[9.2] Add kbn/test-saml-auth package (#259074)

.github/CODEOWNERS

@@ -599,6 +599,7 @@ src/platform/packages/shared/kbn-telemetry-config @elastic/kibana-core
 src/platform/packages/shared/kbn-test @elastic/kibana-operations @elastic/appex-qa
 src/platform/packages/shared/kbn-test-es-server @elastic/kibana-operations @elastic/appex-qa
 src/platform/packages/shared/kbn-test-jest-helpers @elastic/kibana-operations @elastic/appex-qa
+src/platform/packages/shared/kbn-test-saml-auth @elastic/appex-qa
 src/platform/packages/shared/kbn-test-subj-selector @elastic/kibana-operations @elastic/appex-qa
 src/platform/packages/shared/kbn-timerange @elastic/obs-onboarding-team
 src/platform/packages/shared/kbn-tooling-log @elastic/kibana-operations

package.json

@@ -1687,6 +1687,7 @@
     "@kbn/test-es-server": "link:src/platform/packages/shared/kbn-test-es-server",
     "@kbn/test-eui-helpers": "link:src/platform/packages/private/kbn-test-eui-helpers",
     "@kbn/test-jest-helpers": "link:src/platform/packages/shared/kbn-test-jest-helpers",
+    "@kbn/test-saml-auth": "link:src/platform/packages/shared/kbn-test-saml-auth",
     "@kbn/test-subj-selector": "link:src/platform/packages/shared/kbn-test-subj-selector",
     "@kbn/test-suites-security-solution-apis": "link:x-pack/solutions/security/test/security_solution_api_integration",
     "@kbn/test-suites-src": "link:src/platform/test",

packages/kbn-repo-source-classifier/src/repo_source_classifier.ts

@@ -165,6 +165,7 @@ export class RepoSourceClassifier {
     if (
       pkgId === '@kbn/test' ||
       pkgId === '@kbn/test-es-server' ||
+      pkgId === '@kbn/test-saml-auth' ||
       pkgId === '@kbn/test-subj-selector'
     ) {
       return 'common package';

src/platform/packages/shared/kbn-ftr-common-functional-services/moon.yml

@@ -21,6 +21,7 @@ dependsOn:
   - '@kbn/tooling-log'
   - '@kbn/es-archiver'
   - '@kbn/test'
+  - '@kbn/test-saml-auth'
   - '@kbn/expect'
   - '@kbn/search-types'
   - '@kbn/core-http-common'

src/platform/packages/shared/kbn-ftr-common-functional-services/services/saml_auth/serverless/auth_provider.ts

@@ -13,7 +13,7 @@ import { SERVERLESS_ROLES_ROOT_PATH } from '@kbn/es';
 import { type Config } from '@kbn/test';
 import { isServerlessProjectType, readRolesDescriptorsFromResource } from '@kbn/es/src/utils';
 import { resolve } from 'path';
-import type { Role } from '@kbn/test/src/auth/types';
+import type { Role } from '@kbn/test-saml-auth';
 import {
   getServerlessInternalRequestHeaders,
   COMMON_REQUEST_HEADERS,

src/platform/packages/shared/kbn-ftr-common-functional-services/tsconfig.json

@@ -16,6 +16,7 @@
     "@kbn/tooling-log",
     "@kbn/es-archiver",
     "@kbn/test",
+    "@kbn/test-saml-auth",
     "@kbn/expect",
     "@kbn/search-types",
     "@kbn/core-http-common",

src/platform/packages/shared/kbn-scout/moon.yml

@@ -28,6 +28,7 @@ dependsOn:
   - '@kbn/kbn-client'
   - '@kbn/test-es-server'
   - '@kbn/test'
+  - '@kbn/test-saml-auth'
   - '@kbn/es-archiver'
   - '@kbn/dev-utils'
   - '@kbn/mock-idp-utils'

src/platform/packages/shared/kbn-scout/src/common/constants.ts

@@ -7,7 +7,7 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
-import type { Role } from '@kbn/test/src/auth/types';
+import type { Role } from '@kbn/test-saml-auth';
 
 export const PROJECT_DEFAULT_ROLES = new Map<string, Role>([
   ['es', 'developer'],

src/platform/packages/shared/kbn-scout/src/common/services/index.ts

@@ -14,7 +14,7 @@ export { createKbnUrl } from './kibana_url';
 export { createSamlSessionManager } from './saml_auth';
 
 export type { KibanaUrl } from './kibana_url';
-export type { SamlSessionManager } from '@kbn/test';
+export type { SamlSessionManager } from '@kbn/test-saml-auth';
 export { ScoutLogger } from './logger';
 export type { KbnClient } from '@kbn/kbn-client';
 export type { Client as EsClient } from '@elastic/elasticsearch';

src/platform/packages/shared/kbn-scout/src/common/services/roles.ts

@@ -8,7 +8,7 @@
  */
 
 import type { ServerlessProjectType } from '@kbn/es';
-import type { Role } from '@kbn/test/src/auth/types';
+import type { Role } from '@kbn/test-saml-auth';
 import { PROJECT_DEFAULT_ROLES } from '../constants';
 
 /**

src/platform/packages/shared/kbn-scout/src/common/services/saml_auth.ts

@@ -15,8 +15,8 @@ import {
   readRolesDescriptorsFromResource,
 } from '@kbn/es';
 import { REPO_ROOT } from '@kbn/repo-info';
-import type { HostOptions } from '@kbn/test';
-import { SamlSessionManager } from '@kbn/test';
+import type { HostOptions } from '@kbn/test-saml-auth';
+import { SamlSessionManager } from '@kbn/test-saml-auth';
 import type { ScoutTestConfig } from '../../types';
 import type { Protocol } from '../../playwright/types';
 import type { ScoutLogger } from './logger';

src/platform/packages/shared/kbn-scout/src/playwright/fixtures/scope/worker/core_fixtures.ts

@@ -9,7 +9,7 @@
 
 import { test as base } from '@playwright/test';
 import type { KbnClient } from '@kbn/kbn-client';
-import type { SamlSessionManager } from '@kbn/test';
+import type { SamlSessionManager } from '@kbn/test-saml-auth';
 import type { Client } from '@elastic/elasticsearch';
 import type {
   KibanaUrl,
@@ -32,7 +32,7 @@ import type { ScoutTestConfig } from '.';
 
 // re-export to import types from '@kbn-scout'
 export type { KbnClient } from '@kbn/kbn-client';
-export type { SamlSessionManager } from '@kbn/test';
+export type { SamlSessionManager } from '@kbn/test-saml-auth';
 export type { Client as EsClient } from '@elastic/elasticsearch';
 export type { KibanaUrl } from '../../../../common/services/kibana_url';
 export type { ScoutTestConfig } from '../../../../types';

src/platform/packages/shared/kbn-scout/tsconfig.json

@@ -18,6 +18,7 @@
     "@kbn/kbn-client",
     "@kbn/test-es-server",
     "@kbn/test",
+    "@kbn/test-saml-auth",
     "@kbn/es-archiver",
     "@kbn/dev-utils",
     "@kbn/mock-idp-utils",

src/platform/packages/shared/kbn-test/src/auth/index.ts → src/platform/packages/shared/kbn-test-saml-auth/index.ts

@@ -12,4 +12,6 @@ export {
   type GetCookieOptions,
   type HostOptions,
   type SamlSessionManagerOptions,
-} from './session_manager';
+} from './src/session_manager';
+
+export type { Role } from './src/types';

src/platform/packages/shared/kbn-test-saml-auth/jest.config.js

@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../../../..',
+  roots: ['<rootDir>/src/platform/packages/shared/kbn-test-saml-auth'],
+};

src/platform/packages/shared/kbn-test-saml-auth/kibana.jsonc

@@ -0,0 +1,11 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/test-saml-auth",
+  "owner": [
+    "@elastic/kibana-operations",
+    "@elastic/appex-qa"
+  ],
+  "group": "platform",
+  "visibility": "shared",
+  "devOnly": true
+}

src/platform/packages/shared/kbn-test-saml-auth/moon.yml

@@ -0,0 +1,58 @@
+# This file is generated by the @kbn/moon package. Any manual edits will be erased!
+#  To extend this, write your extensions/overrides to 'moon.extend.yml'
+#  then regenerate this file with: 'node scripts/regenerate_moon_projects.js --update --filter @kbn/test-saml-auth'
+
+$schema: https://moonrepo.dev/schemas/project.json
+id: '@kbn/test-saml-auth'
+layer: unknown
+owners:
+  defaultOwner: '@elastic/kibana-operations'
+toolchains:
+  default: node
+language: typescript
+project:
+  title: '@kbn/test-saml-auth'
+  description: Moon project for @kbn/test-saml-auth
+  channel: ''
+  owner: '@elastic/kibana-operations'
+  sourceRoot: src/platform/packages/shared/kbn-test-saml-auth
+dependsOn:
+  - '@kbn/es'
+  - '@kbn/mock-idp-utils'
+  - '@kbn/tooling-log'
+  - '@kbn/repo-info'
+tags:
+  - shared-common
+  - package
+  - dev
+  - group-platform
+  - shared
+  - jest-unit-tests
+fileGroups:
+  src:
+    - '**/*.ts'
+    - '**/*.js'
+    - '!target/**/*'
+tasks:
+  jest:
+    command: node
+    args:
+      - '--no-experimental-require-module'
+      - $workspaceRoot/scripts/jest
+      - '--config'
+      - $projectRoot/jest.config.js
+    options:
+      runFromWorkspaceRoot: true
+    inputs:
+      - '@group(src)'
+  jestCI:
+    command: node
+    args:
+      - '--no-experimental-require-module'
+      - $workspaceRoot/scripts/jest
+      - '--config'
+      - $projectRoot/jest.config.js
+    options:
+      runFromWorkspaceRoot: true
+    inputs:
+      - '@group(src)'

src/platform/packages/shared/kbn-test-saml-auth/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "@kbn/test-saml-auth",
+  "author": "Operations",
+  "version": "1.0.0",
+  "private": true,
+  "license": "Elastic License 2.0 OR AGPL-3.0-only OR SSPL-1.0"
+}

src/platform/packages/shared/kbn-test-saml-auth/src/fetch_kibana_version.test.ts

@@ -0,0 +1,71 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import axios from 'axios';
+import { ToolingLog } from '@kbn/tooling-log';
+import { fetchKibanaVersionHeaderString } from './fetch_kibana_version';
+
+jest.mock('axios');
+const mockedAxios = axios as jest.Mocked<typeof axios>;
+
+describe('fetchKibanaVersionHeaderString', () => {
+  const log = new ToolingLog();
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+  });
+
+  test('returns version.number and appends -SNAPSHOT when build_snapshot is true', async () => {
+    mockedAxios.request.mockResolvedValue({
+      data: {
+        version: { number: '9.0.0', build_snapshot: true },
+      },
+    });
+
+    const v = await fetchKibanaVersionHeaderString(
+      'https://localhost:5601',
+      'elastic',
+      'changeme',
+      log
+    );
+
+    expect(v).toBe('9.0.0-SNAPSHOT');
+    expect(mockedAxios.request).toHaveBeenCalledTimes(1);
+    expect(mockedAxios.request).toHaveBeenCalledWith(
+      expect.objectContaining({
+        method: 'GET',
+        auth: { username: 'elastic', password: 'changeme' },
+        validateStatus: expect.any(Function),
+      })
+    );
+    const callUrl = mockedAxios.request.mock.calls[0][0].url as string;
+    expect(callUrl).toContain('/api/status');
+    expect(callUrl).toContain('v8format=true');
+  });
+
+  test('throws when version is missing from response body', async () => {
+    mockedAxios.request.mockResolvedValue({ data: {} });
+
+    await expect(
+      fetchKibanaVersionHeaderString('http://localhost:5601', 'u', 'p', log)
+    ).rejects.toThrow(/Unable to get version from Kibana/);
+
+    expect(mockedAxios.request).toHaveBeenCalledTimes(1);
+  });
+
+  test('propagates axios errors after a single attempt', async () => {
+    mockedAxios.request.mockRejectedValue(new Error('network down'));
+
+    await expect(
+      fetchKibanaVersionHeaderString('http://localhost:5601', 'u', 'p', log)
+    ).rejects.toThrow('network down');
+
+    expect(mockedAxios.request).toHaveBeenCalledTimes(1);
+  });
+});

src/platform/packages/shared/kbn-test-saml-auth/src/fetch_kibana_version.ts

@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import https from 'https';
+import axios from 'axios';
+import type { ToolingLog } from '@kbn/tooling-log';
+
+interface KibanaStatusResponse {
+  version?: {
+    number: string;
+    build_snapshot: boolean;
+  };
+}
+
+/**
+ * Fetches Kibana version string in the same shape as @kbn/kbn-client KbnClientVersion.get()
+ * (for use as the `kbn-version` header on SAML requests). Single GET to `/api/status`; no retries.
+ */
+export async function fetchKibanaVersionHeaderString(
+  kbnBaseUrl: string,
+  username: string,
+  password: string,
+  log: ToolingLog
+): Promise<string> {
+  const base = kbnBaseUrl.endsWith('/') ? kbnBaseUrl : `${kbnBaseUrl}/`;
+  const url = new URL('api/status', base);
+  url.searchParams.set('v8format', 'true');
+
+  const isHttps = url.protocol === 'https:';
+  const httpsAgent = isHttps
+    ? new https.Agent({
+        rejectUnauthorized: false,
+      })
+    : undefined;
+
+  log.debug(`Fetching Kibana version from ${url.origin}/api/status`);
+
+  const response = await axios.request<KibanaStatusResponse>({
+    method: 'GET',
+    url: url.toString(),
+    auth: { username, password },
+    headers: {
+      'kbn-xsrf': 'kbn-client',
+      'x-elastic-internal-origin': 'kbn-client',
+    },
+    httpsAgent,
+    validateStatus: (status: number) => status === 200 || status === 503,
+  });
+
+  const data = response.data;
+  if (!data?.version) {
+    throw new Error(
+      `Unable to get version from Kibana, invalid response from server: ${JSON.stringify(data)}`
+    );
+  }
+
+  return data.version.number + (data.version.build_snapshot ? '-SNAPSHOT' : '');
+}