[Cases] RBAC Bugs #101325

jonathan-buttner · 2021-06-03T19:54:40Z

This PR address various bugs found in the RBAC branch: #95058

The bugs are listed here: #100468

Issues addressed:

Case List Page

When the user is readonly
- Removed the ... from the table
- Removed the create case button and edit connectors

Case List Page

Case Details Page

When the user is readonly
- Status badge
  - Keep the color but remove the array and don't allow it to be clicked
- Remove the sync alerts
- Remove the ... actions
- Remove any callouts that the user can't act upon when readonly (editing the external connections etc)
Display an external connectors error message when there was a 403 or 401 when retrieving the connectors

Detail Page

Hide the attach to cases button within timeline

No attach to cases button

Remove the recent cases from the overview page if the user does not have permissions

No recent cases in overview

Remove the add cases link on the overview page if the user only has read permissions

No link

Hide the add to cases icon on the detections table

No icon on detections

Remove Cases from the navigation when the user does not have any permissions for cases

Cases doesn't exist on the sidebar

Cases doesn't exist in the header tabs

Read only glasses

Global Header glasses

stephmilovic · 2021-06-15T22:02:23Z

x-pack/plugins/cases/public/containers/configure/use_connectors.tsx

+            permissionsError = i18n.READ_PERMISSIONS_ERROR_MSG;
+          }
+
+          // if the error was not permissions related then toast it


smith

Looks like this fixes the problems I was having while a read-only user. I'm requesting changes for the setBadge bug (see comment.)

I'm also seeing these in the Kibana logs:

server    log   [20:45:47.026] [error][cases][plugins] Failed to get connectors: Error: Unauthorized to get actions
server    log   [20:45:47.027] [error][cases][plugins] Failed to get connectors in route: CaseError: Failed to get connectors: Error: Unauthorized to get actions
server    log   [20:46:17.594] [error][cases][plugins] Failed to get connectors: Error: Unauthorized to get actions
server    log   [20:46:17.594] [error][cases][plugins] Failed to get connectors in route: CaseError: Failed to get connectors: Error: Unauthorized to get actions
server    log   [20:48:17.504] [error][cases][plugins] Failed to get connectors: Error: Unauthorized to get actions
server    log   [20:48:17.505] [error][cases][plugins] Failed to get connectors in route: CaseError: Failed to get connectors: Error: Unauthorized to get actions

So it looks like we need to prevent the UI from making these requests if not authorized so those don't show up.

smith · 2021-06-16T01:51:04Z

x-pack/plugins/observability/public/pages/overview/index.tsx

+
+  // TODO: figure out if this is really necessary? If I don't add this then navigating from cases to
+  // the overview page leaves the glasses icon in the header
+  useKibana().services.chrome.setBadge();


I don't think this is related to the breadcrumbs, but it shouldn't be called in the main render body of the component.

I think the correct way to do this would be to call setBadge in a useEffect and return a function from the effect that calls setBadge(undefined) so the badge is removed when the component is unmounted.

smith · 2021-06-16T01:58:52Z

x-pack/plugins/observability/public/pages/overview/index.tsx

+
+  // TODO: figure out if this is really necessary? If I don't add this then navigating from cases to
+  // the overview page leaves the glasses icon in the header
+  useKibana().services.chrome.setBadge();


Oh I see, you're using an effect in HeaderBadge, I think you need to make that one look like:

useEffect(() => { setBadge(); return () => { chrome.setBadge(undefined); } }, [chrome.setBadge, setBadge]);

cnasikas · 2021-06-16T10:02:28Z

x-pack/plugins/cases/public/components/add_comment/index.test.tsx

+      </TestProviders>
+    );
+
+    expect(wrapper.find(`[data-test-subj="sadd-comment"]`).exists()).toBeFalsy();


nit: What s means (first letter of sadd-comment)?

Nice catch! that data-test-subj definitely wouldn't have existed 😆 should be add-comment

cnasikas

Great job as always! I really liked your PR 🙂.

I think is best to use a context for variables like userCanCrud instead of using props. A lot of components need that information and having a "global" access to it is very useful. We already have the OwnerProvider so we can rename it and use it for other variables. No need to do it in this PR. I just wanted to point it out.

cnasikas · 2021-06-16T10:18:17Z

x-pack/plugins/cases/public/components/case_action_bar/index.tsx

  disableAlerting,
+  userCanCrud = true,


I see that userCanCrud is optional on other components also. Here is also being defaulted it to true. I am bit hesitated to have this variable as optional or make assumptions about what the default value should be. It is very easy to omit it by mistake. Maybe having the type as userCanCrud: boolean | null; would enforce us to think about it more. What do you think?

We could probably just make it a required parameter. I think for this component it's only used in one place 👍

cnasikas · 2021-06-16T10:21:28Z

x-pack/plugins/cases/public/components/edit_connector/index.test.tsx

+    );
+
+    await waitFor(() =>
+      expect(


nit: Can this two waitFor combined to one?

cnasikas · 2021-06-16T10:29:36Z

x-pack/plugins/cases/public/components/edit_connector/index.tsx

@@ -235,7 +236,7 @@ export const EditConnector = React.memo(
                      connectors,
                      dataTestSubj: 'caseConnectors',
                      defaultValue: selectedConnector,
-                      disabled,
+                      disabled: !userCanCrud,


Shouldn't we hide (not render) the whole DisappearingFlexItem if the user cannot crud?

I think we need the form to render so that the currentConnector can be initialized so a readonly user can still view the previously configured connector 👍

cnasikas · 2021-06-16T10:39:50Z

x-pack/plugins/cases/public/components/edit_connector/index.tsx

-              !(currentConnector === null && selectedConnector !== 'none') && // Connector has not been deleted.
-              !editConnector && (
-                <EuiText size="s">
+            {!editConnector && permissionsError ? (


Is it possible to be on edit connector mode and at the same time have permissionsError? Maybe is best to separate them in two blocks as to me they seem unrelated. Am I missing something?

cnasikas · 2021-06-16T10:45:47Z

x-pack/plugins/cases/public/components/edit_connector/index.tsx

+              !editConnector &&
+              (currentConnector == null ||
+                currentConnector?.id === 'none' ||
+                selectedConnector === 'none') && ( // Connector is none or not defined, or the selected connector is none


I think the message will be shown when the selected connector has been deleted. To reproduce that:

Create a connector and create a case with the connector selected.

Go to Stack Management -> Rules & Connectors -> Connectors and delete the connector.

Return back to the case and see if the message is being shown. It should not.

Good catch, I'll put back the previous logic.

cnasikas · 2021-06-16T10:58:35Z

x-pack/plugins/cases/public/containers/configure/use_connectors.tsx

+ *
+ * @param toastPermissionsErrors boolean controlling whether 403 and 401 errors should be displayed in a toast error
+ */
+export const useConnectors = (toastPermissionsErrors: boolean = true): UseConnectorsResponse => {


nit: Do you mind if we change the argument to be an object? It is much easier to read useConnectors({ toastPermissionsErrors: false }) than useConnectors(false).

cnasikas · 2021-06-16T11:06:37Z

x-pack/plugins/cases/public/mocks.ts

+  getAllCases: jest.fn(),
+  getAllCasesSelectorModal: jest.fn(),
+  getCaseView: jest.fn(),
+  getConfigureCases: jest.fn(),


I think is better to leave them as jest.fn() always as they are mocks.

cnasikas · 2021-06-16T11:07:37Z

x-pack/plugins/cases/public/mocks.ts

+  getRecentCases: jest.fn(),
+});
+
+export const casesPluginMock = {


I think is good to have them if any other plugin wants to use our mocks as we do with core for example.

cnasikas · 2021-06-16T11:16:18Z

x-pack/plugins/observability/public/pages/cases/header_badge.tsx

@@ -0,0 +1,37 @@
+/*


I see that we don't render any html code. Why it has to be a component and not a hook?

cnasikas · 2021-06-16T11:24:38Z

x-pack/plugins/security_solution/public/overview/components/sidebar/sidebar.test.tsx

+      )
+    );
+
+    expect(casesMock.getRecentCases).not.toHaveBeenCalled();


Shouldn't we check if the component is does not exists?

I might be misunderstanding you but I think if we wanted to check that the component exists we'd have to grab the data test subj from the cases plugin and make sure it doesn't exist. I feel like that is relying on implementation details of how the cases plugin implements the recent cases. Doing it like this we ensure that we don't call the cases plugin at all and therefore shouldn't render anything.

I guess another option would be to create an empty wrapper component that defines a data test subj and ensure it doesn't get rendered.

jonathan-buttner · 2021-06-16T16:35:30Z

@smith thanks for the review

I'm also seeing these in the Kibana logs:

server    log   [20:45:47.026] [error][cases][plugins] Failed to get connectors: Error: Unauthorized to get actions
server    log   [20:45:47.027] [error][cases][plugins] Failed to get connectors in route: CaseError: Failed to get connectors: Error: Unauthorized to get actions
server    log   [20:46:17.594] [error][cases][plugins] Failed to get connectors: Error: Unauthorized to get actions
server    log   [20:46:17.594] [error][cases][plugins] Failed to get connectors in route: CaseError: Failed to get connectors: Error: Unauthorized to get actions
server    log   [20:48:17.504] [error][cases][plugins] Failed to get connectors: Error: Unauthorized to get actions
server    log   [20:48:17.505] [error][cases][plugins] Failed to get connectors in route: CaseError: Failed to get connectors: Error: Unauthorized to get actions

So it looks like we need to prevent the UI from making these requests if not authorized so those don't show up.

I think these are expected. If the user does not have access to actions and connectors we throw these errors when the cases detail page is viewed. The actions and connectors permissions are configured separately from cases:

We are currently discuss automatically granting read permissions to the actions and connectors if a user is granted read or write access to cases here: #101821

I'll be putting that change up in a different PR.

kibanamachine · 2021-06-21T22:51:16Z

💛 Build succeeded, but was flaky

continuous-integration/kibana-ci/pull-request
Commit: be52548
Storybooks Preview
Documentation Changes
Flaky suites:
- xpack-accessibility

Test Failures

Kibana Pipeline / general / X-Pack Accessibility Tests.x-pack/test/accessibility/apps/roles·ts.Kibana roles page a11y tests a11y test for view privilege summary panel

Link to Jenkins

Standard Out

Failed Tests Reporter:
  - Test has not failed recently on tracked branches

[00:00:00]       │
[00:06:05]         └-: Kibana roles page a11y tests
[00:06:05]           └-> "before all" hook for "a11y test for Roles main page"
[00:06:05]           └-> "before all" hook for "a11y test for Roles main page"
[00:06:05]             │ info [x-pack/test/functional/es_archives/logstash_functional] Loading "mappings.json"
[00:06:05]             │ info [x-pack/test/functional/es_archives/logstash_functional] Loading "data.json.gz"
[00:06:05]             │ info [x-pack/test/functional/es_archives/logstash_functional] Skipped restore for existing index "logstash-2015.09.22"
[00:06:05]             │ info [x-pack/test/functional/es_archives/logstash_functional] Skipped restore for existing index "logstash-2015.09.20"
[00:06:05]             │ info [x-pack/test/functional/es_archives/logstash_functional] Skipped restore for existing index "logstash-2015.09.21"
[00:06:06]             │ debg applying update to kibana config: {"defaultIndex":"logstash-*"}
[00:06:07]             │ debg navigating to settings url: http://localhost:61121/app/management
[00:06:07]             │ debg navigate to: http://localhost:61121/app/management
[00:06:07]             │ debg browser[INFO] http://localhost:61121/app/management?_t=1624310283091 281 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:06:07]             │
[00:06:07]             │ debg browser[INFO] http://localhost:61121/bootstrap.js 41:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:06:07]             │ debg ... sleep(700) start
[00:06:07]             │ debg ... sleep(700) end
[00:06:07]             │ debg returned from get, calling refresh
[00:06:08]             │ debg browser[INFO] http://localhost:61121/app/management?_t=1624310283091 281 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:06:08]             │
[00:06:08]             │ debg browser[INFO] http://localhost:61121/bootstrap.js 41:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:06:09]             │ debg currentUrl = http://localhost:61121/app/management
[00:06:09]             │          appUrl = http://localhost:61121/app/management
[00:06:09]             │ debg TestSubjects.find(kibanaChrome)
[00:06:09]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:06:09]             │ debg ... sleep(501) start
[00:06:09]             │ debg ... sleep(501) end
[00:06:09]             │ debg in navigateTo url = http://localhost:61121/app/management
[00:06:09]             │ debg TestSubjects.click(roles)
[00:06:09]             │ debg Find.clickByCssSelector('[data-test-subj="roles"]') with timeout=10000
[00:06:09]             │ debg Find.findByCssSelector('[data-test-subj="roles"]') with timeout=10000
[00:06:10]           └-> a11y test for Roles main page
[00:06:10]             └-> "before each" hook: global before each for "a11y test for Roles main page"
[00:06:10]             └- ✓ pass  (907ms) "Kibana roles page a11y tests a11y test for Roles main page"
[00:06:10]           └-> a11y test for searching a user
[00:06:10]             └-> "before each" hook: global before each for "a11y test for searching a user"
[00:06:10]             │ debg TestSubjects.setValue(searchRoles, apm_user)
[00:06:10]             │ debg TestSubjects.click(searchRoles)
[00:06:10]             │ debg Find.clickByCssSelector('[data-test-subj="searchRoles"]') with timeout=10000
[00:06:10]             │ debg Find.findByCssSelector('[data-test-subj="searchRoles"]') with timeout=10000
[00:06:11]             │ debg TestSubjects.setValue(searchRoles, )
[00:06:11]             │ debg TestSubjects.click(searchRoles)
[00:06:11]             │ debg Find.clickByCssSelector('[data-test-subj="searchRoles"]') with timeout=10000
[00:06:11]             │ debg Find.findByCssSelector('[data-test-subj="searchRoles"]') with timeout=10000
[00:06:11]             └- ✓ pass  (657ms) "Kibana roles page a11y tests a11y test for searching a user"
[00:06:11]           └-> a11y test for toggle button for show reserved users only
[00:06:11]             └-> "before each" hook: global before each for "a11y test for toggle button for show reserved users only"
[00:06:11]             │ debg Waiting up to 20000ms for show reserved roles toggle button is visible...
[00:06:11]             │ debg TestSubjects.exists(showReservedRolesSwitch)
[00:06:11]             │ debg Find.existsByDisplayedByCssSelector('[data-test-subj="showReservedRolesSwitch"]') with timeout=2500
[00:06:11]             │ debg TestSubjects.click(showReservedRolesSwitch)
[00:06:11]             │ debg Find.clickByCssSelector('[data-test-subj="showReservedRolesSwitch"]') with timeout=10000
[00:06:11]             │ debg Find.findByCssSelector('[data-test-subj="showReservedRolesSwitch"]') with timeout=10000
[00:06:12]             │ debg TestSubjects.click(showReservedRolesSwitch)
[00:06:12]             │ debg Find.clickByCssSelector('[data-test-subj="showReservedRolesSwitch"]') with timeout=10000
[00:06:12]             │ debg Find.findByCssSelector('[data-test-subj="showReservedRolesSwitch"]') with timeout=10000
[00:06:12]             └- ✓ pass  (466ms) "Kibana roles page a11y tests a11y test for toggle button for show reserved users only"
[00:06:12]           └-> a11y test for creating a role form
[00:06:12]             └-> "before each" hook: global before each for "a11y test for creating a role form"
[00:06:12]             │ debg TestSubjects.click(createRoleButton)
[00:06:12]             │ debg Find.clickByCssSelector('[data-test-subj="createRoleButton"]') with timeout=10000
[00:06:12]             │ debg Find.findByCssSelector('[data-test-subj="createRoleButton"]') with timeout=10000
[00:06:12]             └- ✓ pass  (479ms) "Kibana roles page a11y tests a11y test for creating a role form"
[00:06:12]           └-> a11y test for show/hide privilege toggle button
[00:06:12]             └-> "before each" hook: global before each for "a11y test for show/hide privilege toggle button"
[00:06:12]             │ debg TestSubjects.click(showHidePrivilege)
[00:06:12]             │ debg Find.clickByCssSelector('[data-test-subj="showHidePrivilege"]') with timeout=10000
[00:06:12]             │ debg Find.findByCssSelector('[data-test-subj="showHidePrivilege"]') with timeout=10000
[00:06:13]             │ debg TestSubjects.click(showHidePrivilege)
[00:06:13]             │ debg Find.clickByCssSelector('[data-test-subj="showHidePrivilege"]') with timeout=10000
[00:06:13]             │ debg Find.findByCssSelector('[data-test-subj="showHidePrivilege"]') with timeout=10000
[00:06:13]             └- ✓ pass  (566ms) "Kibana roles page a11y tests a11y test for show/hide privilege toggle button"
[00:06:13]           └-> a11y test for cluster privileges drop down
[00:06:13]             └-> "before each" hook: global before each for "a11y test for cluster privileges drop down"
[00:06:13]             │ debg TestSubjects.click(cluster-privileges-combobox)
[00:06:13]             │ debg Find.clickByCssSelector('[data-test-subj="cluster-privileges-combobox"]') with timeout=10000
[00:06:13]             │ debg Find.findByCssSelector('[data-test-subj="cluster-privileges-combobox"]') with timeout=10000
[00:06:13]             └- ✓ pass  (382ms) "Kibana roles page a11y tests a11y test for cluster privileges drop down"
[00:06:13]           └-> a11y test for grant access to fields toggle switch
[00:06:13]             └-> "before each" hook: global before each for "a11y test for grant access to fields toggle switch"
[00:06:13]             │ debg TestSubjects.click(restrictFieldsQuery0)
[00:06:13]             │ debg Find.clickByCssSelector('[data-test-subj="restrictFieldsQuery0"]') with timeout=10000
[00:06:13]             │ debg Find.findByCssSelector('[data-test-subj="restrictFieldsQuery0"]') with timeout=10000
[00:06:13]             └- ✓ pass  (405ms) "Kibana roles page a11y tests a11y test for grant access to fields toggle switch"
[00:06:13]           └-> a11y test for grant read privilege access box
[00:06:13]             └-> "before each" hook: global before each for "a11y test for grant read privilege access box"
[00:06:13]             │ debg TestSubjects.click(restrictFieldsQuery0)
[00:06:13]             │ debg Find.clickByCssSelector('[data-test-subj="restrictFieldsQuery0"]') with timeout=10000
[00:06:13]             │ debg Find.findByCssSelector('[data-test-subj="restrictFieldsQuery0"]') with timeout=10000
[00:06:14]             └- ✓ pass  (355ms) "Kibana roles page a11y tests a11y test for grant read privilege access box"
[00:06:14]           └-> a11y test for Kibana privileges panel-space privilege panel
[00:06:14]             └-> "before each" hook: global before each for "a11y test for Kibana privileges panel-space privilege panel"
[00:06:14]             │ debg TestSubjects.click(addSpacePrivilegeButton)
[00:06:14]             │ debg Find.clickByCssSelector('[data-test-subj="addSpacePrivilegeButton"]') with timeout=10000
[00:06:14]             │ debg Find.findByCssSelector('[data-test-subj="addSpacePrivilegeButton"]') with timeout=10000
[00:06:15]             └- ✓ pass  (1.3s) "Kibana roles page a11y tests a11y test for Kibana privileges panel-space privilege panel"
[00:06:15]           └-> a11y test for customize feature privilege
[00:06:15]             └-> "before each" hook: global before each for "a11y test for customize feature privilege"
[00:06:15]             │ debg TestSubjects.click(featureCategory_kibana)
[00:06:15]             │ debg Find.clickByCssSelector('[data-test-subj="featureCategory_kibana"]') with timeout=10000
[00:06:15]             │ debg Find.findByCssSelector('[data-test-subj="featureCategory_kibana"]') with timeout=10000
[00:06:16]             │ debg TestSubjects.click(cancelSpacePrivilegeButton)
[00:06:16]             │ debg Find.clickByCssSelector('[data-test-subj="cancelSpacePrivilegeButton"]') with timeout=10000
[00:06:16]             │ debg Find.findByCssSelector('[data-test-subj="cancelSpacePrivilegeButton"]') with timeout=10000
[00:06:16]             └- ✓ pass  (1.1s) "Kibana roles page a11y tests a11y test for customize feature privilege"
[00:06:16]           └-> a11y test for view privilege summary panel
[00:06:16]             └-> "before each" hook: global before each for "a11y test for view privilege summary panel"
[00:06:16]             │ debg navigating to settings url: http://localhost:61121/app/management
[00:06:16]             │ debg navigate to: http://localhost:61121/app/management
[00:06:16]             │ debg browser[INFO] http://localhost:61121/app/management?_t=1624310292742 281 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:06:16]             │
[00:06:16]             │ debg browser[INFO] http://localhost:61121/bootstrap.js 41:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:06:16]             │ debg ... sleep(700) start
[00:06:17]             │ debg ... sleep(700) end
[00:06:17]             │ debg returned from get, calling refresh
[00:06:18]             │ debg browser[INFO] http://localhost:61121/app/management?_t=1624310292742 281 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'unsafe-eval' 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-P5polb1UreUSOe5V/Pv7tc+yeZuJXiOi/3fqhGsU7BE='), or a nonce ('nonce-...') is required to enable inline execution.
[00:06:18]             │
[00:06:18]             │ debg browser[INFO] http://localhost:61121/bootstrap.js 41:19 "^ A single error about an inline script not firing due to content security policy is expected!"
[00:06:18]             │ debg currentUrl = http://localhost:61121/app/management
[00:06:18]             │          appUrl = http://localhost:61121/app/management
[00:06:18]             │ debg TestSubjects.find(kibanaChrome)
[00:06:18]             │ debg Find.findByCssSelector('[data-test-subj="kibanaChrome"]') with timeout=60000
[00:06:19]             │ debg ... sleep(501) start
[00:06:19]             │ debg ... sleep(501) end
[00:06:19]             │ debg in navigateTo url = http://localhost:61121/app/management
[00:06:19]             │ debg TestSubjects.click(roles)
[00:06:19]             │ debg Find.clickByCssSelector('[data-test-subj="roles"]') with timeout=10000
[00:06:19]             │ debg Find.findByCssSelector('[data-test-subj="roles"]') with timeout=10000
[00:06:19]             │ debg TestSubjects.click(edit-role-action-global_canvas_all)
[00:06:19]             │ debg Find.clickByCssSelector('[data-test-subj="edit-role-action-global_canvas_all"]') with timeout=10000
[00:06:19]             │ debg Find.findByCssSelector('[data-test-subj="edit-role-action-global_canvas_all"]') with timeout=10000
[00:06:20]             │ debg TestSubjects.click(viewPrivilegeSummaryButton)
[00:06:20]             │ debg Find.clickByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:06:20]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:06:30]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:06:30]             │      Wait timed out after 10059ms
[00:06:30]             │ERROR browser[SEVERE] http://localhost:61121/api/security/role/global_canvas_all - Failed to load resource: net::ERR_NETWORK_CHANGED
[00:06:30]             │ERROR browser[SEVERE] http://localhost:61121/43820/bundles/core/core.entry.js 12:153187 TypeError: Failed to fetch
[00:06:30]             │          at fetch_Fetch.fetchResponse (http://localhost:61121/43820/bundles/core/core.entry.js:6:26193)
[00:06:30]             │          at async http://localhost:61121/43820/bundles/core/core.entry.js:6:24090
[00:06:30]             │          at async http://localhost:61121/43820/bundles/core/core.entry.js:6:23996
[00:06:30]             │ debg browser[INFO] http://localhost:61121/43820/bundles/core/core.entry.js 12:154115 "Detected an unhandled Promise rejection.
[00:06:30]             │      TypeError: Failed to fetch"
[00:06:30]             │ERROR browser[SEVERE] http://localhost:61121/43820/bundles/core/core.entry.js 5:2514 
[00:06:30]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:06:40]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:06:40]             │      Wait timed out after 10031ms
[00:06:41]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:06:51]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:06:51]             │      Wait timed out after 10048ms
[00:06:51]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:07:01]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:07:01]             │      Wait timed out after 10049ms
[00:07:02]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:07:12]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:07:12]             │      Wait timed out after 10048ms
[00:07:12]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:07:22]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:07:22]             │      Wait timed out after 10053ms
[00:07:23]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:07:33]             │ debg --- retry.try failed again with the same message...
[00:07:33]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:07:43]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:07:43]             │      Wait timed out after 10024ms
[00:07:44]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:07:54]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:07:54]             │      Wait timed out after 10020ms
[00:07:54]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:08:04]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:08:04]             │      Wait timed out after 10025ms
[00:08:05]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:08:15]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:08:15]             │      Wait timed out after 10034ms
[00:08:15]             │ debg Find.findByCssSelector('[data-test-subj="viewPrivilegeSummaryButton"]') with timeout=10000
[00:08:26]             │ debg --- retry.try error: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:08:26]             │      Wait timed out after 10024ms
[00:08:26]             │ info Taking screenshot "/dev/shm/workspace/parallel/12/kibana/x-pack/test/functional/screenshots/failure/Kibana roles page a11y tests a11y test for view privilege summary panel.png"
[00:08:26]             │ info Current URL is: http://localhost:61121/app/management/security/roles/edit/global_canvas_all
[00:08:26]             │ info Saving page source to: /dev/shm/workspace/parallel/12/kibana/x-pack/test/functional/failure_debug/html/Kibana roles page a11y tests a11y test for view privilege summary panel.html
[00:08:26]             └- ✖ fail: Kibana roles page a11y tests a11y test for view privilege summary panel
[00:08:26]             │      Error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
[00:08:26]             │ Wait timed out after 10024ms
[00:08:26]             │     at /dev/shm/workspace/parallel/12/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
[00:08:26]             │     at runMicrotasks (<anonymous>)
[00:08:26]             │     at processTicksAndRejections (internal/process/task_queues.js:95:5)
[00:08:26]             │       at onFailure (/dev/shm/workspace/parallel/12/kibana/test/common/services/retry/retry_for_success.ts:17:9)
[00:08:26]             │       at retryForSuccess (/dev/shm/workspace/parallel/12/kibana/test/common/services/retry/retry_for_success.ts:57:13)
[00:08:26]             │       at RetryService.try (/dev/shm/workspace/parallel/12/kibana/test/common/services/retry/retry.ts:31:12)
[00:08:26]             │       at Proxy.clickByCssSelector (/dev/shm/workspace/parallel/12/kibana/test/functional/services/common/find.ts:360:5)
[00:08:26]             │       at TestSubjects.click (/dev/shm/workspace/parallel/12/kibana/test/functional/services/common/test_subjects.ts:105:5)
[00:08:26]             │       at Context.<anonymous> (test/accessibility/apps/roles.ts:93:7)
[00:08:26]             │       at Object.apply (/dev/shm/workspace/parallel/12/kibana/node_modules/@kbn/test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)
[00:08:26]             │ 
[00:08:26]             │

Stack Trace

Error: retry.try timeout: TimeoutError: Waiting for element to be located By(css selector, [data-test-subj="viewPrivilegeSummaryButton"])
Wait timed out after 10024ms
    at /dev/shm/workspace/parallel/12/kibana/node_modules/selenium-webdriver/lib/webdriver.js:842:17
    at runMicrotasks (<anonymous>)
    at processTicksAndRejections (internal/process/task_queues.js:95:5)
    at onFailure (/dev/shm/workspace/parallel/12/kibana/test/common/services/retry/retry_for_success.ts:17:9)
    at retryForSuccess (/dev/shm/workspace/parallel/12/kibana/test/common/services/retry/retry_for_success.ts:57:13)
    at RetryService.try (/dev/shm/workspace/parallel/12/kibana/test/common/services/retry/retry.ts:31:12)
    at Proxy.clickByCssSelector (/dev/shm/workspace/parallel/12/kibana/test/functional/services/common/find.ts:360:5)
    at TestSubjects.click (/dev/shm/workspace/parallel/12/kibana/test/functional/services/common/test_subjects.ts:105:5)
    at Context.<anonymous> (test/accessibility/apps/roles.ts:93:7)
    at Object.apply (/dev/shm/workspace/parallel/12/kibana/node_modules/@kbn/test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16)

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`observability`	246	238	-8
`securitySolution`	2188	2181	-7
total			-15

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`cases`	401	402	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`cases`	502.9KB	507.7KB	+4.8KB
`observability`	464.5KB	453.2KB	-11.3KB
`securitySolution`	6.9MB	6.9MB	-8.0KB
total			-14.5KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`observability`	54.7KB	54.6KB	-111.0B

Unknown metric groups

API count

id	before	after	diff
`cases`	437	438	+1

History

💚 Build #132688 succeeded 0b6b50c
💛 Build #132149 was flaky 4f8ac35
💚 Build #132171 succeeded 320621e
💚 Build #131771 succeeded 7c965c9
💔 Build #131758 failed 5f816fc

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cnasikas

LGTM! Tested locally all bug fixes. Worked as expected 🚀

* Adding feature flag for auth * Hiding SOs and adding consumer field * First pass at adding security changes * Consumer as the app's plugin ID * Create addConsumerToSO migration helper * Fix mapping's SO consumer * Add test for CasesActions * Declare hidden types on SO client * Restructure integration tests * Init spaces_only integration tests * Implementing the cases security string * Adding security plugin tests for cases * Rough concept for authorization class * Adding comments * Fix merge * Get requiredPrivileges for classes * Check privillages * Ensure that all classes are available * Success if hasAllRequested is true * Failure if hasAllRequested is false * Adding schema updates for feature plugin * Seperate basic from trial * Enable SIR on integration tests * Starting the plumbing for authorization in plugin * Unit tests working * Move find route logic to case client * Create integration test helper functions * Adding auth to create call * Create getClassFilter helper * Add class attribute to find request * Create getFindAuthorizationFilter * Ensure savedObject is authorized in find method * Include fields for authorization * Combine authorization filter with cases & subcases filter * Fix isAuthorized flag * Fix merge issue * Create/delete spaces & users before and after tests * Add more user and roles * [Cases] Convert filters from strings to KueryNode (#95288) * [Cases] RBAC: Rename class to scope (#95535) * [Cases][RBAC] Rename scope to owner (#96035) * [Cases] RBAC: Create & Find integration tests (#95511) * [Cases] Cases client enchantment (#95923) * [Cases] Authorization and Client Audit Logger (#95477) * Starting audit logger * Finishing auth audit logger * Fixing tests and types * Adding audit event creator * Renaming class to scope * Adding audit logger messages to create and find * Adding comments and fixing import issue * Fixing type errors * Fixing tests and adding username to message * Addressing PR feedback * Removing unneccessary log and generating id * Fixing module issue and remove expect.anything * [Cases] Migrate sub cases routes to a client (#96461) * Adding sub cases client * Move sub case routes to case client * Throw when attempting to access the sub cases client * Fixing throw and removing user ans soclients * [Cases] RBAC: Migrate routes' unit tests to integration tests (#96374) Co-authored-by: Jonathan Buttner <[email protected]> * [Cases] Move remaining HTTP functionality to client (#96507) * Moving deletes and find for attachments * Moving rest of comment apis * Migrating configuration routes to client * Finished moving routes, starting utils refactor * Refactoring utilites and fixing integration tests * Addressing PR feedback * Fixing mocks and types * Fixing integration tests * Renaming status_stats * Fixing test type errors * Adding plugins to kibana.json * Adding cases to required plugin * [Cases] Refactoring authorization (#97483) * Refactoring authorization * Wrapping auth calls in helper for try catch * Reverting name change * Hardcoding the saved object types * Switching ensure to owner array * [Cases] Add authorization to configuration & cases routes (#97228) * [Cases] Attachments RBAC (#97756) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Addressing PR comments * Reducing operations * [Cases] Add RBAC to remaining Cases APIs (#98762) * Starting rbac for comments * Adding authorization to rest of comment apis * Starting the comment rbac tests * Fixing some of the rbac tests * Adding some integration tests * Starting patch tests * Working tests for comments * Working tests * Fixing some tests * Fixing type issues from pulling in master * Fixing connector tests that only work in trial license * Attempting to fix cypress * Mock return of array for configure * Fixing cypress test * Cleaning up * Working case update tests * Addressing PR comments * Reducing operations * Working rbac push case tests * Starting stats apis * Working status tests * User action tests and fixing migration errors * Fixing type errors * including error in message * Addressing pr feedback * Fixing some type errors * [Cases] Add space only tests (#99409) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * [Cases] Add security only tests (#99679) * Starting spaces tests * Finishing space only tests * Refactoring createCaseWithConnector * Fixing spelling * Addressing PR feedback and creating alert tests * Fixing mocks * Starting security only tests * Adding remainder security only tests * Using helper objects * Fixing type error for null space * Renaming utility variables * Refactoring users and roles for security only tests * Adding sub feature * [Cases] Cleaning up the services and TODOs (#99723) * Cleaning up the service intialization * Fixing type errors * Adding comments for the api * Working test for cases client * Fix type error * Adding generated docs * Adding more docs and cleaning up types * Cleaning up readme * More clean up and links * Changing some file names * Renaming docs * Integration tests for cases privs and fixes (#100038) * [Cases] RBAC on UI (#99478) Co-authored-by: Kibana Machine <[email protected]> * Fixing case ids by alert id route call * [Cases] Fixing UI feature permissions and adding UI tests (#100074) * Integration tests for cases privs and fixes * Fixing ui cases permissions and adding tests * Adding test for collection failure and fixing jest * Renaming variables * Fixing type error * Adding some comments * Validate cases features * Fix new schema * Adding owner param for the status stats * Fix get case status tests * Adjusting permissions text and fixing status * Address PR feedback * Adding top level feature back * Fixing feature privileges * Renaming * Removing uneeded else * Fixing tests and adding cases merge tests * [Cases][Security Solution] Basic license security solution API tests (#100925) * Cleaning up the fixture plugins * Adding basic feature test * renaming to unsecuredSavedObjectsClient (#101215) * [Cases] RBAC Refactoring audit logging (#100952) * Refactoring audit logging * Adding unit tests for authorization classes * Addressing feedback and adding util tests * return undefined on empty array * fixing eslint * conditional rendering the recently created cases * Remove unnecessary Array.from * Cleaning up overview page for permissions * Fixing log message for attachments * hiding add to cases button * Disable the Cases app from the global nav * Hide the add to cases button from detections * Fixing merge * Making progress on removing icons * Hding edit icons on detail view * Trying to get connector error msg tests working * Removing test * Disable error callouts * Fixing spacing and removing cases tab one no read * Adding read only badge * Cleaning up and adding badge * Wrapping in use effect * Default toasting permissions errors * Removing actions icon on comments * Addressing feedback * Fixing type Co-authored-by: Christos Nasikas <[email protected]> Co-authored-by: Kibana Machine <[email protected]> Co-authored-by: Christos Nasikas <[email protected]> Co-authored-by: Kibana Machine <[email protected]>

jonathan-buttner and others added 30 commits March 9, 2021 16:21

Adding feature flag for auth

7f1a7dd

Hiding SOs and adding consumer field

164582d

First pass at adding security changes

7eaf41e

Consumer as the app's plugin ID

f8e62c6

Create addConsumerToSO migration helper

09589c3

Fix mapping's SO consumer

eb75eb0

Add test for CasesActions

a930f03

Declare hidden types on SO client

d6f3b09

Restructure integration tests

b82e686

Init spaces_only integration tests

4d05175

Implementing the cases security string

75d72ae

Merge branch 'master' of github.com:elastic/kibana into cases-rbac-poc

e65838b

Adding security plugin tests for cases

1fd66af

Rough concept for authorization class

4560d42

Adding comments

ef9b3b2

Fix merge

b22a032

Get requiredPrivileges for classes

ddc2280

Check privillages

9d008d8

Ensure that all classes are available

7bb23dd

Success if hasAllRequested is true

65d4c6b

Failure if hasAllRequested is false

59e4045

Adding schema updates for feature plugin

4092733

Seperate basic from trial

311e3f4

Enable SIR on integration tests

f2a50d3

Starting the plumbing for authorization in plugin

00d89ca

Merge branch 'master' into cases-rbac-poc

40cfcce

Unit tests working

644a7ac

Merge branch 'cases-rbac-poc-plugin-changes' into cases-rbac-poc

9bb1b86

Move find route logic to case client

12d6e2e

Create integration test helper functions

84d9167

stephmilovic reviewed Jun 15, 2021

View reviewed changes

smith requested changes Jun 16, 2021

View reviewed changes

cnasikas added the bug Fixes for quality problems that affect the customer experience label Jun 16, 2021

cnasikas reviewed Jun 16, 2021

View reviewed changes

Removing actions icon on comments

c0b9c7c

stephmilovic mentioned this pull request Jun 16, 2021

[Security Solution]Case list disappears under recent case section for user having read case privilege #102321

Closed

monina-n self-requested a review June 16, 2021 15:15

monina-n approved these changes Jun 16, 2021

View reviewed changes

Addressing feedback

fa5d183

jonathan-buttner added 4 commits June 16, 2021 12:35

Merge branch 'master' of github.com:elastic/kibana into cases-rbac-bugs

5f816fc

Fixing type

7c965c9

Merge branch 'master' of github.com:elastic/kibana into cases-rbac-bugs

4f8ac35

Merge branch 'master' of github.com:elastic/kibana into cases-rbac-bugs

320621e

smith approved these changes Jun 17, 2021

View reviewed changes

jonathan-buttner added 2 commits June 21, 2021 09:41

Merge branch 'master' of github.com:elastic/kibana into cases-rbac-bugs

0b6b50c

Merge branch 'master' of github.com:elastic/kibana into cases-rbac-bugs

be52548

cnasikas approved these changes Jun 22, 2021

View reviewed changes

jonathan-buttner merged commit c5e8df0 into elastic:master Jun 22, 2021

jonathan-buttner deleted the cases-rbac-bugs branch June 22, 2021 17:52

jonathan-buttner mentioned this pull request Jun 22, 2021

[7.x] [Cases] RBAC Bugs (#101325) #102969

Merged

cnasikas assigned cnasikas and jonathan-buttner and unassigned cnasikas Jul 7, 2021

cnasikas mentioned this pull request Jul 7, 2021

[Cases] RBAC UI Message #95471

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Cases] RBAC Bugs #101325

[Cases] RBAC Bugs #101325

jonathan-buttner commented Jun 3, 2021 •

edited

Loading

stephmilovic Jun 15, 2021

smith left a comment

smith Jun 16, 2021

smith Jun 16, 2021

cnasikas Jun 16, 2021

jonathan-buttner Jun 16, 2021

cnasikas left a comment

cnasikas Jun 16, 2021

jonathan-buttner Jun 16, 2021

cnasikas Jun 16, 2021

cnasikas Jun 16, 2021

jonathan-buttner Jun 16, 2021

cnasikas Jun 16, 2021

cnasikas Jun 16, 2021

jonathan-buttner Jun 16, 2021

cnasikas Jun 16, 2021

cnasikas Jun 16, 2021

cnasikas Jun 16, 2021

cnasikas Jun 16, 2021

cnasikas Jun 16, 2021

jonathan-buttner Jun 16, 2021

jonathan-buttner commented Jun 16, 2021

kibanamachine commented Jun 21, 2021

Standard Out

Stack Trace

API count

cnasikas left a comment

[Cases] RBAC Bugs #101325

[Cases] RBAC Bugs #101325

Conversation

jonathan-buttner commented Jun 3, 2021 • edited Loading

Case List Page

Case Details Page

Hide the attach to cases button within timeline

Remove the recent cases from the overview page if the user does not have permissions

Remove the add cases link on the overview page if the user only has read permissions

Hide the add to cases icon on the detections table

Remove Cases from the navigation when the user does not have any permissions for cases

Read only glasses

Choose a reason for hiding this comment

smith left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cnasikas left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jonathan-buttner commented Jun 16, 2021

kibanamachine commented Jun 21, 2021

💛 Build succeeded, but was flaky

Standard Out

Stack Trace

Metrics [docs]

Module Count

Public APIs missing comments

Async chunks

Page load bundle

API count

History

cnasikas left a comment

Choose a reason for hiding this comment

jonathan-buttner commented Jun 3, 2021 •

edited

Loading