[8.16] [ML] API tests for ML's _has_privileges (#197274) (#197371)

# Backport

This will backport the following commits from `main` to `8.16`:
- [[ML] API tests for ML's _has_privileges
(#197274)](https://github.com/elastic/kibana/pull/197274)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"James
Gowdy","email":"jgowdy@elastic.co"},"sourceCommit":{"committedDate":"2024-10-23T07:57:46Z","message":"[ML]
API tests for ML's _has_privileges (#197274)\n\nCalls ML's
`_has_privileges` endpoint with various users.\r\nAlso ensures upgrade
mode status is correctly
returned.","sha":"fc812e33d85691d76e657f8056b18d79a9f860b1","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["non-issue",":ml","release_note:skip","v9.0.0","v8.16.0","backport:version","v8.17.0"],"title":"[ML]
API tests for ML's
_has_privileges","number":197274,"url":"https://github.com/elastic/kibana/pull/197274","mergeCommit":{"message":"[ML]
API tests for ML's _has_privileges (#197274)\n\nCalls ML's
`_has_privileges` endpoint with various users.\r\nAlso ensures upgrade
mode status is correctly
returned.","sha":"fc812e33d85691d76e657f8056b18d79a9f860b1"}},"sourceBranch":"main","suggestedTargetBranches":["8.16","8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/197274","number":197274,"mergeCommit":{"message":"[ML]
API tests for ML's _has_privileges (#197274)\n\nCalls ML's
`_has_privileges` endpoint with various users.\r\nAlso ensures upgrade
mode status is correctly
returned.","sha":"fc812e33d85691d76e657f8056b18d79a9f860b1"}},{"branch":"8.16","label":"v8.16.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.x","label":"v8.17.0","branchLabelMappingKey":"^v8.17.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: James Gowdy <jgowdy@elastic.co>

x-pack/test/api_integration/apis/ml/system/has_privileges.ts

@@ -0,0 +1,143 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import expect from '@kbn/expect';
+
+import { MlHasPrivilegesResponse } from '@kbn/ml-plugin/public/application/services/ml_api_service';
+import { FtrProviderContext } from '../../../ftr_provider_context';
+import { getCommonRequestHeader } from '../../../../functional/services/ml/common_api';
+import { USER } from '../../../../functional/services/ml/security_common';
+
+export default ({ getService }: FtrProviderContext) => {
+  const esArchiver = getService('esArchiver');
+  const supertest = getService('supertestWithoutAuth');
+  const ml = getService('ml');
+
+  async function runRequest(
+    user: USER,
+    index: any,
+    expectedStatusCode = 200
+  ): Promise<MlHasPrivilegesResponse> {
+    const { body, status } = await supertest
+      .post(`/internal/ml/_has_privileges`)
+      .auth(user, ml.securityCommon.getPasswordForUser(user))
+      .set(getCommonRequestHeader('1'))
+      .send({ index });
+    ml.api.assertResponseStatusCode(expectedStatusCode, status, body);
+
+    return body;
+  }
+
+  const testData = [
+    {
+      user: USER.ML_POWERUSER,
+      index: [
+        {
+          names: ['ft_farequote_small'],
+          privileges: ['read'],
+        },
+        {
+          names: ['ft_farequote_small'],
+          privileges: ['write'],
+        },
+      ],
+      expectedResponse: {
+        hasPrivileges: {
+          username: 'ft_ml_poweruser',
+          has_all_requested: false,
+          cluster: {},
+          index: {
+            ft_farequote_small: {
+              read: true,
+              write: false,
+            },
+          },
+          application: {},
+        },
+        upgradeInProgress: false,
+      },
+      expectedStatusCode: 200,
+    },
+    {
+      user: USER.ML_VIEWER,
+      index: [
+        {
+          names: ['ft_farequote_small'],
+          privileges: ['read'],
+        },
+        {
+          names: ['ft_farequote_small'],
+          privileges: ['write'],
+        },
+      ],
+      expectedResponse: {
+        hasPrivileges: {
+          username: 'ft_ml_viewer',
+          has_all_requested: false,
+          cluster: {},
+          index: {
+            ft_farequote_small: {
+              read: true,
+              write: false,
+            },
+          },
+          application: {},
+        },
+        upgradeInProgress: false,
+      },
+
+      expectedStatusCode: 200,
+    },
+    {
+      user: USER.ML_UNAUTHORIZED,
+      index: [
+        {
+          names: ['ft_farequote_small'],
+          privileges: ['read'],
+        },
+        {
+          names: ['ft_farequote_small'],
+          privileges: ['write'],
+        },
+      ],
+      expectedResponse: { statusCode: 403, error: 'Forbidden', message: 'Forbidden' },
+      expectedStatusCode: 403,
+    },
+  ];
+
+  describe("ML's _has_privileges", () => {
+    before(async () => {
+      await esArchiver.loadIfNeeded('x-pack/test/functional/es_archives/ml/farequote_small');
+    });
+    after(async () => {
+      await ml.api.setUpgradeMode(false);
+    });
+
+    it('should return correct privileges for test data', async () => {
+      for (const { user, index, expectedResponse, expectedStatusCode } of testData) {
+        const response = await runRequest(user, index, expectedStatusCode);
+        expect(response).to.eql(
+          expectedResponse,
+          `expected ${JSON.stringify(expectedResponse)}, got ${JSON.stringify(response)}`
+        );
+      }
+    });
+
+    it('should return correct upgrade in progress', async () => {
+      const index = testData[0].index;
+      const expectedResponse = { ...testData[0].expectedResponse, upgradeInProgress: true };
+      await ml.api.setUpgradeMode(true);
+      await ml.api.assertUpgradeMode(true);
+
+      const response = await runRequest(USER.ML_POWERUSER, index);
+      expect(response).to.eql(
+        expectedResponse,
+        `expected ${JSON.stringify(expectedResponse)}, got ${JSON.stringify(response)}`
+      );
+    });
+  });
+};

x-pack/test/api_integration/apis/ml/system/index.ts

@@ -14,5 +14,6 @@ export default function ({ loadTestFile }: FtrProviderContext) {
     loadTestFile(require.resolve('./index_exists'));
     loadTestFile(require.resolve('./info'));
     loadTestFile(require.resolve('./node_count'));
+    loadTestFile(require.resolve('./has_privileges'));
   });
 }

x-pack/test/functional/services/ml/api.ts

@@ -1696,5 +1696,33 @@ export function MachineLearningAPIProvider({ getService }: FtrProviderContext) {
       this.assertResponseStatusCode(200, status, module);
       return module;
     },
+
+    async setUpgradeMode(enabled: boolean) {
+      log.debug(`Setting upgrade mode to "${enabled}"`);
+      const { body, status } = await esSupertest.post(`/_ml/set_upgrade_mode?enabled=${enabled}`);
+      this.assertResponseStatusCode(200, status, body);
+
+      log.debug(`Upgrade mode set to "${enabled}"`);
+    },
+
+    async assertUpgradeMode(expectedMode: boolean) {
+      log.debug(`Asserting upgrade mode is "${expectedMode}"`);
+      const { body, status } = await esSupertest.get('/_ml/info');
+      this.assertResponseStatusCode(200, status, body);
+
+      expect(body.upgrade_mode).to.eql(
+        expectedMode,
+        `Expected upgrade mode to be ${expectedMode}, got ${body.upgrade_mode}`
+      );
+    },
+
+    async getMlInfo() {
+      log.debug(`Getting ML info`);
+      const { body, status } = await kbnSupertest
+        .get(`/internal/ml/info`)
+        .set(getCommonRequestHeader('1'));
+      this.assertResponseStatusCode(200, status, body);
+      return body;
+    },
   };
 }