[index management] Allow view only access to Index Templates, Component Templates and Enrich policies

[mattkime]

Summary

Previously, Index Templates, Component Templates and Enrich policies failed to provide view access. This has been addressed by removing endpoints that were used for edit privilege checks and replacing them capabilities api usage only around editing features.

Closes #178654

[elasticmachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 828aa10

Failed CI Steps

• FTR Configs #28

Test Failures

• [job] [logs] FTR Configs #28 / serverless search UI Elasticsearch Start [Onboarding Empty State] developer should show the api key in code view

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
indexManagement	695	690	-5

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
indexManagement	689.9KB	687.8KB	-2.1KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
indexManagement	46.1KB	45.8KB	-218.0B

History

• 💔 Build #251717 failed 5a857a6
• 💔 Build #251716 failed f8ab831
• 💔 Build #247876 failed 6d26f72
• 💔 Build #247875 failed ef44e32
• 💔 Build #247873 failed 5b511df
• 💚 Build #247868 succeeded 10ca3ad

cc @mattkime

[mattkime]

/ci

[dmlemeshko]

x-pack/test/functional/config.base.js changes LGTM

[sabarasaba]

Awesome work @mattkime! Tested locally and all works well. I do however have something I'd like to discuss as part of these new changes:

The missing privileges callout we used to have was very concise copy wise and will tell exactly what privilege(s) the user was missing

Whereas right now the error we show to them it's not as friendly, gives information that might not be relevant to them (current user, action) and it doesn't also specifically say which privileges they are missing.. just which ones are required.

Is there anyway we can extract some of the information from the error and perhaps have a more user friendly copy?

[sabarasaba]

With this change we lose the empty state if they dont have the right permissions, how about we remove the CTA in the empty state component instead?

[sabarasaba]

Just a thought:

We are passing the capabilities object in quite a few places and accessing its internal keys in order to figure out if the user has the manageEnrich privilege. I think having a computed property in the app context (something like hasManageEnrichPrivilege) would avoid us having to specify the full path everywhere and perhaps also be a little bit more semantic than capabilities.index_management.manageEnrich. It might also simplify test setup as we would only need to mock a boolean instead of a full dependency.

Also, a bit unlikely I guess, but if this permission path were to change we would also have to replace it in a bunch of files rather than just once.