Merge pull request #5 from legrego/spaces/securing-update

latest updates from spaces-phase-1

.eslintrc.js

@@ -2,6 +2,8 @@ const { resolve } = require('path');
 const { readdirSync } = require('fs');
 const dedent = require('dedent');
 
+const restrictedModules = { paths: ['gulp-util'] };
+
 module.exports = {
   extends: ['@elastic/eslint-config-kibana', '@elastic/eslint-config-kibana/jest'],
 
@@ -17,6 +19,11 @@ module.exports = {
     },
   },
 
+  rules: {
+    'no-restricted-imports': [2, restrictedModules],
+    'no-restricted-modules': [2, restrictedModules],
+  },
+
   overrides: [
     /**
      * Prettier
@@ -116,7 +123,7 @@ module.exports = {
         'packages/kbn-ui-framework/generator-kui/**/*',
         'packages/kbn-ui-framework/Gruntfile.js',
         'packages/kbn-es/src/**/*',
-        'x-pack/{dev-tools,gulp_helpers,scripts,test,build_chromium}/**/*',
+        'x-pack/{dev-tools,tasks,scripts,test,build_chromium}/**/*',
         'x-pack/**/{__tests__,__test__,__jest__,__fixtures__,__mocks__}/**/*',
         'x-pack/**/*.test.js',
         'x-pack/gulpfile.js',

.i18nrc.json

@@ -1,9 +1,9 @@
 {
   "paths": {
-    "kbn": "src/core_plugins/kibana",
-    "common.server": "src/server",
     "common.ui": "src/ui",
-    "xpack.idxMgmt": "xpack/plugins/index_management"
+    "kbn": "src/core_plugins/kibana",
+    "statusPage": "src/core_plugins/status_page",
+    "xpack.idxMgmt": "x-pack/plugins/index_management"
   },
   "exclude": [
     "src/ui/ui_render/bootstrap/app_bootstrap.js",

docs/api.asciidoc

@@ -29,12 +29,14 @@ entirely.
 
 * <<role-management-api>>
 * <<saved-objects-api>>
+* <<dashboard-import-api>>
 * <<logstash-configuration-management-api>>
 * <<url-shortening-api>>
 --
 
 include::api/role-management.asciidoc[]
 include::api/saved-objects.asciidoc[]
+include::api/dashboard-import.asciidoc[]
 include::api/logstash-configuration-management.asciidoc[]
 include::api/url-shortening.asciidoc[]
 

docs/api/dashboard-import.asciidoc

@@ -0,0 +1,17 @@
+[[dashboard-import-api]]
+== Dashboard Import API
+
+The dashboard import/export APIs allow people to import dashboards along with
+all of their corresponding saved objects such as visualizations, saved
+searches, and index patterns.
+
+Traditionally, developers would perform this level of integration by writing
+documents directly to the `.kibana` index. *Do not do this!* Writing directly
+to the `.kibana` index is not safe and it _will_ result in corrupted data that
+permanently breaks Kibana in a future version.
+
+* <<dashboard-import-api-import>>
+* <<dashboard-import-api-export>>
+
+include::dashboard-import/import.asciidoc[]
+include::dashboard-import/export.asciidoc[]

docs/api/dashboard-import/export.asciidoc

@@ -0,0 +1,38 @@
+[[dashboard-import-api-export]]
+=== Export Dashboard
+
+experimental[This functionality is *experimental* and may be changed or removed completely in a future release.]
+
+The dashboard export API allows people to export dashboards along with all of
+their corresponding saved objects such as visualizations, saved searches, and
+index patterns.
+
+==== Request
+
+`GET /api/kibana/dashboards/export`
+
+==== Query Parameters
+
+`dashboard` (optional)::
+  (array|string) The id(s) of the dashboard(s) to export
+
+==== Response body
+
+The response body will have a top level `objects` property that contains an
+array of saved objects. The order of these objects is not guaranteed. You
+should use this exact response body as the request body for the corresponding
+<<dashboard-import-api-import, Import Dashboard API>>.
+
+==== Examples
+
+The following example exports all saved objects associated with and including
+the dashboard with id `942dcef0-b2cd-11e8-ad8e-85441f0c2e5c`.
+
+[source,js]
+--------------------------------------------------
+GET api/kibana/dashboards/export?dashboard=942dcef0-b2cd-11e8-ad8e-85441f0c2e5c
+--------------------------------------------------
+// KIBANA
+
+A successful call returns a response code of `200` along with the exported
+objects as the response body.

docs/api/dashboard-import/import.asciidoc

@@ -0,0 +1,96 @@
+[[dashboard-import-api-import]]
+=== Import Dashboard
+
+experimental[This functionality is *experimental* and may be changed or removed completely in a future release.]
+
+The dashboard import API allows people to import dashboards along with all of
+their corresponding saved objects such as visualizations, saved searches, and
+index patterns.
+
+==== Request
+
+`POST /api/kibana/dashboards/import`
+
+==== Query Parameters
+
+`force` (optional)::
+  (boolean) Overwrite any existing objects on id conflict
+`exclude` (optional)::
+  (array) Saved object types that should not be imported
+
+==== Request Body
+
+The request body is JSON, but you should not manually construct a payload to
+this endpoint. Instead, use the complete response body from the
+<<dashboard-import-api-export, Export Dashboard API>> as the request body to
+this import API.
+
+==== Response body
+
+The response body will have a top level `objects` property that contains an
+array of the saved objects that were created.
+
+==== Examples
+
+The following example imports saved objects associated with and including the
+dashboard with id `942dcef0-b2cd-11e8-ad8e-85441f0c2e5c`.
+
+[source,js]
+--------------------------------------------------
+POST api/kibana/dashboards/import?exclude=index-pattern
+{
+  "objects": [
+    {
+      "id": "80b956f0-b2cd-11e8-ad8e-85441f0c2e5c",
+      "type": "visualization",
+      "updated_at": "2018-09-07T18:40:33.247Z",
+      "version": 1,
+      "attributes": {
+        "title": "Count Example",
+        "visState": "{\"title\":\"Count Example\",\"type\":\"metric\",\"params\":{\"addTooltip\":true,\"addLegend\":false,\"type\":\"metric\",\"metric\":{\"percentageMode\":false,\"useRanges\":false,\"colorSchema\":\"Green to Red\",\"metricColorMode\":\"None\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"labels\":{\"show\":true},\"invertColors\":false,\"style\":{\"bgFill\":\"#000\",\"bgColor\":false,\"labelColor\":false,\"subText\":\"\",\"fontSize\":60}}},\"aggs\":[{\"id\":\"1\",\"enabled\":true,\"type\":\"count\",\"schema\":\"metric\",\"params\":{}}]}",
+        "uiStateJSON": "{}",
+        "description": "",
+        "version": 1,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"index\":\"90943e30-9a47-11e8-b64d-95841ca0b247\",\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"
+        }
+      }
+    },
+    {
+      "id": "90943e30-9a47-11e8-b64d-95841ca0b247",
+      "type": "index-pattern",
+      "updated_at": "2018-09-07T18:39:47.683Z",
+      "version": 1,
+      "attributes": {
+        "title": "kibana_sample_data_logs",
+        "timeFieldName": "timestamp",
+        "fields": "<truncated for example>",
+        "fieldFormatMap": "{\"hour_of_day\":{}}"
+      }
+    },
+    {
+      "id": "942dcef0-b2cd-11e8-ad8e-85441f0c2e5c",
+      "type": "dashboard",
+      "updated_at": "2018-09-07T18:41:05.887Z",
+      "version": 1,
+      "attributes": {
+        "title": "Example Dashboard",
+        "hits": 0,
+        "description": "",
+        "panelsJSON": "[{\"gridData\":{\"w\":24,\"h\":15,\"x\":0,\"y\":0,\"i\":\"1\"},\"version\":\"7.0.0-alpha1\",\"panelIndex\":\"1\",\"type\":\"visualization\",\"id\":\"80b956f0-b2cd-11e8-ad8e-85441f0c2e5c\",\"embeddableConfig\":{}}]",
+        "optionsJSON": "{\"darkTheme\":false,\"useMargins\":true,\"hidePanelTitles\":false}",
+        "version": 1,
+        "timeRestore": false,
+        "kibanaSavedObjectMeta": {
+          "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"lucene\"},\"filter\":[]}"
+        }
+      }
+    }
+  ]
+}
+--------------------------------------------------
+// KIBANA
+
+A response code of `200` will be returned even if there are errors importing
+individual saved objects. In that case, error information will be returned in
+the response body on an object-by-object basis.

docs/api/spaces-management/delete.asciidoc

@@ -0,0 +1,25 @@
+[[spaces-api-delete]]
+=== Delete space
+
+experimental[This API is *experimental* and may be changed or removed completely in a future release. The underlying Spaces concepts are stable, but the APIs for managing Spaces are currently experimental.]
+
+[WARNING]
+==================================================
+Deleting a space will automatically delete all saved objects that belong to that space. This operation cannot be undone!
+==================================================
+
+==== Request
+
+To delete a space, submit a DELETE request to the `/api/spaces/space/<space_id>`
+endpoint:
+
+[source,js]
+--------------------------------------------------
+DELETE /api/spaces/space/marketing
+--------------------------------------------------
+// KIBANA
+
+==== Response
+
+If the space is successfully deleted, the response code is `204`; otherwise, the response
+code is 404.

docs/api/spaces-management/get.asciidoc

@@ -0,0 +1,77 @@
+[[spaces-api-get]]
+=== Get Space
+
+experimental[This API is *experimental* and may be changed or removed completely in a future release. The underlying Spaces concepts are stable, but the APIs for managing Spaces are currently experimental.]
+
+Retrieves all {kib} spaces, or a specific space.
+
+==== Get all {kib} spaces
+
+===== Request
+
+To retrieve all spaces, issue a GET request to the
+/api/spaces/space endpoint.
+
+[source,js]
+--------------------------------------------------
+GET /api/spaces/space
+--------------------------------------------------
+// KIBANA
+
+===== Response
+
+A successful call returns a response code of `200` and a response body containing a JSON 
+representation of the spaces.
+
+[source,js]
+--------------------------------------------------
+[
+  {
+    "id": "default",
+    "name": "Default",
+    "description" : "This is the Default Space",
+    "_reserved": true
+  },
+  {
+    "id": "marketing",
+    "name": "Marketing",
+    "description" : "This is the Marketing Space",
+    "color": "#aabbcc",
+    "initials": "MK"
+  },
+  {
+    "id": "sales",
+    "name": "Sales",
+    "initials": "MK"
+  },
+]
+--------------------------------------------------
+
+==== Get a specific space
+
+===== Request
+
+To retrieve a specific space, issue a GET request to
+the `/api/spaces/space/<space_id>` endpoint:
+
+[source,js]
+--------------------------------------------------
+GET /api/spaces/space/marketing
+--------------------------------------------------
+// KIBANA
+
+===== Response
+
+A successful call returns a response code of `200` and a response body containing a JSON 
+representation of the space.
+
+[source,js]
+--------------------------------------------------
+{
+  "id": "marketing",
+  "name": "Marketing",
+  "description" : "This is the Marketing Space",
+  "color": "#aabbcc",
+  "initials": "MK"
+}
+--------------------------------------------------

docs/api/spaces-management/post.asciidoc

@@ -0,0 +1,50 @@
+[[spaces-api-post]]
+=== Create Space
+
+experimental[This API is *experimental* and may be changed or removed completely in a future release. The underlying Spaces concepts are stable, but the APIs for managing Spaces are currently experimental.]
+
+Creates a new {kib} space. To update an existing space, use the PUT command.
+
+==== Request
+
+To create a space, issue a POST request to the 
+`/api/spaces/space` endpoint.
+
+[source,js]
+--------------------------------------------------
+PUT /api/spaces/space
+--------------------------------------------------
+
+==== Request Body
+
+The following parameters can be specified in the body of a POST request to create a space:
+
+`id`:: (string) Required identifier for the space. This identifier becomes part of Kibana's URL when inside the space. This cannot be changed by the update operation.
+
+`name`:: (string) Required display name for the space.
+
+`description`:: (string) Optional description for the space.
+
+`initials`:: (string) Optionally specify the initials shown in the Space Avatar for this space. By default, the initials will be automatically generated from the space name.
+If specified, initials should be either 1 or 2 characters.
+
+`color`:: (string) Optioanlly specify the hex color code used in the Space Avatar for this space. By default, the color will be automatically generated from the space name.
+
+===== Example
+
+[source,js]
+--------------------------------------------------
+POST /api/spaces/space
+{
+  "id": "marketing",
+  "name": "Marketing",
+  "description" : "This is the Marketing Space",
+  "color": "#aabbcc",
+  "initials": "MK"
+}
+--------------------------------------------------
+// KIBANA
+
+==== Response
+
+A successful call returns a response code of `200` with the created Space.