[8.x] [Fleet] Add actionable error message when generating logstash A…

…PI keys (#192765) (#192929)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Fleet] Add actionable error message when generating logstash API
keys (#192765)](#192765)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Nicolas
Chaulet","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-09-13T12:03:31Z","message":"[Fleet]
Add actionable error message when generating logstash API keys
(#192765)","sha":"d07ba0fa49dbb07e831f0096f91ca56573713741","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Fleet","v9.0.0","backport:prev-major"],"title":"[Fleet]
Add actionable error message when generating logstash API
keys","number":192765,"url":"https://github.com/elastic/kibana/pull/192765","mergeCommit":{"message":"[Fleet]
Add actionable error message when generating logstash API keys
(#192765)","sha":"d07ba0fa49dbb07e831f0096f91ca56573713741"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/192765","number":192765,"mergeCommit":{"message":"[Fleet]
Add actionable error message when generating logstash API keys
(#192765)","sha":"d07ba0fa49dbb07e831f0096f91ca56573713741"}},{"url":"https://github.com/elastic/kibana/pull/192923","number":192923,"branch":"8.x","state":"OPEN"}]}]
BACKPORT-->

Co-authored-by: Nicolas Chaulet <[email protected]>

x-pack/plugins/fleet/common/constants/output.ts

@@ -139,3 +139,18 @@ export const OUTPUT_TYPES_WITH_PRESET_SUPPORT: Array<ValueOf<OutputType>> = [
 ];
 
 export const OUTPUT_HEALTH_DATA_STREAM = 'logs-fleet_server.output_health-default';
+
+export const LOGSTASH_API_KEY_CLUSTER_PERMISSIONS = ['monitor', 'manage_own_api_key'];
+
+export const LOGSTASH_API_KEY_INDICES_PRIVILEGES = ['auto_configure', 'create_doc'];
+
+export const LOGSTASH_API_KEY_INDICES = [
+  'logs-*-*',
+  'metrics-*-*',
+  'traces-*-*',
+  'synthetics-*-*',
+  '.logs-endpoint.diagnostic.collection-*',
+  '.logs-endpoint.action.responses-*',
+  'profiling-*',
+  '.profiling-*',
+];

x-pack/plugins/fleet/public/applications/fleet/sections/settings/components/logstash_instructions/hooks.tsx

@@ -0,0 +1,88 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useState, useMemo, useCallback } from 'react';
+import { i18n } from '@kbn/i18n';
+import { FormattedMessage } from '@kbn/i18n-react';
+import { EuiCode } from '@elastic/eui';
+import { toMountPoint } from '@kbn/react-kibana-mount';
+
+import {
+  LOGSTASH_API_KEY_CLUSTER_PERMISSIONS,
+  LOGSTASH_API_KEY_INDICES,
+  LOGSTASH_API_KEY_INDICES_PRIVILEGES,
+} from '../../../../../../../common/constants';
+import { sendPostLogstashApiKeys, useStartServices } from '../../../../hooks';
+
+export function useLogstashApiKey() {
+  const [isLoading, setIsLoading] = useState(false);
+  const [apiKey, setApiKey] = useState<string>();
+  const startServices = useStartServices();
+  const { notifications } = startServices;
+  const generateApiKey = useCallback(async () => {
+    try {
+      setIsLoading(true);
+
+      const res = await sendPostLogstashApiKeys();
+      if (res.error) {
+        throw res.error;
+      }
+
+      setApiKey(res.data?.api_key);
+    } catch (err) {
+      if (err.statusCode === 403) {
+        notifications.toasts.addDanger(
+          {
+            title: i18n.translate('xpack.fleet.settings.logstashInstructions.generateApiKeyError', {
+              defaultMessage: 'Cannot generate an API key',
+            }),
+            text: toMountPoint(
+              <FormattedMessage
+                id="xpack.fleet.settings.logstashInstructions.generateApiKeyPermissions"
+                defaultMessage="You need the cluster permissions: {clusterPermissions}{br} and the index permissions: {indexPermissions}{br}for indexes: {br}{indexes}"
+                values={{
+                  clusterPermissions: (
+                    <EuiCode>{LOGSTASH_API_KEY_CLUSTER_PERMISSIONS.join(', ')}</EuiCode>
+                  ),
+                  indexPermissions: (
+                    <EuiCode>{LOGSTASH_API_KEY_INDICES_PRIVILEGES.join(', ')}</EuiCode>
+                  ),
+                  indexes: LOGSTASH_API_KEY_INDICES.map((index) => (
+                    <React.Fragment key={index}>
+                      <EuiCode>{index}</EuiCode>
+                      <br />
+                    </React.Fragment>
+                  )),
+                  br: <br />,
+                }}
+              />,
+              startServices
+            ),
+          },
+          {}
+        );
+      } else {
+        notifications.toasts.addError(err, {
+          title: i18n.translate('xpack.fleet.settings.logstashInstructions.generateApiKeyError', {
+            defaultMessage: 'Cannot generate an API key',
+          }),
+        });
+      }
+    } finally {
+      setIsLoading(false);
+    }
+  }, [notifications.toasts, startServices]);
+
+  return useMemo(
+    () => ({
+      isLoading,
+      generateApiKey,
+      apiKey,
+    }),
+    [isLoading, generateApiKey, apiKey]
+  );
+}

x-pack/plugins/fleet/server/services/api_keys/logstash_api_keys.ts

@@ -7,27 +7,24 @@
 
 import type { ElasticsearchClient } from '@kbn/core/server';
 
+import {
+  LOGSTASH_API_KEY_CLUSTER_PERMISSIONS,
+  LOGSTASH_API_KEY_INDICES,
+  LOGSTASH_API_KEY_INDICES_PRIVILEGES,
+} from '../../../common/constants';
+
 /**
  * Check if an esClient has enought permission to create a valid API key for logstash
  *
  * @param esClient
  */
 export async function canCreateLogstashApiKey(esClient: ElasticsearchClient) {
   const res = await esClient.security.hasPrivileges({
-    cluster: ['monitor', 'manage_own_api_key'],
+    cluster: LOGSTASH_API_KEY_CLUSTER_PERMISSIONS,
     index: [
       {
-        names: [
-          'logs-*-*',
-          'metrics-*-*',
-          'traces-*-*',
-          'synthetics-*-*',
-          '.logs-endpoint.diagnostic.collection-*',
-          '.logs-endpoint.action.responses-*',
-          'profiling-*',
-          '.profiling-*',
-        ],
-        privileges: ['auto_configure', 'create_doc'],
+        names: LOGSTASH_API_KEY_INDICES,
+        privileges: LOGSTASH_API_KEY_INDICES_PRIVILEGES,
       },
     ],
   });