[SOR] Intersect allowed and authorized types

[afharo]

Summary

We identified some scenarios where clients authorized to a partial list of SO types would circumvent the Saved Objects Repository's allowed types (it could list "hidden" SO types).

This PR addresses this issue by unifying the flow for partially and fully authorized clients, and applying the intersection of the allowed and authorized lists.

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

• Some APIs might have been abusing this bug. We need to validate through CI that they work as intended, and send an internal note to all Kibana contributors to raise awareness of potential failures.

[elasticmachine]

⏳ Build in-progress, with failures

• Buildkite Build
• Commit: 3a28421

Failed CI Steps

• Jest Tests #14
• Jest Tests #14

Test Failures

• [job] [logs] Jest Tests #14 / #deleteByNamespace performDeleteByNamespace search dsl constructs a query using all multi-namespace types, and another using all single-namespace types
• [job] [logs] Jest Tests #14 / #deleteByNamespace performDeleteByNamespace search dsl constructs a query using all multi-namespace types, and another using all single-namespace types

History

• 💔 Build #368127 failed 739ecef
• 💔 Build #367871 failed 739ecef

cc @afharo

[afharo]

This only ensures the same path is followed for both authorization levels, although, functionally, it achieves the same result if we don't add this clause in the if.

Happy to remove this line if we think that performance might be a problem.

I'd appreciate @azasypkin's thoughts on this.

[afharo]

Mixing the user's authorization and the client's scope here (which can be odd).

However, typeToNamespacesMap doesn't really imply that it's bound to only one.

[afharo]

I had to add foo to the requested type so that it is kept in the auth map.

[afharo]

just repeating the test above, but for fully authorized.

[afharo]

I assume that we want to search references to the Data View across all types. Is my assumption correct?

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)