[ResponseOps][Alerting] Optimize the scheduling of rule actions so it can happen in bulk

x-pack/plugins/actions/server/actions_client.mock.ts

@@ -23,6 +23,7 @@ const createActionsClientMock = () => {
     execute: jest.fn(),
     enqueueExecution: jest.fn(),
     ephemeralEnqueuedExecution: jest.fn(),
+    bulkEnqueueExecution: jest.fn(),
     listTypes: jest.fn(),
     isActionTypeEnabled: jest.fn(),
     isPreconfigured: jest.fn(),

x-pack/plugins/actions/server/actions_client.test.ts

@@ -32,6 +32,7 @@ import { ActionsAuthorization } from './authorization/actions_authorization';
 import {
   getAuthorizationModeBySource,
   AuthorizationMode,
+  getBulkAuthorizationModeBySource,
 } from './authorization/get_authorization_mode_by_source';
 import { actionsAuthorizationMock } from './authorization/actions_authorization.mock';
 import { trackLegacyRBACExemption } from './lib/track_legacy_rbac_exemption';
@@ -59,6 +60,9 @@ jest.mock('./authorization/get_authorization_mode_by_source', () => {
     getAuthorizationModeBySource: jest.fn(() => {
       return 1;
     }),
+    getBulkAuthorizationModeBySource: jest.fn(() => {
+      return 1;
+    }),
     AuthorizationMode: {
       Legacy: 0,
       RBAC: 1,
@@ -80,6 +84,7 @@ const actionExecutor = actionExecutorMock.create();
 const authorization = actionsAuthorizationMock.create();
 const executionEnqueuer = jest.fn();
 const ephemeralExecutionEnqueuer = jest.fn();
+const bulkExecutionEnqueuer = jest.fn();
 const request = httpServerMock.createKibanaRequest();
 const auditLogger = auditLoggerMock.create();
 const mockUsageCountersSetup = usageCountersServiceMock.createSetupContract();
@@ -124,6 +129,7 @@ beforeEach(() => {
     actionExecutor,
     executionEnqueuer,
     ephemeralExecutionEnqueuer,
+    bulkExecutionEnqueuer,
     request,
     authorization: authorization as unknown as ActionsAuthorization,
     auditLogger,
@@ -550,6 +556,7 @@ describe('create()', () => {
       actionExecutor,
       executionEnqueuer,
       ephemeralExecutionEnqueuer,
+      bulkExecutionEnqueuer,
       request,
       authorization: authorization as unknown as ActionsAuthorization,
       connectorTokenClient: connectorTokenClientMock.create(),
@@ -655,6 +662,7 @@ describe('get()', () => {
         actionExecutor,
         executionEnqueuer,
         ephemeralExecutionEnqueuer,
+        bulkExecutionEnqueuer,
         request,
         authorization: authorization as unknown as ActionsAuthorization,
         preconfiguredActions: [
@@ -714,6 +722,7 @@ describe('get()', () => {
         actionExecutor,
         executionEnqueuer,
         ephemeralExecutionEnqueuer,
+        bulkExecutionEnqueuer,
         request,
         authorization: authorization as unknown as ActionsAuthorization,
         preconfiguredActions: [
@@ -835,6 +844,7 @@ describe('get()', () => {
       actionExecutor,
       executionEnqueuer,
       ephemeralExecutionEnqueuer,
+      bulkExecutionEnqueuer,
       request,
       authorization: authorization as unknown as ActionsAuthorization,
       preconfiguredActions: [
@@ -909,6 +919,7 @@ describe('getAll()', () => {
         actionExecutor,
         executionEnqueuer,
         ephemeralExecutionEnqueuer,
+        bulkExecutionEnqueuer,
         request,
         authorization: authorization as unknown as ActionsAuthorization,
         preconfiguredActions: [
@@ -1050,6 +1061,7 @@ describe('getAll()', () => {
       actionExecutor,
       executionEnqueuer,
       ephemeralExecutionEnqueuer,
+      bulkExecutionEnqueuer,
       request,
       authorization: authorization as unknown as ActionsAuthorization,
       preconfiguredActions: [
@@ -1131,6 +1143,7 @@ describe('getBulk()', () => {
         actionExecutor,
         executionEnqueuer,
         ephemeralExecutionEnqueuer,
+        bulkExecutionEnqueuer,
         request,
         authorization: authorization as unknown as ActionsAuthorization,
         preconfiguredActions: [
@@ -1266,6 +1279,7 @@ describe('getBulk()', () => {
       actionExecutor,
       executionEnqueuer,
       ephemeralExecutionEnqueuer,
+      bulkExecutionEnqueuer,
       request,
       authorization: authorization as unknown as ActionsAuthorization,
       preconfiguredActions: [
@@ -1324,6 +1338,7 @@ describe('getOAuthAccessToken()', () => {
       actionExecutor,
       executionEnqueuer,
       ephemeralExecutionEnqueuer,
+      bulkExecutionEnqueuer,
       request,
       authorization: authorization as unknown as ActionsAuthorization,
       preconfiguredActions: [
@@ -2326,6 +2341,119 @@ describe('enqueueExecution()', () => {
   });
 });
 
+describe('bulkEnqueueExecution()', () => {
+  describe('authorization', () => {
+    test('ensures user is authorised to excecute actions', async () => {
+      (getBulkAuthorizationModeBySource as jest.Mock).mockImplementationOnce(() => {
+        return { [AuthorizationMode.RBAC]: 1, [AuthorizationMode.Legacy]: 0 };
+      });
+      await actionsClient.bulkEnqueueExecution([
+        {
+          id: uuid.v4(),
+          params: {},
+          spaceId: 'default',
+          executionId: '123abc',
+          apiKey: null,
+        },
+        {
+          id: uuid.v4(),
+          params: {},
+          spaceId: 'default',
+          executionId: '456def',
+          apiKey: null,
+        },
+      ]);
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+    });
+
+    test('throws when user is not authorised to create the type of action', async () => {
+      (getBulkAuthorizationModeBySource as jest.Mock).mockImplementationOnce(() => {
+        return { [AuthorizationMode.RBAC]: 1, [AuthorizationMode.Legacy]: 0 };
+      });
+      authorization.ensureAuthorized.mockRejectedValue(
+        new Error(`Unauthorized to execute all actions`)
+      );
+
+      await expect(
+        actionsClient.bulkEnqueueExecution([
+          {
+            id: uuid.v4(),
+            params: {},
+            spaceId: 'default',
+            executionId: '123abc',
+            apiKey: null,
+          },
+          {
+            id: uuid.v4(),
+            params: {},
+            spaceId: 'default',
+            executionId: '456def',
+            apiKey: null,
+          },
+        ])
+      ).rejects.toMatchInlineSnapshot(`[Error: Unauthorized to execute all actions]`);
+
+      expect(authorization.ensureAuthorized).toHaveBeenCalledWith('execute');
+    });
+
+    test('tracks legacy RBAC', async () => {
+      (getBulkAuthorizationModeBySource as jest.Mock).mockImplementationOnce(() => {
+        return { [AuthorizationMode.RBAC]: 0, [AuthorizationMode.Legacy]: 2 };
+      });
+
+      await actionsClient.bulkEnqueueExecution([
+        {
+          id: uuid.v4(),
+          params: {},
+          spaceId: 'default',
+          executionId: '123abc',
+          apiKey: null,
+        },
+        {
+          id: uuid.v4(),
+          params: {},
+          spaceId: 'default',
+          executionId: '456def',
+          apiKey: null,
+        },
+      ]);
+
+      expect(trackLegacyRBACExemption as jest.Mock).toBeCalledWith(
+        'bulkEnqueueExecution',
+        mockUsageCounter,
+        2
+      );
+    });
+  });
+
+  test('calls the bulkExecutionEnqueuer with the appropriate parameters', async () => {
+    (getBulkAuthorizationModeBySource as jest.Mock).mockImplementationOnce(() => {
+      return { [AuthorizationMode.RBAC]: 0, [AuthorizationMode.Legacy]: 0 };
+    });
+    const opts = [
+      {
+        id: uuid.v4(),
+        params: {},
+        spaceId: 'default',
+        executionId: '123abc',
+        apiKey: null,
+      },
+      {
+        id: uuid.v4(),
+        params: {},
+        spaceId: 'default',
+        executionId: '456def',
+        apiKey: null,
+      },
+    ];
+    await expect(actionsClient.bulkEnqueueExecution(opts)).resolves.toMatchInlineSnapshot(
+      `undefined`
+    );
+
+    expect(bulkExecutionEnqueuer).toHaveBeenCalledWith(unsecuredSavedObjectsClient, opts);
+  });
+});
+
 describe('isActionTypeEnabled()', () => {
   const fooActionType: ActionType = {
     id: 'foo',
@@ -2366,6 +2494,7 @@ describe('isPreconfigured()', () => {
       actionExecutor,
       executionEnqueuer,
       ephemeralExecutionEnqueuer,
+      bulkExecutionEnqueuer,
       request,
       authorization: authorization as unknown as ActionsAuthorization,
       preconfiguredActions: [
@@ -2403,6 +2532,7 @@ describe('isPreconfigured()', () => {
       actionExecutor,
       executionEnqueuer,
       ephemeralExecutionEnqueuer,
+      bulkExecutionEnqueuer,
       request,
       authorization: authorization as unknown as ActionsAuthorization,
       preconfiguredActions: [

x-pack/plugins/actions/server/actions_client.ts

@@ -39,10 +39,12 @@ import { ExecuteOptions } from './lib/action_executor';
 import {
   ExecutionEnqueuer,
   ExecuteOptions as EnqueueExecutionOptions,
+  BulkExecutionEnqueuer,
 } from './create_execute_function';
 import { ActionsAuthorization } from './authorization/actions_authorization';
 import {
   getAuthorizationModeBySource,
+  getBulkAuthorizationModeBySource,
   AuthorizationMode,
 } from './authorization/get_authorization_mode_by_source';
 import { connectorAuditEvent, ConnectorAuditAction } from './lib/audit_events';
@@ -94,6 +96,7 @@ interface ConstructorOptions {
   actionExecutor: ActionExecutorContract;
   executionEnqueuer: ExecutionEnqueuer<void>;
   ephemeralExecutionEnqueuer: ExecutionEnqueuer<RunNowResult>;
+  bulkExecutionEnqueuer: BulkExecutionEnqueuer<void>;
   request: KibanaRequest;
   authorization: ActionsAuthorization;
   auditLogger?: AuditLogger;
@@ -118,6 +121,7 @@ export class ActionsClient {
   private readonly authorization: ActionsAuthorization;
   private readonly executionEnqueuer: ExecutionEnqueuer<void>;
   private readonly ephemeralExecutionEnqueuer: ExecutionEnqueuer<RunNowResult>;
+  private readonly bulkExecutionEnqueuer: BulkExecutionEnqueuer<void>;
   private readonly auditLogger?: AuditLogger;
   private readonly usageCounter?: UsageCounter;
   private readonly connectorTokenClient: ConnectorTokenClientContract;
@@ -132,6 +136,7 @@ export class ActionsClient {
     actionExecutor,
     executionEnqueuer,
     ephemeralExecutionEnqueuer,
+    bulkExecutionEnqueuer,
     request,
     authorization,
     auditLogger,
@@ -147,6 +152,7 @@ export class ActionsClient {
     this.actionExecutor = actionExecutor;
     this.executionEnqueuer = executionEnqueuer;
     this.ephemeralExecutionEnqueuer = ephemeralExecutionEnqueuer;
+    this.bulkExecutionEnqueuer = bulkExecutionEnqueuer;
     this.request = request;
     this.authorization = authorization;
     this.auditLogger = auditLogger;
@@ -656,6 +662,24 @@ export class ActionsClient {
     return this.executionEnqueuer(this.unsecuredSavedObjectsClient, options);
   }
 
+  public async bulkEnqueueExecution(options: EnqueueExecutionOptions[]): Promise<void> {
+    const authCounts = await getBulkAuthorizationModeBySource(
+      this.unsecuredSavedObjectsClient,
+      options
+    );
+    if (authCounts[AuthorizationMode.RBAC] > 0) {
+      await this.authorization.ensureAuthorized('execute');
+    }
+    if (authCounts[AuthorizationMode.Legacy] > 0) {
+      trackLegacyRBACExemption(
+        'bulkEnqueueExecution',
+        this.usageCounter,
+        authCounts[AuthorizationMode.Legacy]
+      );
+    }
+    return this.bulkExecutionEnqueuer(this.unsecuredSavedObjectsClient, options);
+  }
+
   public async ephemeralEnqueuedExecution(options: EnqueueExecutionOptions): Promise<RunNowResult> {
     const { source } = options;
     if (