Skip to content

Commit

Permalink
[SecuritySolution] Fix Risk score Insufficient privileges warning mis…
Browse files Browse the repository at this point in the history
…sing cluster privileges (elastic#212405)

* Fixes Bug: User with no cluster privileges should not be able to
enable the risk score
When users with no cluster privileges open the risk score page, they
don't see any errors and are able to click the install button.

This happened because we were only checking for index privileges in the
UI, but for the enablement flow we also need to check cluster
privileges. I also introduced a new parameter to the missing privileges
hook so pages that only need to check for `read` privileges can work as
before.

https://github.com/user-attachments/assets/fe162005-ee2b-497d-8744-6262e4511d2d

* Fixed Bug: The install button was enabled when all toggles were
disabled
There were too many booleans in the panel, which was confusing and led
me to introduce more bugs while trying to fix this one, so I refactored
the code to understand it before fixing it.
I also simplified the logic to display the modal. Now, it only shows
when one of the engines' status is "not_installed"

<img width="300"
src="https://github.com/user-attachments/assets/a2e8fbba-ac64-4c97-9ef0-ef6fe61e60cd"
/>

1. Create a user with security privileges and index privileges but no
cluster privileges
2. Go to the risk score page and enable the toggle

Check the PR satisfies following conditions.

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or

(cherry picked from commit b69b696)
  • Loading branch information
machadoum committed Mar 6, 2025
1 parent a5e2453 commit 275e283
Show file tree
Hide file tree
Showing 7 changed files with 4,288 additions and 77 deletions.
Loading

0 comments on commit 275e283

Please sign in to comment.