78caf3f451de1275a3803879ec9935b4a2e34076dee56878c228f",
         "uptime-synthetics-api-key": "5ca81f180763e85397fa8c6508adcd60efd0f916e29bac6dcd5b4564f1db7375",
         "user_connector_token": "b443b022b46b79c0ff9fa674aecc64176a5fcbd09c2db2d9f050a6a88435732e",
       }
@@ -151,6 +151,7 @@ describe('checking changes on all registered encrypted SO types', () => {
         "oauth_state|1",
         "synthetics-monitor|2",
         "synthetics-monitor|1",
+        "task|9",
         "task|8",
         "task|7",
         "task|6",

x-pack/platform/plugins/shared/task_manager/moon.yml

@@ -55,6 +55,7 @@ dependsOn:
   - '@kbn/core-execution-context-server-mocks'
   - '@kbn/core-execution-context-common'
   - '@kbn/core-http-server'
+  - '@kbn/core-security-server'
 tags:
   - plugin
   - prod

x-pack/platform/plugins/shared/task_manager/server/api_key_strategy/api_key_strategy.ts

@@ -0,0 +1,77 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type {
+  Logger,
+  SecurityServiceStart,
+  IBasePath,
+  KibanaRequest,
+  SavedObjectsClientContract,
+} from '@kbn/core/server';
+import type { ApiKeyType } from '../config';
+import type { ConcreteTaskInstance, TaskInstance, TaskUserScope } from '../task';
+import { INVALIDATE_API_KEY_SO_NAME } from '../saved_objects';
+
+export type { ApiKeyType } from '../config';
+
+export interface ApiKeySOFields {
+  apiKey: string;
+  uiamApiKey?: string;
+  userScope: TaskUserScope;
+}
+
+export interface InvalidationTarget {
+  apiKeyId: string;
+  uiamApiKey?: string;
+}
+
+export interface ApiKeyStrategy {
+  readonly shouldGrantUiam: boolean;
+  readonly typeToUse: ApiKeyType;
+
+  grantApiKeys(
+    taskInstances: TaskInstance[],
+    request: KibanaRequest,
+    security: SecurityServiceStart,
+    basePath: IBasePath
+  ): Promise<Map<string, ApiKeySOFields>>;
+
+  getApiKeyForFakeRequest(taskInstance: ConcreteTaskInstance): string | undefined;
+
+  getApiKeyIdsForInvalidation(taskInstance: ConcreteTaskInstance): InvalidationTarget[];
+
+  markForInvalidation(
+    targets: InvalidationTarget[],
+    logger: Logger,
+    savedObjectsClient: SavedObjectsClientContract
+  ): Promise<void>;
+}
+
+export const markApiKeysForInvalidation = async (
+  targets: InvalidationTarget[],
+  logger: Logger,
+  savedObjectsClient: SavedObjectsClientContract
+): Promise<void> => {
+  if (targets.length === 0) {
+    return;
+  }
+
+  try {
+    await savedObjectsClient.bulkCreate(
+      targets.map((target) => ({
+        attributes: {
+          apiKeyId: target.apiKeyId,
+          createdAt: new Date().toISOString(),
+          ...(target.uiamApiKey ? { uiamApiKey: target.uiamApiKey } : {}),
+        },
+        type: INVALIDATE_API_KEY_SO_NAME,
+      }))
+    );
+  } catch (e) {
+    logger.error(`Failed to bulk mark ${targets.length} API keys for invalidation: ${e.message}`);
+  }
+};

x-pack/platform/plugins/shared/task_manager/server/api_key_strategy/create_api_key_strategy.test.ts

@@ -0,0 +1,46 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { coreMock } from '@kbn/core/server/mocks';
+import { ApiKeyType } from '../config';
+import { createApiKeyStrategy } from './create_api_key_strategy';
+import { EsApiKeyStrategy } from './es_api_key_strategy';
+import { EsAndUiamApiKeyStrategy } from './es_and_uiam_api_key_strategy';
+
+describe('createApiKeyStrategy', () => {
+  test('returns EsApiKeyStrategy when UIAM is not available', () => {
+    const coreStart = coreMock.createStart();
+    coreStart.security.authc.apiKeys.uiam = null as never;
+
+    const strategy = createApiKeyStrategy(ApiKeyType.ES, coreStart.security);
+    expect(strategy).toBeInstanceOf(EsApiKeyStrategy);
+  });
+
+  test('returns EsAndUiamApiKeyStrategy when UIAM is available', () => {
+    const coreStart = coreMock.createStart();
+    coreStart.security.authc.apiKeys.uiam = {
+      grant: jest.fn(),
+      invalidate: jest.fn(),
+      convert: jest.fn(),
+    } as never;
+
+    const strategy = createApiKeyStrategy(ApiKeyType.ES, coreStart.security);
+    expect(strategy).toBeInstanceOf(EsAndUiamApiKeyStrategy);
+  });
+
+  test('passes apiKeyType to EsAndUiamApiKeyStrategy', () => {
+    const coreStart = coreMock.createStart();
+    coreStart.security.authc.apiKeys.uiam = {
+      grant: jest.fn(),
+      invalidate: jest.fn(),
+      convert: jest.fn(),
+    } as never;
+
+    const strategy = createApiKeyStrategy(ApiKeyType.UIAM, coreStart.security);
+    expect(strategy.typeToUse).toBe(ApiKeyType.UIAM);
+  });
+});

x-pack/platform/plugins/shared/task_manager/server/api_key_strategy/create_api_key_strategy.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { SecurityServiceStart } from '@kbn/core/server';
+import type { ApiKeyType } from '../config';
+import type { ApiKeyStrategy } from './api_key_strategy';
+import { EsApiKeyStrategy } from './es_api_key_strategy';
+import { EsAndUiamApiKeyStrategy } from './es_and_uiam_api_key_strategy';
+
+export const createApiKeyStrategy = (
+  apiKeyType: ApiKeyType,
+  security: SecurityServiceStart
+): ApiKeyStrategy => {
+  if (security.authc.apiKeys.uiam) {
+    return new EsAndUiamApiKeyStrategy(apiKeyType, security);
+  }
+  return new EsApiKeyStrategy();
+};