[Alerting] Secret Service

src/legacy/server/kbn_server.js

@@ -43,6 +43,7 @@ import { serverExtensionsMixin } from './server_extensions';
 import { uiMixin } from '../ui';
 import { sassMixin } from './sass';
 import { i18nMixin } from './i18n';
+import { keystoreMixin } from './keystore';
 
 const rootDir = fromRoot('.');
 
@@ -101,6 +102,9 @@ export default class KbnServer {
       // tell the config we are done loading plugins
       configCompleteMixin,
 
+      // once the main config is loaded add the keystore
+      keystoreMixin,
+
       // setup this.uiExports and this.uiBundles
       uiMixin,
       indexPatternsMixin,

src/legacy/server/keystore/index.js

@@ -18,3 +18,4 @@
  */
 
 export { Keystore } from './keystore';
+export { keystoreMixin } from './keystore_mixin';

src/legacy/server/keystore/keystore.js

@@ -116,6 +116,10 @@ export class Keystore {
     return this.keys().indexOf(key) > -1;
   }
 
+  get(key) {
+    return this.data[key];
+  }
+
   add(key, value) {
     this.data[key] = value;
   }

src/legacy/server/keystore/keystore.test.js

@@ -150,6 +150,19 @@ describe('Keystore', () => {
     });
   });
 
+  describe('get', () => {
+    it('gets a value by key', () => {
+      const keystore = new Keystore('/data/unprotected.keystore');
+      expect(keystore.get('a2')).toEqual('bar');
+    });
+
+    it('gets a value that has been added', () => {
+      const keystore = new Keystore('/data/unprotected.keystore');
+      keystore.add('foo', 'baz');
+      expect(keystore.get('foo')).toEqual('baz');
+    });
+  });
+
   describe('add', () => {
     it('adds a key/value pair', () => {
       const keystore = new Keystore('/data/unprotected.keystore');

src/legacy/server/keystore/keystore_mixin.js

@@ -0,0 +1,26 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Keystore } from './keystore';
+import { join } from 'path';
+
+export function keystoreMixin(_, server) {
+  const keystorePath = join(server.config().get('path.data'), 'kibana.keystore');
+  server.decorate('server', 'keystore', new Keystore(keystorePath));
+}

src/legacy/server/saved_objects/index.d.ts

@@ -24,5 +24,6 @@ export {
   SavedObjectsClient,
   SavedObjectsClientWrapperFactory,
   SavedObjectReference,
+  SavedObjectsRepository,
   SavedObjectsService,
 } from './service';

src/legacy/server/saved_objects/migrations/kibana/kibana_migrator.test.ts

@@ -64,7 +64,7 @@ describe('KibanaMigrator', () => {
       expect(result).toEqual({ status: 'skipped' });
     });
 
-    it('waits for kbnServer.ready and elasticsearch.ready before attempting migrations', async () => {
+    it('waits for elasticsearch.ready before attempting migrations', async () => {
       const { kbnServer } = mockKbnServer();
       const clusterStub = jest.fn<any, any>(() => {
         throw new Error('Doh!');
@@ -74,7 +74,6 @@ describe('KibanaMigrator', () => {
       kbnServer.server.plugins.elasticsearch = {
         waitUntilReady,
         getCluster() {
-          expect(kbnServer.ready as any).toHaveBeenCalledTimes(1);
           expect(waitUntilReady).toHaveBeenCalledTimes(1);
 
           return {
@@ -92,7 +91,6 @@ function mockKbnServer({ configValues }: { configValues?: any } = {}) {
   const callCluster = jest.fn();
   const kbnServer: KbnServer = {
     version: '8.2.3',
-    ready: jest.fn(async () => undefined),
     uiExports: {
       savedObjectValidations: {},
       savedObjectMigrations: {},

src/legacy/server/saved_objects/migrations/kibana/kibana_migrator.ts

@@ -33,7 +33,6 @@ import { DocumentMigrator, VersionedTransformer } from '../core/document_migrato
 export interface KbnServer {
   server: Server;
   version: string;
-  ready: () => Promise<any>;
   uiExports: {
     savedObjectMappings: any[];
     savedObjectMigrations: any;
@@ -75,9 +74,6 @@ export class KibanaMigrator {
   public awaitMigration = once(async () => {
     const { server } = this.kbnServer;
 
-    // Wait until the plugins have been found an initialized...
-    await this.kbnServer.ready();
-
     // We can't do anything if the elasticsearch plugin has been disabled.
     if (!server.plugins.elasticsearch) {
       server.log(

src/legacy/server/saved_objects/service/index.d.ts

@@ -31,7 +31,7 @@ export interface SavedObjectsService<Request = any> {
   getSavedObjectsRepository(...rest: any[]): any;
 }
 
-export { SavedObjectsClientWrapperFactory } from './lib';
+export { SavedObjectsClientWrapperFactory, SavedObjectsRepository } from './lib';
 export {
   FindOptions,
   GetResponse,

src/legacy/server/saved_objects/service/lib/repository.d.ts

@@ -17,7 +17,23 @@
  * under the License.
  */
 
-import { BaseOptions, SavedObject } from '../saved_objects_client';
+import {
+  BaseOptions,
+  BulkCreateObject,
+  BulkCreateResponse,
+  BulkGetObjects,
+  BulkGetResponse,
+  CreateOptions,
+  CreateResponse,
+  FindOptions,
+  FindResponse,
+  GetResponse,
+  SavedObject,
+  SavedObjectAttributes,
+  UpdateOptions,
+  UpdateResponse,
+} from '../saved_objects_client';
+import * as errors from './errors';
 
 export interface SavedObjectsRepositoryOptions {
   index: string | string[];
@@ -30,9 +46,8 @@ export interface SavedObjectsRepositoryOptions {
 }
 
 export declare class SavedObjectsRepository {
-  // ATTENTION: this interface is incomplete
-
-  public get: (type: string, id: string, options?: BaseOptions) => Promise<SavedObject>;
+  public static errors: typeof errors;
+  public errors: typeof errors;
   public incrementCounter: (
     type: string,
     id: string,
@@ -41,4 +56,39 @@ export declare class SavedObjectsRepository {
   ) => Promise<SavedObject>;
 
   constructor(options: SavedObjectsRepositoryOptions);
+
+  public create<T extends SavedObjectAttributes = any>(
+    type: string,
+    attributes: T,
+    options?: CreateOptions
+  ): Promise<CreateResponse<T>>;
+
+  public bulkCreate<T extends SavedObjectAttributes = any>(
+    objects: Array<BulkCreateObject<T>>,
+    options?: CreateOptions
+  ): Promise<BulkCreateResponse<T>>;
+
+  public delete(type: string, id: string, options?: BaseOptions): Promise<{}>;
+
+  public find<T extends SavedObjectAttributes = any>(
+    options: FindOptions
+  ): Promise<FindResponse<T>>;
+
+  public bulkGet<T extends SavedObjectAttributes = any>(
+    objects: BulkGetObjects,
+    options?: BaseOptions
+  ): Promise<BulkGetResponse<T>>;
+
+  public get<T extends SavedObjectAttributes = any>(
+    type: string,
+    id: string,
+    options?: BaseOptions
+  ): Promise<GetResponse<T>>;
+
+  public update<T extends SavedObjectAttributes = any>(
+    type: string,
+    id: string,
+    attributes: Partial<T>,
+    options?: UpdateOptions
+  ): Promise<UpdateResponse<T>>;
 }

src/legacy/server/saved_objects/service/lib/repository.js

@@ -48,6 +48,7 @@ export class SavedObjectsRepository {
     //
     // The migrator performs double-duty, and validates the documents prior
     // to returning them.
+    this.errors = errors;
     this._migrator = migrator;
     this._index = index;
     this._mappings = mappings;

x-pack/index.js

@@ -36,6 +36,7 @@ import { crossClusterReplication } from './plugins/cross_cluster_replication';
 import { translations } from './plugins/translations';
 import { upgradeAssistant } from './plugins/upgrade_assistant';
 import { uptime } from './plugins/uptime';
+import { secretService } from './plugins/secret_service';
 import { ossTelemetry } from './plugins/oss_telemetry';
 
 module.exports = function (kibana) {
@@ -72,6 +73,7 @@ module.exports = function (kibana) {
     translations(kibana),
     upgradeAssistant(kibana),
     uptime(kibana),
+    secretService(kibana),
     ossTelemetry(kibana),
   ];
 };

x-pack/package.json

@@ -55,6 +55,7 @@
     "@types/jsonwebtoken": "^7.2.7",
     "@types/lodash": "^3.10.1",
     "@types/mocha": "^5.2.6",
+    "@types/object-hash": "^1.2.0",
     "@types/pngjs": "^3.3.1",
     "@types/prop-types": "^15.5.3",
     "@types/react": "^16.8.0",
@@ -226,6 +227,7 @@
     "ngreact": "^0.5.1",
     "node-fetch": "^2.1.2",
     "nodemailer": "^4.6.4",
+    "object-hash": "^1.3.1",
     "object-path-immutable": "^0.5.3",
     "oppsy": "^2.0.0",
     "papaparse": "^4.6.0",

x-pack/plugins/secret_service/index.test.ts

@@ -0,0 +1,85 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { secretService } from './';
+import { PluginSpec } from './mocks';
+
+describe('The SecretService', function TestSecretService() {
+  const mockKbn = {
+    Plugin: PluginSpec,
+  };
+  const subject = secretService(mockKbn);
+  beforeAll(() => {
+    expect(subject).not.toBeNull();
+    mockKbn.Plugin = jest.fn();
+  });
+
+  it('should expose itself to other plugins', () => {
+    expect(subject).not.toBeNull();
+  });
+
+  it('should expose a method to encrypt data', async () => {
+    const stubConfigGet = jest.fn();
+    const stubKeystore = {
+      has: jest.fn(),
+      get: jest.fn(),
+      add: jest.fn(),
+      exists: jest.fn(),
+      save: jest.fn(),
+    };
+    let secret: string;
+    const core = {
+      expose: jest.fn(),
+      log: jest.fn(),
+      logWithMetadata: jest.fn(),
+      savedObjects: {
+        addScopedSavedObjectsClientWrapperFactory: jest.fn(),
+        getSavedObjectsRepository: jest.fn(() => {
+          return {
+            errors: {
+              isConflictError: jest.fn(),
+            },
+            create: jest.fn((type, attributes, { id }) => {
+              secret = attributes.secret;
+              return {
+                id,
+                type,
+                attributes,
+              };
+            }),
+            get: jest.fn((type, id) => {
+              return {
+                id,
+                type,
+                attributes: {
+                  secret,
+                },
+              };
+            }),
+          };
+        }),
+      },
+      config: () => {
+        return {
+          get: stubConfigGet,
+        };
+      },
+      keystore: stubKeystore,
+      plugins: {
+        elasticsearch: {
+          getCluster: () => {
+            return { callWithInternalUser: jest.fn() };
+          },
+        },
+      },
+    };
+
+    stubKeystore.get.mockReturnValue('bogusencrpyptionley');
+    stubConfigGet.mockReturnValueOnce(false);
+    await subject.init(core);
+    expect(core.expose).toHaveBeenCalledWith('secretService', expect.any(Object));
+  });
+});