Add tests to ensure AAD isn't broken after performing a change on an alert / action (#53333)

x-pack/legacy/plugins/alerting/server/plugin.ts

@@ -71,7 +71,7 @@ export class Plugin {
       attributesToEncrypt: new Set(['apiKey']),
       attributesToExcludeFromAAD: new Set([
         'scheduledTaskId',
-        'muted',
+        'muteAll',
         'mutedInstanceIds',
         'updatedBy',
       ]),

x-pack/test/alerting_api_integration/common/config.ts

@@ -78,6 +78,7 @@ export function createTestConfig(name: string, options: CreateTestConfigOptions)
           `--plugin-path=${path.join(__dirname, 'fixtures', 'plugins', 'alerts')}`,
           `--plugin-path=${path.join(__dirname, 'fixtures', 'plugins', 'actions')}`,
           `--plugin-path=${path.join(__dirname, 'fixtures', 'plugins', 'task_manager')}`,
+          `--plugin-path=${path.join(__dirname, 'fixtures', 'plugins', 'aad')}`,
           `--server.xsrf.whitelist=${JSON.stringify(getAllExternalServiceSimulatorPaths())}`,
           ...(ssl
             ? [

x-pack/test/alerting_api_integration/common/fixtures/plugins/aad/index.ts

@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Joi from 'joi';
+import Hapi from 'hapi';
+import { Legacy } from 'kibana';
+import KbnServer from '../../../../../../../src/legacy/server/kbn_server';
+import { PluginStartContract } from '../../../../../../plugins/encrypted_saved_objects/server';
+
+interface CheckAADRequest extends Hapi.Request {
+  payload: {
+    spaceId?: string;
+    type: string;
+    id: string;
+  };
+}
+
+// eslint-disable-next-line import/no-default-export
+export default function(kibana: any) {
+  return new kibana.Plugin({
+    require: ['actions', 'alerting', 'encryptedSavedObjects'],
+    name: 'aad-fixtures',
+    init(server: Legacy.Server) {
+      const newPlatform = ((server as unknown) as KbnServer).newPlatform;
+      const esoPlugin = newPlatform.start.plugins.encryptedSavedObjects as PluginStartContract;
+
+      server.route({
+        method: 'POST',
+        path: '/api/check_aad',
+        options: {
+          validate: {
+            payload: Joi.object()
+              .keys({
+                spaceId: Joi.string().optional(),
+                type: Joi.string().required(),
+                id: Joi.string().required(),
+              })
+              .required(),
+          },
+        },
+        async handler(request: CheckAADRequest) {
+          let namespace: string | undefined;
+          const spacesPlugin = server.plugins.spaces;
+          if (spacesPlugin && request.payload.spaceId) {
+            namespace = spacesPlugin.spaceIdToNamespace(request.payload.spaceId);
+          }
+          await esoPlugin.getDecryptedAsInternalUser(request.payload.type, request.payload.id, {
+            namespace,
+          });
+          return { success: true };
+        },
+      });
+    },
+  });
+}

x-pack/test/alerting_api_integration/common/fixtures/plugins/aad/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "aad-fixtures",
+  "version": "0.0.0",
+  "kibana": {
+    "version": "kibana"
+  }
+}

x-pack/test/alerting_api_integration/common/lib/check_aad.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+interface Opts {
+  supertest: any;
+  spaceId?: string;
+  type: string;
+  id: string;
+}
+
+export async function checkAAD({ supertest, spaceId, type, id }: Opts) {
+  await supertest
+    .post('/api/check_aad')
+    .set('kbn-xsrf', 'foo')
+    .send({ spaceId, type, id })
+    .expect(200, { success: true });
+}

x-pack/test/alerting_api_integration/common/lib/index.ts

@@ -10,3 +10,4 @@ export { ES_TEST_INDEX_NAME, ESTestIndexTool } from './es_test_index_tool';
 export { getTestAlertData } from './get_test_alert_data';
 export { AlertUtils } from './alert_utils';
 export { TaskManagerUtils } from './task_manager_utils';
+export { checkAAD } from './check_aad';

x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/create.ts

@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { getUrlPrefix, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getUrlPrefix, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -52,6 +52,7 @@ export default function createActionTests({ getService }: FtrProviderContext) {
             case 'superuser at space1':
             case 'space_1_all at space1':
               expect(response.statusCode).to.eql(200);
+              objectRemover.add(space.id, response.body.id, 'action');
               expect(response.body).to.eql({
                 id: response.body.id,
                 name: 'My action',
@@ -61,7 +62,13 @@ export default function createActionTests({ getService }: FtrProviderContext) {
                 },
               });
               expect(typeof response.body.id).to.be('string');
-              objectRemover.add(space.id, response.body.id, 'action');
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'action',
+                id: response.body.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/update.ts

@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { getUrlPrefix, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getUrlPrefix, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -75,6 +75,13 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
                   unencrypted: `This value shouldn't get encrypted`,
                 },
               });
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'action',
+                id: createdAction.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts

@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { getTestAlertData, getUrlPrefix, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getTestAlertData, getUrlPrefix, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -106,6 +106,13 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
                 alertId: response.body.id,
                 spaceId: space.id,
               });
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: response.body.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/disable.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createDisableAlertTests({ getService }: FtrProviderContext) {
@@ -65,6 +71,13 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
               } catch (e) {
                 expect(e.status).to.eql(404);
               }
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/enable.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createEnableAlertTests({ getService }: FtrProviderContext) {
@@ -70,6 +76,13 @@ export default function createEnableAlertTests({ getService }: FtrProviderContex
                 alertId: createdAlert.id,
                 spaceId: space.id,
               });
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_all.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createMuteAlertTests({ getService }: FtrProviderContext) {
@@ -55,6 +61,13 @@ export default function createMuteAlertTests({ getService }: FtrProviderContext)
                 .auth(user.username, user.password)
                 .expect(200);
               expect(updatedAlert.muteAll).to.eql(true);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_instance.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createMuteAlertInstanceTests({ getService }: FtrProviderContext) {
@@ -55,6 +61,13 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider
                 .auth(user.username, user.password)
                 .expect(200);
               expect(updatedAlert.mutedInstanceIds).to.eql(['1']);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_all.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createUnmuteAlertTests({ getService }: FtrProviderContext) {
@@ -60,6 +66,13 @@ export default function createUnmuteAlertTests({ getService }: FtrProviderContex
                 .auth(user.username, user.password)
                 .expect(200);
               expect(updatedAlert.muteAll).to.eql(false);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_instance.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createMuteAlertInstanceTests({ getService }: FtrProviderContext) {
@@ -60,6 +66,13 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider
                 .auth(user.username, user.password)
                 .expect(200);
               expect(updatedAlert.mutedInstanceIds).to.eql([]);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts

@@ -7,7 +7,7 @@
 import expect from '@kbn/expect';
 import { Response as SupertestResponse } from 'supertest';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -82,6 +82,13 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
                 mutedInstanceIds: [],
                 scheduledTaskId: createdAlert.scheduledTaskId,
               });
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update_api_key.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createUpdateApiKeyTests({ getService }: FtrProviderContext) {
@@ -55,6 +61,13 @@ export default function createUpdateApiKeyTests({ getService }: FtrProviderConte
                 .auth(user.username, user.password)
                 .expect(200);
               expect(updatedAlert.apiKeyOwner).to.eql(user.username);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/spaces_only/tests/actions/create.ts

@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { Spaces } from '../../scenarios';
-import { getUrlPrefix, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getUrlPrefix, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -34,6 +34,7 @@ export default function createActionTests({ getService }: FtrProviderContext) {
         });
 
       expect(response.statusCode).to.eql(200);
+      objectRemover.add(Spaces.space1.id, response.body.id, 'action');
       expect(response.body).to.eql({
         id: response.body.id,
         name: 'My action',
@@ -43,7 +44,14 @@ export default function createActionTests({ getService }: FtrProviderContext) {
         },
       });
       expect(typeof response.body.id).to.be('string');
-      objectRemover.add(Spaces.space1.id, response.body.id, 'action');
+
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest,
+        spaceId: Spaces.space1.id,
+        type: 'action',
+        id: response.body.id,
+      });
     });
   });
 }

x-pack/test/alerting_api_integration/spaces_only/tests/actions/update.ts

@@ -5,7 +5,7 @@
  */
 
 import { Spaces } from '../../scenarios';
-import { getUrlPrefix, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getUrlPrefix, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -54,6 +54,14 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
             unencrypted: `This value shouldn't get encrypted`,
           },
         });
+
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest,
+        spaceId: Spaces.space1.id,
+        type: 'action',
+        id: createdAction.id,
+      });
     });
 
     it(`shouldn't update action from another space`, async () => {

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/create.ts

@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { Spaces } from '../../scenarios';
-import { getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -88,6 +88,13 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
         alertId: response.body.id,
         spaceId: Spaces.space1.id,
       });
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest,
+        spaceId: Spaces.space1.id,
+        type: 'alert',
+        id: response.body.id,
+      });
     });
 
     it('should handle create alert request appropriately when an alert is disabled ', async () => {

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/disable.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { Spaces } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createDisableAlertTests({ getService }: FtrProviderContext) {
@@ -43,6 +49,14 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
       } catch (e) {
         expect(e.status).to.eql(404);
       }
+
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest: supertestWithoutAuth,
+        spaceId: Spaces.space1.id,
+        type: 'alert',
+        id: createdAlert.id,
+      });
     });
 
     it(`shouldn't disable alert from another space`, async () => {

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/enable.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { Spaces } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createEnableAlertTests({ getService }: FtrProviderContext) {
@@ -49,6 +55,14 @@ export default function createEnableAlertTests({ getService }: FtrProviderContex
         alertId: createdAlert.id,
         spaceId: Spaces.space1.id,
       });
+
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest: supertestWithoutAuth,
+        spaceId: Spaces.space1.id,
+        type: 'alert',
+        id: createdAlert.id,
+      });
     });
 
     it(`shouldn't enable alert from another space`, async () => {

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/mute_all.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { Spaces } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createMuteTests({ getService }: FtrProviderContext) {
@@ -34,6 +40,14 @@ export default function createMuteTests({ getService }: FtrProviderContext) {
         .set('kbn-xsrf', 'foo')
         .expect(200);
       expect(updatedAlert.muteAll).to.eql(true);
+
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest: supertestWithoutAuth,
+        spaceId: Spaces.space1.id,
+        type: 'alert',
+        id: createdAlert.id,
+      });
     });
   });
 }

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/mute_instance.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { Spaces } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createMuteInstanceTests({ getService }: FtrProviderContext) {
@@ -34,6 +40,14 @@ export default function createMuteInstanceTests({ getService }: FtrProviderConte
         .set('kbn-xsrf', 'foo')
         .expect(200);
       expect(updatedAlert.mutedInstanceIds).to.eql(['1']);
+
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest: supertestWithoutAuth,
+        spaceId: Spaces.space1.id,
+        type: 'alert',
+        id: createdAlert.id,
+      });
     });
   });
 }

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/unmute_all.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { Spaces } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createUnmuteTests({ getService }: FtrProviderContext) {
@@ -35,6 +41,14 @@ export default function createUnmuteTests({ getService }: FtrProviderContext) {
         .set('kbn-xsrf', 'foo')
         .expect(200);
       expect(updatedAlert.muteAll).to.eql(false);
+
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest: supertestWithoutAuth,
+        spaceId: Spaces.space1.id,
+        type: 'alert',
+        id: createdAlert.id,
+      });
     });
   });
 }

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/unmute_instance.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { Spaces } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createUnmuteInstanceTests({ getService }: FtrProviderContext) {
@@ -35,6 +41,14 @@ export default function createUnmuteInstanceTests({ getService }: FtrProviderCon
         .set('kbn-xsrf', 'foo')
         .expect(200);
       expect(updatedAlert.mutedInstanceIds).to.eql([]);
+
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest: supertestWithoutAuth,
+        spaceId: Spaces.space1.id,
+        type: 'alert',
+        id: createdAlert.id,
+      });
     });
   });
 }

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update.ts

@@ -5,7 +5,7 @@
  */
 
 import { Spaces } from '../../scenarios';
-import { getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -53,6 +53,14 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
           mutedInstanceIds: [],
           scheduledTaskId: createdAlert.scheduledTaskId,
         });
+
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest,
+        spaceId: Spaces.space1.id,
+        type: 'alert',
+        id: createdAlert.id,
+      });
     });
 
     it(`shouldn't update alert from another space`, async () => {

x-pack/test/alerting_api_integration/spaces_only/tests/alerting/update_api_key.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { Spaces } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 /**
  * Eventhough security is disabled, this test checks the API behavior.
@@ -38,6 +44,14 @@ export default function createUpdateApiKeyTests({ getService }: FtrProviderConte
         .set('kbn-xsrf', 'foo')
         .expect(200);
       expect(updatedAlert.apiKeyOwner).to.eql(null);
+
+      // Ensure AAD isn't broken
+      await checkAAD({
+        supertest: supertestWithoutAuth,
+        spaceId: Spaces.space1.id,
+        type: 'alert',
+        id: createdAlert.id,
+      });
     });
 
     it(`shouldn't update alert api key from another space`, async () => {