[workchat] Initial FTR test setup (#216828)

## Summary

This PR adds the structure for workchat FTR tests and adds a few initial
tests as an example.

### Details about initially added tests

New test directories:
- `x-pack/test_serverless/api_integration/test_suites/chat`
  - load a few common tests (that run on all project types)
- run `platform` security tests (taken over from `search` project type)
- `x-pack/test_serverless/functional/services/svl_chat_navigation.ts`
  - load the `home page` common test
- run a simple navigation test, using the `svlChatNavigation` service
that has been introduced as an example

Note that these tests mostly serve as examples to prove things are
actually running and will have to be adjusted / removed / extended over
time. The purpose of this PR is NOT to add proper test coverage.

Closes #213469

---------

Co-authored-by: Aleh Zasypkin <[email protected]>

Author: pheyos

.buildkite/ftr_chat_serverless_configs.yml

@@ -0,0 +1,11 @@
+disabled:
+  # Base config files, only necessary to inform config finding script
+
+defaultQueue: 'n2-4-spot'
+enabled:
+  - x-pack/test_serverless/api_integration/test_suites/chat/config.ts
+  - x-pack/test_serverless/api_integration/test_suites/chat/config.feature_flags.ts
+  - x-pack/test_serverless/api_integration/test_suites/chat/common_configs/config.group1.ts
+  - x-pack/test_serverless/functional/test_suites/chat/config.ts
+  - x-pack/test_serverless/functional/test_suites/chat/config.feature_flags.ts
+  - x-pack/test_serverless/functional/test_suites/chat/common_configs/config.group1.ts

.buildkite/ftr_configs_manifests.json

@@ -9,6 +9,7 @@
         ".buildkite/ftr_base_serverless_configs.yml",
         ".buildkite/ftr_oblt_serverless_configs.yml",
         ".buildkite/ftr_security_serverless_configs.yml",
-        ".buildkite/ftr_search_serverless_configs.yml"
+        ".buildkite/ftr_search_serverless_configs.yml",
+        ".buildkite/ftr_chat_serverless_configs.yml"
     ]
-}
+}

.github/CODEOWNERS

@@ -2104,6 +2104,12 @@ x-pack/test/api_integration/apis/management/index_management/inference_endpoints
 /x-pack/test_serverless/functional/page_objects/svl_search_* @elastic/search-kibana
 /x-pack/test/functional_search/ @elastic/search-kibana
 
+# workchat
+/x-pack/test_serverless/api_integration/test_suites/chat @elastic/search-kibana
+/x-pack/test_serverless/api_integration/test_suites/chat/config.ts @elastic/search-kibana @elastic/appex-qa
+/x-pack/test_serverless/functional/test_suites/chat/ @elastic/search-kibana
+/x-pack/test_serverless/functional/test_suites/chat/config.ts @elastic/search-kibana @elastic/appex-qa
+
 # Management Experience - Deployment Management
 /src/platform/test/functional/fixtures/kbn_archiver/management.json @elastic/kibana-management @elastic/kibana-data-discovery # Assigned per 2 uses: test/functional/apps/management/_import_objects.ts && test/functional/apps/management/data_views/_scripted_fields_filter.ts
 /x-pack/test/functional/fixtures/kbn_archiver/home/feature_controls/security/security.json @elastic/kibana-management

packages/kbn-mock-idp-plugin/server/plugin.ts

@@ -39,6 +39,7 @@ const projectToAlias = new Map<string, string>([
   // TODO add new 'chat' solution
   // https://elastic.slack.com/archives/C04HT4P1YS3/p1741690997400059
   // https://github.com/elastic/kibana/issues/213469
+  // requires update of config/serverless.chat.yml (currently uses projectType 'search')
 ]);
 
 const readServerlessRoles = (projectType: string) => {

src/platform/packages/shared/kbn-es/src/serverless_resources/README.md

@@ -4,7 +4,7 @@ The resources in this directory are used for seeding Elasticsearch Serverless im
 
 ## Roles
 
-Roles are defined in `roles.yml` for each project under 'es' | 'oblt' | 'security' folder respectively and intended to mock a Serverless deployment. It must be in sync with `project-controller` defined roles and used in real (MKI) environments. In case of some differences tests may pass against Serverless snapshot environment but fail against MKI environments creating confusion.
+Roles are defined in `roles.yml` for each project under 'es' | 'oblt' | 'security' | 'chat' folder respectively and intended to mock a Serverless deployment. It must be in sync with `elasticsearch-controller` defined roles and used in real (MKI) environments. In case of some differences tests may pass against Serverless snapshot environment but fail against MKI environments creating confusion.
 
 ### Why `security_roles.json` is here?
 

src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/chat/roles.yml

@@ -0,0 +1,55 @@
+# -----
+# Copy from internal roles config in elasticsearch-controller
+# -----
+viewer:
+  cluster: ['manage_own_api_key', 'read_pipeline']
+  indices:
+    - names:
+        - '*'
+      privileges:
+        - 'read'
+        - 'view_index_metadata'
+  applications:
+    - application: 'kibana-.kibana'
+      privileges:
+        - 'read'
+      resources:
+        - '*'
+developer:
+  cluster: ['all']
+  indices:
+    - names:
+        - '*'
+      privileges:
+        - 'all'
+  applications:
+    - application: 'kibana-.kibana'
+      privileges:
+        - 'all'
+      resources:
+        - '*'
+
+# admin role defined in elasticsearch controller
+admin:
+  cluster: ['all']
+  indices:
+    - names: ['*']
+      privileges: ['all']
+      allow_restricted_indices: false
+  applications:
+    - application: '*'
+      privileges: ['*']
+      resources: ['*']
+
+# temporarily added for testing purpose
+system_indices_superuser:
+  cluster: ['all']
+  indices:
+    - names: ['*']
+      privileges: ['all']
+      allow_restricted_indices: true
+  applications:
+    - application: '*'
+      privileges: ['*']
+      resources: ['*']
+  run_as: ['*']

src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/es/roles.yml

@@ -1,5 +1,5 @@
 # -----
-# Source: project-controller/blob/main/internal/project/esproject/config/roles.yml
+# Copy from internal roles config in elasticsearch-controller
 # -----
 viewer:
   cluster: ['manage_own_api_key', 'read_pipeline']

src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/oblt/roles.yml

@@ -1,5 +1,5 @@
 # -----
-# Source: project-controller/blob/main/internal/project/security/config/roles.yml
+# Copy from internal roles config in elasticsearch-controller
 # -----
 viewer:
   cluster: []

src/platform/packages/shared/kbn-es/src/serverless_resources/project_roles/security/roles.yml

@@ -1,5 +1,5 @@
 # -----
-# Source: project-controller/blob/main/internal/project/security/config/roles.yml
+# Copy from internal roles config in elasticsearch-controller
 # -----
 # modeled after the t1_analyst minus osquery run saved queries privilege
 viewer:

src/platform/packages/shared/kbn-es/src/utils/docker.ts

@@ -63,12 +63,12 @@ interface BaseOptions extends ImageOptions {
   files?: string | string[];
 }
 
-export const serverlessProjectTypes = new Set<string>(['es', 'oblt', 'security']);
+export const serverlessProjectTypes = new Set<string>(['es', 'oblt', 'security', 'chat']);
 export const isServerlessProjectType = (value: string): value is ServerlessProjectType => {
   return serverlessProjectTypes.has(value);
 };
 
-export type ServerlessProjectType = 'es' | 'oblt' | 'security';
+export type ServerlessProjectType = 'es' | 'oblt' | 'security' | 'chat';
 
 export interface DockerOptions extends EsClusterExecOptions, BaseOptions {
   dockerCmd?: string;

src/platform/packages/shared/kbn-ftr-common-functional-services/services/saml_auth/serverless/auth_provider.ts

@@ -23,6 +23,7 @@ const projectDefaultRoles = new Map<string, Role>([
   ['es', 'developer'],
   ['security', 'editor'],
   ['oblt', 'editor'],
+  ['chat', 'developer'], // TODO: double check if it's really 'developer'
 ]);
 
 const projectTypesWithCustomRolesEnabled = ['es', 'security'];

src/platform/packages/shared/kbn-scout/src/playwright/tags.ts

@@ -7,9 +7,10 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
-const SERVERLESS_ONLY = ['@svlSecurity', '@svlOblt', '@svlSearch'];
+const SERVERLESS_ONLY = ['@svlSecurity', '@svlOblt', '@svlSearch', '@svlChat'];
 const ESS_ONLY = ['@ess'];
-const DEPLOYMENT_AGNOSTIC = SERVERLESS_ONLY.concat(ESS_ONLY);
+// svlChat is truly serverless only and doesn't have a stateful counterpart
+const DEPLOYMENT_AGNOSTIC = ['@ess', '@svlSecurity', '@svlOblt', '@svlSearch'];
 const PERFORMANCE = ['@perf'];
 
 export const tags = {
@@ -22,6 +23,7 @@ export const tags = {
 export const tagsByMode = {
   stateful: '@ess',
   serverless: {
+    chat: '@svlChat',
     es: '@svlSearch',
     oblt: '@svlOblt',
     security: '@svlSecurity',

x-pack/solutions/chat/plugins/workchat-app/public/application/components/home/home_view.tsx

@@ -12,7 +12,7 @@ import { HomeIntegrationSection } from './home_integration_section';
 
 export const WorkChatHomeView: React.FC<{}> = () => {
   return (
-    <KibanaPageTemplate panelled>
+    <KibanaPageTemplate panelled data-test-subj="workChatHomePage">
       <KibanaPageTemplate.Header pageTitle="WorkChat" />
 
       <HomeAgentSection />

x-pack/test/api_integration/deployment_agnostic/default_configs/serverless.config.base.ts

@@ -36,6 +36,7 @@ const esServerArgsFromController = {
     'xpack.ml.dfa.enabled=false',
   ],
   security: ['xpack.security.authc.api_key.cache.max_keys=70000'],
+  chat: [],
 };
 
 // include settings from kibana controller
@@ -55,6 +56,7 @@ const kbnServerArgsFromController = {
     // disable fleet task that writes to metrics.fleet_server.* data streams, impacting functional tests
     `--xpack.task_manager.unsafe.exclude_task_types=${JSON.stringify(['Fleet-Metrics-Task'])}`,
   ],
+  chat: [],
 };
 
 export function createServerlessTestConfig<T extends DeploymentAgnosticCommonServices>(

x-pack/test_serverless/README.md

@@ -2,8 +2,7 @@
 
 The tests and helper methods (services, page objects) defined here in
 `x-pack/test_serverless` cover the serverless functionality introduced by the
- `serverless`, `serverless_observability`, `serverless_search` and
- `serverless_security` plugins.
+ `serverless`, `serverless_observability`, `serverless_search`, `security_solution_serverless` and `serverless_chat` plugins.
 
  For how to set up Docker for serverless ES images, please refer to
  [src/platform/packages/shared/kbn-es/README](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-es/README.mdx).
@@ -19,6 +18,7 @@ set of helper methods and sub-directories for
 - `observability` project specific functionality
 - `search` project specific functionality
 - `security` project specific functionality
+- `chat` project specific functionality
 
 The `shared` directory contains fixtures, services, ... that are shared across
 `api_integration` abd `functional` tests.
@@ -28,6 +28,7 @@ x-pack/test_serverless/
 ├─ api_integration
 │  ├─ services
 │  ├─ test_suites
+│  │  ├─ chat
 │  │  ├─ common
 │  │  ├─ observability
 │  │  ├─ search
@@ -36,6 +37,7 @@ x-pack/test_serverless/
 │  ├─ page_objects
 │  ├─ services
 │  ├─ test_suites
+│  │  ├─ chat
 │  │  ├─ common
 │  │  ├─ observability
 │  │  ├─ search
@@ -52,25 +54,25 @@ covering functionality that's shared across serverless projects. That's why thes
 don't have a dedicated config file and instead need to be included in project specific
 configurations.
 
-**If you add a new `api_integration` or `functional` `common` sub-directory, remember to add it to the corresponding `common_configs` of all projects (`x-pack/test_serverless/[api_integration|functional]/test_suites/[observability|search|security]/common_configs`).**
+**If you add a new `api_integration` or `functional` `common` sub-directory, remember to add it to the corresponding `common_configs` of all projects (`x-pack/test_serverless/[api_integration|functional]/test_suites/[chat|observability|search|security]/common_configs`).**
 
 In case a common test needs to be skipped for one of the projects 
 (in both regular pipelines that start KBN in serverless mode [against serverless ES] & pipelines creating serverless projects in MKI [Cloud]),
 there are the following suite tags available to do so: 
-`skipSvlOblt`, `skipSvlSearch`, `skipSvlSec`, which can be added like this to a test suite:
+`skipSvlChat`, `skipSvlOblt`, `skipSvlSearch`, `skipSvlSec`, which can be added like this to a test suite:
 
 ```
 describe('my test suite', function () {
-  this.tags(['skipSvlOblt', 'skipSvlSearch', 'skipSvlSec']);
+  this.tags(['skipSvlChat', 'skipSvlOblt', 'skipSvlSearch', 'skipSvlSec']);
   // or for a single tag: this.tags('skipSvlSec');
   [...]
 });
 ```
 
 Tests that are designed to only run in one of the projects should be added to the project
-specific test directory and not to `common` with two skips.
+specific test directory and not to `common` with three skips.
 
-Note, that `common` tests are invoked three times in a full test run: once per project to make
+Note, that `common` tests are invoked up to four times in a full test run: once per project to make
 sure the covered shared functionality works correctly in every project. So when writing tests there, be mindful about the test run time.
 
 See also the README files for [Serverless Common API Integration Tests](https://github.com/elastic/kibana/blob/main/x-pack/test_serverless/api_integration/test_suites/common/README.md) and [Serverless Common Functional Tests](https://github.com/elastic/kibana/blob/main/x-pack/test_serverless/functional/test_suites/common/README.md).
@@ -93,6 +95,7 @@ following namespaces:
 | observability | svlOblt                      |
 | search        | svlSearch                    |
 | security      | svlSec                       |
+| chat          | svlChat                      |
 
 ### Adding Serverless Tests
 

x-pack/test_serverless/api_integration/test_suites/chat/common_configs/config.group1.ts

@@ -0,0 +1,23 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrConfigProviderContext } from '@kbn/test';
+
+export default async function ({ readConfigFile }: FtrConfigProviderContext) {
+  const baseTestConfig = await readConfigFile(require.resolve('../config.ts'));
+
+  return {
+    ...baseTestConfig.getAll(),
+    testFiles: [
+      require.resolve('../../common/core'),
+      require.resolve('../../common/elasticsearch_api'),
+    ],
+    junit: {
+      reportName: 'Serverless Chat API Integration Tests - Common Group 1',
+    },
+  };
+}

x-pack/test_serverless/api_integration/test_suites/chat/config.feature_flags.ts

@@ -0,0 +1,29 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../config.base';
+
+/**
+ * Make sure to create a MKI deployment with custom Kibana image, that includes feature flags arguments
+ * These tests most likely will fail on default MKI project
+ */
+export default createTestConfig({
+  serverlessProject: 'chat',
+  junit: {
+    reportName: 'Serverless Chat Feature Flags API Integration Tests',
+  },
+  suiteTags: { exclude: ['skipSvlChat'] },
+  // add feature flags
+  kbnServerArgs: [
+    // e.g. `--xpack.searchIndices.enabled=true`, // global empty state FF
+  ],
+  // load tests in the index file
+  testFiles: [require.resolve('./index.feature_flags.ts')],
+
+  // include settings from project controller
+  esServerArgs: [],
+});

x-pack/test_serverless/api_integration/test_suites/chat/config.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { createTestConfig } from '../../config.base';
+
+export default createTestConfig({
+  serverlessProject: 'chat',
+  testFiles: [require.resolve('.')],
+  junit: {
+    reportName: 'Serverless Chat API Integration Tests',
+  },
+  suiteTags: { exclude: ['skipSvlChat'] },
+
+  // include settings from project controller
+  esServerArgs: [],
+  kbnServerArgs: [],
+});

x-pack/test_serverless/api_integration/test_suites/chat/index.feature_flags.ts

@@ -0,0 +1,14 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('Serverless chat API - feature flags', function () {
+    // loadTestFile(require.resolve('./path/to/tests'));
+  });
+}

x-pack/test_serverless/api_integration/test_suites/chat/index.ts

@@ -0,0 +1,16 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { FtrProviderContext } from '../../ftr_provider_context';
+
+export default function ({ loadTestFile }: FtrProviderContext) {
+  describe('Serverless chat API', function () {
+    this.tags(['esGate']);
+
+    loadTestFile(require.resolve('./platform_security'));
+  });
+}