import { KibanaRequest , Logger } from 'src/core/server' ; import { SecurityPluginSetup } from '../../../security/server' ; import { SpacesPluginStart } from '../../../spaces/server' ; import { ProductAccess } from '../../common/types' ; import { ConfigType } from '../index' ; import { callEnterpriseSearchConfigAPI } from './enterprise_search_config_api' ; interface CheckAccess { request : KibanaRequest ; security : SecurityPluginSetup ; spaces : SpacesPluginStart ; config : ConfigType ; log : Logger ; } const ALLOW_ALL_PLUGINS = { hasAppSearchAccess : true , hasWorkplaceSearchAccess : true , } ; const DENY_ALL_PLUGINS = { hasAppSearchAccess : false , hasWorkplaceSearchAccess : false , } ; /**
 * Determines whether the user has access to our Enterprise Search products
 * via HTTP call. If not, we hide the corresponding plugin links from the
 * nav and catalogue in `plugin.ts`, which disables plugin access
 */ export const checkAccess = async ( { config , security , spaces , request , log , } ) : Promise < ProductAccess > => { const isRbacEnabled = security . authz . mode . useRbacForRequest ( request ) ; if ( ! isRbacEnabled ) { return DENY_ALL_PLUGINS ; } const attemptSpaceRetrieval = request . auth . isAuthenticated ; let allowedAtSpace = false ; if ( attemptSpaceRetrieval ) { try { const space = await spaces . spacesService . getActiveSpace ( request ) ; allowedAtSpace = ! space . disabledFeatures ?. includes ( 'enterpriseSearch' ) ; } catch ( err ) { if ( err ?. output ?. statusCode === 403 ) { allowedAtSpace = false ; } else { throw err ; } } } if ( ! allowedAtSpace ) { return DENY_ALL_PLUGINS ; } const isSuperUser = async ( ) : Promise < boolean > => { try { const { hasAllRequested } = await security . authz . checkPrivilegesWithRequest ( request ) . globally ( { kibana : security . authz . actions . ui . get ( 'enterpriseSearch' , 'all' ) } ) ; return hasAllRequested ; } catch ( err ) { if ( err . statusCode === 401 || err . statusCode === 403 ) { return false ; } throw err ; } } ; if ( await isSuperUser ( ) ) { return ALLOW_ALL_PLUGINS ; } if ( ! config . host ) { return DENY_ALL_PLUGINS ; } const { access } = ( await callEnterpriseSearchConfigAPI ( { request , config , log } ) ) || { } ; return access || DENY_ALL_PLUGINS ; } ;