Improve advanced settings management APIs privilege checks#230067
Improve advanced settings management APIs privilege checks#230067Dosant merged 8 commits intoelastic:mainfrom
Conversation
…na into my-advanced-settings-privileges
Dosant
added
release_note:breaking
Team:SharedUX
|
Pinging @elastic/appex-sharedux (Team:SharedUX) |
|
codeowner changes look good but I wonder if this results in UI options that are presented but not functional. Whether this PR is merged doesn't depend upon this but we should have an accurate list of needed follow up changes. Will look at this tomorrow. |
@mattkime, I think it's the other way around. Previously, the UI didn't allow to save, but the API was still accessible. Now, both the UI and the API are don't allow to save. |
💛 Build succeeded, but was flaky
Failed CI StepsMetrics [docs]
History
|
mattkime
left a comment
mattkime
left a comment
There was a problem hiding this comment.
code changes look good and work well
…30067) ## Summary This is about an internal, undocumented API for managing advanced settings, but we're marking it as a breaking change just in case. ### Release Notes Roles with explicit `read` access to advanced settings but `all` access to `SavedObjectManagement` can no longer update settings via the internal advanced settings API. This update enforces explicit privileges instead of relying on saved object security checks. --------- Co-authored-by: Elena Shostak <elena.shostak@elastic.co>
…30067) ## Summary This is about an internal, undocumented API for managing advanced settings, but we're marking it as a breaking change just in case. ### Release Notes Roles with explicit `read` access to advanced settings but `all` access to `SavedObjectManagement` can no longer update settings via the internal advanced settings API. This update enforces explicit privileges instead of relying on saved object security checks. --------- Co-authored-by: Elena Shostak <elena.shostak@elastic.co>
7 participants
Summary
This is about an internal, undocumented API for managing advanced settings, but we're marking it as a breaking change just in case.
Release Notes
Roles with explicit
readaccess to advanced settings butallaccess toSavedObjectManagementcan no longer update settings via the internal advanced settings API. This update enforces explicit privileges instead of relying on saved object security checks.