Add Scout API tests

legrego · legrego · commit 7c967ce98f73 · 2026-05-26T14:53:01.000-04:00
diff --git a/.buildkite/scout_ci_config.yml b/.buildkite/scout_ci_config.yml
@@ -77,6 +77,7 @@ packages:
   enabled:
     - core
     - kbn-scout
+    - kbn-security-hardening
     - kbn-streamlang-tests
     - user-storage
   disabled:
diff --git a/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/observability_complete.serverless.config.ts b/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/observability_complete.serverless.config.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { resolve } from 'path';
+import { REPO_ROOT } from '@kbn/repo-info';
+import { servers as defaultConfig } from '../../default/serverless/observability_complete.serverless.config';
+import type { ScoutServerConfig } from '../../../../../types';
+
+const pluginPath = `--plugin-path=${resolve(
+  REPO_ROOT,
+  'src/platform/test/plugin_functional/plugins/hardening'
+)}`;
+
+export const servers: ScoutServerConfig = {
+  ...defaultConfig,
+  kbnTestServer: {
+    ...defaultConfig.kbnTestServer,
+    serverArgs: [...defaultConfig.kbnTestServer.serverArgs, pluginPath],
+  },
+};
diff --git a/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/observability_logs_essentials.serverless.config.ts b/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/observability_logs_essentials.serverless.config.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { resolve } from 'path';
+import { REPO_ROOT } from '@kbn/repo-info';
+import { servers as defaultConfig } from '../../default/serverless/observability_logs_essentials.serverless.config';
+import type { ScoutServerConfig } from '../../../../../types';
+
+const pluginPath = `--plugin-path=${resolve(
+  REPO_ROOT,
+  'src/platform/test/plugin_functional/plugins/hardening'
+)}`;
+
+export const servers: ScoutServerConfig = {
+  ...defaultConfig,
+  kbnTestServer: {
+    ...defaultConfig.kbnTestServer,
+    serverArgs: [...defaultConfig.kbnTestServer.serverArgs, pluginPath],
+  },
+};
diff --git a/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/search.serverless.config.ts b/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/search.serverless.config.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { resolve } from 'path';
+import { REPO_ROOT } from '@kbn/repo-info';
+import { servers as defaultConfig } from '../../default/serverless/search.serverless.config';
+import type { ScoutServerConfig } from '../../../../../types';
+
+const pluginPath = `--plugin-path=${resolve(
+  REPO_ROOT,
+  'src/platform/test/plugin_functional/plugins/hardening'
+)}`;
+
+export const servers: ScoutServerConfig = {
+  ...defaultConfig,
+  kbnTestServer: {
+    ...defaultConfig.kbnTestServer,
+    serverArgs: [...defaultConfig.kbnTestServer.serverArgs, pluginPath],
+  },
+};
diff --git a/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/security_complete.serverless.config.ts b/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/security_complete.serverless.config.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { resolve } from 'path';
+import { REPO_ROOT } from '@kbn/repo-info';
+import { servers as defaultConfig } from '../../default/serverless/security_complete.serverless.config';
+import type { ScoutServerConfig } from '../../../../../types';
+
+const pluginPath = `--plugin-path=${resolve(
+  REPO_ROOT,
+  'src/platform/test/plugin_functional/plugins/hardening'
+)}`;
+
+export const servers: ScoutServerConfig = {
+  ...defaultConfig,
+  kbnTestServer: {
+    ...defaultConfig.kbnTestServer,
+    serverArgs: [...defaultConfig.kbnTestServer.serverArgs, pluginPath],
+  },
+};
diff --git a/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/security_ease.serverless.config.ts b/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/security_ease.serverless.config.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { resolve } from 'path';
+import { REPO_ROOT } from '@kbn/repo-info';
+import { servers as defaultConfig } from '../../default/serverless/security_ease.serverless.config';
+import type { ScoutServerConfig } from '../../../../../types';
+
+const pluginPath = `--plugin-path=${resolve(
+  REPO_ROOT,
+  'src/platform/test/plugin_functional/plugins/hardening'
+)}`;
+
+export const servers: ScoutServerConfig = {
+  ...defaultConfig,
+  kbnTestServer: {
+    ...defaultConfig.kbnTestServer,
+    serverArgs: [...defaultConfig.kbnTestServer.serverArgs, pluginPath],
+  },
+};
diff --git a/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/security_essentials.serverless.config.ts b/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/security_essentials.serverless.config.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { resolve } from 'path';
+import { REPO_ROOT } from '@kbn/repo-info';
+import { servers as defaultConfig } from '../../default/serverless/security_essentials.serverless.config';
+import type { ScoutServerConfig } from '../../../../../types';
+
+const pluginPath = `--plugin-path=${resolve(
+  REPO_ROOT,
+  'src/platform/test/plugin_functional/plugins/hardening'
+)}`;
+
+export const servers: ScoutServerConfig = {
+  ...defaultConfig,
+  kbnTestServer: {
+    ...defaultConfig.kbnTestServer,
+    serverArgs: [...defaultConfig.kbnTestServer.serverArgs, pluginPath],
+  },
+};
diff --git a/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/vectordb.serverless.config.ts b/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/vectordb.serverless.config.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { resolve } from 'path';
+import { REPO_ROOT } from '@kbn/repo-info';
+import { servers as defaultConfig } from '../../default/serverless/vectordb.serverless.config';
+import type { ScoutServerConfig } from '../../../../../types';
+
+const pluginPath = `--plugin-path=${resolve(
+  REPO_ROOT,
+  'src/platform/test/plugin_functional/plugins/hardening'
+)}`;
+
+export const servers: ScoutServerConfig = {
+  ...defaultConfig,
+  kbnTestServer: {
+    ...defaultConfig.kbnTestServer,
+    serverArgs: [...defaultConfig.kbnTestServer.serverArgs, pluginPath],
+  },
+};
diff --git a/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/workplaceai.serverless.config.ts b/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/serverless/workplaceai.serverless.config.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { resolve } from 'path';
+import { REPO_ROOT } from '@kbn/repo-info';
+import { servers as defaultConfig } from '../../default/serverless/workplaceai.serverless.config';
+import type { ScoutServerConfig } from '../../../../../types';
+
+const pluginPath = `--plugin-path=${resolve(
+  REPO_ROOT,
+  'src/platform/test/plugin_functional/plugins/hardening'
+)}`;
+
+export const servers: ScoutServerConfig = {
+  ...defaultConfig,
+  kbnTestServer: {
+    ...defaultConfig.kbnTestServer,
+    serverArgs: [...defaultConfig.kbnTestServer.serverArgs, pluginPath],
+  },
+};
diff --git a/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/stateful/classic.stateful.config.ts b/src/platform/packages/shared/kbn-scout/src/servers/configs/config_sets/hardening/stateful/classic.stateful.config.ts
@@ -0,0 +1,26 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { resolve } from 'path';
+import { REPO_ROOT } from '@kbn/repo-info';
+import type { ScoutServerConfig } from '../../../../../types';
+import { defaultConfig } from '../../default/stateful/base.config';
+
+const pluginPath = `--plugin-path=${resolve(
+  REPO_ROOT,
+  'src/platform/test/plugin_functional/plugins/hardening'
+)}`;
+
+export const servers: ScoutServerConfig = {
+  ...defaultConfig,
+  kbnTestServer: {
+    ...defaultConfig.kbnTestServer,
+    serverArgs: [...defaultConfig.kbnTestServer.serverArgs, pluginPath],
+  },
+};
diff --git a/src/platform/packages/shared/kbn-security-hardening/README.md b/src/platform/packages/shared/kbn-security-hardening/README.md
@@ -8,4 +8,8 @@ When running in production mode (`process.env.NODE_ENV === 'production'`), globa
 
 ## prototype
 
-The prototypes of most built-in classes are sealed to mitigate many prototype pollution vulnerabilities.
+The prototypes of most built-in classes are sealed to mitigate many prototype pollution vulnerabilities.
+
+## Testing
+
+Scout API tests live in `test/scout_hardening/api/` and verify that server-side hardening measures are active at runtime (e.g. `--disallow-code-generation-from-strings` blocking `eval()` and `new Function()`). These tests require the `hardening` server config set which loads the test plugin from `src/platform/test/plugin_functional/plugins/hardening/`.
diff --git a/src/platform/packages/shared/kbn-security-hardening/moon.yml b/src/platform/packages/shared/kbn-security-hardening/moon.yml
@@ -16,7 +16,8 @@ project:
   channel: ''
   owner: '@elastic/kibana-security'
   sourceRoot: src/platform/packages/shared/kbn-security-hardening
-dependsOn: []
+dependsOn:
+  - '@kbn/scout'
 tags:
   - shared-common
   - package
diff --git a/src/platform/packages/shared/kbn-security-hardening/test/scout_hardening/api/playwright.config.ts b/src/platform/packages/shared/kbn-security-hardening/test/scout_hardening/api/playwright.config.ts
@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import { createPlaywrightConfig } from '@kbn/scout';
+
+export default createPlaywrightConfig({
+  testDir: './tests',
+});
diff --git a/src/platform/packages/shared/kbn-security-hardening/test/scout_hardening/api/tests/code_generation.spec.ts b/src/platform/packages/shared/kbn-security-hardening/test/scout_hardening/api/tests/code_generation.spec.ts
@@ -0,0 +1,48 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+import type { RoleApiCredentials } from '@kbn/scout';
+import { apiTest, tags } from '@kbn/scout';
+import { expect } from '@kbn/scout/api';
+
+apiTest.describe(
+  'code generation from strings is disallowed',
+  { tag: tags.deploymentAgnostic },
+  () => {
+    let credentials: RoleApiCredentials;
+
+    apiTest.beforeAll(async ({ requestAuth }) => {
+      credentials = await requestAuth.getApiKey('viewer');
+    });
+
+    apiTest('eval is blocked on the server', async ({ apiClient }) => {
+      const response = await apiClient.get('/internal/hardening/_try_code_generation', {
+        headers: credentials.apiKeyHeader,
+      });
+
+      expect(response).toHaveStatusCode(200);
+      expect(response.body.eval.blocked).toBe(true);
+      expect(response.body.eval.error).toContain(
+        'Code generation from strings disallowed for this context'
+      );
+    });
+
+    apiTest('Function constructor is blocked on the server', async ({ apiClient }) => {
+      const response = await apiClient.get('/internal/hardening/_try_code_generation', {
+        headers: credentials.apiKeyHeader,
+      });
+
+      expect(response).toHaveStatusCode(200);
+      expect(response.body.functionConstructor.blocked).toBe(true);
+      expect(response.body.functionConstructor.error).toContain(
+        'Code generation from strings disallowed for this context'
+      );
+    });
+  }
+);
diff --git a/src/platform/packages/shared/kbn-security-hardening/tsconfig.json b/src/platform/packages/shared/kbn-security-hardening/tsconfig.json
@@ -12,5 +12,7 @@
   "exclude": [
     "target/**/*"
   ],
-  "kbn_references": []
+  "kbn_references": [
+    "@kbn/scout",
+  ]
 }
diff --git a/src/platform/test/plugin_functional/plugins/hardening/common/code_generation.ts b/src/platform/test/plugin_functional/plugins/hardening/common/code_generation.ts
@@ -0,0 +1,34 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the "Elastic License
+ * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
+ * Public License v 1"; you may not use this file except in compliance with, at
+ * your election, the "Elastic License 2.0", the "GNU Affero General Public
+ * License v3.0 only", or the "Server Side Public License, v 1".
+ */
+
+export interface CodeGenerationResult {
+  eval: { blocked: boolean; error?: string };
+  functionConstructor: { blocked: boolean; error?: string };
+}
+
+export function tryCodeGeneration(): CodeGenerationResult {
+  const result: CodeGenerationResult = {
+    eval: { blocked: false },
+    functionConstructor: { blocked: false },
+  };
+
+  try {
+    eval('1+1'); // eslint-disable-line no-eval
+  } catch (e) {
+    result.eval = { blocked: true, error: e.message };
+  }
+
+  try {
+    new Function('return 1+1')(); // eslint-disable-line no-new-func
+  } catch (e) {
+    result.functionConstructor = { blocked: true, error: e.message };
+  }
+
+  return result;
+}
diff --git a/src/platform/test/plugin_functional/plugins/hardening/server/plugin.ts b/src/platform/test/plugin_functional/plugins/hardening/server/plugin.ts
diff --git a/src/platform/test/plugin_functional/test_suites/hardening/prototype.ts b/src/platform/test/plugin_functional/test_suites/hardening/prototype.ts
