[Fleet] Add base Fleet authz logic and API

x-pack/plugins/fleet/common/authz.ts

@@ -0,0 +1,64 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+export interface FleetAuthz {
+  fleet: {
+    all: boolean;
+    setup: boolean;
+    readEnrollmentTokens: boolean;
+  };
+
+  integrations: {
+    readPackageInfo: boolean;
+    readInstalledPackages: boolean;
+    installPackages: boolean;
+    upgradePackages: boolean;
+    removePackages: boolean;
+
+    readPackageSettings: boolean;
+    writePackageSettings: boolean;
+
+    readIntegrationPolicies: boolean;
+    writeIntegrationPolicies: boolean;
+  };
+}
+
+interface CalculateParams {
+  fleet: {
+    all: boolean;
+    setup: boolean;
+  };
+
+  integrations: {
+    all: boolean;
+    read: boolean;
+  };
+}
+
+export const calculateAuthz = ({ fleet, integrations }: CalculateParams): FleetAuthz => ({
+  fleet: {
+    all: fleet.all && (integrations.all || integrations.read),
+
+    // These are currently used by Fleet Server setup
+    setup: fleet.all || fleet.setup,
+    readEnrollmentTokens: fleet.all || fleet.setup,
+  },
+
+  integrations: {
+    readPackageInfo: fleet.all || fleet.setup || integrations.all || integrations.read,
+    readInstalledPackages: integrations.all || integrations.read,
+    installPackages: fleet.all && integrations.all,
+    upgradePackages: fleet.all && integrations.all,
+    removePackages: fleet.all && integrations.all,
+
+    readPackageSettings: fleet.all && integrations.all,
+    writePackageSettings: fleet.all && integrations.all,
+
+    readIntegrationPolicies: fleet.all && integrations.all,
+    writeIntegrationPolicies: fleet.all && integrations.all,
+  },
+});

x-pack/plugins/fleet/common/index.ts

@@ -11,3 +11,4 @@
 export * from './constants';
 export * from './services';
 export * from './types';
+export { FleetAuthz, calculateAuthz } from './authz';

x-pack/plugins/fleet/public/plugin.ts

@@ -38,8 +38,14 @@ import { Storage } from '../../../../src/plugins/kibana_utils/public';
 import type { LicensingPluginSetup } from '../../licensing/public';
 import type { CloudSetup } from '../../cloud/public';
 import type { GlobalSearchPluginSetup } from '../../global_search/public';
-import { PLUGIN_ID, INTEGRATIONS_PLUGIN_ID, setupRouteService, appRoutesService } from '../common';
-import type { CheckPermissionsResponse, PostFleetSetupResponse } from '../common';
+import {
+  PLUGIN_ID,
+  INTEGRATIONS_PLUGIN_ID,
+  setupRouteService,
+  appRoutesService,
+  calculateAuthz,
+} from '../common';
+import type { CheckPermissionsResponse, PostFleetSetupResponse, FleetAuthz } from '../common';
 
 import type { FleetConfigType } from '../common/types';
 
@@ -65,6 +71,8 @@ export interface FleetSetup {}
  * Describes public Fleet plugin contract returned at the `start` stage.
  */
 export interface FleetStart {
+  /** Authorization for the current user */
+  authz: FleetAuthz;
   registerExtension: UIExtensionRegistrationCallback;
   isInitialized: () => Promise<true>;
 }
@@ -90,6 +98,7 @@ export interface FleetStartServices extends CoreStart, FleetStartDeps {
   storage: Storage;
   share: SharePluginStart;
   cloud?: CloudSetup;
+  authz: FleetAuthz;
 }
 
 export class FleetPlugin implements Plugin<FleetSetup, FleetStart, FleetSetupDeps, FleetStartDeps> {
@@ -103,7 +112,7 @@ export class FleetPlugin implements Plugin<FleetSetup, FleetStart, FleetSetupDep
     this.kibanaVersion = initializerContext.env.packageInfo.version;
   }
 
-  public setup(core: CoreSetup, deps: FleetSetupDeps) {
+  public setup(core: CoreSetup<FleetStartDeps, FleetStart>, deps: FleetSetupDeps) {
     const config = this.config;
     const kibanaVersion = this.kibanaVersion;
     const extensions = this.extensions;
@@ -129,16 +138,13 @@ export class FleetPlugin implements Plugin<FleetSetup, FleetStart, FleetSetupDep
       order: 9019,
       euiIconType: 'logoElastic',
       mount: async (params: AppMountParameters) => {
-        const [coreStartServices, startDepsServices] = (await core.getStartServices()) as [
-          CoreStart,
-          FleetStartDeps,
-          FleetStart
-        ];
+        const [coreStartServices, startDepsServices, fleetStart] = await core.getStartServices();
         const startServices: FleetStartServices = {
           ...coreStartServices,
           ...startDepsServices,
           storage: this.storage,
           cloud: deps.cloud,
+          authz: fleetStart.authz,
         };
         const { renderApp, teardownIntegrations } = await import('./applications/integrations');
 
@@ -169,16 +175,13 @@ export class FleetPlugin implements Plugin<FleetSetup, FleetStart, FleetSetupDep
       euiIconType: 'logoElastic',
       appRoute: '/app/fleet',
       mount: async (params: AppMountParameters) => {
-        const [coreStartServices, startDepsServices] = (await core.getStartServices()) as [
-          CoreStart,
-          FleetStartDeps,
-          FleetStart
-        ];
+        const [coreStartServices, startDepsServices, fleetStart] = await core.getStartServices();
         const startServices: FleetStartServices = {
           ...coreStartServices,
           ...startDepsServices,
           storage: this.storage,
           cloud: deps.cloud,
+          authz: fleetStart.authz,
         };
         const { renderApp, teardownFleet } = await import('./applications/fleet');
         const unmount = renderApp(startServices, params, config, kibanaVersion, extensions);
@@ -243,7 +246,23 @@ export class FleetPlugin implements Plugin<FleetSetup, FleetStart, FleetSetupDep
       Component: LazyCustomLogsAssetsExtension,
     });
 
+    const { capabilities } = core.application;
+    const authz = calculateAuthz({
+      fleet: {
+        // Once we have a split privilege, this should be using fleetv2
+        // all: capabilities.fleetv2.all as boolean,
+        all: capabilities.fleet.all as boolean,
+        setup: false, // browser users will never have setup privileges
+      },
+
+      integrations: {
+        all: capabilities.fleet.all as boolean,
+        read: capabilities.fleet.read as boolean,
+      },
+    });
+
     return {
+      authz,
       isInitialized: () => {
         if (!successPromise) {
           successPromise = Promise.resolve().then(async () => {

x-pack/plugins/fleet/server/plugin.ts

@@ -15,6 +15,7 @@ import type {
   PluginInitializerContext,
   SavedObjectsServiceStart,
   HttpServiceSetup,
+  KibanaRequest,
 } from 'kibana/server';
 import type { UsageCollectionSetup } from 'src/plugins/usage_collection/server';
 
@@ -29,7 +30,7 @@ import type {
 } from '../../encrypted_saved_objects/server';
 import type { SecurityPluginSetup, SecurityPluginStart } from '../../security/server';
 import type { PluginSetupContract as FeaturesPluginSetup } from '../../features/server';
-import type { FleetConfigType } from '../common';
+import type { FleetConfigType, FleetAuthz } from '../common';
 import { INTEGRATIONS_PLUGIN_ID } from '../common';
 import type { CloudSetup } from '../../cloud/server';
 
@@ -79,7 +80,7 @@ import {
 } from './services/agents';
 import { registerFleetUsageCollector } from './collectors/register';
 import { getInstallation, ensureInstalledPackage } from './services/epm/packages';
-import { RouterWrappers } from './routes/security';
+import { getAuthzFromRequest, RouterWrappers } from './routes/security';
 import { FleetArtifactsClient } from './services/artifacts';
 import type { FleetRouter } from './types/request_context';
 import { TelemetryEventsSender } from './telemetry/sender';
@@ -142,6 +143,9 @@ export interface FleetStartContract {
    * services
    */
   fleetSetupCompleted: () => Promise<void>;
+  authz: {
+    fromRequest(request: KibanaRequest): Promise<FleetAuthz>;
+  };
   esIndexPatternService: ESIndexPatternService;
   packageService: PackageService;
   agentService: AgentService;
@@ -205,7 +209,7 @@ export class FleetPlugin
     // TODO: Flesh out privileges
     if (deps.features) {
       deps.features.registerKibanaFeature({
-        id: PLUGIN_ID,
+        id: 'fleet',
         name: 'Fleet and Integrations',
         category: DEFAULT_APP_CATEGORIES.management,
         app: [PLUGIN_ID, INTEGRATIONS_PLUGIN_ID, 'kibana'],
@@ -230,7 +234,7 @@ export class FleetPlugin
         },
         privileges: {
           all: {
-            api: [`${PLUGIN_ID}-read`, `${PLUGIN_ID}-all`],
+            api: [`fleet-read`, `fleet-all`, `integrations-all`, `integrations-read`],
             app: [PLUGIN_ID, INTEGRATIONS_PLUGIN_ID, 'kibana'],
             catalogue: ['fleet'],
             savedObject: {
@@ -240,7 +244,7 @@ export class FleetPlugin
             ui: ['show', 'read', 'write'],
           },
           read: {
-            api: [`${PLUGIN_ID}-read`],
+            api: [`fleet-read`, `integrations-read`],
             app: [PLUGIN_ID, INTEGRATIONS_PLUGIN_ID, 'kibana'],
             catalogue: ['fleet'], // TODO: check if this is actually available to read user
             savedObject: {
@@ -255,7 +259,8 @@ export class FleetPlugin
 
     core.http.registerRouteHandlerContext<FleetRequestHandlerContext, 'fleet'>(
       'fleet',
-      (coreContext, request) => ({
+      async (coreContext, request) => ({
+        authz: await getAuthzFromRequest(request),
         epm: {
           // Use a lazy getter to avoid constructing this client when not used by a request handler
           get internalSoClient() {
@@ -348,6 +353,9 @@ export class FleetPlugin
     })();
 
     return {
+      authz: {
+        fromRequest: getAuthzFromRequest,
+      },
       fleetSetupCompleted: () => fleetSetupPromise,
       esIndexPatternService: new ESIndexPatternSavedObjectService(),
       packageService: {

x-pack/plugins/fleet/server/routes/security.ts

@@ -12,6 +12,9 @@ import type {
   RequestHandlerContext,
 } from 'src/core/server';
 
+import type { FleetAuthz } from '../../common';
+import { calculateAuthz } from '../../common';
+
 import { appContextService } from '../services';
 
 const SUPERUSER_AUTHZ_MESSAGE =
@@ -120,6 +123,48 @@ function makeRouterEnforcingFleetSetupPrivilege<TContext extends RequestHandlerC
   };
 }
 
+export async function getAuthzFromRequest(req: KibanaRequest): Promise<FleetAuthz> {
+  const security = appContextService.getSecurity();
+
+  if (security.authz.mode.useRbacForRequest(req)) {
+    const checkPrivileges = security.authz.checkPrivilegesDynamicallyWithRequest(req);
+    const { privileges } = await checkPrivileges({
+      kibana: [
+        security.authz.actions.api.get('fleet-all'),
+        security.authz.actions.api.get('fleet-setup'),
+        security.authz.actions.api.get('integrations-all'),
+        security.authz.actions.api.get('integrations-read'),
+      ],
+    });
+
+    const [fleetAll, fleetSetup, intAll, intRead] = privileges.kibana;
+
+    return calculateAuthz({
+      fleet: {
+        all: fleetAll.authorized,
+        setup: fleetSetup.authorized,
+      },
+
+      integrations: {
+        all: intAll.authorized,
+        read: intRead.authorized,
+      },
+    });
+  }
+
+  return calculateAuthz({
+    fleet: {
+      all: true,
+      setup: true,
+    },
+
+    integrations: {
+      all: true,
+      read: true,
+    },
+  });
+}
+
 export type RouterWrapper = <T extends RequestHandlerContext>(route: IRouter<T>) => IRouter<T>;
 
 interface RouterWrappersSetup {

x-pack/plugins/fleet/server/types/request_context.ts

@@ -13,10 +13,12 @@ import type {
   SavedObjectsClientContract,
   IRouter,
 } from '../../../../../src/core/server';
+import type { FleetAuthz } from '../../common/authz';
 
 /** @internal */
 export interface FleetRequestHandlerContext extends RequestHandlerContext {
   fleet: {
+    authz: FleetAuthz;
     epm: {
       /**
        * Saved Objects client configured to use kibana_system privileges instead of end-user privileges. Should only be