Skip to content

Commit 0dae528

Browse files
jeramysoucyjeramysoucy
committed
Squashed commit of the following:
commit 4d914e0 Author: Sid <[email protected]> Date: Thu Oct 23 13:11:03 2025 +0200 [Write restricted dashboards] Change AccessMode const (elastic#239973) Closes elastic#237816 PR changes the `read_only` const we've been using to `write_restricted`. We've also changed the integration and unit test descriptions to match this. No functional changes here. --------- Co-authored-by: Elastic Machine <[email protected]> Co-authored-by: “jeramysoucy” <[email protected]> Co-authored-by: kibanamachine <[email protected]>
1 parent 25c6828 commit 0dae528

File tree

25 files changed

+422
-392
lines changed

25 files changed

+422
-392
lines changed

‎.buildkite/ftr_platform_stateful_configs.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -332,7 +332,7 @@ enabled:
332332
- x-pack/platform/test/spaces_api_integration/security_and_spaces/config_basic.ts
333333
- x-pack/platform/test/spaces_api_integration/security_and_spaces/config_trial.ts
334334
- x-pack/platform/test/spaces_api_integration/spaces_only/config.ts
335-
- x-pack/platform/test/spaces_api_integration/read_only_objects/config.ts
335+
- x-pack/platform/test/spaces_api_integration/access_control_objects/config.ts
336336
- x-pack/platform/test/task_manager_claimer_update_by_query/config.ts
337337
- x-pack/platform/test/ui_capabilities/security_and_spaces/config.ts
338338
- x-pack/platform/test/ui_capabilities/spaces_only/config.ts

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@
164164
"@hapi/wreck": "^18.1.0",
165165
"@hello-pangea/dnd": "18.0.1",
166166
"@kbn/aad-fixtures-plugin": "link:x-pack/platform/test/alerting_api_integration/common/plugins/aad",
167+
"@kbn/access-control-test-plugin": "link:x-pack/platform/test/spaces_api_integration/common/plugins/access_control_test_plugin",
167168
"@kbn/actions-plugin": "link:x-pack/platform/plugins/shared/actions",
168169
"@kbn/actions-simulators-plugin": "link:x-pack/platform/test/alerting_api_integration/common/plugins/actions_simulators",
169170
"@kbn/actions-types": "link:src/platform/packages/shared/kbn-actions-types",
@@ -824,7 +825,6 @@
824825
"@kbn/react-kibana-context-theme": "link:src/platform/packages/shared/react/kibana_context/theme",
825826
"@kbn/react-kibana-mount": "link:src/platform/packages/shared/react/kibana_mount",
826827
"@kbn/react-mute-legacy-root-warning": "link:src/platform/packages/private/kbn-react-mute-legacy-root-warning",
827-
"@kbn/read-only-objects-test-plugin": "link:x-pack/platform/test/spaces_api_integration/common/plugins/read_only_objects_test_plugin",
828828
"@kbn/recently-accessed": "link:src/platform/packages/shared/kbn-recently-accessed",
829829
"@kbn/reindex-service-plugin": "link:x-pack/platform/plugins/private/reindex_service",
830830
"@kbn/remote-clusters-plugin": "link:x-pack/platform/plugins/private/remote_clusters",

‎src/core/packages/saved-objects/api-server-internal/src/lib/apis/bulk_create.test.ts‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1093,7 +1093,7 @@ describe('#bulkCreate', () => {
10931093

10941094
describe('access control', () => {
10951095
const CURRENT_USER_PROFILE_ID = 'current_user_profile_id';
1096-
const READ_ONLY_TYPE = 'read-only-type';
1096+
const ACCESS_CONTROL_TYPE = 'access-control-type';
10971097

10981098
beforeEach(() => {
10991099
securityExtension.getCurrentUser.mockReturnValue({
@@ -1116,7 +1116,7 @@ describe('#bulkCreate', () => {
11161116
});
11171117

11181118
registry.registerType({
1119-
name: READ_ONLY_TYPE,
1119+
name: ACCESS_CONTROL_TYPE,
11201120
hidden: false,
11211121
namespaceType: 'multiple-isolated',
11221122
supportsAccessControl: true,
@@ -1143,13 +1143,13 @@ describe('#bulkCreate', () => {
11431143
references: [{ name: 'ref_0', type: 'test', id: '1' }],
11441144
};
11451145
const obj2AccessControl = {
1146-
type: READ_ONLY_TYPE,
1146+
type: ACCESS_CONTROL_TYPE,
11471147
id: 'has-read-only-metadata',
11481148
attributes: { title: 'Test Two' },
11491149
references: [{ name: 'ref_0', type: 'test', id: '2' }],
11501150
};
11511151
await bulkCreateSuccess(client, repository, [obj1NoAccessControl, obj2AccessControl], {
1152-
accessControl: { accessMode: 'read_only' },
1152+
accessControl: { accessMode: 'write_restricted' },
11531153
});
11541154

11551155
expect(securityExtension.authorizeBulkCreate).toHaveBeenCalledWith(
@@ -1164,14 +1164,14 @@ describe('#bulkCreate', () => {
11641164
// explicitly confirm there is no accessControl for non-supporting type
11651165
},
11661166
{
1167-
type: READ_ONLY_TYPE,
1167+
type: ACCESS_CONTROL_TYPE,
11681168
id: 'has-read-only-metadata',
11691169
name: 'Test Two',
11701170
existingNamespaces: [],
11711171
initialNamespace: undefined,
11721172
accessControl: {
11731173
owner: CURRENT_USER_PROFILE_ID,
1174-
accessMode: 'read_only',
1174+
accessMode: 'write_restricted',
11751175
},
11761176
},
11771177
]),
@@ -1186,11 +1186,11 @@ describe('#bulkCreate', () => {
11861186
attributes: { title: 'Test One' },
11871187
references: [{ name: 'ref_0', type: 'test', id: '1' }],
11881188
accessControl: {
1189-
accessMode: 'read_only',
1189+
accessMode: 'write_restricted',
11901190
} as Pick<SavedObjectAccessControl, 'accessMode'>,
11911191
};
11921192
const obj2AccessControl = {
1193-
type: READ_ONLY_TYPE,
1193+
type: ACCESS_CONTROL_TYPE,
11941194
id: 'has-read-only-metadata',
11951195
attributes: { title: 'Test Two' },
11961196
references: [{ name: 'ref_0', type: 'test', id: '2' }],
@@ -1199,7 +1199,7 @@ describe('#bulkCreate', () => {
11991199
} as Pick<SavedObjectAccessControl, 'accessMode'>,
12001200
};
12011201
const obj3AccessControl = {
1202-
type: READ_ONLY_TYPE,
1202+
type: ACCESS_CONTROL_TYPE,
12031203
id: 'has-read-only-metadata',
12041204
attributes: { title: 'Test Three' },
12051205
references: [{ name: 'ref_0', type: 'test', id: '3' }],
@@ -1209,7 +1209,7 @@ describe('#bulkCreate', () => {
12091209
repository,
12101210
[obj1NoAccessControl, obj2AccessControl, obj3AccessControl],
12111211
{
1212-
accessControl: { accessMode: 'read_only' },
1212+
accessControl: { accessMode: 'write_restricted' },
12131213
}
12141214
);
12151215

@@ -1225,7 +1225,7 @@ describe('#bulkCreate', () => {
12251225
// explicitly confirm there is no accessControl for non-supporting type
12261226
},
12271227
{
1228-
type: READ_ONLY_TYPE,
1228+
type: ACCESS_CONTROL_TYPE,
12291229
id: 'has-read-only-metadata',
12301230
name: 'Test Two',
12311231
existingNamespaces: [],
@@ -1236,14 +1236,14 @@ describe('#bulkCreate', () => {
12361236
},
12371237
},
12381238
{
1239-
type: READ_ONLY_TYPE,
1239+
type: ACCESS_CONTROL_TYPE,
12401240
id: 'has-read-only-metadata',
12411241
name: 'Test Three',
12421242
existingNamespaces: [],
12431243
initialNamespace: undefined,
12441244
accessControl: {
12451245
owner: CURRENT_USER_PROFILE_ID,
1246-
accessMode: 'read_only', // explicitly confirm the mode is NOT overriden
1246+
accessMode: 'write_restricted', // explicitly confirm the mode is NOT overriden
12471247
},
12481248
},
12491249
]),
@@ -1261,13 +1261,13 @@ describe('#bulkCreate', () => {
12611261
references: [{ name: 'ref_0', type: 'test', id: '1' }],
12621262
};
12631263
const obj2AccessControl = {
1264-
type: READ_ONLY_TYPE,
1264+
type: ACCESS_CONTROL_TYPE,
12651265
id: 'has-read-only-metadata',
12661266
attributes: { title: 'Test Two' },
12671267
references: [{ name: 'ref_0', type: 'test', id: '2' }],
12681268
};
12691269
await bulkCreateSuccess(client, repository, [obj1NoAccessControl, obj2AccessControl], {
1270-
accessControl: { accessMode: 'read_only' },
1270+
accessControl: { accessMode: 'write_restricted' },
12711271
});
12721272

12731273
expect(securityExtension.authorizeBulkCreate).toHaveBeenCalledWith(
@@ -1297,7 +1297,7 @@ describe('#bulkCreate', () => {
12971297
references: [{ name: 'ref_0', type: 'test', id: '1' }],
12981298
};
12991299
const obj2AccessControl = {
1300-
type: READ_ONLY_TYPE,
1300+
type: ACCESS_CONTROL_TYPE,
13011301
id: 'could-have-read-only-metadata',
13021302
attributes: { title: 'Test Two' },
13031303
references: [{ name: 'ref_0', type: 'test', id: '2' }],
@@ -1316,7 +1316,7 @@ describe('#bulkCreate', () => {
13161316
// explicitly confirm there is no accessControl for non-supporting type
13171317
},
13181318
{
1319-
type: READ_ONLY_TYPE,
1319+
type: ACCESS_CONTROL_TYPE,
13201320
id: 'could-have-read-only-metadata',
13211321
name: 'Test Two',
13221322
existingNamespaces: [],

‎src/core/packages/saved-objects/api-server-internal/src/lib/apis/create.test.ts‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -862,7 +862,7 @@ describe('#create', () => {
862862
id,
863863
namespace,
864864
accessControl: {
865-
accessMode: 'read_only',
865+
accessMode: 'write_restricted',
866866
},
867867
})
868868
).rejects.toThrowError(
@@ -878,7 +878,7 @@ describe('#create', () => {
878878
mockAuthenticatedUser({ profile_uid: 'u_test_user_version' })
879879
);
880880
const accessControl = {
881-
accessMode: 'read_only' as const,
881+
accessMode: 'write_restricted' as const,
882882
};
883883

884884
const result = await repository.create(ACCESS_CONTROL_TYPE, attributes, {
@@ -901,7 +901,7 @@ describe('#create', () => {
901901
updated_by: 'u_test_user_version',
902902
created_by: 'u_test_user_version',
903903
accessControl: {
904-
accessMode: 'read_only',
904+
accessMode: 'write_restricted',
905905
owner: 'u_test_user_version',
906906
},
907907
});
@@ -915,12 +915,12 @@ describe('#create', () => {
915915
namespace,
916916
references,
917917
accessControl: {
918-
accessMode: 'read_only',
918+
accessMode: 'write_restricted',
919919
},
920920
})
921921
).rejects.toThrowError(
922922
createBadRequestErrorPayload(
923-
`Unable to create \"read_only\" \"accessControlType\" saved object. User profile ID not found.`
923+
`Unable to create \"write_restricted\" \"accessControlType\" saved object. User profile ID not found.`
924924
)
925925
);
926926
expect(client.create).not.toHaveBeenCalled();

‎src/core/packages/saved-objects/api-server-internal/src/lib/apis/internals/change_object_access_control.test.ts‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ jest.mock('../utils', () => ({
3636

3737
type SetupParams = Partial<Pick<ChangeAccessControlParams, 'objects'>>;
3838

39-
const READ_ONLY_TYPE = 'read-only-type';
40-
const NON_READ_ONLY_TYPE = 'non-read-only-type';
39+
const ACCESS_CONTROL_TYPE = 'access-control-type';
40+
const NON_ACCESS_CONTROL_TYPE = 'non-access-control-type';
4141

4242
const BULK_ERROR = {
4343
error: 'Oh no, a bulk error!',
@@ -58,14 +58,14 @@ describe('changeObjectAccessControl', () => {
5858
securityExtension?: ISavedObjectsSecurityExtension
5959
) {
6060
const registry = typeRegistryMock.create();
61-
registry.supportsAccessControl.mockImplementation((type) => type === READ_ONLY_TYPE);
61+
registry.supportsAccessControl.mockImplementation((type) => type === ACCESS_CONTROL_TYPE);
6262
client = elasticsearchClientMock.createElasticsearchClient();
6363
const serializer = new SavedObjectsSerializer(registry);
6464

6565
return {
6666
mappings: { properties: {} }, // doesn't matter, only used as an argument to deleteLegacyUrlAliases which is mocked
6767
registry,
68-
allowedTypes: [READ_ONLY_TYPE, NON_READ_ONLY_TYPE],
68+
allowedTypes: [ACCESS_CONTROL_TYPE, NON_ACCESS_CONTROL_TYPE],
6969
client,
7070
serializer,
7171
logger: loggerMock.create(),
@@ -90,8 +90,8 @@ describe('changeObjectAccessControl', () => {
9090
const result = results.map((x) =>
9191
x.found
9292
? {
93-
_id: `${x.type ?? READ_ONLY_TYPE}:${x.id ?? 'id-unknown'}`,
94-
_index: `index-for-${x.type ?? READ_ONLY_TYPE}`,
93+
_id: `${x.type ?? ACCESS_CONTROL_TYPE}:${x.id ?? 'id-unknown'}`,
94+
_index: `index-for-${x.type ?? ACCESS_CONTROL_TYPE}`,
9595
_source: { namespaces: x.namespaces, accessControl: x.accessControl },
9696
_seq_no: VERSION_PROPS._seq_no,
9797
_primary_term: VERSION_PROPS._primary_term,
@@ -130,7 +130,7 @@ describe('changeObjectAccessControl', () => {
130130
describe('validation', () => {
131131
it('throws if owner is not specified', async () => {
132132
const params = setup({
133-
objects: [{ type: READ_ONLY_TYPE, id: 'id-1' }],
133+
objects: [{ type: ACCESS_CONTROL_TYPE, id: 'id-1' }],
134134
});
135135

136136
await expect(() =>
@@ -149,7 +149,7 @@ describe('changeObjectAccessControl', () => {
149149

150150
it('throws if owner has invalid user profile id', async () => {
151151
const params = setup({
152-
objects: [{ type: READ_ONLY_TYPE, id: 'id-1' }],
152+
objects: [{ type: ACCESS_CONTROL_TYPE, id: 'id-1' }],
153153
});
154154

155155
await expect(() =>
@@ -166,11 +166,11 @@ describe('changeObjectAccessControl', () => {
166166
);
167167
});
168168

169-
it('returns error if no read-only objects are specified', async () => {
169+
it('returns error if no access control objects are specified', async () => {
170170
const params = setup({
171171
objects: [
172-
{ type: NON_READ_ONLY_TYPE, id: 'id-1' },
173-
{ type: NON_READ_ONLY_TYPE, id: 'id-2' },
172+
{ type: NON_ACCESS_CONTROL_TYPE, id: 'id-1' },
173+
{ type: NON_ACCESS_CONTROL_TYPE, id: 'id-2' },
174174
],
175175
});
176176

@@ -186,15 +186,15 @@ describe('changeObjectAccessControl', () => {
186186
const error = result.objects[0].error;
187187
expect(error).toBeTruthy();
188188
expect(error!.message).toBe(
189-
`The type ${NON_READ_ONLY_TYPE} does not support access control: Bad Request`
189+
`The type ${NON_ACCESS_CONTROL_TYPE} does not support access control: Bad Request`
190190
);
191191
});
192192
});
193193

194194
describe('bulk and mget behavior', () => {
195195
it('does not call bulk if no objects need to be updated', async () => {
196196
const params = setup({
197-
objects: [{ type: NON_READ_ONLY_TYPE, id: 'id-1' }],
197+
objects: [{ type: NON_ACCESS_CONTROL_TYPE, id: 'id-1' }],
198198
});
199199
mockMgetResults([{ found: true, namespaces: ['default'] }]);
200200
const result = await changeObjectAccessControl({
@@ -212,13 +212,13 @@ describe('changeObjectAccessControl', () => {
212212
describe('authorization of operations', () => {
213213
it('successfully delegates to security extension for change ownership', async () => {
214214
const params = setup({
215-
objects: [{ type: READ_ONLY_TYPE, id: 'id-1' }],
215+
objects: [{ type: ACCESS_CONTROL_TYPE, id: 'id-1' }],
216216
});
217217
mockMgetResults([
218218
{
219219
found: true,
220220
namespaces: ['default'],
221-
type: READ_ONLY_TYPE,
221+
type: ACCESS_CONTROL_TYPE,
222222
id: 'id-1',
223223
accessControl: {
224224
owner: 'new-owner',
@@ -239,7 +239,7 @@ describe('changeObjectAccessControl', () => {
239239
namespace: 'default',
240240
objects: [
241241
{
242-
type: READ_ONLY_TYPE,
242+
type: ACCESS_CONTROL_TYPE,
243243
id: 'id-1',
244244
accessControl: {
245245
owner: 'new-owner',
@@ -259,7 +259,7 @@ describe('changeObjectAccessControl', () => {
259259
describe('validation', () => {
260260
it('throws if access mode is not specified', async () => {
261261
const params = setup({
262-
objects: [{ type: READ_ONLY_TYPE, id: 'id-1' }],
262+
objects: [{ type: ACCESS_CONTROL_TYPE, id: 'id-1' }],
263263
});
264264

265265
await expect(() =>
@@ -276,15 +276,15 @@ describe('changeObjectAccessControl', () => {
276276
);
277277
});
278278

279-
it('returns error if no read-only objects are specified', async () => {
279+
it('returns error if no access control objects are specified', async () => {
280280
const params = setup({
281-
objects: [{ type: NON_READ_ONLY_TYPE, id: 'id-1' }],
281+
objects: [{ type: NON_ACCESS_CONTROL_TYPE, id: 'id-1' }],
282282
});
283283

284284
const result = await changeObjectAccessControl({
285285
...params,
286286
options: {
287-
accessMode: 'read_only',
287+
accessMode: 'write_restricted',
288288
},
289289
actionType: 'changeAccessMode',
290290
currentUserProfileUid: mockUserProfileId,
@@ -293,20 +293,20 @@ describe('changeObjectAccessControl', () => {
293293
const error = result.objects[0].error;
294294
expect(error).toBeTruthy();
295295
expect(error!.message).toBe(
296-
`The type ${NON_READ_ONLY_TYPE} does not support access control: Bad Request`
296+
`The type ${NON_ACCESS_CONTROL_TYPE} does not support access control: Bad Request`
297297
);
298298
});
299299
});
300300
describe('authorization of operations', () => {
301301
it('successfully delegates to security extension for change access mode', async () => {
302302
const params = setup({
303-
objects: [{ type: READ_ONLY_TYPE, id: 'id-1' }],
303+
objects: [{ type: ACCESS_CONTROL_TYPE, id: 'id-1' }],
304304
});
305305
mockMgetResults([
306306
{
307307
found: true,
308308
namespaces: ['default'],
309-
type: READ_ONLY_TYPE,
309+
type: ACCESS_CONTROL_TYPE,
310310
id: 'id-1',
311311
accessControl: {
312312
owner: 'new-owner',
@@ -318,7 +318,7 @@ describe('changeObjectAccessControl', () => {
318318
await changeObjectAccessControl({
319319
...params,
320320
securityExtension: params.securityExtension,
321-
options: { accessMode: 'read_only', namespace: 'default' },
321+
options: { accessMode: 'write_restricted', namespace: 'default' },
322322
actionType: 'changeAccessMode',
323323
currentUserProfileUid: mockUserProfileId,
324324
});
@@ -327,7 +327,7 @@ describe('changeObjectAccessControl', () => {
327327
namespace: 'default',
328328
objects: [
329329
{
330-
type: READ_ONLY_TYPE,
330+
type: ACCESS_CONTROL_TYPE,
331331
id: 'id-1',
332332
accessControl: {
333333
owner: 'new-owner',

0 commit comments

Comments
 (0)