elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.65k stars 8.23k forks source link

Refine privilege-checking UX in Index Management #77376

Open cjcenizal opened 4 years ago

cjcenizal commented 4 years ago

Missing privileges for index actions should be surfaced

Per https://github.com/elastic/kibana/issues/76617, when you try to perform an action on an index without sufficient privileges (e.g. deleting an index as outlined in the linked issue), the UI shows a toast that says "Forbidden" but no other information. We can make this toast more helpful by surfacing the status code and message from the API:

{
  "statusCode":403,
  "error":"Forbidden",
  "message":"[security_exception] action [indices:admin/delete] is unauthorized for user [test] on indices [], this action is granted by the privileges [delete_index,manage,all]"
}

Surface missing cluster privileges for index templates

When the user is missing the required privileges for managing index templates they just see a 500 error:

image

We should incorporate the same privileges check used in component templates:

image

elasticmachine commented 4 years ago

Pinging @elastic/es-ui (Team:Elasticsearch UI)

sebelga commented 3 years ago

I think this could be part of a dedicated workstream "Apps privileges".

Instead of patching Index management we could work on an reusable app interceptor component that would handle this globally and for any app.

Something like this

// Provide de http client through context to the app
<HttpRequestInterceptor>
  <App />
</HttpRequestInterceptor>
// or through prop
<HttpRequestInterceptor>
  {(httpClient) => <App httpClient={httpClient} />}
</HttpRequestInterceptor>

At this point we can globally handle 403 Forbidden errors and display a toast message. We can do anything really, we could have a link in the toast to open a flyout and explain what privileges are required and how to enable them.

The same approach could be used for handling errors in license. We could have a link to the License management to upgrade the license.

elasticmachine commented 2 months ago

Pinging @elastic/kibana-management (Team:Kibana Management)