[Cases] RBAC: Create & Find integration tests

x-pack/plugins/cases/common/api/runtime_types.ts

@@ -58,7 +58,9 @@ const getExcessProps = (props: rt.Props, r: Record<string, unknown>): string[] =
   return ex;
 };
 
-export function excess<C extends rt.InterfaceType<rt.Props>>(codec: C): C {
+export function excess<C extends rt.InterfaceType<rt.Props> | rt.PartialType<rt.Props>>(
+  codec: C
+): C {
   const r = new rt.InterfaceType(
     codec.name,
     codec.is,

x-pack/plugins/cases/server/client/cases/find.ts

@@ -19,6 +19,7 @@ import {
   throwErrors,
   caseStatuses,
   CasesFindResponseRt,
+  excess,
 } from '../../../common/api';
 
 import { CASE_SAVED_OBJECT } from '../../../common/constants';
@@ -49,7 +50,7 @@ export const find = async ({
 }: FindParams): Promise<CasesFindResponse> => {
   try {
     const queryParams = pipe(
-      CasesFindRequestRt.decode(options),
+      excess(CasesFindRequestRt).decode(options),
       fold(throwErrors(Boom.badRequest), identity)
     );
 

x-pack/test/case_api_integration/security_and_spaces/tests/common/cases/find_cases.ts

@@ -790,10 +790,34 @@ export default ({ getService }: FtrProviderContext): void => {
         expectCasesToBeValidOwner(res.cases, 1, ['securitySolutionFixture']);
       });
 
-          appendToUrl: 'search=securitySolutionFixture+observabilityFixture&searchFields[0]=scope',
+      // This test is to prevent a future developer to add the filter attribute without taking into consideration
+      // the authorizationFilter produced by the cases authorization class
+      it('should NOT allow to pass a filter query parameter', async () => {
+        await supertest
+          .get(
+            `${CASES_URL}/_find?sortOrder=asc&filter=cases.attributes.owner=observabilityFixture`
+          )
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(400);
+      });
+
+      // This test ensures that the user is not allowed to define the namespaces query param
+      // so she cannot search across spaces
+      it('should NOT allow to pass a namespaces query parameter', async () => {
+        await supertest
+          .get(`${CASES_URL}/_find?sortOrder=asc&namespaces[0]=*`)
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(400);
       });
 
-        expectCasesToBeValidScoped(res.cases, 1, ['securitySolutionFixture']);
+      it('should NOT allow to pass a non supported query parameter', async () => {
+        await supertest
+          .get(`${CASES_URL}/_find?notExists=papa`)
+          .set('kbn-xsrf', 'true')
+          .send()
+          .expect(400);
       });
     });
   });