Skip to content

[Write restricted dashboards] Implements upsert for types supporting access control#247941

Merged
jeramysoucy merged 10 commits intoelastic:mainfrom
jeramysoucy:access-control-upserts
Jan 13, 2026
Merged

[Write restricted dashboards] Implements upsert for types supporting access control#247941
jeramysoucy merged 10 commits intoelastic:mainfrom
jeramysoucy:access-control-upserts

Conversation

@jeramysoucy
Copy link
Copy Markdown
Contributor

@jeramysoucy jeramysoucy commented Jan 6, 2026 •
edited by kibanamachine
Loading

Closes #239686

Summary

This PR implements the "upsert" case for types supporting access control in the Saved Objects update operation. The default access mode is always used during an upsert. The active user profile becomes the owner. If there is no active user profile, no access control metadata is saved during the upsert.

Tests

  • x-pack/platform/test/spaces_api_integration/access_control_objects/apis/spaces/access_control_objects.ts
    • 'should apply defaults when upserting a supported type'
    • 'should not write access control metadata when upserting unsupported types'
    • 'should not write access control metadata when upserting a supported type if there is no active user profile ID'

Note: "upserting" is not supported in bulk update.

@jeramysoucy jeramysoucy added Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Jan 6, 2026
@jeramysoucy jeramysoucy marked this pull request as ready for review January 6, 2026 16:35
@jeramysoucy jeramysoucy requested review from a team as code owners January 6, 2026 16:35
@jeramysoucy jeramysoucy requested a review from azasypkin January 6, 2026 16:35
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 6, 2026

Pinging @elastic/kibana-security (Team:Security)

@azasypkin
Copy link
Copy Markdown
Contributor

azasypkin commented Jan 12, 2026

ACK: will review today

azasypkin
azasypkin approved these changes Jan 12, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@azasypkin azasypkin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, thanks for adding the integration tests! Just a couple of minor nits.

Also, are we expected to cover this new case in the update.ts unit tests, or are we relying fully on the integration tests to verify access control functionality in general? I'm fine either way as long as we have integration tests.

afharo
afharo approved these changes Jan 13, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@afharo afharo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving to unblock. I can see that Oleg already covered all my concerns

@jeramysoucy jeramysoucy enabled auto-merge (squash) January 13, 2026 12:57
@jeramysoucy
Copy link
Copy Markdown
Contributor Author

jeramysoucy commented Jan 13, 2026

Also, are we expected to cover this new case in the update.ts unit tests, or are we relying fully on the integration tests to verify access control functionality in general? I'm fine either way as long as we have integration tests.

@azasypkin Good point...let me take a look at what we can verify in the unit tests.

@jeramysoucy jeramysoucy disabled auto-merge January 13, 2026 13:04
@jeramysoucy
Copy link
Copy Markdown
Contributor Author

jeramysoucy commented Jan 13, 2026

@azasypkin Unit tests added in 8888294

@jeramysoucy jeramysoucy enabled auto-merge (squash) January 13, 2026 13:24
@jeramysoucy jeramysoucy merged commit 7975d47 into elastic:main Jan 13, 2026
13 checks passed
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jan 13, 2026

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

@jeramysoucy
Copy link
Copy Markdown
Contributor Author

jeramysoucy commented Jan 16, 2026

@SiddharthMantri @legrego Do you think we should backport this to 9.3?

@SiddharthMantri
Copy link
Copy Markdown
Contributor

SiddharthMantri commented Jan 16, 2026

@jeramysoucy I'm not sure. It's not something we committed for 9.3 - i'm happy to leave it for a patch or next minor release even. what do you think?

smith pushed a commit to smith/kibana that referenced this pull request Jan 16, 2026
@jeramysoucy @azasypkin @smith
[Write restricted dashboards] Implements upsert for types supporting …
5666f10 
…access control (elastic#247941)

Closes elastic#239686

## Summary

This PR implements the "upsert" case for types supporting access control
in the Saved Objects update operation. The default access mode is always
used during an upsert. The active user profile becomes the owner. If
there is no active user profile, no access control metadata is saved
during the upsert.

### Tests

-
x-pack/platform/test/spaces_api_integration/access_control_objects/apis/spaces/access_control_objects.ts
    - 'should apply defaults when upserting a supported type'
- 'should not write access control metadata when upserting unsupported
types'
- 'should not write access control metadata when upserting a supported
type if there is no active user profile ID'

Note: "upserting" is not supported in bulk update.

---------

Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>
@jeramysoucy jeramysoucy added backport:version Backport to applied version labels v9.3.0 and removed backport:skip This PR does not require backporting labels Jan 19, 2026
@kibanamachine kibanamachine added backport:skip This PR does not require backporting and removed backport:version Backport to applied version labels labels Jan 19, 2026
@jeramysoucy
Copy link
Copy Markdown
Contributor Author

jeramysoucy commented Jan 19, 2026

I'll backport it so it lands in 9.3.1.

@jeramysoucy jeramysoucy added backport:version Backport to applied version labels and removed backport:skip This PR does not require backporting labels Jan 19, 2026
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 19, 2026

Starting backport for target branches: 9.3

https://github.com/elastic/kibana/actions/runs/21129436370

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 19, 2026

Starting backport for target branches: 9.3

https://github.com/elastic/kibana/actions/runs/21129436358

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jan 19, 2026
@jeramysoucy @azasypkin
[Write restricted dashboards] Implements upsert for types supporting …
6eb0706 
…access control (elastic#247941)

Closes elastic#239686

## Summary

This PR implements the "upsert" case for types supporting access control
in the Saved Objects update operation. The default access mode is always
used during an upsert. The active user profile becomes the owner. If
there is no active user profile, no access control metadata is saved
during the upsert.

### Tests

-
x-pack/platform/test/spaces_api_integration/access_control_objects/apis/spaces/access_control_objects.ts
    - 'should apply defaults when upserting a supported type'
- 'should not write access control metadata when upserting unsupported
types'
- 'should not write access control metadata when upserting a supported
type if there is no active user profile ID'

Note: "upserting" is not supported in bulk update.

---------

Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>
(cherry picked from commit 7975d47)
@kibanamachine kibanamachine mentioned this pull request Jan 19, 2026
Merged
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 19, 2026

💚 All backports created successfully

Status Branch Result
✅ 9.3

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Jan 19, 2026
@jeramysoucy @azasypkin
[Write restricted dashboards] Implements upsert for types supporting …
58fa3de 
…access control (elastic#247941)

Closes elastic#239686

## Summary

This PR implements the "upsert" case for types supporting access control
in the Saved Objects update operation. The default access mode is always
used during an upsert. The active user profile becomes the owner. If
there is no active user profile, no access control metadata is saved
during the upsert.

### Tests

-
x-pack/platform/test/spaces_api_integration/access_control_objects/apis/spaces/access_control_objects.ts
    - 'should apply defaults when upserting a supported type'
- 'should not write access control metadata when upserting unsupported
types'
- 'should not write access control metadata when upserting a supported
type if there is no active user profile ID'

Note: "upserting" is not supported in bulk update.

---------

Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>
(cherry picked from commit 7975d47)
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Jan 19, 2026

💚 All backports created successfully

Status Branch Result
✅ 9.3

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Jan 19, 2026
@kibanamachine @jeramysoucy @azasypkin
[9.3] [Write restricted dashboards] Implements upsert for types suppo…
9b0f63d 
…rting access control (#247941) (#249503)

# Backport

This will backport the following commits from `main` to `9.3`:
- [[Write restricted dashboards] Implements upsert for types supporting
access control (#247941)](#247941)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Jeramy
Soucy","email":"jeramy.soucy@elastic.co"},"sourceCommit":{"committedDate":"2026-01-13T15:45:02Z","message":"[Write
restricted dashboards] Implements upsert for types supporting access
control (#247941)\n\nCloses #239686\n\n## Summary\n\nThis PR implements
the \"upsert\" case for types supporting access control\nin the Saved
Objects update operation. The default access mode is always\nused during
an upsert. The active user profile becomes the owner. If\nthere is no
active user profile, no access control metadata is saved\nduring the
upsert.\n\n###
Tests\n\n-\nx-pack/platform/test/spaces_api_integration/access_control_objects/apis/spaces/access_control_objects.ts\n
- 'should apply defaults when upserting a supported type'\n- 'should not
write access control metadata when upserting unsupported\ntypes'\n-
'should not write access control metadata when upserting a
supported\ntype if there is no active user profile ID'\n\nNote:
\"upserting\" is not supported in bulk
update.\n\n---------\n\nCo-authored-by: Aleh Zasypkin
<aleh.zasypkin@gmail.com>","sha":"7975d473559c90f7361f7238023331fc906af47c","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Team:Security","release_note:skip","backport:version","v9.3.0","v9.4.0"],"title":"[Write
restricted dashboards] Implements upsert for types supporting access
control","number":247941,"url":"https://github.com/elastic/kibana/pull/247941","mergeCommit":{"message":"[Write
restricted dashboards] Implements upsert for types supporting access
control (#247941)\n\nCloses #239686\n\n## Summary\n\nThis PR implements
the \"upsert\" case for types supporting access control\nin the Saved
Objects update operation. The default access mode is always\nused during
an upsert. The active user profile becomes the owner. If\nthere is no
active user profile, no access control metadata is saved\nduring the
upsert.\n\n###
Tests\n\n-\nx-pack/platform/test/spaces_api_integration/access_control_objects/apis/spaces/access_control_objects.ts\n
- 'should apply defaults when upserting a supported type'\n- 'should not
write access control metadata when upserting unsupported\ntypes'\n-
'should not write access control metadata when upserting a
supported\ntype if there is no active user profile ID'\n\nNote:
\"upserting\" is not supported in bulk
update.\n\n---------\n\nCo-authored-by: Aleh Zasypkin
<aleh.zasypkin@gmail.com>","sha":"7975d473559c90f7361f7238023331fc906af47c"}},"sourceBranch":"main","suggestedTargetBranches":["9.3"],"targetPullRequestStates":[{"branch":"9.3","label":"v9.3.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/247941","number":247941,"mergeCommit":{"message":"[Write
restricted dashboards] Implements upsert for types supporting access
control (#247941)\n\nCloses #239686\n\n## Summary\n\nThis PR implements
the \"upsert\" case for types supporting access control\nin the Saved
Objects update operation. The default access mode is always\nused during
an upsert. The active user profile becomes the owner. If\nthere is no
active user profile, no access control metadata is saved\nduring the
upsert.\n\n###
Tests\n\n-\nx-pack/platform/test/spaces_api_integration/access_control_objects/apis/spaces/access_control_objects.ts\n
- 'should apply defaults when upserting a supported type'\n- 'should not
write access control metadata when upserting unsupported\ntypes'\n-
'should not write access control metadata when upserting a
supported\ntype if there is no active user profile ID'\n\nNote:
\"upserting\" is not supported in bulk
update.\n\n---------\n\nCo-authored-by: Aleh Zasypkin
<aleh.zasypkin@gmail.com>","sha":"7975d473559c90f7361f7238023331fc906af47c"}}]}]
BACKPORT-->

Co-authored-by: Jeramy Soucy <jeramy.soucy@elastic.co>
Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@azasypkin azasypkin azasypkin approved these changes

@afharo afharo afharo approved these changes

Assignees

No one assigned

Labels

backport:version Backport to applied version labels release_note:skip Skip the PR/issue when compiling release notes Team:Security Platform Security: Auth, Users, Roles, Spaces, Audit Logging, etc t// v9.3.0 v9.4.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Write restricted dashboards] Allow write restricted upserts

6 participants

@jeramysoucy @elasticmachine @azasypkin @SiddharthMantri @kibanamachine @afharo