Add reporting_user feature for reserved set of privileges

[tsullivan]

Summary

We want to switch the reserved reporting_user role to use a "reserved privilege definition" and uses just that privilege. This PR satisfies the Kibana requirements. There is a corresponding Elasticsearch PR: elastic/elasticsearch#132766

Testing

NOTE: PNG/PDF reporting requires a Trial, or Gold+ license

1. Create test_reporting_user role

   POST /_security/role/test_reporting_user
   {
       "cluster": [],
       "indices": [],
       "application": [{
           "application": "kibana-*",
           "privileges": ["reserved_reporting_user"],
           "resources": ["*"]
       }]
   }
   

2. Create test_analyst_user role

   POST /_security/role/test_analyst_user
   {
       "cluster": [],
       "indices": [
           {
           "names": ["kibana_sample_*"],
           "privileges": ["all"],
           "field_security": {
               "grant": ["*"],
               "except": []
           },
           "allow_restricted_indices": false
           }
       ],
       "applications": [
           {
           "application": "kibana-.kibana",
           "privileges": [
               "feature_discover_v2.read",
               "feature_dashboard_v2.read",
               "feature_canvas.read",
               "feature_visualize_v2.read"
           ],
           "resources": ["space:default"]
           }
       ],
       "run_as": [],
       "metadata": {},
       "transient_metadata": {
           "enabled": true
       }
   }
   

3. Create a test user with just those two roles. Install sample data. Log in using the new test user.

4. Test cases

   App	Reporting feature
   Dashboard	PDF, PNG, CSV (from saved search panel action)
   Discover	CSV
   Canvas	PDF
   Lens	PDF, PNG
   Stack Management	List reports, download reports, view report info, delete reports

5. As admin, create an additional Space which the test user should not have access to. Ensure the test user does not have access to those spaces.

6. Remove the test_reporting_user role from the user and ensure they do not see any Reporting controls in the UI, and can not access Stack Management > Reporting.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• [ ] Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• [ ] Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

[nreese]

kibana-presentation changes LGTM
code review only

[legrego]

Thanks for the PR, Tim. If you want to test your changes locally, you can simulate the reserved role by putting this through DevTools, and then assigning a user this test_reporting_user role alongside a custom role:

POST /_security/role/test_reporting_user
{
    "cluster": [],
    "indices": [],
    "application": [{
        "application": "kibana-*",
        "privileges": ["reserved_reporting_user"],
        "resources": ["*"]
    }]
}

[darnautov]

Tested locally, LGTM

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 64428ee

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
reporting	166.4KB	166.4KB	+79.0B
spaces	214.7KB	214.7KB	+26.0B
total			+105.0B

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
canvas	13.5KB	13.6KB	+92.0B
reporting	49.1KB	49.1KB	+8.0B
total			+100.0B

History

• 💔 Build #330885 failed 76ab280
• 💔 Build #330765 failed 903d5ab
• 💔 Build #330557 failed 7830b65
• 💔 Build #330166 failed 2eb5ad8
• 💔 Build #330027 failed d110a5d

cc @tsullivan

[jloleysens]

Overall feature changes make sense, did not review in depth seems like Core review was not needed but for some reason is still block, so approving to unblock

[kibanamachine]

Starting backport for target branches: 9.0, 9.1

https://github.com/elastic/kibana/actions/runs/17097663139

[kibanamachine]

💔 All backports failed

Status	Branch	Result
❌	9.0	Backport failed because of merge conflicts
❌	9.1	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 231533

Questions ?

Please refer to the Backport tool documentation

[darnautov]

💚 All backports created successfully

Status	Branch	Result
✅	9.1
✅	9.0

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation