[Write restricted SOs] Allow creation, update, delete and transfer ownership

.buildkite/ftr_platform_stateful_configs.yml

@@ -334,6 +334,7 @@ enabled:
   - x-pack/platform/test/spaces_api_integration/security_and_spaces/config_basic.ts
   - x-pack/platform/test/spaces_api_integration/security_and_spaces/config_trial.ts
   - x-pack/platform/test/spaces_api_integration/spaces_only/config.ts
+  - x-pack/platform/test/spaces_api_integration/read_only_objects/config.ts
   - x-pack/platform/test/task_manager_claimer_update_by_query/config.ts
   - x-pack/platform/test/ui_capabilities/security_and_spaces/config.ts
   - x-pack/platform/test/ui_capabilities/spaces_only/config.ts

.github/CODEOWNERS

@@ -1081,6 +1081,7 @@ x-pack/platform/test/security_api_integration/plugins/oidc_provider @elastic/kib
 x-pack/platform/test/security_api_integration/plugins/saml_provider @elastic/kibana-security
 x-pack/platform/test/security_api_integration/plugins/user_profiles_consumer @elastic/kibana-security
 x-pack/platform/test/security_functional/plugins/test_endpoints @elastic/kibana-security
+x-pack/platform/test/spaces_api_integration/common/plugins/read_only_objects_test_plugin @elastic/kibana-security
 x-pack/platform/test/spaces_api_integration/common/plugins/spaces_test_plugin @elastic/kibana-security
 x-pack/platform/test/task_manager_claimer_update_by_query/plugins/sample_task_plugin_mget @elastic/response-ops
 x-pack/platform/test/ui_capabilities/common/plugins/foo_plugin @elastic/kibana-security

package.json

@@ -817,6 +817,7 @@
     "@kbn/react-kibana-context-theme": "link:src/platform/packages/shared/react/kibana_context/theme",
     "@kbn/react-kibana-mount": "link:src/platform/packages/shared/react/kibana_mount",
     "@kbn/react-mute-legacy-root-warning": "link:src/platform/packages/private/kbn-react-mute-legacy-root-warning",
+    "@kbn/read-only-objects-test-plugin": "link:x-pack/platform/test/spaces_api_integration/common/plugins/read_only_objects_test_plugin",
     "@kbn/recently-accessed": "link:src/platform/packages/shared/kbn-recently-accessed",
     "@kbn/reindex-service-plugin": "link:x-pack/platform/plugins/private/reindex_service",
     "@kbn/remote-clusters-plugin": "link:x-pack/platform/plugins/private/remote_clusters",

src/core/packages/saved-objects/api-server-internal/src/lib/apis/bulk_create.test.ts

@@ -19,7 +19,10 @@ import {
 
 import type { Payload } from '@hapi/boom';
 
-import type { SavedObjectsBulkCreateObject } from '@kbn/core-saved-objects-api-server';
+import type {
+  SavedObjectAccessControl,
+  SavedObjectsBulkCreateObject,
+} from '@kbn/core-saved-objects-api-server';
 import {
   type SavedObjectsRawDoc,
   type SavedObjectUnsanitizedDoc,
@@ -58,6 +61,7 @@ import {
 } from '../../test_helpers/repository.test.common';
 import type { ISavedObjectsSecurityExtension } from '@kbn/core-saved-objects-server';
 import { savedObjectsExtensionsMock } from '../../mocks/saved_objects_extensions.mock';
+import type { AuthenticatedUser } from '@kbn/core-security-common';
 
 // so any breaking changes to this repository are considered breaking changes to the SavedObjectsClient.
 
@@ -1086,6 +1090,244 @@ describe('#bulkCreate', () => {
           })
         );
       });
+
+      describe('access control', () => {
+        const CURRENT_USER_PROFILE_ID = 'current_user_profile_id';
+        const READ_ONLY_TYPE = 'read-only-type';
+
+        beforeEach(() => {
+          securityExtension.getCurrentUser.mockReturnValue({
+            authentication_realm: {
+              name: 'authentication_realm',
+              type: 'authentication_realm_type',
+            },
+            lookup_realm: {
+              name: 'lookup_realm',
+              type: 'lookup_realm_type',
+            },
+            authentication_provider: {
+              name: 'authentication_provider',
+              type: 'authentication_provider_type',
+            },
+            authentication_type: 'realm',
+            elastic_cloud_user: false,
+            profile_uid: CURRENT_USER_PROFILE_ID,
+          } as AuthenticatedUser);
+        });
+
+        registry.registerType({
+          name: READ_ONLY_TYPE,
+          hidden: false,
+          namespaceType: 'multiple-isolated',
+          supportsAccessControl: true,
+          mappings: {
+            dynamic: false,
+            properties: {
+              description: { type: 'text' },
+            },
+          },
+          management: {
+            importableAndExportable: true,
+          },
+        });
+
+        afterEach(() => {
+          securityExtension.getCurrentUser.mockClear();
+        });
+
+        it('applies access control options only to applicable types', async () => {
+          const obj1NoAccessControl = {
+            type: 'config',
+            id: '6.0.0-alpha1',
+            attributes: { title: 'Test One' },
+            references: [{ name: 'ref_0', type: 'test', id: '1' }],
+          };
+          const obj2AccessControl = {
+            type: READ_ONLY_TYPE,
+            id: 'has-read-only-metadata',
+            attributes: { title: 'Test Two' },
+            references: [{ name: 'ref_0', type: 'test', id: '2' }],
+          };
+          await bulkCreateSuccess(client, repository, [obj1NoAccessControl, obj2AccessControl], {
+            accessControl: { accessMode: 'read_only' },
+          });
+
+          expect(securityExtension.authorizeBulkCreate).toHaveBeenCalledWith(
+            expect.objectContaining({
+              objects: expect.arrayContaining([
+                {
+                  type: 'config',
+                  id: '6.0.0-alpha1',
+                  name: 'Test One',
+                  existingNamespaces: [],
+                  initialNamespace: undefined,
+                  // explicitly confirm there is no accessControl for non-supporting type
+                },
+                {
+                  type: READ_ONLY_TYPE,
+                  id: 'has-read-only-metadata',
+                  name: 'Test Two',
+                  existingNamespaces: [],
+                  initialNamespace: undefined,
+                  accessControl: {
+                    owner: CURRENT_USER_PROFILE_ID,
+                    accessMode: 'read_only',
+                  },
+                },
+              ]),
+            })
+          );
+        });
+
+        it('overrides access control options with incoming object property only for applicable types', async () => {
+          const obj1NoAccessControl = {
+            type: 'config',
+            id: '6.0.0-alpha1',
+            attributes: { title: 'Test One' },
+            references: [{ name: 'ref_0', type: 'test', id: '1' }],
+            accessControl: {
+              accessMode: 'read_only',
+            } as Pick<SavedObjectAccessControl, 'accessMode'>,
+          };
+          const obj2AccessControl = {
+            type: READ_ONLY_TYPE,
+            id: 'has-read-only-metadata',
+            attributes: { title: 'Test Two' },
+            references: [{ name: 'ref_0', type: 'test', id: '2' }],
+            accessControl: {
+              accessMode: 'default', // default === RBAC-only
+            } as Pick<SavedObjectAccessControl, 'accessMode'>,
+          };
+          const obj3AccessControl = {
+            type: READ_ONLY_TYPE,
+            id: 'has-read-only-metadata',
+            attributes: { title: 'Test Three' },
+            references: [{ name: 'ref_0', type: 'test', id: '3' }],
+          };
+          await bulkCreateSuccess(
+            client,
+            repository,
+            [obj1NoAccessControl, obj2AccessControl, obj3AccessControl],
+            {
+              accessControl: { accessMode: 'read_only' },
+            }
+          );
+
+          expect(securityExtension.authorizeBulkCreate).toHaveBeenCalledWith(
+            expect.objectContaining({
+              objects: expect.arrayContaining([
+                {
+                  type: 'config',
+                  id: '6.0.0-alpha1',
+                  name: 'Test One',
+                  existingNamespaces: [],
+                  initialNamespace: undefined,
+                  // explicitly confirm there is no accessControl for non-supporting type
+                },
+                {
+                  type: READ_ONLY_TYPE,
+                  id: 'has-read-only-metadata',
+                  name: 'Test Two',
+                  existingNamespaces: [],
+                  initialNamespace: undefined,
+                  accessControl: {
+                    owner: CURRENT_USER_PROFILE_ID,
+                    accessMode: 'default', // explicitly confirm the mode is overriden
+                  },
+                },
+                {
+                  type: READ_ONLY_TYPE,
+                  id: 'has-read-only-metadata',
+                  name: 'Test Three',
+                  existingNamespaces: [],
+                  initialNamespace: undefined,
+                  accessControl: {
+                    owner: CURRENT_USER_PROFILE_ID,
+                    accessMode: 'read_only', // explicitly confirm the mode is NOT overriden
+                  },
+                },
+              ]),
+            })
+          );
+        });
+
+        it('does not create objects with access control when there is no active user profile', async () => {
+          securityExtension.getCurrentUser.mockReturnValueOnce(null);
+
+          const obj1NoAccessControl = {
+            type: 'config',
+            id: '6.0.0-alpha1',
+            attributes: { title: 'Test One' },
+            references: [{ name: 'ref_0', type: 'test', id: '1' }],
+          };
+          const obj2AccessControl = {
+            type: READ_ONLY_TYPE,
+            id: 'has-read-only-metadata',
+            attributes: { title: 'Test Two' },
+            references: [{ name: 'ref_0', type: 'test', id: '2' }],
+          };
+          await bulkCreateSuccess(client, repository, [obj1NoAccessControl, obj2AccessControl], {
+            accessControl: { accessMode: 'read_only' },
+          });
+
+          expect(securityExtension.authorizeBulkCreate).toHaveBeenCalledWith(
+            expect.objectContaining({
+              objects: expect.arrayContaining([
+                {
+                  type: 'config',
+                  id: '6.0.0-alpha1',
+                  name: 'Test One',
+                  existingNamespaces: [],
+                  initialNamespace: undefined,
+                  // explicitly confirm there is no accessControl for non-supporting type
+                },
+              ]),
+            })
+          );
+        });
+
+        // regression test
+        it('creates objects supporting access control with no access control metadata when there is no active user profile and no access mode is provided', async () => {
+          securityExtension.getCurrentUser.mockReturnValueOnce(null);
+
+          const obj1NoAccessControl = {
+            type: 'config',
+            id: '6.0.0-alpha1',
+            attributes: { title: 'Test One' },
+            references: [{ name: 'ref_0', type: 'test', id: '1' }],
+          };
+          const obj2AccessControl = {
+            type: READ_ONLY_TYPE,
+            id: 'could-have-read-only-metadata',
+            attributes: { title: 'Test Two' },
+            references: [{ name: 'ref_0', type: 'test', id: '2' }],
+          };
+          await bulkCreateSuccess(client, repository, [obj1NoAccessControl, obj2AccessControl]); // no accessControl options
+
+          expect(securityExtension.authorizeBulkCreate).toHaveBeenCalledWith(
+            expect.objectContaining({
+              objects: [
+                {
+                  type: 'config',
+                  id: '6.0.0-alpha1',
+                  name: 'Test One',
+                  existingNamespaces: [],
+                  initialNamespace: undefined,
+                  // explicitly confirm there is no accessControl for non-supporting type
+                },
+                {
+                  type: READ_ONLY_TYPE,
+                  id: 'could-have-read-only-metadata',
+                  name: 'Test Two',
+                  existingNamespaces: [],
+                  initialNamespace: undefined,
+                  // explicitly confirm there is no accessControl for supporting type
+                },
+              ],
+            })
+          );
+        });
+      });
     });
   });
 });