[Search][Onboarding] api-key plugin

.github/CODEOWNERS

@@ -752,6 +752,8 @@ src/plugins/screenshot_mode @elastic/appex-sharedux
 x-pack/examples/screenshotting_example @elastic/appex-sharedux
 x-pack/plugins/screenshotting @elastic/kibana-reporting-services
 packages/kbn-screenshotting-server @elastic/appex-sharedux
+packages/kbn-search-api-keys-api @elastic/search-kibana
+packages/kbn-search-api-keys-components @elastic/search-kibana
 packages/kbn-search-api-panels @elastic/search-kibana
 x-pack/plugins/search_assistant @elastic/search-kibana
 packages/kbn-search-connectors @elastic/search-kibana
@@ -765,6 +767,7 @@ x-pack/plugins/search_inference_endpoints @elastic/search-kibana
 x-pack/plugins/search_notebooks @elastic/search-kibana
 x-pack/plugins/search_playground @elastic/search-kibana
 packages/kbn-search-response-warnings @elastic/kibana-data-discovery
+x-pack/packages/search/shared_ui @elastic/search-kibana
 packages/kbn-search-types @elastic/kibana-data-discovery
 x-pack/plugins/searchprofiler @elastic/kibana-management
 x-pack/test/security_api_integration/packages/helpers @elastic/kibana-security

.i18nrc.json

@@ -109,6 +109,7 @@
     "server": "src/legacy/server",
     "share": ["src/plugins/share", "packages/kbn-reporting-share"],
     "sharedUXPackages": "packages/shared-ux",
+    "searchApiKeysComponents": "packages/kbn-search-api-keys-components",
     "searchApiPanels": "packages/kbn-search-api-panels/",
     "searchErrors": "packages/kbn-search-errors",
     "searchIndexDocuments": "packages/kbn-search-index-documents",

package.json

@@ -769,6 +769,8 @@
     "@kbn/screenshotting-example-plugin": "link:x-pack/examples/screenshotting_example",
     "@kbn/screenshotting-plugin": "link:x-pack/plugins/screenshotting",
     "@kbn/screenshotting-server": "link:packages/kbn-screenshotting-server",
+    "@kbn/search-api-keys-api": "link:packages/kbn-search-api-keys-api",
+    "@kbn/search-api-keys-components": "link:packages/kbn-search-api-keys-components",
     "@kbn/search-api-panels": "link:packages/kbn-search-api-panels",
     "@kbn/search-assistant": "link:x-pack/plugins/search_assistant",
     "@kbn/search-connectors": "link:packages/kbn-search-connectors",
@@ -782,6 +784,7 @@
     "@kbn/search-notebooks": "link:x-pack/plugins/search_notebooks",
     "@kbn/search-playground": "link:x-pack/plugins/search_playground",
     "@kbn/search-response-warnings": "link:packages/kbn-search-response-warnings",
+    "@kbn/search-shared-ui": "link:x-pack/packages/search/shared_ui",
     "@kbn/search-types": "link:packages/kbn-search-types",
     "@kbn/searchprofiler-plugin": "link:x-pack/plugins/searchprofiler",
     "@kbn/security-api-key-management": "link:x-pack/packages/security/api_key_management",

packages/kbn-search-api-keys-api/README.md

@@ -0,0 +1,3 @@
+# Search API Keys
+
+The Search API Keys package is a shared components and utilities to simplify managing the API Keys experience for elasticsearch users across stack and serverless search solutions.

packages/kbn-search-api-keys-api/jest.config.js

@@ -0,0 +1,17 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+module.exports = {
+  preset: '@kbn/test/jest_node',
+  rootDir: '../..',
+  roots: ['<rootDir>/packages/kbn-search-api-keys-api'],
+  coverageDirectory: '<rootDir>/target/kibana-coverage/jest/packages/kbn-search-api-keys-api',
+  coverageReporters: ['text', 'html'],
+  collectCoverageFrom: ['<rootDir>/packages/kbn-search-api-keys-api/**/*.{ts,tsx}'],
+};

packages/kbn-search-api-keys-api/kibana.jsonc

@@ -0,0 +1,5 @@
+{
+  "type": "shared-server",
+  "id": "@kbn/search-api-keys-api",
+  "owner": "@elastic/search-kibana"
+}

packages/kbn-search-api-keys-api/package.json

@@ -0,0 +1,6 @@
+{
+  "name": "@kbn/search-api-keys-api",
+  "private": true,
+  "version": "1.0.0",
+  "license": "Elastic License 2.0 OR AGPL-3.0-only OR SSPL-1.0"
+}

packages/kbn-search-api-keys-api/server/index.ts

@@ -0,0 +1,10 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+export * from './routes/routes';

packages/kbn-search-api-keys-api/server/lib/create_key.ts

@@ -0,0 +1,31 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
+import type { Logger } from '@kbn/logging';
+import type { APIKeyCreationResponse } from '../types';
+
+export async function createAPIKey(
+  name: string,
+  client: ElasticsearchClient,
+  logger: Logger
+): Promise<APIKeyCreationResponse> {
+  try {
+    const apiKey = await client.security.createApiKey({
+      name,
+      role_descriptors: {},
+    });
+
+    return apiKey;
+  } catch (e) {
+    logger.error(`Search API Keys: Error during creating API Key`);
+    logger.error(e);
+    throw e;
+  }
+}

packages/kbn-search-api-keys-api/server/lib/get_key_by_id.ts

@@ -0,0 +1,30 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
+import type { Logger } from '@kbn/logging';
+import type { GetApiKeyResponse } from '../types';
+
+export async function getAPIKeyById(
+  id: string,
+  client: ElasticsearchClient,
+  logger: Logger
+): Promise<GetApiKeyResponse> {
+  try {
+    const apiKey = await client.security.getApiKey({
+      id,
+    });
+
+    return apiKey.api_keys?.[0];
+  } catch (e) {
+    logger.error(`Search API Keys: Error on getting API Key`);
+    logger.error(e);
+    throw e;
+  }
+}

packages/kbn-search-api-keys-api/server/lib/privileges.ts

@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import type { ElasticsearchClient } from '@kbn/core-elasticsearch-server';
+import type { Logger } from '@kbn/logging';
+
+export async function fetchUserStartPrivileges(
+  client: ElasticsearchClient,
+  logger: Logger
+): Promise<boolean> {
+  try {
+    // relying on manage cluster privilege to check if user can create API keys
+    // and can also have permissions for index monitoring
+    const securityCheck = await client.security.hasPrivileges({
+      cluster: ['manage'],
+    });
+
+    return securityCheck?.cluster?.manage ?? false;
+  } catch (e) {
+    logger.error(`Error checking user privileges for search API Keys`);
+    logger.error(e);
+    return false;
+  }
+}
+
+export async function fetchClusterHasApiKeys(
+  client: ElasticsearchClient,
+  logger: Logger
+): Promise<boolean> {
+  try {
+    const clusterApiKeys = await client.security.queryApiKeys({
+      query: {
+        term: {
+          invalidated: false,
+        },
+      },
+    });
+    return clusterApiKeys.api_keys.length > 0;
+  } catch (e) {
+    logger.error(`Error checking cluster for existing valid API keys`);
+    logger.error(e);
+    return true;
+  }
+}

packages/kbn-search-api-keys-api/server/routes/routes.ts

@@ -0,0 +1,108 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import type { IRouter } from '@kbn/core/server';
+import type { Logger } from '@kbn/logging';
+
+import { schema } from '@kbn/config-schema';
+import { APIRoutes } from '../types';
+import { getAPIKeyById } from '../lib/get_key_by_id';
+import { createAPIKey } from '../lib/create_key';
+import { fetchClusterHasApiKeys, fetchUserStartPrivileges } from '../lib/privileges';
+
+const API_KEY_NAME = 'Unrestricted API Key';
+
+export function registerSearchApiKeysRoutes(router: IRouter, logger: Logger) {
+  router.post(
+    {
+      path: APIRoutes.API_KEY_VALIDITY,
+      validate: {
+        body: schema.object({
+          id: schema.string(),
+        }),
+      },
+      options: {
+        access: 'internal',
+      },
+    },
+    async (context, request, response) => {
+      try {
+        const core = await context.core;
+        const client = core.elasticsearch.client.asCurrentUser;
+        const apiKey = await getAPIKeyById(request.body.id, client, logger);
+
+        if (!apiKey) {
+          return response.customError({
+            body: { message: 'API key is not found.' },
+            statusCode: 404,
+          });
+        }
+
+        return response.ok({
+          body: { isValid: !apiKey.invalidated },
+          headers: { 'content-type': 'application/json' },
+        });
+      } catch (e) {
+        logger.error(`Error fetching API Key`);
+        logger.error(e);
+        return response.customError({
+          body: { message: e.message },
+          statusCode: 500,
+        });
+      }
+    }
+  );
+
+  router.post(
+    {
+      path: APIRoutes.API_KEYS,
+      validate: {},
+      options: {
+        access: 'internal',
+      },
+    },
+    async (context, _request, response) => {
+      try {
+        const core = await context.core;
+        const client = core.elasticsearch.client.asCurrentUser;
+        const clusterHasApiKeys = await fetchClusterHasApiKeys(client, logger);
+
+        if (clusterHasApiKeys) {
+          return response.customError({
+            body: { message: 'Project already has API keys' },
+            statusCode: 400,
+          });
+        }
+
+        const canCreateApiKeys = await fetchUserStartPrivileges(client, logger);
+
+        if (!canCreateApiKeys) {
+          return response.customError({
+            body: { message: 'User does not have required privileges' },
+            statusCode: 403,
+          });
+        }
+
+        const apiKey = await createAPIKey(API_KEY_NAME, client, logger);
+
+        return response.ok({
+          body: apiKey,
+          headers: { 'content-type': 'application/json' },
+        });
+      } catch (e) {
+        logger.error(`Error creating API Key`);
+        logger.error(e);
+        return response.customError({
+          body: { message: e.message },
+          statusCode: 500,
+        });
+      }
+    }
+  );
+}

packages/kbn-search-api-keys-api/server/types.ts

@@ -0,0 +1,27 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+export enum APIRoutes {
+  API_KEYS = '/internal/search_api_keys',
+  API_KEY_VALIDITY = '/internal/search_api_keys/validity',
+}
+
+export interface APIKey {
+  id: string;
+  name: string;
+  expiration?: number;
+  invalidated?: boolean;
+}
+
+export interface APIKeyCreationResponse extends Pick<APIKey, 'id' | 'name' | 'expiration'> {
+  api_key: string;
+  encoded: string;
+}
+
+export type GetApiKeyResponse = APIKey;

packages/kbn-search-api-keys-api/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "target/types",
+  },
+  "include": [
+    "server/**/*"
+  ],
+  "kbn_references": [
+    "@kbn/core-elasticsearch-server",
+    "@kbn/logging",
+    "@kbn/core",
+    "@kbn/config-schema",
+  ],
+  "exclude": [
+    "target/**/*",
+  ]
+}

packages/kbn-search-api-keys-components/README.md

@@ -0,0 +1,3 @@
+# Search API Key Components
+
+The Search API Keys components package is a shared components and utilities to simplify managing the API Keys experience for elasticsearch users across stack and serverless search solutions.

packages/kbn-search-api-keys-components/jest.config.js

@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+module.exports = {
+  preset: '@kbn/test',
+  rootDir: '../..',
+  roots: ['<rootDir>/packages/kbn-search-api-keys-components'],
+  coverageDirectory:
+    '<rootDir>/target/kibana-coverage/jest/packages/kbn-search-api-keys-components',
+  coverageReporters: ['text', 'html'],
+  collectCoverageFrom: [
+    '<rootDir>/packages/kbn-search-api-keys-components/public/{components,hooks}/**/*.{ts,tsx}',
+  ],
+};

packages/kbn-search-api-keys-components/kibana.jsonc

@@ -0,0 +1,5 @@
+{
+  "type": "shared-browser",
+  "id": "@kbn/search-api-keys-components",
+  "owner": "@elastic/search-kibana"
+}