Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Fleet] Handle missing permissions when creating standalone agent API keys #193218

Merged

Conversation

nchaulet
Copy link
Member

@nchaulet nchaulet commented Sep 17, 2024

Description

Resolve #189150

We were not handling errors when creating standalone agent API keys in the Fleet UI.

That PR address that by:

  • handling the error in the UI
  • verifying in the API that user has the correct permissions and if not throw a 403 with an actionable error message.
  • Add missing API integration test to that API

UI Changes

Screenshot 2024-09-17 at 2 50 25 PM

@nchaulet nchaulet added release_note:skip Skip the PR/issue when compiling release notes Team:Fleet Team label for Observability Data Collection Fleet team backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) v8.16.0 labels Sep 17, 2024
@nchaulet nchaulet self-assigned this Sep 17, 2024
@nchaulet nchaulet requested a review from a team as a code owner September 17, 2024 19:19
@elasticmachine
Copy link
Contributor

Pinging @elastic/fleet (Team:Fleet)

@obltmachine
Copy link

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

  • /oblt-deploy : Deploy a Kibana instance using the Observability test environments.
  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)


export function sendCreateStandaloneAgentAPIKey(body: PostStandaloneAgentAPIKeyRequest['body']) {
return sendRequest<PostStandaloneAgentAPIKeyResponse>({
return sendRequestForRq<PostStandaloneAgentAPIKeyResponse>({
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use sendRequestForRq as it throws on error, sendRequest return an error that was not handled

@@ -21,7 +21,7 @@ export const registerRoutes = (router: FleetAuthzRouter) => {
path: CREATE_STANDALONE_AGENT_API_KEY_ROUTE,
access: 'internal',
fleetAuthz: {
fleet: { all: true },
fleet: { addAgents: true },
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should only have the addAgents permission and not all

@@ -210,12 +210,15 @@ export function useGetCreateApiKey() {
const core = useStartServices();

const [apiKey, setApiKey] = useState<string | undefined>(undefined);
const [isLoading, setIsLoading] = useState(false);
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a loading state, as it was weird to me to not have feedback while the API key is creating

Copy link
Contributor

@jen-huang jen-huang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

The CI Stats report is too large to be displayed here, check out the CI build annotation for this information.

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @nchaulet

@nchaulet nchaulet merged commit 6a79e2d into elastic:main Sep 18, 2024
28 checks passed
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Sep 18, 2024
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Sep 18, 2024
…nt API keys (#193218) (#193292)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[Fleet] Handle missing permissions when creating standalone agent API
keys (#193218)](#193218)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Nicolas
Chaulet","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-09-18T13:06:09Z","message":"[Fleet]
Handle missing permissions when creating standalone agent API keys
(#193218)","sha":"6a79e2d0be4d1cb9155b32afcff5753e1860b801","branchLabelMapping":{"^v9.0.0$":"main","^v8.16.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Fleet","v9.0.0","backport:prev-minor","v8.16.0"],"title":"[Fleet]
Handle missing permissions when creating standalone agent API keys
","number":193218,"url":"https://github.com/elastic/kibana/pull/193218","mergeCommit":{"message":"[Fleet]
Handle missing permissions when creating standalone agent API keys
(#193218)","sha":"6a79e2d0be4d1cb9155b32afcff5753e1860b801"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/193218","number":193218,"mergeCommit":{"message":"[Fleet]
Handle missing permissions when creating standalone agent API keys
(#193218)","sha":"6a79e2d0be4d1cb9155b32afcff5753e1860b801"}},{"branch":"8.x","label":"v8.16.0","branchLabelMappingKey":"^v8.16.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Nicolas Chaulet <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport:prev-minor Backport to (8.x) the previous minor version (i.e. one version back from main) release_note:skip Skip the PR/issue when compiling release notes Team:Fleet Team label for Observability Data Collection Fleet team v8.16.0 v9.0.0
Projects
None yet
6 participants