Prevent regressions in Dashboard's dev tools permissions

[bengerman13]

In order to prevent regressions in intended permissions, the Dashboard dev tools app should have e2e tests for auth.

Acceptance Criteria

• GIVEN I am not a platform-ops member
  • [ ] WHEN I view the Opensearch Dashboard \ THEN I don't see links to "Dev Tools"
  • [ ] WHEN I poke a Dev Tools URL \ THEN I have no ability to make changes

    ---

Security considerations

This change ensures we're not leaking information between users or letting users modify information as we make other changes in the proxy.

Implementation sketch

• [ ] validate a match_all query doesn't return any results a user shouldn't see
• [ ] validate queries in dev tools do not allow users to modify, create, or delete documents
• We can use the Security API to write tests

[rcgottlieb]

Closed this when meaning to close the window but not the story. Reopened it so it is back in it's prior state.

[markdboyd]

There is an option to disable the dev tools console entirely: https://github.com/opensearch-project/OpenSearch-Dashboards/issues/1406

However, we want admins to have access the dev tools console which can be helpful for debugging.

Unfortunately, there is no granular system for showing menu links based on user permissions: https://github.com/opensearch-project/security-dashboards-plugin/issues/857.

So this issue is blocked until Opensearch implements some sort of granular permissions system for menu links.

[divanshurox]

Hi, I had a similar use case where I just want the platform-admins to have access to the Dev Tools. Are you guys working on this?

[markdboyd]

@divanshurox This feature can't be implemented without upstream changes to the Opensearch security-dashboards-plugin:

https://github.com/opensearch-project/security-dashboards-plugin/issues/857