[Roles] Added error reasons for role malformed message

[elena-shostak]

Summary

Added error reasons for role malformed message.

How to test

1. Create a couple of malformed roles

POST _security/role
{
  "roles": {
    "malformed-reserved-privileges-wrong-app-role": {
      "cluster": [],
      "remote_cluster": [],
      "indices": [],
      "applications": [
        {
          "application": "kibana-.kibana",
          "privileges": [
            "reserved_ml_admin"
          ],
          "resources": [
            "*"
          ]
        }
      ],
      "run_as": [],
      "metadata": {},
      "transient_metadata": {
        "enabled": true
      }
    },
    "malformed-space-privileges-global-role": {
      "cluster": [],
      "remote_cluster": [],
      "indices": [],
      "applications": [
        {
          "application": "kibana-.kibana",
          "privileges": [
            "space_read"
          ],
          "resources": [
            "*"
          ]
        }
      ],
      "run_as": [],
      "metadata": {},
      "transient_metadata": {
        "enabled": true
      }
    },
    "malformed-global-privileges-space-role": {
      "cluster": [],
      "remote_cluster": [],
      "indices": [],
      "applications": [
        {
          "application": "kibana-.kibana",
          "privileges": [
            "all"
          ],
          "resources": [
            "space:default"
          ]
        }
      ],
      "run_as": [],
      "metadata": {},
      "transient_metadata": {
        "enabled": true
      }
    },
    "malformed-base-feature-privileges-mixed-role": {
      "cluster": [],
      "remote_cluster": [],
      "indices": [],
      "applications": [
        {
          "application": "kibana-.kibana",
          "privileges": [
            "all",
            "feature_dashboard.read"
          ],
          "resources": [
            "*"
          ]
        }
      ],
      "run_as": [],
      "metadata": {},
      "transient_metadata": {
        "enabled": true
      }
    },
    "malformed-invalid-resource-format-role": {
      "cluster": [],
      "remote_cluster": [],
      "indices": [],
      "applications": [
        {
          "application": "kibana-.kibana",
          "privileges": [
            "feature_dashboard.read"
          ],
          "resources": [
            "invalid:resource:format"
          ]
        }
      ],
      "run_as": [],
      "metadata": {},
      "transient_metadata": {
        "enabled": true
      }
    },
    "malformed-duplicated-resources-role": {
      "cluster": [],
      "remote_cluster": [],
      "indices": [],
      "applications": [
        {
          "application": "kibana-.kibana",
          "privileges": [
            "feature_dashboard.read"
          ],
          "resources": [
            "space:default",
            "space:default"
          ]
        }
      ],
      "run_as": [],
      "metadata": {},
      "transient_metadata": {
        "enabled": true
      }
    },
    "malformed-reserved-privileges-mixed-role": {
      "cluster": [],
      "remote_cluster": [],
      "indices": [],
      "applications": [
        {
          "application": "kibana-.kibana",
          "privileges": [
            "reserved_ml_admin",
            "feature_dashboard.read"
          ],
          "resources": [
            "*"
          ]
        }
      ],
      "run_as": [],
      "metadata": {},
      "transient_metadata": {
        "enabled": true
      }
    }
  }
}

2. Go to Stack Management -> Roles -> [MALFORMED_ROLE] and check the displayed error messages.

The code block for kibana applications has been added underneath the message as well.

Error Reason	Client Message
RESERVED_PRIVILEGES_WRONG_APP
GLOBAL_PRIVILEGES_SPACE
GLOBAL_RESOURCE_MIXED
BASE_FEATURE_PRIVILEGES_MIXED
INVALID_RESOURCE_FORMAT
DUPLICATED_RESOURCES
SPACE_PRIVILEGES_GLOBAL
RESERVED_PRIVILEGES_MIXED
DISABLED_FEATURE_PRIVILEGES

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Unit or functional tests were updated or added to match the most common scenarios
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Closes: #224053

Release Note

Enhanced the error message to include detailed information about why the role is considered malformed.

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[rgodfrey-elastic]

Looks really good! I added a couple comments to the code but I'll leave it up to you if you want to make those changes.

I also have a couple general comments/questions:

1. Are you missing labels for v9.2 and v9.3? I was told to add those to my one and only PR lol
2. Are there any validations that prevent these bad roles from getting saved in the first place? It's great to display the extra context when there are errors but preventing them from being stored would probably be more valuable.

[elena-shostak]

@rgodfrey-elastic

Are you missing labels for v9.2 and v9.3? I was told to add those to my one and only PR lol

yeah, added for v9.2 and v9.3 is current main, so no need to backport for it. Thanks!

Are there any validations that prevent these bad roles from getting saved in the first place? It's great to display the extra context when there are errors but preventing them from being stored would probably be more valuable.

Validations are performed if you create a role using kibana endpoint, but since they are not present at the es level we can still come up with this malformed issues

[rgodfrey-elastic]

Looks good! and thanks for addressing my questions!

[kibanamachine]

Starting backport for target branches: 8.18, 8.19, 9.0, 9.1, 9.2

https://github.com/elastic/kibana/actions/runs/18569196664

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 96d15ec

Failed CI Steps

• FTR Configs #31
• FTR Configs #46
• FTR Configs #116
• FTR Configs #127
• FTR Configs #133

Test Failures

• [job] [logs] FTR Configs #116 / Cloud Security Posture Agentless cloud Hyperlink on PostInstallation Modal should have the correct URL
• [job] [logs] FTR Configs #31 / Cloud Security Posture POST /internal/cloud_security_posture/graph Happy flows should return a graph with nodes and edges by alert and actor
• [job] [logs] FTR Configs #127 / Cloud Security Posture Test adding Cloud Security Posture Integrations CNVM CNVM AWS Hyperlink on PostInstallation Modal should have the correct URL
• [job] [logs] FTR Configs #46 / serverless observability UI Onboarding Onboarding Auto-Detect guides user through data onboarding
• [job] [logs] FTR Configs #133 / Synthetics API Tests AddProjectMonitors "before all" hook for "project monitors - saves space as data stream namespace"

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
security	549	551	+2

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
@kbn/security-plugin-types-common	68	76	+8

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
security	482.2KB	485.5KB	+3.3KB

Unknown metric groups

API count

id	before	after	diff
@kbn/security-plugin-types-common	129	137	+8

History

• 💔 Build #351340 failed 474b985
• 💔 Build #351327 failed 36638ab
• 💔 Build #351217 failed 0a95f6e

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.18
✅	8.19
✅	9.0
✅	9.1
✅	9.2

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation