[SECURITY_SOLUTION][ENDPOINT] Trusted Apps Create API

[paul-tavares]

Summary

Adds HTTP POST support to the Trusted Apps API for creating a new Trusted App entry.

Request:

_core.http.post(
  '/api/endpoint/trusted_apps',
  {
    body: JSON.stringify({
      name: 'new trusted app for windows',
      os: 'windows',
      entries: [
        { field: 'path', operator: 'included', type: 'match', value: 'one/two' }
      ],
    }),
  }
)

Response:

HTTP 200 with body set to:

{
    "data": {
        "entries": [
            {
                "field": "path",
                "operator": "included",
                "type": "match",
                "value": "one/two"
            }
        ],
        "description": "",
        "created_at": "2020-08-27T19:22:57.526Z",
        "created_by": "kibana",
        "name": "new exception",
        "os": "windows",
        "id": "b6a7a870-e89a-11ea-98dd-29138fd9cf52"
    }
}

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[elasticmachine]

Pinging @elastic/endpoint-app-team (Feature:Endpoint)

[elasticmachine]

Pinging @elastic/endpoint-management (Team:Endpoint Management)

[kevinlog]

this will check if the list is created first?

[paul-tavares]

Yes - the createTrustedAppsLists() method will not create it if it already exists - a warning is logged to the kibana log. Ref:

kibana/x-pack/plugins/lists/server/services/exception_lists/create_endpoint_trusted_apps_list.ts

Lines 70 to 72 in d462274

	} catch (err) {
	if (savedObjectsClient.errors.isConflictError(err)) {
	return null;

(FYI: I just noticed the ? in the above code - will remove it (no longer needed)

[kevinlog]

if the schema doesn't validate here, we get a 400 error? Do we get a meaningful message from the error? From your tests, it looks like an error will be thrown as expected - expect(() => body.validate(bodyMsg)).toThrow() - just wondering what the error actually looks like

[paul-tavares]

they are "typical" errors thrown by the schema lib. Here are a few examples:

// entries was an empty array
{
  'statusCode': 400,
  'error': 'Bad Request',
  'message': '[request body.entries]: array size is [0], but cannot be smaller than [1]',
}

// enty had os set to `winz`
{
  'statusCode': 400,
  'error': 'Bad Request',
  'message': '[request body.os]: types that failed validation:\n- [request body.os.0]: expected value to equal [linux]\n- [request body.os.1]: expected value to equal [macos]\n- [request body.os.2]: expected value to equal [windows]',
}

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 34b3da6

Build metrics

✅ unchanged

History

• 💚 Build #71352 succeeded 13c072e
• 💚 Build #71035 succeeded 85da730

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream