kibana/x-pack/plugins/fleet/server/services/agents/reassign.ts

/*
 * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
 * or more contributor license agreements. Licensed under the Elastic License
 * 2.0; you may not use this file except in compliance with the Elastic License
 * 2.0.
 */

import type { SavedObjectsClientContract, ElasticsearchClient } from 'kibana/server';
import Boom from '@hapi/boom';

import type { Agent } from '../../types';
import { agentPolicyService } from '../agent_policy';
import { AgentReassignmentError } from '../../errors';

import { getAgents, getAgentPolicyForAgent, updateAgent, bulkUpdateAgents } from './crud';
import type { GetAgentsOptions } from './index';
import { createAgentAction, bulkCreateAgentActions } from './actions';

export async function reassignAgent(
  soClient: SavedObjectsClientContract,
  esClient: ElasticsearchClient,
  agentId: string,
  newAgentPolicyId: string
) {
  const newAgentPolicy = await agentPolicyService.get(soClient, newAgentPolicyId);
  if (!newAgentPolicy) {
    throw Boom.notFound(`Agent policy not found: ${newAgentPolicyId}`);
  }

  await reassignAgentIsAllowed(soClient, esClient, agentId, newAgentPolicyId);

  await updateAgent(esClient, agentId, {
    policy_id: newAgentPolicyId,
    policy_revision: null,
  });

  await createAgentAction(soClient, esClient, {
    agent_id: agentId,
    created_at: new Date().toISOString(),
    type: 'INTERNAL_POLICY_REASSIGN',
  });
}

export async function reassignAgentIsAllowed(
  soClient: SavedObjectsClientContract,
  esClient: ElasticsearchClient,
  agentId: string,
  newAgentPolicyId: string
) {
  const agentPolicy = await getAgentPolicyForAgent(soClient, esClient, agentId);
  if (agentPolicy?.is_managed) {
    throw new AgentReassignmentError(
      `Cannot reassign an agent from managed agent policy ${agentPolicy.id}`
    );
  }

  const newAgentPolicy = await agentPolicyService.get(soClient, newAgentPolicyId);
  if (newAgentPolicy?.is_managed) {
    throw new AgentReassignmentError(
      `Cannot reassign an agent to managed agent policy ${newAgentPolicy.id}`
    );
  }

  return true;
}

export async function reassignAgents(
  soClient: SavedObjectsClientContract,
  esClient: ElasticsearchClient,
  options: { agents: Agent[] } | GetAgentsOptions,
  newAgentPolicyId: string
): Promise<{ items: Array<{ id: string; success: boolean; error?: Error }> }> {
  const agentPolicy = await agentPolicyService.get(soClient, newAgentPolicyId);
  if (!agentPolicy) {
    throw Boom.notFound(`Agent policy not found: ${newAgentPolicyId}`);
  }

  const allResults = 'agents' in options ? options.agents : await getAgents(esClient, options);
  // which are allowed to unenroll
  const settled = await Promise.allSettled(
    allResults.map((agent) =>
      reassignAgentIsAllowed(soClient, esClient, agent.id, newAgentPolicyId).then((_) => agent)
    )
  );

  // Filter to agents that do not already use the new agent policy ID
  const agentsToUpdate = allResults.filter((agent, index) => {
    if (settled[index].status === 'fulfilled') {
      if (agent.policy_id === newAgentPolicyId) {
        settled[index] = {
          status: 'rejected',
          reason: new AgentReassignmentError(
            `${agent.id} is already assigned to ${newAgentPolicyId}`
          ),
        };
      } else {
        return true;
      }
    }
  });

  const res = await bulkUpdateAgents(
    esClient,
    agentsToUpdate.map((agent) => ({
      agentId: agent.id,
      data: {
        policy_id: newAgentPolicyId,
        policy_revision: null,
      },
    }))
  );

  const now = new Date().toISOString();
  await bulkCreateAgentActions(
    soClient,
    esClient,
    agentsToUpdate.map((agent) => ({
      agent_id: agent.id,
      created_at: now,
      type: 'INTERNAL_POLICY_REASSIGN',
    }))
  );

  return res;
}