Skip to content

[ML] Adding endpoint capability checks #64662

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Apr 29, 2020
Merged

[ML] Adding endpoint capability checks #64662

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
0a82531
[ML] Adding endpoint capability checks
jgowdyelastic Apr 28, 2020
de1f763
adding missing capability checks
jgowdyelastic Apr 28, 2020
5516436
fixing test
jgowdyelastic Apr 28, 2020
a92d6e3
removing commented code
jgowdyelastic Apr 28, 2020
ba394c1
Merge branch 'master' into adding-endpoint-capability-checks
elasticmachine Apr 28, 2020
2909a93
fixing functional test
jgowdyelastic Apr 29, 2020
191cfad
Merge branch 'adding-endpoint-capability-checks' of github.com:jgowdy…
jgowdyelastic Apr 29, 2020
d70f40d
fixing functional tests
jgowdyelastic Apr 29, 2020
a9f0df1
changes based on review
jgowdyelastic Apr 29, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 22 additions & 2 deletions x-pack/plugins/ml/common/types/capabilities.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
import { KibanaRequest } from 'kibana/server';

export const userMlCapabilities = {
canAccessML: false,
// Anomaly Detection
canGetJobs: false,
canGetDatafeeds: false,
Expand Down Expand Up @@ -38,16 +39,18 @@ export const adminMlCapabilities = {
canCreateFilter: false,
canDeleteFilter: false,
// Data Frame Analytics
canDeleteDataFrameAnalytics: false,
canCreateDataFrameAnalytics: false,
canDeleteDataFrameAnalytics: false,
canStartStopDataFrameAnalytics: false,
};

export type UserMlCapabilities = typeof userMlCapabilities;
export type AdminMlCapabilities = typeof adminMlCapabilities;
export type MlCapabilities = UserMlCapabilities & AdminMlCapabilities;

export const basicLicenseMlCapabilities = ['canFindFileStructure'] as Array<keyof MlCapabilities>;
export const basicLicenseMlCapabilities = ['canAccessML', 'canFindFileStructure'] as Array<
keyof MlCapabilities
>;

export function getDefaultCapabilities(): MlCapabilities {
return {
Expand All @@ -56,6 +59,23 @@ export function getDefaultCapabilities(): MlCapabilities {
};
}

export function getPluginPrivileges() {
const userMlCapabilitiesKeys = Object.keys(userMlCapabilities);
const adminMlCapabilitiesKeys = Object.keys(adminMlCapabilities);
const allMlCapabilities = [...adminMlCapabilitiesKeys, ...userMlCapabilitiesKeys];

return {
user: {
ui: userMlCapabilitiesKeys,
api: userMlCapabilitiesKeys.map(k => `ml:${k}`),
},
admin: {
ui: allMlCapabilities,
api: allMlCapabilities.map(k => `ml:${k}`),
},
};
}

export interface MlCapabilitiesResponse {
capabilities: MlCapabilities;
upgradeInProgress: boolean;
Expand Down
8 changes: 7 additions & 1 deletion x-pack/plugins/ml/server/lib/capabilities/check_capabilities.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ describe('check_capabilities', () => {
);
const { capabilities } = await getCapabilities();
const count = Object.keys(capabilities).length;
expect(count).toBe(22);
expect(count).toBe(23);
done();
});
});
Expand All @@ -52,6 +52,7 @@ describe('check_capabilities', () => {
const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
expect(upgradeInProgress).toBe(false);
expect(mlFeatureEnabledInSpace).toBe(true);
expect(capabilities.canAccessML).toBe(true);
expect(capabilities.canGetJobs).toBe(true);
expect(capabilities.canCreateJob).toBe(false);
expect(capabilities.canDeleteJob).toBe(false);
Expand Down Expand Up @@ -87,6 +88,7 @@ describe('check_capabilities', () => {
const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
expect(upgradeInProgress).toBe(false);
expect(mlFeatureEnabledInSpace).toBe(true);
expect(capabilities.canAccessML).toBe(true);
expect(capabilities.canGetJobs).toBe(true);
expect(capabilities.canCreateJob).toBe(true);
expect(capabilities.canDeleteJob).toBe(true);
Expand Down Expand Up @@ -122,6 +124,7 @@ describe('check_capabilities', () => {
const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
expect(upgradeInProgress).toBe(true);
expect(mlFeatureEnabledInSpace).toBe(true);
expect(capabilities.canAccessML).toBe(true);
expect(capabilities.canGetJobs).toBe(true);
expect(capabilities.canCreateJob).toBe(false);
expect(capabilities.canDeleteJob).toBe(false);
Expand Down Expand Up @@ -157,6 +160,7 @@ describe('check_capabilities', () => {
const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
expect(upgradeInProgress).toBe(true);
expect(mlFeatureEnabledInSpace).toBe(true);
expect(capabilities.canAccessML).toBe(true);
expect(capabilities.canGetJobs).toBe(true);
expect(capabilities.canCreateJob).toBe(false);
expect(capabilities.canDeleteJob).toBe(false);
Expand Down Expand Up @@ -192,6 +196,7 @@ describe('check_capabilities', () => {
const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
expect(upgradeInProgress).toBe(false);
expect(mlFeatureEnabledInSpace).toBe(false);
expect(capabilities.canAccessML).toBe(false);
expect(capabilities.canGetJobs).toBe(false);
expect(capabilities.canCreateJob).toBe(false);
expect(capabilities.canDeleteJob).toBe(false);
Expand Down Expand Up @@ -228,6 +233,7 @@ describe('check_capabilities', () => {
const { capabilities, upgradeInProgress, mlFeatureEnabledInSpace } = await getCapabilities();
expect(upgradeInProgress).toBe(false);
expect(mlFeatureEnabledInSpace).toBe(false);
expect(capabilities.canAccessML).toBe(false);
expect(capabilities.canGetJobs).toBe(false);
expect(capabilities.canCreateJob).toBe(false);
expect(capabilities.canDeleteJob).toBe(false);
Expand Down
14 changes: 7 additions & 7 deletions x-pack/plugins/ml/server/plugin.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ import { systemRoutes } from './routes/system';
import { MlLicense } from '../common/license';
import { MlServerLicense } from './lib/license';
import { createSharedServices, SharedServices } from './shared_services';
import { userMlCapabilities, adminMlCapabilities } from '../common/types/capabilities';
import { getPluginPrivileges } from '../common/types/capabilities';
import { setupCapabilitiesSwitcher } from './lib/capabilities';
import { registerKibanaSettings } from './lib/register_settings';

Expand Down Expand Up @@ -75,8 +75,7 @@ export class MlServerPlugin implements Plugin<MlPluginSetup, MlPluginStart, Plug
}

public setup(coreSetup: CoreSetup, plugins: PluginsSetup): MlPluginSetup {
const userMlCapabilitiesKeys = Object.keys(userMlCapabilities);
const adminMlCapabilitiesKeys = Object.keys(adminMlCapabilities);
const { user, admin } = getPluginPrivileges();

plugins.features.registerFeature({
id: PLUGIN_ID,
Expand All @@ -98,31 +97,32 @@ export class MlServerPlugin implements Plugin<MlPluginSetup, MlPluginStart, Plug
{
id: 'ml_user',
privilege: {
api: user.api,
app: [PLUGIN_ID, 'kibana'],
catalogue: [PLUGIN_ID],
savedObject: {
all: [],
read: [],
},
ui: userMlCapabilitiesKeys,
ui: user.ui,
},
},
{
id: 'ml_admin',
privilege: {
api: admin.api,
app: [PLUGIN_ID, 'kibana'],
catalogue: [PLUGIN_ID],
savedObject: {
all: [],
read: [],
},
ui: [...adminMlCapabilitiesKeys, ...userMlCapabilitiesKeys],
ui: admin.ui,
},
},
],
},
});

registerKibanaSettings(coreSetup);

this.mlLicense.setup(plugins.licensing.license$, [
Expand Down Expand Up @@ -168,7 +168,7 @@ export class MlServerPlugin implements Plugin<MlPluginSetup, MlPluginStart, Plug
indicesRoutes(routeInit);
jobAuditMessagesRoutes(routeInit);
jobRoutes(routeInit);
jobServiceRoutes(routeInit, { resolveMlCapabilities });
jobServiceRoutes(routeInit);
notificationRoutes(routeInit);
resultsServiceRoutes(routeInit);
jobValidationRoutes(routeInit, this.version);
Expand Down
9 changes: 9 additions & 0 deletions x-pack/plugins/ml/server/routes/annotations.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,9 @@ export function annotationRoutes(
validate: {
body: getAnnotationsSchema,
},
options: {
tags: ['access:ml:canGetJobs'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -86,6 +89,9 @@ export function annotationRoutes(
validate: {
body: indexAnnotationSchema,
},
options: {
tags: ['access:ml:canCreateJob'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -130,6 +136,9 @@ export function annotationRoutes(
validate: {
params: deleteAnnotationSchema,
},
options: {
tags: ['access:ml:canCreateJob'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down
45 changes: 45 additions & 0 deletions x-pack/plugins/ml/server/routes/anomaly_detectors.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
{
path: '/api/ml/anomaly_detectors',
validate: false,
options: {
tags: ['access:ml:canGetJobs'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -65,6 +68,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
validate: {
params: jobIdSchema,
},
options: {
tags: ['access:ml:canGetJobs'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -93,6 +99,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
{
path: '/api/ml/anomaly_detectors/_stats',
validate: false,
options: {
tags: ['access:ml:canGetJobs'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -121,6 +130,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
validate: {
params: jobIdSchema,
},
options: {
tags: ['access:ml:canGetJobs'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -154,6 +166,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
params: jobIdSchema,
body: schema.object(anomalyDetectionJobSchema),
},
options: {
tags: ['access:ml:canCreateJob'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -188,6 +203,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
params: jobIdSchema,
body: anomalyDetectionUpdateJobSchema,
},
options: {
tags: ['access:ml:canUpdateJob'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -220,6 +238,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
validate: {
params: jobIdSchema,
},
options: {
tags: ['access:ml:canOpenJob'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -251,6 +272,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
validate: {
params: jobIdSchema,
},
options: {
tags: ['access:ml:canCloseJob'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -286,6 +310,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
validate: {
params: jobIdSchema,
},
options: {
tags: ['access:ml:canDeleteJob'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -319,6 +346,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
validate: {
body: schema.any(),
},
options: {
tags: ['access:ml:canCreateJob'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -351,6 +381,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
params: jobIdSchema,
body: forecastAnomalyDetector,
},
options: {
tags: ['access:ml:canForecastJob'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -389,6 +422,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
params: jobIdSchema,
body: getRecordsSchema,
},
options: {
tags: ['access:ml:canGetJobs'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -425,6 +461,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
params: getBucketParamsSchema,
body: getBucketsSchema,
},
options: {
tags: ['access:ml:canGetJobs'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -462,6 +501,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
params: jobIdSchema,
body: getOverallBucketsSchema,
},
options: {
tags: ['access:ml:canGetJobs'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down Expand Up @@ -496,6 +538,9 @@ export function jobRoutes({ router, mlLicense }: RouteInitialization) {
validate: {
params: getCategoriesSchema,
},
options: {
tags: ['access:ml:canGetJobs'],
},
},
mlLicense.fullLicenseAPIGuard(async (context, request, response) => {
try {
Expand Down
Loading