[Read only dashboards] Store Saved object access control information by SiddharthMantri · Pull Request #221916 · elastic/kibana

SiddharthMantri · 2025-05-29T11:25:30Z

Summary

PR introduces support for storing access control information into saved object metadata.

By itself this won't do anything in this PR but we'll use it for the next phase implementing the various APIs for dashboard specific operations.

Note: Merging into a feature branch before merging into main.

src/core/packages/saved-objects/common/src/server_types.ts

src/core/packages/saved-objects/server/src/saved_objects_type.ts

src/platform/plugins/shared/dashboard/server/dashboard_saved_object/dashboard_saved_object.ts

SiddharthMantri · 2025-06-09T14:33:02Z

/ci

SiddharthMantri · 2025-06-09T14:46:09Z

@elasticmachine merge upstream

SiddharthMantri · 2025-06-09T20:50:14Z

/ci

SiddharthMantri · 2025-06-10T11:29:03Z

/ci

Copilot

Pull Request Overview

This PR introduces support for storing access control information into saved object metadata, allowing the system to track ownership and read-only restrictions on dashboards. Key changes include:

Adding a new SavedObjectAccessControl interface to define ownership and access mode.
Propagating the accessControl property in serializers and saved object service logic.
Extending configuration and type registry to support access control processing and testing.

Reviewed Changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/platform/plugins/shared/dashboard/server/plugin.ts	Minor formatting clean-up.
src/core/server/index.ts	Re-export of SavedObjectAccessControl.
src/core/packages/saved-objects/server/tsconfig.json	Updated dependency list to include @kbn/core.
src/core/packages/saved-objects/server/src/serialization.ts	Inclusion of accessControl in raw doc and doc interfaces.
src/core/packages/saved-objects/server/src/saved_objects_type.ts	Added supportsAccessControl property in saved object type.
src/core/packages/saved-objects/server/index.ts	Export update for the new access control interface.
src/core/packages/saved-objects/server-internal/src/saved_objects_service.ts	Updated type registry initialization with accessControlTypes from config.
src/core/packages/saved-objects/common/src/server_types.ts	Added the SavedObjectAccessControl definition and updated SavedObject type.
src/core/packages/saved-objects/base-server-internal/src/serialization/serializer.ts	Updated serialization logic to support accessControl.
src/core/packages/saved-objects/base-server-internal/src/serialization/serializer.test.ts	Added tests to verify accessControl propagation.
src/core/packages/saved-objects/base-server-internal/src/saved_objects_type_registry.ts	Introduced accessControlTypes mapping and supportsAccessControl method.
src/core/packages/saved-objects/base-server-internal/src/saved_objects_config.ts	Extended configuration to include accessControlTypes.
src/core/packages/saved-objects/api-server/index.ts	Re-export of SavedObjectAccessControl for API usage.

src/core/packages/saved-objects/base-server-internal/src/saved_objects_type_registry.ts

…_objects_type_registry.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

SiddharthMantri · 2025-06-11T12:17:35Z

src/core/packages/saved-objects/base-server-internal/src/saved_objects_type_registry.ts

  }
+
+  public supportsAccessControl(type: string): boolean {
+    return this.accessControlTypesMap.has(type);


Question for core - using config flags to allow specific SO types to have this ownership information. Instead of exposing this to the consumers, we start off with an internal config. What do you think?

Pierre left a similar comment on the RFC, but if types are already having to opt in, I don't think we should have another config option.

If we want to merge this PR and avoid anyone using this before it's fully ready, we could rather comment out the accessControl from the saved object type interface.

We are planning to merge this into a feature branch security/read-only-dashboards for now. What do you think?

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

jeramysoucy

Looks good, Sid! Just requesting one change, but I think we can open the PR for review from Core if you're ready. 👍

src/core/packages/saved-objects/common/src/server_types.ts

Co-authored-by: Jeramy Soucy <jeramy.soucy@elastic.co>

…-fix'

rudolf · 2025-06-16T12:43:30Z

src/core/packages/saved-objects/base-server-internal/src/serialization/serializer.test.ts

    });
  });
+
+  test('it copies accessControl to _source.accessControl', () => {


for both these tests we also need to test when accesscontrol isn't defined

Done in ce73f61

rudolf · 2025-06-16T12:46:06Z

src/core/packages/saved-objects/base-server-internal/src/saved_objects_type_registry.ts

  }
+
+  public supportsAccessControl(type: string): boolean {
+    return this.accessControlTypesMap.has(type);


Pierre left a similar comment on the RFC, but if types are already having to opt in, I don't think we should have another config option.

If we want to merge this PR and avoid anyone using this before it's fully ready, we could rather comment out the accessControl from the saved object type interface.

elasticmachine · 2025-06-19T12:55:57Z

💚 Build Succeeded

Buildkite Build
Commit: 8cac562

Metrics [docs]

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/core-saved-objects-server`	138	140	+2

Public APIs missing exports

Total count of every type that is part of your API that should be exported but is not. This will cause broken links in the API documentation system. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats exports for more detailed information.

id	before	after	diff
`@kbn/core`	883	884	+1

Unknown metric groups

API count

id	before	after	diff
`@kbn/core-saved-objects-api-server`	361	365	+4
`@kbn/core-saved-objects-server`	575	582	+7
`data`	3260	3262	+2
`dataViews`	1241	1242	+1
total			+14

History

💚 Build #309233 succeeded ce73f61
💚 Build #307704 succeeded ba30a9d
💔 Build #307586 failed bac45a8
💔 Build #307580 failed a03bb8d
💔 Build #306940 failed edd11b0
💔 Build #306773 failed 6eb485c

…lastic#221916) Closes elastic#221752 PR introduces support for storing access control information into saved object metadata. By itself this won't do anything in this PR but we'll use it for the next phase implementing the various APIs for dashboard specific operations. Note: Merging into a feature branch before merging into main. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jeramy Soucy <jeramy.soucy@elastic.co>

Closes elastic/kibana-team#808 The respective teams have been raising PRs against this feature branch. Approved PRs merged so far: - #221916 - #224411 - #239973 - #241101 - #238468 - #233552 - #228416 - #241168 - #244746 - #244830 ## Summary This pull request overhauls the saved object management workflow by introducing the concept of ownership for SOs - specifically enabled for dashboards only at the moment. Owners and administrators can now control a new write-restricted flag on their objects, allowing them to keep work draft/uneditable state before publishing. This change enables users to define who can modify shared objects, providing a crucial capability to manage and share dashboards. ## Release note Kibana Dashboards now support ownership and "write_restricted" mode. Users can now keep dashboards publicly editable or in a write-restricted state until they are ready to publish, giving them more control over who can edit their dashboards, regardless of broader space permissions. ## How to test ### Serverless Please reach out to me via slack or in the project channel (#read-only-dashboards) to be invited to the serverless environment where this feature has been enabled. ### Local - Clone this PR - Enable the feature by editing kibana.yml to include ``` savedObjects.enableAccessControl: true ``` - Start ES and Kibana as you would - Once started, seed Kibana with sample data. This should create a few dashboards. - Navigate to dashboards and create a new one. - In the share modal, change the view mode `Everybody in the space Can View`, <img width="500" height="410" alt="image" src="https://github.com/user-attachments/assets/b895442f-cce3-41a6-8b47-d206a9afbf43" /> - Now create a new role which grants access to indices and dashboards all. Create a new user and then assign that role to the newly created user. <img width="500" height="410" alt="image" src="https://github.com/user-attachments/assets/dd5251e1-a3b5-41a8-abc1-7e67399d65d2" /> - Login as the new user and navigate to the dashboard you had initially set as `Can view`. You'll see that you're not able to edit the dashboard and a warning like <img width="500" height="410" alt="Screenshot 2025-11-28 at 12 30 50" src="https://github.com/user-attachments/assets/1f71ccc7-9dc6-4a68-9a2c-540aa74e4f03" /> ### Local (2nd option) You can also follow the instructions in #224411 that detail how to use the funtional test runner to test this using the test plugin created for this feature. ### Risk matrix - What happens when your feature is used in a non-default space or a custom space? Works as expected - What happens when there are multiple Kibana nodes using the same Elasticsearch cluster? Does not depend on functionality of kibana nodes - What happens when a plugin you depend on is disabled? Changes are in core and security - both are always available - What happens when a feature you depend on is disabled? No dependency - What happens when a third party integration you depend on is not responding? No third party inregration - Does the feature work in Elastic Cloud? Yes - Does the feature create a setting that needs to be exposed, or configured differently than the default, on the Elastic Cloud? No - Is there a significant performance impact that may affect Cloud Kibana instances? No - Does your feature need to be aware of running in a container? No - Does the feature Work with security disabled, or fails gracefully? If disabled, fails gracefully. - Are there performance risks associated with your feature? No - Could this cause memory to leak in either the browser or server? No - Will your feature still work if Kibana is run behind a reverse proxy? Yes - Does your feature affect other plugins? No, other plugins could choose to use it if registering a SO with ownable types - Are migrations handled gracefully? Does the feature affect old indices or saved objects? Yes, migrations taken care of. - Are you using any technologies, protocols, techniques, conventions, libraries, NPM modules, etc. that may be new or unprecedented in Kibana? No --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jeramy Soucy <jeramy.soucy@elastic.co> Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com> Co-authored-by: Christiane (Tina) Heiligers <christiane.heiligers@elastic.co> Co-authored-by: Krzysztof Kowalczyk <krzysztof.kowalczyk@elastic.co> Co-authored-by: Gerard Soldevila <gerard.soldevila@elastic.co>

Closes elastic/kibana-team#808 The respective teams have been raising PRs against this feature branch. Approved PRs merged so far: - elastic#221916 - elastic#224411 - elastic#239973 - elastic#241101 - elastic#238468 - elastic#233552 - elastic#228416 - elastic#241168 - elastic#244746 - elastic#244830 ## Summary This pull request overhauls the saved object management workflow by introducing the concept of ownership for SOs - specifically enabled for dashboards only at the moment. Owners and administrators can now control a new write-restricted flag on their objects, allowing them to keep work draft/uneditable state before publishing. This change enables users to define who can modify shared objects, providing a crucial capability to manage and share dashboards. ## Release note Kibana Dashboards now support ownership and "write_restricted" mode. Users can now keep dashboards publicly editable or in a write-restricted state until they are ready to publish, giving them more control over who can edit their dashboards, regardless of broader space permissions. ## How to test ### Serverless Please reach out to me via slack or in the project channel (#read-only-dashboards) to be invited to the serverless environment where this feature has been enabled. ### Local - Clone this PR - Enable the feature by editing kibana.yml to include ``` savedObjects.enableAccessControl: true ``` - Start ES and Kibana as you would - Once started, seed Kibana with sample data. This should create a few dashboards. - Navigate to dashboards and create a new one. - In the share modal, change the view mode `Everybody in the space Can View`, <img width="500" height="410" alt="image" src="https://github.com/user-attachments/assets/b895442f-cce3-41a6-8b47-d206a9afbf43" /> - Now create a new role which grants access to indices and dashboards all. Create a new user and then assign that role to the newly created user. <img width="500" height="410" alt="image" src="https://github.com/user-attachments/assets/dd5251e1-a3b5-41a8-abc1-7e67399d65d2" /> - Login as the new user and navigate to the dashboard you had initially set as `Can view`. You'll see that you're not able to edit the dashboard and a warning like <img width="500" height="410" alt="Screenshot 2025-11-28 at 12 30 50" src="https://github.com/user-attachments/assets/1f71ccc7-9dc6-4a68-9a2c-540aa74e4f03" /> ### Local (2nd option) You can also follow the instructions in elastic#224411 that detail how to use the funtional test runner to test this using the test plugin created for this feature. ### Risk matrix - What happens when your feature is used in a non-default space or a custom space? Works as expected - What happens when there are multiple Kibana nodes using the same Elasticsearch cluster? Does not depend on functionality of kibana nodes - What happens when a plugin you depend on is disabled? Changes are in core and security - both are always available - What happens when a feature you depend on is disabled? No dependency - What happens when a third party integration you depend on is not responding? No third party inregration - Does the feature work in Elastic Cloud? Yes - Does the feature create a setting that needs to be exposed, or configured differently than the default, on the Elastic Cloud? No - Is there a significant performance impact that may affect Cloud Kibana instances? No - Does your feature need to be aware of running in a container? No - Does the feature Work with security disabled, or fails gracefully? If disabled, fails gracefully. - Are there performance risks associated with your feature? No - Could this cause memory to leak in either the browser or server? No - Will your feature still work if Kibana is run behind a reverse proxy? Yes - Does your feature affect other plugins? No, other plugins could choose to use it if registering a SO with ownable types - Are migrations handled gracefully? Does the feature affect old indices or saved objects? Yes, migrations taken care of. - Are you using any technologies, protocols, techniques, conventions, libraries, NPM modules, etc. that may be new or unprecedented in Kibana? No --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Jeramy Soucy <jeramy.soucy@elastic.co> Co-authored-by: Aleh Zasypkin <aleh.zasypkin@gmail.com> Co-authored-by: Christiane (Tina) Heiligers <christiane.heiligers@elastic.co> Co-authored-by: Krzysztof Kowalczyk <krzysztof.kowalczyk@elastic.co> Co-authored-by: Gerard Soldevila <gerard.soldevila@elastic.co>

SiddharthMantri added 2 commits May 28, 2025 17:40

placeholder commit

2ab690d

[Read only dashboards] Access control information

36e8e06

jeramysoucy reviewed Jun 3, 2025

View reviewed changes

SiddharthMantri added 2 commits June 3, 2025 14:58

update docs

d6904ea

Update serializer test

a40bfe2

SiddharthMantri requested a review from Copilot June 9, 2025 14:32

This comment was marked as outdated.

Sign in to view

SiddharthMantri and others added 2 commits June 9, 2025 16:40

update copilot suggestions, update jsdoc

f80767a

[CI] Auto-commit changed files from 'node scripts/notice'

cfcd593

elasticmachine and others added 2 commits June 9, 2025 16:46

Merge branch 'main' into security/readonly-dashboards-access-information

b48ecb9

fix jsdoc

23eb4e3

SiddharthMantri requested a review from Copilot June 9, 2025 17:58

This comment was marked as outdated.

Sign in to view

remove supportsAccessControl from dashboard

6eb485c

SiddharthMantri requested a review from jeramysoucy June 9, 2025 20:27

SiddharthMantri changed the title ~~[WIP] Security/readonly dashboards access information~~ Jun 9, 2025

add config for dashboard access control

edd11b0

SiddharthMantri requested a review from Copilot June 10, 2025 11:31

This comment was marked as outdated.

Sign in to view

SiddharthMantri added 2 commits June 10, 2025 23:48

remove config from dashboard, move to core

91b23e1

remove unused type

0c9b4ad

SiddharthMantri requested a review from Copilot June 10, 2025 21:51

Copilot AI reviewed Jun 10, 2025

View reviewed changes

src/core/packages/saved-objects/base-server-internal/src/saved_objects_type_registry.ts Outdated Show resolved Hide resolved

SiddharthMantri and others added 2 commits June 10, 2025 23:52

Update src/core/packages/saved-objects/base-server-internal/src/saved…

0f49911

…_objects_type_registry.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

remove newlines

07f2ef0

SiddharthMantri commented Jun 11, 2025

View reviewed changes

SiddharthMantri requested a review from Copilot June 11, 2025 12:34

Copilot AI reviewed Jun 11, 2025

View reviewed changes

SiddharthMantri changed the base branch from main to security/read-only-dashboards June 11, 2025 12:36

jeramysoucy requested changes Jun 11, 2025

View reviewed changes

src/core/packages/saved-objects/common/src/server_types.ts Show resolved Hide resolved

Update src/core/packages/saved-objects/common/src/server_types.ts

a03bb8d

Co-authored-by: Jeramy Soucy <jeramy.soucy@elastic.co>

SiddharthMantri marked this pull request as ready for review June 11, 2025 18:39

SiddharthMantri requested a review from a team as a code owner June 11, 2025 18:39

kibanamachine and others added 2 commits June 11, 2025 19:03

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

bac45a8

…-fix'

remove circular references

ba30a9d

jeramysoucy approved these changes Jun 12, 2025

View reviewed changes

rudolf requested changes Jun 16, 2025

View reviewed changes

Update tests

ce73f61

SiddharthMantri requested a review from rudolf June 18, 2025 11:47

remove usage of config variables, allow all types to have access control

8cac562

rudolf approved these changes Jun 19, 2025

View reviewed changes

SiddharthMantri merged commit 5487e4c into elastic:security/read-only-dashboards Jun 19, 2025
8 of 10 checks passed

SiddharthMantri mentioned this pull request Jun 19, 2025

[Write Restricted Dashboards] Feature branch #224552

Merged

legrego mentioned this pull request Jun 23, 2025

[Write restricted dashboards] Add owner and accessMode fields to Saved Objects #221752

Closed

SiddharthMantri mentioned this pull request Aug 28, 2025

[Write restricted SOs] Allow creation, update, delete and transfer ownership #224411

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Read only dashboards] Store Saved object access control information#221916

[Read only dashboards] Store Saved object access control information#221916
SiddharthMantri merged 19 commits intoelastic:security/read-only-dashboardsfrom
SiddharthMantri:security/readonly-dashboards-access-information

SiddharthMantri commented May 29, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SiddharthMantri commented Jun 9, 2025

This comment was marked as outdated.

Uh oh!

SiddharthMantri commented Jun 9, 2025

This comment was marked as outdated.

Uh oh!

SiddharthMantri commented Jun 9, 2025

SiddharthMantri commented Jun 10, 2025

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Uh oh!

SiddharthMantri Jun 11, 2025

rudolf Jun 16, 2025

SiddharthMantri Jun 17, 2025

Copilot AI left a comment

jeramysoucy left a comment

Uh oh!

rudolf Jun 16, 2025

SiddharthMantri Jun 18, 2025

rudolf Jun 16, 2025

Uh oh!

elasticmachine commented Jun 19, 2025

API count

Labels

6 participants

Conversation

SiddharthMantri commented May 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SiddharthMantri commented Jun 9, 2025

This comment was marked as outdated.

Uh oh!

SiddharthMantri commented Jun 9, 2025

This comment was marked as outdated.

Uh oh!

SiddharthMantri commented Jun 9, 2025

SiddharthMantri commented Jun 10, 2025

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

SiddharthMantri Jun 11, 2025

Choose a reason for hiding this comment

rudolf Jun 16, 2025

Choose a reason for hiding this comment

SiddharthMantri Jun 17, 2025

Choose a reason for hiding this comment

Copilot AI left a comment

Choose a reason for hiding this comment

jeramysoucy left a comment

Choose a reason for hiding this comment

Uh oh!

rudolf Jun 16, 2025

Choose a reason for hiding this comment

SiddharthMantri Jun 18, 2025

Choose a reason for hiding this comment

rudolf Jun 16, 2025

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jun 19, 2025

💚 Build Succeeded

Metrics [docs]

Public APIs missing comments

Public APIs missing exports

API count

History

Labels

6 participants

SiddharthMantri commented May 29, 2025 •

edited

Loading