Disable private tenant for read only users

[hsiang9431-amzn]

opensearch-project/security-dashboards-plugin pull request intake form

Please provide as much details as possible to get feedback/acceptance on your PR quickly

1. Category: (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)

Bug fix

2. Github Issue # or road-map entry, if available:

#812

3. Description of changes:

If a user has a role that is configured as "read only" in opensearch_dashboards.yml, or if a user has the default read only role "kibana_read_only", make Dashboards behave as if the private tenant is disabled. You cannot choose "Private" in the tenant switch panel anymore, and a descriptive text is displayed in the tenant switch panel.

4. Why these changes are required?

If a user has a read only role, offering the possibility to use the private tenant does not make much sense. The read only role implies that only read operations are allowed. Since no one other as the current user is able to access the private tenant, but due to read only the current user is also not allowed to make any changes, selecting the private tenant in this situation is useless.

5. What is the old behavior before changes and new behavior after changes? (Please add any example/logs/screen-shot if available)

If a user has a read only role, the tenant switch panel would still allow to choose the private tenant.

6. Testing done: (Please provide details of testing done: Unit testing, integration testing and manual testing)

Added additional tests to password-reset-panel.test.tsx. Manual testing for different combinations of roles and read only roles.

7. TO-DOs, if any: (Please describe pending items and provide Github issues# for each of them)

None.

8. Is it backport from main branch? (If yes, please add backport PR # and commits #)

No.

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I
have the right to submit it under the open source license
indicated in the file; or

(b) The contribution is based upon previous work that, to the best
of my knowledge, is covered under an appropriate open source
license and I have the right under that license to submit that
work with modifications, whether created in whole or in part
by me, under the same open source license (unless I am
permitted to submit under a different license), as indicated
in the file; or

(c) The contribution was provided directly to me by some other
person who certified (a), (b) or (c) and I have not modified
it.

(d) I understand and agree that this project and the contribution
are public and that a record of the contribution (including all
personal information I submit with it, including my sign-off) is
maintained indefinitely and may be redistributed consistent with
this project or the open source license(s) involved.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[peternied]

Thanks for the new functional test, could you please add unit test for the behavior in tenant_resolver.ts so your change in that file gets test coverage?

[codecov-commenter]

Codecov Report

Merging #868 (d20d292) into main (c19b01f) will increase coverage by 0.11%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main     #868      +/-   ##
==========================================
+ Coverage   72.10%   72.21%   +0.11%     
==========================================
  Files          87       87              
  Lines        1907     1915       +8     
  Branches      247      249       +2     
==========================================
+ Hits         1375     1383       +8     
  Misses        478      478              
  Partials       54       54              

Impacted Files	Coverage Δ
...plugin/public/apps/account/tenant-switch-panel.tsx	91.11% <0.00%> (+0.86%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c19b01f...d20d292. Read the comment docs.

[cliu123]

I've rebased this PR against main branch.
@opensearch-project/security Please review.

[peternied]

Thanks for the updates