[6.x] [ML] Adding rules and filters permission checks (#21097)

x-pack/plugins/ml/public/components/anomalies_table/anomalies_table.js

@@ -32,6 +32,7 @@ import { EntityCell } from './entity_cell';
 import { InfluencersCell } from './influencers_cell';
 import { AnomalyDetails } from './anomaly_details';
 import { LinksMenu } from './links_menu';
+import { checkPermission } from 'plugins/ml/privilege/check_privilege';
 
 import { mlAnomaliesTableService } from './anomalies_table_service';
 import { mlFieldFormatService } from 'plugins/ml/services/field_format_service';
@@ -54,12 +55,11 @@ function renderTime(date, aggregationInterval) {
 }
 
 function showLinksMenuForItem(item) {
-  // TODO - add in checking of user privileges to see if they can view / edit rules.
-  const canViewRules = true;
-  return canViewRules ||
+  const canUpdateJob = checkPermission('canUpdateJob');
+  return (canUpdateJob ||
     item.isTimeSeriesViewDetector ||
     item.entityName === 'mlcategory' ||
-    item.customUrls !== undefined;
+    item.customUrls !== undefined);
 }
 
 function getColumns(

x-pack/plugins/ml/public/components/anomalies_table/links_menu.js

@@ -22,6 +22,7 @@ import chrome from 'ui/chrome';
 import { toastNotifications } from 'ui/notify';
 
 import { ES_FIELD_TYPES } from 'plugins/ml/../common/constants/field_types';
+import { checkPermission } from 'plugins/ml/privilege/check_privilege';
 import { parseInterval } from 'plugins/ml/../common/util/parse_interval';
 import { getFieldTypeFromMapping } from 'plugins/ml/services/mapping_service';
 import { ml } from 'plugins/ml/services/ml_api_service';
@@ -335,6 +336,7 @@ export class LinksMenu extends Component {
 
   render() {
     const { anomaly, showViewSeriesLink } = this.props;
+    const canUpdateJob = checkPermission('canUpdateJob');
 
     const button = (
       <EuiButtonIcon
@@ -385,15 +387,17 @@ export class LinksMenu extends Component {
       );
     }
 
-    items.push(
-      <EuiContextMenuItem
-        key="create_rule"
-        icon="controlsHorizontal"
-        onClick={() => { this.closePopover(); this.props.showRuleEditorFlyout(anomaly); }}
-      >
-        Configure rules
-      </EuiContextMenuItem>
-    );
+    if (canUpdateJob) {
+      items.push(
+        <EuiContextMenuItem
+          key="create_rule"
+          icon="controlsHorizontal"
+          onClick={() => { this.closePopover(); this.props.showRuleEditorFlyout(anomaly); }}
+        >
+          Configure rules
+        </EuiContextMenuItem>
+      );
+    }
 
     return (
       <EuiPopover

x-pack/plugins/ml/public/components/rule_editor/rule_editor_flyout.js

@@ -32,6 +32,7 @@ import {
 import { toastNotifications } from 'ui/notify';
 
 import { ActionsSection } from './actions_section';
+import { checkPermission } from 'plugins/ml/privilege/check_privilege';
 import { ConditionsSection } from './conditions_section';
 import { ScopeSection } from './scope_section';
 import { SelectRuleAction } from './select_rule_action';
@@ -67,6 +68,7 @@ export class RuleEditorFlyout extends Component {
     };
 
     this.partitioningFieldNames = [];
+    this.canGetFilters = checkPermission('canGetFilters');
   }
 
   componentDidMount() {
@@ -121,7 +123,7 @@ export class RuleEditorFlyout extends Component {
       isFlyoutVisible: true
     });
 
-    if (this.partitioningFieldNames.length > 0) {
+    if (this.partitioningFieldNames.length > 0 && this.canGetFilters) {
       // Load the current list of filters.
       ml.filters.filters()
         .then((filters) => {

x-pack/plugins/ml/public/components/rule_editor/scope_section.js

@@ -21,6 +21,7 @@ import {
 } from '@elastic/eui';
 
 import { ScopeExpression } from './scope_expression';
+import { checkPermission } from 'plugins/ml/privilege/check_privilege';
 import { getScopeFieldDefaults } from './utils';
 
 
@@ -49,6 +50,14 @@ function NoFilterListsCallOut() {
   );
 }
 
+function NoPermissionCallOut() {
+  return (
+    <EuiCallOut
+      title="You do not have permission to view filter lists"
+      iconType="gear"
+    />
+  );
+}
 
 export function ScopeSection({
   isEnabled,
@@ -58,6 +67,8 @@ export function ScopeSection({
   scope,
   updateScope }) {
 
+  const canGetFilters = checkPermission('canGetFilters');
+
   if (partitioningFieldNames === null || partitioningFieldNames.length === 0) {
     return null;
   }
@@ -86,6 +97,8 @@ export function ScopeSection({
         />
       );
     });
+  } else if(canGetFilters === false) {
+    content = <NoPermissionCallOut />;
   } else {
     content = <NoFilterListsCallOut />;
   }

x-pack/plugins/ml/public/settings/filter_lists/components/delete_filter_list_modal/delete_filter_list_modal.js

@@ -16,6 +16,7 @@ import {
   EUI_MODAL_CONFIRM_BUTTON,
 } from '@elastic/eui';
 
+import { checkPermission } from 'plugins/ml/privilege/check_privilege';
 import { deleteFilterLists } from './delete_filter_lists';
 
 /*
@@ -28,6 +29,7 @@ export class DeleteFilterListModal extends Component {
     this.state = {
       isModalVisible: false
     };
+    this.canDeleteFilter = checkPermission('canDeleteFilter');
   }
 
   closeModal = () => {
@@ -85,7 +87,7 @@ export class DeleteFilterListModal extends Component {
           iconType="trash"
           color="danger"
           onClick={this.showModal}
-          isDisabled={selectedFilterLists.length === 0}
+          isDisabled={(selectedFilterLists.length === 0 || this.canDeleteFilter === false)}
         >
           Delete
         </EuiButton>

x-pack/plugins/ml/public/settings/filter_lists/list/table.js

@@ -24,6 +24,7 @@ import {
 } from '@elastic/eui';
 
 import chrome from 'ui/chrome';
+import { checkPermission } from 'plugins/ml/privilege/check_privilege';
 import { DeleteFilterListModal } from '../components/delete_filter_list_modal';
 
 
@@ -44,10 +45,12 @@ UsedByIcon.propTypes = {
 };
 
 function NewFilterButton() {
+  const canCreateFilter = checkPermission('canCreateFilter');
   return (
     <EuiButton
       key="new_filter_list"
       href={`${chrome.getBasePath()}/app/ml#/settings/filter_lists/new_filter_list`}
+      isDisabled={(canCreateFilter === false)}
     >
       New
     </EuiButton>

x-pack/plugins/ml/public/settings/settings.html

@@ -30,6 +30,7 @@
             </li>
             <li class="col-xs-4 col-md-3 ng-scope">
               <a
+                ng-if="(canCreateFilter === true)"
                 data-test-subj=""
                 class="management-panel__link ng-binding"
                 tooltip=""
@@ -39,6 +40,16 @@
                 href="ml#/settings/filter_lists">
                  Filter Lists
               </a>
+              <span
+                ng-if="(canCreateFilter === false)"
+                class="management-panel__link disabled  ng-binding"
+                tooltip="You do not have permission to manage filter lists"
+                tooltip-placement="bottom"
+                tooltip-popup-delay="400"
+                tooltip-append-to-body="1"
+              >
+                Filter Lists
+              </span>
             </li>
           </ul>
         </div>

x-pack/plugins/ml/public/settings/settings_controller.js

@@ -8,7 +8,7 @@
 
 import uiRoutes from 'ui/routes';
 import { checkLicense } from 'plugins/ml/license/check_license';
-import { checkGetJobsPrivilege } from 'plugins/ml/privilege/check_privilege';
+import { checkGetJobsPrivilege, checkPermission } from 'plugins/ml/privilege/check_privilege';
 import { getMlNodeCount } from 'plugins/ml/ml_nodes_check/check_ml_nodes';
 import { initPromise } from 'plugins/ml/util/promise';
 
@@ -30,9 +30,10 @@ uiRoutes
 import { uiModules } from 'ui/modules';
 const module = uiModules.get('apps/ml');
 
-module.controller('MlSettings',
-  function () {
+module.controller('MlSettings', function ($scope) {
 
-    timefilter.disableTimeRangeSelector(); // remove time picker from top of page
-    timefilter.disableAutoRefreshSelector(); // remove time picker from top of page
-  });
+  timefilter.disableTimeRangeSelector(); // remove time picker from top of page
+  timefilter.disableAutoRefreshSelector(); // remove time picker from top of page
+
+  $scope.canCreateFilter = checkPermission('canCreateFilter');
+});

x-pack/plugins/ml/public/settings/styles/main.less

@@ -7,10 +7,15 @@
 }
 
 ml-settings {
-  .management-panel .management-panel__link {
-    font-size: 17px;
-    line-height: 32px;
-    margin-left: 6px;
+  .management-panel {
+    .management-panel__link {
+      font-size: 17px;
+      line-height: 32px;
+      margin-left: 6px;
+    }
+    .disabled {
+      color: silver;
+    }
   }
 }