[Osquery] Remove agent policy reference from pack on integration deletion (#122082) (#123163)

(cherry picked from commit 426ac6a012)

Co-authored-by: Tomasz Ciecierski <tomasz.ciecierski@elastic.co>

x-pack/plugins/fleet/common/types/rest_spec/package_policy.ts

@@ -56,6 +56,7 @@ export type DeletePackagePoliciesResponse = Array<{
   name?: string;
   success: boolean;
   package?: PackagePolicyPackage;
+  policy_id?: string;
 }>;
 
 export interface UpgradePackagePolicyBaseResponse {

x-pack/plugins/fleet/server/services/package_policy.ts

@@ -489,6 +489,7 @@ class PackagePolicyService {
             title: packagePolicy.package?.title || '',
             version: packagePolicy.package?.version || '',
           },
+          policy_id: packagePolicy.policy_id,
         });
       } catch (error) {
         result.push({

x-pack/plugins/osquery/cypress/integration/superuser/packs.spec.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { navigateTo } from '../../tasks/navigation';
+import { FLEET_AGENT_POLICIES, navigateTo } from '../../tasks/navigation';
 import {
   deleteAndConfirm,
   findAndClickButton,
@@ -15,8 +15,10 @@ import {
 import { login } from '../../tasks/login';
 import { ArchiverMethod, runKbnArchiverScript } from '../../tasks/archiver';
 import { preparePack } from '../../tasks/packs';
+import { addIntegration, closeModalIfVisible } from '../../tasks/integrations';
 
 describe('SuperUser - Packs', () => {
+  const integration = 'Osquery Manager';
   const SAVED_QUERY_ID = 'Saved-Query-Id';
   const PACK_NAME = 'Pack-name';
   const NEW_QUERY_NAME = 'new-query-name';
@@ -77,7 +79,7 @@ describe('SuperUser - Packs', () => {
       findAndClickButton('Save and deploy changes');
     });
     // THIS TESTS TAKES TOO LONG FOR NOW - LET ME THINK IT THROUGH
-    it('to click the icon and visit discover', () => {
+    it.skip('to click the icon and visit discover', () => {
       preparePack(PACK_NAME, SAVED_QUERY_ID);
       cy.react('CustomItemAction', {
         props: { index: 0, item: { id: SAVED_QUERY_ID } },
@@ -149,6 +151,52 @@ describe('SuperUser - Packs', () => {
       deleteAndConfirm('pack');
     });
   });
+  describe('Validate that agent is getting removed from pack if we remove agent', () => {
+    beforeEach(() => {
+      login();
+    });
+    const AGENT_NAME = 'PackTest';
+    const REMOVING_PACK = 'removing-pack';
+    it('add integration', () => {
+      cy.visit(FLEET_AGENT_POLICIES);
+      cy.contains('Create agent policy').click();
+      cy.get('input[placeholder*="Choose a name"]').type(AGENT_NAME);
+      cy.get('.euiFlyoutFooter').contains('Create agent policy').click();
+      cy.contains(`Agent policy '${AGENT_NAME}' created`);
+      cy.visit(FLEET_AGENT_POLICIES);
+      cy.contains('Default Fleet Server policy').click();
+      cy.contains('Add integration').click();
+      cy.contains(integration).click();
+      addIntegration(AGENT_NAME);
+      cy.contains('Add Elastic Agent later').click();
+      navigateTo('app/osquery/packs');
+      findAndClickButton('Add pack');
+      findFormFieldByRowsLabelAndType('Name', REMOVING_PACK);
+      findFormFieldByRowsLabelAndType('Scheduled agent policies (optional)', AGENT_NAME);
+      findAndClickButton('Save pack');
+
+      cy.getBySel('toastCloseButton').click();
+      cy.contains(REMOVING_PACK).click();
+      cy.contains(`${REMOVING_PACK} details`);
+      findAndClickButton('Edit');
+      cy.react('EuiComboBoxInput', { props: { value: AGENT_NAME } }).should('exist');
+
+      cy.visit(FLEET_AGENT_POLICIES);
+      cy.contains(AGENT_NAME).click();
+      cy.get('.euiTableCellContent')
+        .get('.euiPopover__anchor')
+        .get(`[aria-label="Open"]`)
+        .first()
+        .click();
+      cy.contains(/^Delete integration$/).click();
+      closeModalIfVisible();
+      navigateTo('app/osquery/packs');
+      cy.contains(REMOVING_PACK).click();
+      cy.contains(`${REMOVING_PACK} details`);
+      findAndClickButton('Edit');
+      cy.react('EuiComboBoxInput', { props: { value: '' } }).should('exist');
+    });
+  });
   describe.skip('Remove queries from pack', () => {
     const TEST_PACK = 'Test-pack';
     before(() => {

x-pack/plugins/osquery/cypress/tasks/integrations.ts

@@ -13,14 +13,13 @@ import {
   DATA_COLLECTION_SETUP_STEP,
 } from '../screens/integrations';
 
-export const addIntegration = () => {
+export const addIntegration = (agent = 'Default fleet') => {
   cy.getBySel(ADD_POLICY_BTN).click();
   cy.getBySel(DATA_COLLECTION_SETUP_STEP).find('.euiLoadingSpinner').should('not.exist');
-  cy.getBySel('comboBoxInput').click().type('Default fleet {downArrow} {enter}');
+  cy.getBySel('comboBoxInput').click().type(`${agent} {downArrow} {enter}`);
   cy.getBySel(CREATE_PACKAGE_POLICY_SAVE_BTN).click();
   // sometimes agent is assigned to default policy, sometimes not
   closeModalIfVisible();
-  cy.getBySel(CREATE_PACKAGE_POLICY_SAVE_BTN, { timeout: 60000 }).should('not.exist');
 };
 
 export function closeModalIfVisible() {

x-pack/plugins/osquery/server/lib/fleet_integration.ts

@@ -0,0 +1,54 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SavedObjectReference, SavedObjectsClient } from 'kibana/server';
+import { filter, map } from 'lodash';
+import { packSavedObjectType } from '../../common/types';
+import { PostPackagePolicyDeleteCallback } from '../../../fleet/server';
+import { AGENT_POLICY_SAVED_OBJECT_TYPE } from '../../../fleet/common';
+import { OSQUERY_INTEGRATION_NAME } from '../../common';
+
+export const getPackagePolicyDeleteCallback =
+  (packsClient: SavedObjectsClient): PostPackagePolicyDeleteCallback =>
+  async (deletedPackagePolicy) => {
+    const deletedOsqueryManagerPolicies = filter(deletedPackagePolicy, [
+      'package.name',
+      OSQUERY_INTEGRATION_NAME,
+    ]);
+    await Promise.all(
+      map(deletedOsqueryManagerPolicies, async (deletedOsqueryManagerPolicy) => {
+        if (deletedOsqueryManagerPolicy.policy_id) {
+          const foundPacks = await packsClient.find({
+            type: packSavedObjectType,
+            hasReference: {
+              type: AGENT_POLICY_SAVED_OBJECT_TYPE,
+              id: deletedOsqueryManagerPolicy.policy_id,
+            },
+            perPage: 1000,
+          });
+
+          await Promise.all(
+            map(
+              foundPacks.saved_objects,
+              (pack: { id: string; references: SavedObjectReference[] }) =>
+                packsClient.update(
+                  packSavedObjectType,
+                  pack.id,
+                  {},
+                  {
+                    references: filter(
+                      pack.references,
+                      (reference) => reference.id !== deletedOsqueryManagerPolicy.policy_id
+                    ),
+                  }
+                )
+            )
+          );
+        }
+      })
+    );
+  };

x-pack/plugins/osquery/server/plugin.ts

@@ -18,8 +18,10 @@ import {
   CoreStart,
   Plugin,
   Logger,
+  SavedObjectsClient,
   DEFAULT_APP_CATEGORIES,
 } from '../../../../src/core/server';
+
 import { createConfig } from './create_config';
 import { OsqueryPluginSetup, OsqueryPluginStart, SetupPlugins, StartPlugins } from './types';
 import { defineRoutes } from './routes';
@@ -30,6 +32,7 @@ import { OsqueryAppContext, OsqueryAppContextService } from './lib/osquery_app_c
 import { ConfigType } from './config';
 import { packSavedObjectType, savedQuerySavedObjectType } from '../common/types';
 import { PLUGIN_ID } from '../common';
+import { getPackagePolicyDeleteCallback } from './lib/fleet_integration';
 
 const registerFeatures = (features: SetupPlugins['features']) => {
   features.registerKibanaFeature({
@@ -257,6 +260,11 @@ export class OsqueryPlugin implements Plugin<OsqueryPluginSetup, OsqueryPluginSt
       registerIngestCallback,
     });
 
+    if (registerIngestCallback) {
+      const client = new SavedObjectsClient(core.savedObjects.createInternalRepository());
+
+      registerIngestCallback('postPackagePolicyDelete', getPackagePolicyDeleteCallback(client));
+    }
     return {};
   }