mirror of
https://github.com/elastic/kibana.git
synced 2025-04-24 17:59:23 -04:00
5de13d49ac
Closes #147049 Closes #149897 Migrates authorization and audit logic from the Saved Objects Repository to the Saved Objects Security Extension. This is achieved by implementing action-specific authorization methods within the security extension. The SO repository is no longer responsible for making any authorization decisions, but It is still responsible to know how to call the extension methods. I've tried to make this as straightforward as possible such that there is a clear ownership delineation between the repository and the extension, by keeping the interface simple and (hopefully) obvious. ### Security Extension Interface New Public Extension Methods: - authorizeCreate - authorizeBulkCreate - authorizeUpdate - authorizeBulkUpdate - authorizeDelete - authorizeBulkDelete - authorizeGet - authorizeBulkGet - authorizeCheckConflicts - authorizeRemoveReferences - authorizeOpenPointInTime - auditClosePointInTime - authorizeAndRedactMultiNamespaceReferences - authorizeAndRedactInternalBulkResolve - authorizeUpdateSpaces - authorizeFind - getFindRedactTypeMap - authorizeDisableLegacyUrlAliases (for secure spaces client) - auditObjectsForSpaceDeletion (for secure spaces client) Removed from public interface: - authorize - enforceAuthorization - addAuditEvent ### Tests - Most test coverage moved from `repository.security_extension.test.ts` to `saved_objects_security_extension.test.ts` - `repository.security_extension.test.ts` tests extension call, parameters, and return - Updates repository unit tests to check that all security extension calls are made with the current space when the spaces extension is also enabled --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| api | ||
| api-generated | ||
| apm | ||
| canvas | ||
| concepts | ||
| dev-tools | ||
| developer | ||
| development/plugins/expressions/public | ||
| discover | ||
| fleet | ||
| getting-started | ||
| management | ||
| maps | ||
| migration | ||
| observability | ||
| osquery | ||
| settings | ||
| setup | ||
| siem | ||
| spaces | ||
| user | ||
| accessibility.asciidoc | ||
| action-type-template.asciidoc | ||
| apis.asciidoc | ||
| CHANGELOG.asciidoc | ||
| gs-index.asciidoc | ||
| index-custom-title-page.html | ||
| index.asciidoc | ||
| index.x.asciidoc | ||
| limitations.asciidoc | ||
| migration.asciidoc | ||
| redirects.asciidoc | ||
| rule-type-template.asciidoc | ||
| template.asciidoc | ||