Add tests to ensure AAD isn't broken after performing a change on an alert / action

x-pack/legacy/plugins/alerting/server/plugin.ts

@@ -71,7 +71,7 @@ export class Plugin {
       attributesToEncrypt: new Set(['apiKey']),
       attributesToExcludeFromAAD: new Set([
         'scheduledTaskId',
-        'muted',
+        'muteAll',
         'mutedInstanceIds',
         'updatedBy',
       ]),

x-pack/test/alerting_api_integration/common/config.ts

@@ -78,6 +78,7 @@ export function createTestConfig(name: string, options: CreateTestConfigOptions)
           `--plugin-path=${path.join(__dirname, 'fixtures', 'plugins', 'alerts')}`,
           `--plugin-path=${path.join(__dirname, 'fixtures', 'plugins', 'actions')}`,
           `--plugin-path=${path.join(__dirname, 'fixtures', 'plugins', 'task_manager')}`,
+          `--plugin-path=${path.join(__dirname, 'fixtures', 'plugins', 'aad')}`,
           `--server.xsrf.whitelist=${JSON.stringify(getAllExternalServiceSimulatorPaths())}`,
           ...(ssl
             ? [

x-pack/test/alerting_api_integration/common/fixtures/plugins/aad/index.ts

@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import Joi from 'joi';
+import Hapi from 'hapi';
+import { Legacy } from 'kibana';
+import KbnServer from '../../../../../../../src/legacy/server/kbn_server';
+import { PluginStartContract } from '../../../../../../plugins/encrypted_saved_objects/server';
+
+interface CheckAADRequest extends Hapi.Request {
+  payload: {
+    spaceId?: string;
+    type: string;
+    id: string;
+  };
+}
+
+// eslint-disable-next-line import/no-default-export
+export default function(kibana: any) {
+  return new kibana.Plugin({
+    require: ['actions', 'alerting', 'encryptedSavedObjects'],
+    name: 'aad-fixtures',
+    init(server: Legacy.Server) {
+      const newPlatform = ((server as unknown) as KbnServer).newPlatform;
+      const esoPlugin = newPlatform.start.plugins.encryptedSavedObjects as PluginStartContract;
+
+      server.route({
+        method: 'POST',
+        path: '/api/check_aad',
+        options: {
+          validate: {
+            payload: Joi.object()
+              .keys({
+                spaceId: Joi.string().optional(),
+                type: Joi.string().required(),
+                id: Joi.string().required(),
+              })
+              .required(),
+          },
+        },
+        async handler(request: CheckAADRequest) {
+          let namespace: string | undefined;
+          const spacesPlugin = server.plugins.spaces;
+          if (spacesPlugin && request.payload.spaceId) {
+            namespace = spacesPlugin.spaceIdToNamespace(request.payload.spaceId);
+          }
+          await esoPlugin.getDecryptedAsInternalUser(request.payload.type, request.payload.id, {
+            namespace,
+          });
+          return { success: true };
+        },
+      });
+    },
+  });
+}

x-pack/test/alerting_api_integration/common/fixtures/plugins/aad/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "aad-fixtures",
+  "version": "0.0.0",
+  "kibana": {
+    "version": "kibana"
+  }
+}

x-pack/test/alerting_api_integration/common/lib/check_aad.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+interface Opts {
+  supertest: any;
+  spaceId?: string;
+  type: string;
+  id: string;
+}
+
+export async function checkAAD({ supertest, spaceId, type, id }: Opts) {
+  await supertest
+    .post('/api/check_aad')
+    .set('kbn-xsrf', 'foo')
+    .send({ spaceId, type, id })
+    .expect(200, { success: true });
+}

x-pack/test/alerting_api_integration/common/lib/index.ts

@@ -10,3 +10,4 @@ export { ES_TEST_INDEX_NAME, ESTestIndexTool } from './es_test_index_tool';
 export { getTestAlertData } from './get_test_alert_data';
 export { AlertUtils } from './alert_utils';
 export { TaskManagerUtils } from './task_manager_utils';
+export { checkAAD } from './check_aad';

x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/create.ts

@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { getUrlPrefix, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getUrlPrefix, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -52,6 +52,7 @@ export default function createActionTests({ getService }: FtrProviderContext) {
             case 'superuser at space1':
             case 'space_1_all at space1':
               expect(response.statusCode).to.eql(200);
+              objectRemover.add(space.id, response.body.id, 'action');
               expect(response.body).to.eql({
                 id: response.body.id,
                 name: 'My action',
@@ -61,7 +62,13 @@ export default function createActionTests({ getService }: FtrProviderContext) {
                 },
               });
               expect(typeof response.body.id).to.be('string');
-              objectRemover.add(space.id, response.body.id, 'action');
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'action',
+                id: response.body.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/actions/update.ts

@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { getUrlPrefix, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getUrlPrefix, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -75,6 +75,13 @@ export default function updateActionTests({ getService }: FtrProviderContext) {
                   unencrypted: `This value shouldn't get encrypted`,
                 },
               });
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'action',
+                id: createdAction.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/create.ts

@@ -6,7 +6,7 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { getTestAlertData, getUrlPrefix, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getTestAlertData, getUrlPrefix, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -106,6 +106,13 @@ export default function createAlertTests({ getService }: FtrProviderContext) {
                 alertId: response.body.id,
                 spaceId: space.id,
               });
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: response.body.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/disable.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createDisableAlertTests({ getService }: FtrProviderContext) {
@@ -65,6 +71,13 @@ export default function createDisableAlertTests({ getService }: FtrProviderConte
               } catch (e) {
                 expect(e.status).to.eql(404);
               }
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/enable.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createEnableAlertTests({ getService }: FtrProviderContext) {
@@ -70,6 +76,13 @@ export default function createEnableAlertTests({ getService }: FtrProviderContex
                 alertId: createdAlert.id,
                 spaceId: space.id,
               });
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_all.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createMuteAlertTests({ getService }: FtrProviderContext) {
@@ -55,6 +61,13 @@ export default function createMuteAlertTests({ getService }: FtrProviderContext)
                 .auth(user.username, user.password)
                 .expect(200);
               expect(updatedAlert.muteAll).to.eql(true);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/mute_instance.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createMuteAlertInstanceTests({ getService }: FtrProviderContext) {
@@ -55,6 +61,13 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider
                 .auth(user.username, user.password)
                 .expect(200);
               expect(updatedAlert.mutedInstanceIds).to.eql(['1']);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_all.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createUnmuteAlertTests({ getService }: FtrProviderContext) {
@@ -60,6 +66,13 @@ export default function createUnmuteAlertTests({ getService }: FtrProviderContex
                 .auth(user.username, user.password)
                 .expect(200);
               expect(updatedAlert.muteAll).to.eql(false);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/unmute_instance.ts

@@ -6,8 +6,14 @@
 
 import expect from '@kbn/expect';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { AlertUtils, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
+import {
+  AlertUtils,
+  checkAAD,
+  getUrlPrefix,
+  getTestAlertData,
+  ObjectRemover,
+} from '../../../common/lib';
 
 // eslint-disable-next-line import/no-default-export
 export default function createMuteAlertInstanceTests({ getService }: FtrProviderContext) {
@@ -60,6 +66,13 @@ export default function createMuteAlertInstanceTests({ getService }: FtrProvider
                 .auth(user.username, user.password)
                 .expect(200);
               expect(updatedAlert.mutedInstanceIds).to.eql([]);
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);

x-pack/test/alerting_api_integration/security_and_spaces/tests/alerting/update.ts

@@ -7,7 +7,7 @@
 import expect from '@kbn/expect';
 import { Response as SupertestResponse } from 'supertest';
 import { UserAtSpaceScenarios } from '../../scenarios';
-import { getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
+import { checkAAD, getUrlPrefix, getTestAlertData, ObjectRemover } from '../../../common/lib';
 import { FtrProviderContext } from '../../../common/ftr_provider_context';
 
 // eslint-disable-next-line import/no-default-export
@@ -82,6 +82,13 @@ export default function createUpdateTests({ getService }: FtrProviderContext) {
                 mutedInstanceIds: [],
                 scheduledTaskId: createdAlert.scheduledTaskId,
               });
+              // Ensure AAD isn't broken
+              await checkAAD({
+                supertest,
+                spaceId: space.id,
+                type: 'alert',
+                id: createdAlert.id,
+              });
               break;
             default:
               throw new Error(`Scenario untested: ${JSON.stringify(scenario)}`);