Merge branch 'main' into fix-cloud-test-for-encoded-param-in-context

docs/setup/configuring-reporting.asciidoc

@@ -6,7 +6,16 @@
 <titleabbrev>Configure reporting</titleabbrev>
 ++++
 
-To enable users to manually and automatically generate reports, install the reporting packages, grant users access to the {report-features}, and secure the reporting endpoints.
+For security, you grant users access to the {report-features} and secure the reporting endpoints
+with TLS/SSL encryption. Additionally, you can install graphical packages into the operating system
+to enable the {kib} server to have screenshotting capabilities.
+
+* <<install-reporting-packages>>
+* <<grant-user-access>>
+* <<reporting-roles-user-api>>
+* <<grant-user-access-basic>>
+* <<grant-user-access-external-provider>>
+* <<securing-reporting>>
 
 [float]
 [[install-reporting-packages]]
@@ -32,7 +41,7 @@ If you are using Ubuntu/Debian systems, install the following packages:
 * `libfontconfig1`
 * `libnss3`
 
-If the system is missing dependencies, *Reporting* fails in a non-deterministic way. {kib} runs a self-test at server startup, and
+If the system is missing dependencies, a screenshot report job may fail in a non-deterministic way. {kib} runs a self-test at server startup, and
 if it encounters errors, logs them in the Console. The error message does not include
 information about why Chromium failed to run. The most common error message is `Error: connect ECONNREFUSED`, which indicates
 that {kib} could not connect to the Chromium process.
@@ -53,7 +62,7 @@ xpack.reporting.roles.enabled: false
 +
 NOTE: If you use the default settings, you can still create a custom role that grants reporting privileges. The default role is `reporting_user`. This behavior is being deprecated and does not allow application-level access controls for {report-features}, and does not allow API keys or authentication tokens to authorize report generation. Refer to <<reporting-advanced-settings, reporting security settings>> for information and caveats about the deprecated access control features.
 
-. Create the reporting role. 
+. Create the reporting role.
 
 .. Open the main menu, then click *Stack Management*.
 
@@ -77,14 +86,13 @@ For more information, refer to {ref}/security-privileges.html[Security privilege
 
 .. Click *Customize*, then click *Analytics*.
 
-.. Next each application listed, click *All* or click *Read*. You will need to enable the *Customize sub-feature
-privileges* checkbox to grant reporting privileges if you select *Read*.
+.. For each application, select *All*, or to customize the privileges, select *Read* and *Customize sub-feature privileges*.
 +
-If you’ve followed the example above, you should end up on a screen defining your customized privileges that looks like this:
+NOTE: If you have a Basic license, sub-feature privileges are unavailable. For details, check out <<grant-user-access-basic>>.
 [role="screenshot"]
-image::user/reporting/images/kibana-privileges-with-reporting.png["Kibana privileges with Reporting options"]
+image::user/reporting/images/kibana-privileges-with-reporting.png["Kibana privileges with Reporting options, Gold or higher license"]
 +
-NOTE: If *Reporting* options for application features are not available, contact your administrator, or <<reporting-advanced-settings,check that xpack.reporting.roles.enabled is set to false in kibana.yml>>. 
+NOTE: If the *Reporting* options for application features are unavailable, and the cluster license is higher than Basic, contact your administrator, or <<reporting-advanced-settings,check that `xpack.reporting.roles.enabled` is set to `false` in kibana.yml>>.
 
 .. Click *Add {kib} privilege*.
 
@@ -94,7 +102,7 @@ NOTE: If *Reporting* options for application features are not available, contact
 
 .. Open the main menu, then click *Stack Management*.
 
-.. Click *Users*, then click the user you want to assign the reporting role to. 
+.. Click *Users*, then click the user you want to assign the reporting role to.
 
 .. From the *Roles* dropdown, select *custom_reporting_user*.
 
@@ -105,29 +113,43 @@ Granting the privilege to generate reports also grants the user the privilege to
 [float]
 [[reporting-roles-user-api]]
 ==== Grant access with the role API
-With <<grant-user-access, {kib} application privileges>> enabled in Reporting, you can also use the {ref}/security-api-put-role.html[role API] to grant access to the {report-features}. Grant custom reporting roles to users in combination with other roles that grant read access to the data in {es}, and at least read access in the applications where users can generate reports.
+With <<grant-user-access, {kib} application privileges>> enabled in Reporting, you can also use the {ref}/security-api-put-role.html[role API] to grant access to the {report-features}, using *All* privileges, or sub-feature privileges.
 
-[source, sh]
+NOTE: If you have a Basic license, sub-feature privileges are unavailable. For details, check out the API command to grant *All* privileges in <<grant-user-access-basic>>.
+
+Grant users custom Reporting roles, other roles that grant read access to the data in {es}, and at least read access in the applications where users can generate reports.
+
+[source, json]
 ---------------------------------------------------------------
-POST /_security/role/custom_reporting_user
+PUT localhost:5601/api/security/role/custom_reporting_user
 {
-  metadata: {},
-  elasticsearch: { cluster: [], indices: [], run_as: [] },
-  kibana: [
+  "elasticsearch": { "cluster": [], "indices": [], "run_as": [] },
+  "kibana": [
     {
-      base: [],
-      feature: {
-        dashboard: [
-          'generate_report', <1>
-          'download_csv_report' <2>
+      "base": [],
+      "feature": {
+        "dashboard": [
+          "minimal_read",
+          "generate_report", <1>
+          "download_csv_report" <2>
+        ],
+        "discover": [
+          "minimal_read",
+          "generate_report" <3>
+        ],
+        "canvas": [
+          "minimal_read",
+          "generate_report" <4>
         ],
-        discover: ['generate_report'], <3>
-        canvas: ['generate_report'], <4>
-        visualize: ['generate_report'], <5>
+        "visualize": [
+          "minimal_read",
+          "generate_report" <5>
+        ]
       },
-      spaces: ['*'],
+      "spaces": [ "*" ]
     }
-  ]
+  ],
+  "metadata": {} // optional
 }
 ---------------------------------------------------------------
 // CONSOLE
@@ -139,6 +161,41 @@ POST /_security/role/custom_reporting_user
 <5> Grants access to generate PNG and PDF reports in *Visualize Library*.
 
 [float]
+[[grant-user-access-basic]]
+=== Grant users access with a Basic license
+
+With a Basic license, you can grant users access with custom roles to {report-features} with <<kibana-privileges, {kib} application privileges>>. However, with a Basic license, sub-feature privileges are unavailable. <<grant-user-access,Create a role>>, then select *All* privileges for the applications where users can create reports.
+
+[role="screenshot"]
+image::user/reporting/images/kibana-privileges-with-reporting-basic.png["Kibana privileges with Reporting options, Basic license"]
+
+With a Basic license, sub-feature application privileges are unavailable, but you can use the {ref}/security-api-put-role.html[role API] to grant access to CSV {report-features}:
+
+[source, sh]
+---------------------------------------------------------------
+PUT localhost:5601/api/security/role/custom_reporting_user
+{
+  "elasticsearch": { "cluster": [], "indices": [], "run_as": [] },
+  "kibana": [
+    {
+      "base": [],
+      "feature": {
+        "dashboard": [ "all" ], <1>
+        "discover": [ "all" ], <2>
+      },
+      "spaces": [ "*" ]
+    }
+  ],
+  "metadata": {} // optional
+}
+---------------------------------------------------------------
+// CONSOLE
+
+<1> Grants access to generate CSV reports from saved searches in *Discover*.
+<2> Grants access to download CSV reports from saved search panels in *Dashboard*.
+
+[float]
+[[grant-user-access-external-provider]]
 ==== Grant access using an external provider
 
 If you are using an external identity provider, such as LDAP or Active Directory, you can assign roles to individual users or groups of users. Role mappings are configured in {ref}/mapping-roles.html[`config/role_mapping.yml`].

docs/user/reporting/reporting-troubleshooting.asciidoc

@@ -1,6 +1,7 @@
 [role="xpack"]
 [[reporting-troubleshooting]]
 == Reporting troubleshooting
+
 ++++
 <titleabbrev>Troubleshooting</titleabbrev>
 ++++

package.json

@@ -108,7 +108,7 @@
     "@elastic/charts": "43.1.1",
     "@elastic/datemath": "link:bazel-bin/packages/elastic-datemath",
     "@elastic/elasticsearch": "npm:@elastic/elasticsearch-canary@8.2.0-canary.1",
-    "@elastic/ems-client": "8.0.0",
+    "@elastic/ems-client": "8.1.0",
     "@elastic/eui": "48.1.1",
     "@elastic/filesaver": "1.1.2",
     "@elastic/node-crypto": "1.2.1",

packages/kbn-docs-utils/src/api_docs/tests/snapshots/plugin_a.mdx

@@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/pluginA
 title: "pluginA"
 image: https://source.unsplash.com/400x175/?github
 summary: API docs for the pluginA plugin
-date: 2020-11-16
+date: 2022-02-14
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'pluginA']
 warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info.
 ---

packages/kbn-docs-utils/src/api_docs/tests/snapshots/plugin_a_foo.mdx

@@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/pluginA-foo
 title: "pluginA.foo"
 image: https://source.unsplash.com/400x175/?github
 summary: API docs for the pluginA.foo plugin
-date: 2020-11-16
+date: 2022-02-14
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'pluginA.foo']
 warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info.
 ---

packages/kbn-docs-utils/src/api_docs/tests/snapshots/plugin_b.mdx

@@ -4,7 +4,7 @@ slug: /kibana-dev-docs/api/pluginB
 title: "pluginB"
 image: https://source.unsplash.com/400x175/?github
 summary: API docs for the pluginB plugin
-date: 2020-11-16
+date: 2022-02-14
 tags: ['contributor', 'dev', 'apidocs', 'kibana', 'pluginB']
 warning: This document is auto-generated and is meant to be viewed inside our experimental, new docs system. Reach out in #docs-engineering for more info.
 ---

src/dev/license_checker/config.ts

@@ -76,7 +76,7 @@ export const DEV_ONLY_LICENSE_ALLOWED = ['MPL-2.0'];
 export const LICENSE_OVERRIDES = {
   'jsts@1.6.2': ['Eclipse Distribution License - v 1.0'], // cf. https://github.com/bjornharrtell/jsts
   '@mapbox/jsonlint-lines-primitives@2.0.2': ['MIT'], // license in readme https://github.com/tmcw/jsonlint
-  '@elastic/ems-client@8.0.0': ['Elastic License 2.0'],
+  '@elastic/ems-client@8.1.0': ['Elastic License 2.0'],
   '@elastic/eui@48.1.1': ['SSPL-1.0 OR Elastic License 2.0'],
   'language-subtag-registry@0.3.21': ['CC-BY-4.0'], // retired ODC‑By license https://github.com/mattcg/language-subtag-registry
 };

src/plugins/chart_expressions/expression_gauge/common/expression_functions/gauge_function.test.ts

@@ -36,28 +36,19 @@ describe('interpreter/functions#gauge', () => {
     min: 'col-1-2',
     metric: 'col-0-1',
   };
-  const checkArg = (
-    arg: keyof GaugeArguments,
-    options: Record<string, string>,
-    invalidValue: string
-  ) => {
+  const checkArg = (arg: keyof GaugeArguments, options: Record<string, string>) => {
     Object.values(options).forEach((option) => {
       it(`returns an object with the correct structure for the ${option} ${arg}`, () => {
         const actual = fn(context, { ...args, [arg]: option }, undefined);
         expect(actual).toMatchSnapshot();
       });
     });
-
-    it(`throws error on wrong ${arg} type`, () => {
-      const actual = () => fn(context, { ...args, [arg]: invalidValue as any }, undefined);
-      expect(actual).toThrowErrorMatchingSnapshot();
-    });
   };
 
-  checkArg('shape', GaugeShapes, 'invalid_shape');
-  checkArg('colorMode', GaugeColorModes, 'invalid_color_mode');
-  checkArg('ticksPosition', GaugeTicksPositions, 'invalid_ticks_position');
-  checkArg('labelMajorMode', GaugeLabelMajorModes, 'invalid_label_major_mode');
+  checkArg('shape', GaugeShapes);
+  checkArg('colorMode', GaugeColorModes);
+  checkArg('ticksPosition', GaugeTicksPositions);
+  checkArg('labelMajorMode', GaugeLabelMajorModes);
 
   it(`returns an object with the correct structure for the circle if centralMajor and centralMajorMode are passed`, () => {
     const actual = fn(

src/plugins/chart_expressions/expression_gauge/common/expression_functions/gauge_function.ts

@@ -8,7 +8,6 @@
 
 import { i18n } from '@kbn/i18n';
 import { prepareLogTable, validateAccessor } from '../../../../visualizations/common/utils';
-import { validateOptions } from '../../../../charts/common';
 import { GaugeExpressionFunctionDefinition } from '../types';
 import {
   EXPRESSION_GAUGE_NAME,
@@ -21,26 +20,6 @@ import {
 import { isRoundShape } from '../utils';
 
 export const errors = {
-  invalidShapeError: () =>
-    i18n.translate('expressionGauge.functions.gauge.errors.invalidShapeError', {
-      defaultMessage: `Invalid shape is specified. Supported shapes: {shapes}`,
-      values: { shapes: Object.values(GaugeShapes).join(', ') },
-    }),
-  invalidColorModeError: () =>
-    i18n.translate('expressionGauge.functions.gauge.errors.invalidColorModeError', {
-      defaultMessage: `Invalid color mode is specified. Supported color modes: {colorModes}`,
-      values: { colorModes: Object.values(GaugeColorModes).join(', ') },
-    }),
-  invalidTicksPositionError: () =>
-    i18n.translate('expressionGauge.functions.gauge.errors.invalidTicksPositionError', {
-      defaultMessage: `Invalid ticks position is specified. Supported ticks positions: {ticksPositions}`,
-      values: { ticksPositions: Object.values(GaugeTicksPositions).join(', ') },
-    }),
-  invalidLabelMajorModeError: () =>
-    i18n.translate('expressionGauge.functions.gauge.errors.invalidLabelMajorModeError', {
-      defaultMessage: `Invalid label major mode is specified. Supported label major modes: {labelMajorModes}`,
-      values: { labelMajorModes: Object.values(GaugeLabelMajorModes).join(', ') },
-    }),
   centralMajorNotSupportedForShapeError: (shape: string) =>
     i18n.translate('expressionGauge.functions.gauge.errors.centralMajorNotSupportedForShapeError', {
       defaultMessage:
@@ -185,11 +164,6 @@ export const gaugeFunction = (): GaugeExpressionFunctionDefinition => ({
   },
 
   fn(data, args, handlers) {
-    validateOptions(args.shape, GaugeShapes, errors.invalidShapeError);
-    validateOptions(args.colorMode, GaugeColorModes, errors.invalidColorModeError);
-    validateOptions(args.ticksPosition, GaugeTicksPositions, errors.invalidTicksPositionError);
-    validateOptions(args.labelMajorMode, GaugeLabelMajorModes, errors.invalidLabelMajorModeError);
-
     validateAccessor(args.metric, data.columns);
     validateAccessor(args.min, data.columns);
     validateAccessor(args.max, data.columns);

src/plugins/chart_expressions/expression_heatmap/common/expression_functions/heatmap_legend.ts

@@ -8,18 +8,9 @@
 import { Position } from '@elastic/charts';
 import { i18n } from '@kbn/i18n';
 import type { ExpressionFunctionDefinition } from '../../../../expressions/common';
-import { validateOptions } from '../../../../charts/common';
 import { EXPRESSION_HEATMAP_LEGEND_NAME } from '../constants';
 import { HeatmapLegendConfig, HeatmapLegendConfigResult } from '../types';
 
-export const errors = {
-  invalidPositionError: () =>
-    i18n.translate('expressionHeatmap.functions.heatmap.errors.invalidPositionError', {
-      defaultMessage: `Invalid position is specified. Supported positions: {positions}`,
-      values: { positions: Object.values(Position).join(', ') },
-    }),
-};
-
 export const heatmapLegendConfig: ExpressionFunctionDefinition<
   typeof EXPRESSION_HEATMAP_LEGEND_NAME,
   null,
@@ -67,7 +58,6 @@ export const heatmapLegendConfig: ExpressionFunctionDefinition<
     },
   },
   fn(input, args) {
-    validateOptions(args.position, Position, errors.invalidPositionError);
     return {
       type: EXPRESSION_HEATMAP_LEGEND_NAME,
       ...args,

src/plugins/chart_expressions/expression_metric/common/expression_functions/metric_vis_function.ts

@@ -14,22 +14,11 @@ import {
   Dimension,
   validateAccessor,
 } from '../../../../visualizations/common/utils';
-import { ColorMode, validateOptions } from '../../../../charts/common';
+import { ColorMode } from '../../../../charts/common';
 import { MetricVisExpressionFunctionDefinition } from '../types';
 import { EXPRESSION_METRIC_NAME, LabelPosition } from '../constants';
 
 const errors = {
-  invalidColorModeError: () =>
-    i18n.translate('expressionMetricVis.function.errors.invalidColorModeError', {
-      defaultMessage: 'Invalid color mode is specified. Supported color modes: {colorModes}',
-      values: { colorModes: Object.values(ColorMode).join(', ') },
-    }),
-  invalidLabelPositionError: () =>
-    i18n.translate('expressionMetricVis.function.errors.invalidLabelPositionError', {
-      defaultMessage:
-        'Invalid label position is specified. Supported label positions: {labelPosition}',
-      values: { labelPosition: Object.values(LabelPosition).join(', ') },
-    }),
   severalMetricsAndColorFullBackgroundSpecifiedError: () =>
     i18n.translate(
       'expressionMetricVis.function.errors.severalMetricsAndColorFullBackgroundSpecified',
@@ -151,9 +140,6 @@ export const metricVisFunction = (): MetricVisExpressionFunctionDefinition => ({
       }
     }
 
-    validateOptions(args.colorMode, ColorMode, errors.invalidColorModeError);
-    validateOptions(args.labelPosition, LabelPosition, errors.invalidLabelPositionError);
-
     args.metric.forEach((metric) => validateAccessor(metric, input.columns));
     validateAccessor(args.bucket, input.columns);
 

src/plugins/chart_expressions/expression_partition_vis/common/expression_functions/i18n.ts

@@ -7,8 +7,6 @@
  */
 
 import { i18n } from '@kbn/i18n';
-import { Position } from '@elastic/charts';
-import { LegendDisplay } from '../types/expression_renderers';
 
 export const strings = {
   getPieVisFunctionName: () =>
@@ -133,14 +131,4 @@ export const errors = {
       defaultMessage:
         'A split row and column are specified. Expression is supporting only one of them at once.',
     }),
-  invalidLegendDisplayError: () =>
-    i18n.translate('expressionPartitionVis.reusable.function.errors.invalidLegendDisplayError', {
-      defaultMessage: `Invalid legend display mode is specified. Supported ticks legend display modes: {legendDisplayModes}`,
-      values: { legendDisplayModes: Object.values(LegendDisplay).join(', ') },
-    }),
-  invalidLegendPositionError: () =>
-    i18n.translate('expressionPartitionVis.reusable.function.errors.invalidLegendPositionError', {
-      defaultMessage: `Invalid legend position is specified. Supported ticks legend positions: {positions}`,
-      values: { positions: Object.values(Position).join(', ') },
-    }),
 };