import expect from '@kbn/expect' ; import { FtrProviderContext } from '../../ftr_provider_context' ; import { createUsersAndRoles , deleteUsersAndRoles , } from '../../../cases_api_integration/common/lib/authentication' ; import { Role , User } from '../../../cases_api_integration/common/lib/authentication/types' ; import { createCase , deleteAllCaseItems , getCase , } from '../../../cases_api_integration/common/lib/utils' ; import { getPostCaseRequest } from '../../../cases_api_integration/common/lib/mock' ; import { APP_ID } from '../../../../plugins/security_solution/common/constants' ; const secAll = { name : 'sec_all_role' , privileges : { elasticsearch : { indices : [ { names : [ '*' ] , privileges : [ 'all' ] , } , ] , } , kibana : [ { feature : { siem : [ 'all' ] , securitySolutionCases : [ 'all' ] , actions : [ 'all' ] , actionsSimulators : [ 'all' ] , } , spaces : [ '*' ] , } , ] , } , } ; const secAllUser = { username : 'sec_all_user' , password : 'password' , roles : [ secAll . name ] , } ; const secAllCasesRead = { name : 'sec_all_cases_read_role' , privileges : { elasticsearch : { indices : [ { names : [ '*' ] , privileges : [ 'all' ] , } , ] , } , kibana : [ { feature : { siem : [ 'all' ] , securitySolutionCases : [ 'read' ] , actions : [ 'all' ] , actionsSimulators : [ 'all' ] , } , spaces : [ '*' ] , } , ] , } , } ; const secAllCasesReadUser = { username : 'sec_all_cases_read_user' , password : 'password' , roles : [ secAllCasesRead . name ] , } ; const secAllCasesNone = { name : 'sec_all_cases_none_role' , privileges : { elasticsearch : { indices : [ { names : [ '*' ] , privileges : [ 'all' ] , } , ] , } , kibana : [ { feature : { siem : [ 'all' ] , actions : [ 'all' ] , actionsSimulators : [ 'all' ] , } , spaces : [ '*' ] , } , ] , } , } ; const secAllCasesNoneUser = { username : 'sec_all_cases_none_user' , password : 'password' , roles : [ secAllCasesNone . name ] , } ; const secReadCasesAll = { name : 'sec_read_cases_all_role' , privileges : { elasticsearch : { indices : [ { names : [ '*' ] , privileges : [ 'all' ] , } , ] , } , kibana : [ { feature : { siem : [ 'read' ] , securitySolutionCases : [ 'all' ] , actions : [ 'all' ] , actionsSimulators : [ 'all' ] , } , spaces : [ '*' ] , } , ] , } , } ; const secReadCasesAllUser = { username : 'sec_read_cases_all_user' , password : 'password' , roles : [ secReadCasesAll . name ] , } ; const secReadCasesRead = { name : 'sec_read_cases_read_role' , privileges : { elasticsearch : { indices : [ { names : [ '*' ] , privileges : [ 'all' ] , } , ] , } , kibana : [ { feature : { siem : [ 'read' ] , securitySolutionCases : [ 'read' ] , actions : [ 'all' ] , actionsSimulators : [ 'all' ] , } , spaces : [ '*' ] , } , ] , } , } ; const secReadCasesReadUser = { username : 'sec_read_cases_read_user' , password : 'password' , roles : [ secReadCasesRead . name ] , } ; const secRead = { name : 'sec_read_role' , privileges : { elasticsearch : { indices : [ { names : [ '*' ] , privileges : [ 'all' ] , } , ] , } , kibana : [ { feature : { siem : [ 'read' ] , securitySolutionCases : [ 'read' ] , actions : [ 'all' ] , actionsSimulators : [ 'all' ] , } , spaces : [ '*' ] , } , ] , } , } ; const secReadUser = { username : 'sec_read_user' , password : 'password' , roles : [ secRead . name ] , } ; const secReadCasesNone = { name : 'sec_read_cases_none_role' , privileges : { elasticsearch : { indices : [ { names : [ '*' ] , privileges : [ 'all' ] , } , ] , } , kibana : [ { feature : { siem : [ 'read' ] , actions : [ 'all' ] , actionsSimulators : [ 'all' ] , } , spaces : [ '*' ] , } , ] , } , } ; const secReadCasesNoneUser = { username : 'sec_read_cases_none_user' , password : 'password' , roles : [ secReadCasesNone . name ] , } ; const roles = [ secAll , secAllCasesRead , secAllCasesNone , secReadCasesAll , secReadCasesRead , secRead , secReadCasesNone , ] ; const users = [ secAllUser , secAllCasesReadUser , secAllCasesNoneUser , secReadCasesAllUser , secReadCasesReadUser , secReadUser , secReadCasesNoneUser , ] ; export default ( { getService } ) : void => { describe ( 'security solution cases sub feature privilege' , ( ) => { const es = getService ( 'es' ) ; const supertestWithoutAuth = getService ( 'supertestWithoutAuth' ) ; const supertest = getService ( 'supertest' ) ; before ( async ( ) => { await createUsersAndRoles ( getService , users , roles ) ; } ) ; after ( async ( ) => { await deleteUsersAndRoles ( getService , users , roles ) ; } ) ; afterEach ( async ( ) => { await deleteAllCaseItems ( es ) ; } ) ; for ( const user of [ secAllUser , secReadCasesAllUser ] ) { it ( `User ${ user . username } with role(s) ${ user . roles . join ( ) } can create a case` , async ( ) => { await createCase ( supertestWithoutAuth , getPostCaseRequest ( { owner : APP_ID } ) , 200 , { user , space : null , } ) ; } ) ; } for ( const user of [ secAllCasesReadUser , secReadCasesAllUser , secReadCasesReadUser , secReadUser , ] ) { it ( `User ${ user . username } with role(s) ${ user . roles . join ( ) } can get a case` , async ( ) => { const caseInfo = await createCase ( supertest , getPostCaseRequest ( { owner : APP_ID } ) ) ; const retrievedCase = await getCase ( { supertest : supertestWithoutAuth , caseId : caseInfo . id , expectedHttpCode : 200 , auth : { user , space : null } , } ) ; expect ( caseInfo . owner ) . to . eql ( retrievedCase . owner ) ; } ) ; } for ( const user of [ secAllCasesReadUser , secAllCasesNoneUser , secReadCasesReadUser , secReadUser , secReadCasesNoneUser , ] ) { it ( `User ${ user . username } with role(s) ${ user . roles . join ( ) } cannot create a case` , async ( ) => { await createCase ( supertestWithoutAuth , getPostCaseRequest ( { owner : APP_ID } ) , 403 , { user , space : null , } ) ; } ) ; } for ( const user of [ secAllCasesNoneUser , secReadCasesNoneUser ] ) { it ( `User ${ user . username } with role(s) ${ user . roles . join ( ) } cannot get a case` , async ( ) => { const caseInfo = await createCase ( supertest , getPostCaseRequest ( { owner : APP_ID } ) ) ; await getCase ( { supertest : supertestWithoutAuth , caseId : caseInfo . id , expectedHttpCode : 403 , auth : { user , space : null } , } ) ; } ) ; } } ) ; } ;