[Dashboards] Write-restricted dashboards UI

.github/CODEOWNERS

@@ -405,6 +405,8 @@ src/platform/packages/private/shared-ux/storybook/config @elastic/appex-sharedux
 src/platform/packages/shared/chart-expressions-common @elastic/kibana-visualizations
 src/platform/packages/shared/chart-test-jest-helpers @elastic/kibana-visualizations
 src/platform/packages/shared/cloud @elastic/kibana-core
+src/platform/packages/shared/content-management/access_control/access_control_public @elastic/appex-sharedux
+src/platform/packages/shared/content-management/access_control/access_control_server @elastic/appex-sharedux
 src/platform/packages/shared/content-management/content_editor @elastic/appex-sharedux
 src/platform/packages/shared/content-management/content_insights/content_insights_public @elastic/appex-sharedux
 src/platform/packages/shared/content-management/content_insights/content_insights_server @elastic/appex-sharedux

package.json

@@ -257,6 +257,8 @@
     "@kbn/connector-specs": "link:src/platform/packages/shared/kbn-connector-specs",
     "@kbn/console-plugin": "link:src/platform/plugins/shared/console",
     "@kbn/content-connectors-plugin": "link:x-pack/platform/plugins/shared/content_connectors",
+    "@kbn/content-management-access-control-public": "link:src/platform/packages/shared/content-management/access_control/access_control_public",
+    "@kbn/content-management-access-control-server": "link:src/platform/packages/shared/content-management/access_control/access_control_server",
     "@kbn/content-management-content-editor": "link:src/platform/packages/shared/content-management/content_editor",
     "@kbn/content-management-content-insights-public": "link:src/platform/packages/shared/content-management/content_insights/content_insights_public",
     "@kbn/content-management-content-insights-server": "link:src/platform/packages/shared/content-management/content_insights/content_insights_server",

src/platform/packages/shared/content-management/access_control/access_control_public/README.md

@@ -0,0 +1,3 @@
+# @kbn/content-management-access-control-public
+
+Helpers for access control management.

src/platform/packages/shared/content-management/access_control/access_control_public/index.ts

@@ -0,0 +1,18 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+export { AccessControlClient, type AccessControlClientPublic } from './src';
+export { AccessModeContainer } from './src';
+export type {
+  CheckGlobalPrivilegeResponse,
+  ChangeAccesModeParameters,
+  ChangeAccessModeResponse,
+  CheckUserAccessControlParameters,
+  CanManageContentControlParameters,
+} from './src';

src/platform/packages/shared/content-management/access_control/access_control_public/jest.config.js

@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../../../../../../..',
+  roots: [
+    '<rootDir>/src/platform/packages/shared/content-management/access_control/access_control_public',
+  ],
+};

src/platform/packages/shared/content-management/access_control/access_control_public/kibana.jsonc

@@ -0,0 +1,9 @@
+{
+  "type": "shared-common",
+  "id": "@kbn/content-management-access-control-public",
+  "owner": [
+    "@elastic/appex-sharedux"
+  ],
+  "group": "platform",
+  "visibility": "shared"
+}

src/platform/packages/shared/content-management/access_control/access_control_public/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/content-management-access-control-public",
+  "private": true,
+  "version": "1.0.0",
+  "license": "Elastic License 2.0 OR AGPL-3.0-only OR SSPL-1.0"
+}

src/platform/packages/shared/content-management/access_control/access_control_public/src/access_control_client.ts

@@ -0,0 +1,116 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import type { HttpStart } from '@kbn/core-http-browser';
+import type { SavedObjectAccessControl } from '@kbn/core-saved-objects-common';
+import type {
+  CanManageContentControlParameters,
+  ChangeAccesModeParameters,
+  ChangeAccessModeResponse,
+  CheckGlobalPrivilegeResponse,
+  CheckUserAccessControlParameters,
+  IsAccessControlEnabledResponse,
+} from './types';
+
+export interface AccessControlClientPublic {
+  checkGlobalPrivilege(contentTypeId: string): Promise<CheckGlobalPrivilegeResponse>;
+  changeAccessMode({
+    objects,
+    accessMode,
+  }: ChangeAccesModeParameters): Promise<ChangeAccessModeResponse>;
+  canManageAccessControl(params: CanManageContentControlParameters): Promise<boolean>;
+  checkUserAccessControl(params: CheckUserAccessControlParameters): boolean;
+  isInEditAccessMode(accessControl?: Partial<SavedObjectAccessControl>): boolean;
+  isAccessControlEnabled(): Promise<boolean>;
+}
+
+export class AccessControlClient implements AccessControlClientPublic {
+  constructor(
+    private readonly deps: {
+      http: HttpStart;
+    }
+  ) {}
+
+  async checkGlobalPrivilege(contentTypeId: string): Promise<CheckGlobalPrivilegeResponse> {
+    const response = await this.deps.http.get<CheckGlobalPrivilegeResponse>(
+      `/internal/access_control/global_access/${contentTypeId}`
+    );
+
+    return {
+      isGloballyAuthorized: response?.isGloballyAuthorized,
+    };
+  }
+
+  async changeAccessMode({
+    objects,
+    accessMode,
+  }: ChangeAccesModeParameters): Promise<ChangeAccessModeResponse> {
+    const { result } = await this.deps.http.post<ChangeAccessModeResponse>(
+      `/internal/access_control/change_access_mode`,
+      {
+        body: JSON.stringify({ objects, accessMode }),
+      }
+    );
+
+    return {
+      result,
+    };
+  }
+
+  async canManageAccessControl({
+    accessControl,
+    createdBy,
+    userId,
+    contentTypeId,
+  }: CanManageContentControlParameters): Promise<boolean> {
+    const { isGloballyAuthorized } = await this.checkGlobalPrivilege(contentTypeId);
+    const canManage = this.checkUserAccessControl({
+      accessControl,
+      createdBy,
+      userId,
+    });
+    return isGloballyAuthorized || canManage;
+  }
+
+  checkUserAccessControl({
+    accessControl,
+    createdBy,
+    userId,
+  }: CheckUserAccessControlParameters): boolean {
+    if (!userId) {
+      return false;
+    }
+
+    if (!accessControl?.owner) {
+      // New saved object
+      if (!createdBy) {
+        return true;
+      }
+      return userId === createdBy;
+    }
+
+    return userId === accessControl.owner;
+  }
+
+  isInEditAccessMode(accessControl?: Partial<SavedObjectAccessControl>): boolean {
+    return (
+      !accessControl ||
+      accessControl.accessMode === undefined ||
+      accessControl.accessMode === 'default'
+    );
+  }
+
+  async isAccessControlEnabled(): Promise<boolean> {
+    const response = await this.deps.http.get<IsAccessControlEnabledResponse>(
+      '/internal/access_control/is_enabled'
+    );
+
+    return response?.isAccessControlEnabled ?? false;
+  }
+}

src/platform/packages/shared/content-management/access_control/access_control_public/src/components/access_mode_container.test.tsx

@@ -0,0 +1,181 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import React from 'react';
+import { renderWithI18n } from '@kbn/test-jest-helpers';
+import { AccessModeContainer } from './access_mode_container';
+import type { SavedObjectAccessControl } from '@kbn/core-saved-objects-common';
+import { act, waitFor, screen } from '@testing-library/react';
+
+describe('Access Mode Container', () => {
+  const mockAccessControlClient = {
+    canManageAccessControl: jest.fn(),
+    isInEditAccessMode: jest.fn(),
+    checkGlobalPrivilege: jest.fn(),
+    changeAccessMode: jest.fn(),
+    checkUserAccessControl: jest.fn(),
+    isAccessControlEnabled: jest.fn(),
+  } as any;
+
+  const mockGetActiveSpace = jest.fn();
+  const mockGetCurrentUser = jest.fn();
+
+  beforeAll(() => {
+    mockGetActiveSpace.mockResolvedValue({
+      name: 'Default Space',
+    });
+
+    mockGetCurrentUser.mockResolvedValue({
+      uid: 'user-id',
+    });
+
+    mockAccessControlClient.isAccessControlEnabled.mockResolvedValue(true);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  const getDefaultProps = (accessControl?: Partial<SavedObjectAccessControl>) => ({
+    onChangeAccessMode: jest.fn(),
+    accessControl,
+    getCurrentUser: mockGetCurrentUser,
+    accessControlClient: mockAccessControlClient,
+    getActiveSpace: mockGetActiveSpace,
+    contentTypeId: 'dashboard',
+  });
+
+  it('should render access mode container', async () => {
+    mockAccessControlClient.canManageAccessControl.mockResolvedValue(true);
+    mockAccessControlClient.isInEditAccessMode.mockReturnValue(true);
+
+    const accessControl: SavedObjectAccessControl = { owner: 'user-id', accessMode: 'default' };
+
+    await act(async () => {
+      renderWithI18n(<AccessModeContainer {...getDefaultProps(accessControl)} />);
+    });
+
+    const container = screen.getByTestId('accessModeContainer');
+    expect(container).toBeInTheDocument();
+  });
+
+  it('should render access mode select when current user can manage access control', async () => {
+    mockAccessControlClient.canManageAccessControl.mockResolvedValue(true);
+    mockAccessControlClient.isInEditAccessMode.mockReturnValue(true);
+
+    const accessControl: SavedObjectAccessControl = { owner: 'user-id', accessMode: 'default' };
+
+    await act(async () => {
+      renderWithI18n(<AccessModeContainer {...getDefaultProps(accessControl)} />);
+    });
+
+    const select = screen.getByTestId('accessModeSelect');
+
+    expect(select).toBeInTheDocument();
+  });
+
+  it('should not render access mode select when accessControl is undefined', async () => {
+    mockAccessControlClient.canManageAccessControl.mockResolvedValue(false);
+    mockAccessControlClient.isInEditAccessMode.mockReturnValue(true);
+
+    await act(async () => {
+      renderWithI18n(<AccessModeContainer {...getDefaultProps(undefined)} />);
+    });
+
+    const select = screen.queryByTestId('dashboardAccessModeSelect');
+
+    await waitFor(() => {
+      expect(select).not.toBeInTheDocument();
+    });
+  });
+
+  it('should not render access mode select when current user cannot manage access control', async () => {
+    mockAccessControlClient.canManageAccessControl.mockResolvedValue(false);
+    mockAccessControlClient.isInEditAccessMode.mockReturnValue(true);
+
+    const accessControl: SavedObjectAccessControl = { owner: 'user-id2', accessMode: 'default' };
+
+    await act(async () => {
+      renderWithI18n(<AccessModeContainer {...getDefaultProps(accessControl)} />);
+    });
+
+    const select = screen.queryByTestId('dashboardAccessModeSelect');
+
+    await waitFor(() => {
+      expect(select).not.toBeInTheDocument();
+    });
+  });
+
+  it('should render space name', async () => {
+    mockAccessControlClient.canManageAccessControl.mockResolvedValue(false);
+    mockAccessControlClient.isInEditAccessMode.mockReturnValue(true);
+
+    await act(async () => {
+      renderWithI18n(<AccessModeContainer {...getDefaultProps(undefined)} />);
+    });
+
+    const spaceName = screen.getByText(/Default Space/i);
+
+    await waitFor(() => {
+      expect(spaceName).toBeInTheDocument();
+    });
+  });
+
+  it('should render description tooltip when current user cannot manage access control', async () => {
+    mockAccessControlClient.canManageAccessControl.mockResolvedValue(false);
+    mockAccessControlClient.isInEditAccessMode.mockReturnValue(true);
+
+    const accessControl: SavedObjectAccessControl = { owner: 'user-id2', accessMode: 'default' };
+
+    await act(async () => {
+      renderWithI18n(<AccessModeContainer {...getDefaultProps(accessControl)} />);
+    });
+
+    const tooltip = screen.getByTestId('accessModeContainerDescriptionTooltip');
+
+    await waitFor(() => {
+      expect(tooltip).toBeInTheDocument();
+    });
+  });
+
+  it('should not render description tooltip when current user can manage access control', async () => {
+    mockAccessControlClient.canManageAccessControl.mockResolvedValue(true);
+    mockAccessControlClient.isInEditAccessMode.mockReturnValue(true);
+
+    const accessControl: SavedObjectAccessControl = { owner: 'user-id', accessMode: 'default' };
+
+    await act(async () => {
+      renderWithI18n(<AccessModeContainer {...getDefaultProps(accessControl)} />);
+    });
+
+    const tooltip = screen.queryByTestId('accessModeContainerDescriptionTooltip');
+
+    await waitFor(() => {
+      expect(tooltip).not.toBeInTheDocument();
+    });
+  });
+
+  it('should not render anything when access control is disabled', async () => {
+    mockAccessControlClient.isAccessControlEnabled.mockResolvedValueOnce(false);
+    mockAccessControlClient.canManageAccessControl.mockResolvedValue(true);
+    mockAccessControlClient.isInEditAccessMode.mockReturnValue(true);
+
+    const accessControl: SavedObjectAccessControl = { owner: 'user-id', accessMode: 'default' };
+
+    await act(async () => {
+      renderWithI18n(<AccessModeContainer {...getDefaultProps(accessControl)} />);
+    });
+
+    const container = screen.queryByTestId('accessModeContainer');
+
+    await waitFor(() => {
+      expect(container).not.toBeInTheDocument();
+    });
+  });
+});