[7.x] [Alerting] Export rules and connectors (#98802)

docs/management/action-types.asciidoc

@@ -106,6 +106,12 @@ New connectors can be created by clicking the *Create connector* button, which w
 [role="screenshot"]
 image::images/connector-select-type.png[Connector select type]
 
+[float]
+[[importing-and-exporting-connectors]]
+=== Importing and exporting connectors
+
+To import and export rules, use the <<managing-saved-objects, Saved Objects Management UI>>.
+
 [float]
 [[create-connectors]]
 === Preconfigured connectors

docs/user/alerting/rule-management.asciidoc

@@ -57,6 +57,12 @@ These operations can also be performed in bulk by multi-selecting rules and clic
 [role="screenshot"]
 image:images/bulk-mute-disable.png[The Manage rules button lets you mute/unmute, enable/disable, and delete in bulk]
 
+[float]
+[[importing-and-exporting-rules]]
+=== Importing and exporting rules
+
+To import and export rules, use the <<managing-saved-objects, Saved Objects Management UI>>.
+
 [float]
 === Required permissions
 

x-pack/plugins/actions/server/plugin.ts

@@ -181,7 +181,6 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
     }
 
     plugins.features.registerKibanaFeature(ACTIONS_FEATURE);
-    setupSavedObjects(core.savedObjects, plugins.encryptedSavedObjects);
 
     this.eventLogService = plugins.eventLog;
     plugins.eventLog.registerProviderActions(EVENT_LOG_PROVIDER, Object.values(EVENT_LOG_ACTIONS));
@@ -228,6 +227,8 @@ export class ActionsPlugin implements Plugin<PluginSetupContract, PluginStartCon
     this.actionExecutor = actionExecutor;
     this.security = plugins.security;
 
+    setupSavedObjects(core.savedObjects, plugins.encryptedSavedObjects, this.actionTypeRegistry!);
+
     registerBuiltInActionTypes({
       logger: this.logger,
       actionTypeRegistry,

x-pack/plugins/actions/server/saved_objects/index.ts

@@ -5,20 +5,27 @@
  * 2.0.
  */
 
-import { SavedObject, SavedObjectsServiceSetup } from 'kibana/server';
+import {
+  SavedObject,
+  SavedObjectsExportTransformContext,
+  SavedObjectsServiceSetup,
+} from 'kibana/server';
 import { EncryptedSavedObjectsPluginSetup } from '../../../encrypted_saved_objects/server';
 import mappings from './mappings.json';
 import { getMigrations } from './migrations';
 import { RawAction } from '../types';
 import { getImportResultMessage, GO_TO_CONNECTORS_BUTTON_LABLE } from './get_import_result_message';
+import { transformConnectorsForExport } from './transform_connectors_for_export';
+import { ActionTypeRegistry } from '../action_type_registry';
 
 export const ACTION_SAVED_OBJECT_TYPE = 'action';
 export const ALERT_SAVED_OBJECT_TYPE = 'alert';
 export const ACTION_TASK_PARAMS_SAVED_OBJECT_TYPE = 'action_task_params';
 
 export function setupSavedObjects(
   savedObjects: SavedObjectsServiceSetup,
-  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup
+  encryptedSavedObjects: EncryptedSavedObjectsPluginSetup,
+  actionTypeRegistry: ActionTypeRegistry
 ) {
   savedObjects.registerType({
     name: ACTION_SAVED_OBJECT_TYPE,
@@ -32,6 +39,12 @@ export function setupSavedObjects(
       getTitle(obj) {
         return `Connector: [${obj.attributes.name}]`;
       },
+      onExport<RawAction>(
+        context: SavedObjectsExportTransformContext,
+        objects: Array<SavedObject<RawAction>>
+      ) {
+        return transformConnectorsForExport(objects, actionTypeRegistry);
+      },
       onImport(connectors) {
         return {
           warnings: [

x-pack/plugins/actions/server/saved_objects/transform_connectors_for_export.test.ts

@@ -0,0 +1,253 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { transformConnectorsForExport } from './transform_connectors_for_export';
+import { ActionTypeRegistry, ActionTypeRegistryOpts } from '../action_type_registry';
+import { loggingSystemMock } from '../../../../../src/core/server/mocks';
+import { actionsConfigMock } from '../actions_config.mock';
+import { licensingMock } from '../../../licensing/server/mocks';
+import { licenseStateMock } from '../lib/license_state.mock';
+import { taskManagerMock } from '../../../task_manager/server/mocks';
+import { ActionExecutor, TaskRunnerFactory } from '../lib';
+import { registerBuiltInActionTypes } from '../builtin_action_types';
+
+describe('transform connector for export', () => {
+  const actionTypeRegistryParams: ActionTypeRegistryOpts = {
+    licensing: licensingMock.createSetup(),
+    taskManager: taskManagerMock.createSetup(),
+    taskRunnerFactory: new TaskRunnerFactory(new ActionExecutor({ isESOCanEncrypt: true })),
+    actionsConfigUtils: actionsConfigMock.create(),
+    licenseState: licenseStateMock.create(),
+    preconfiguredActions: [],
+  };
+  const actionTypeRegistry: ActionTypeRegistry = new ActionTypeRegistry(actionTypeRegistryParams);
+
+  registerBuiltInActionTypes({
+    logger: loggingSystemMock.create().get(),
+    actionTypeRegistry,
+    actionsConfigUtils: actionsConfigMock.create(),
+  });
+
+  const connectorsWithNoSecrets = [
+    {
+      id: '1',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.email',
+        name: 'email connector without auth',
+        isMissingSecrets: false,
+        config: {
+          hasAuth: false,
+          from: 'me@me.com',
+          host: 'host',
+          port: 22,
+          service: null,
+          secure: null,
+        },
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '2',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.index',
+        name: 'index connector',
+        isMissingSecrets: false,
+        config: {
+          index: 'test-index',
+          refresh: false,
+          executionTimeField: null,
+        },
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '3',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.server-log',
+        name: 'server log connector',
+        isMissingSecrets: false,
+        config: {},
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '4',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.webhook',
+        name: 'webhook connector without auth',
+        isMissingSecrets: false,
+        config: {
+          method: 'post',
+          hasAuth: false,
+          url: 'https://webhook',
+          headers: {},
+        },
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+  ];
+  const connectorsWithSecrets = [
+    {
+      id: '1',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.email',
+        name: 'email connector with auth',
+        isMissingSecrets: false,
+        config: {
+          hasAuth: true,
+          from: 'me@me.com',
+          host: 'host',
+          port: 22,
+          service: null,
+          secure: null,
+        },
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '2',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.resilient',
+        name: 'resilient connector',
+        isMissingSecrets: false,
+        config: {
+          apiUrl: 'https://resilient',
+          orgId: 'origId',
+        },
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '3',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.servicenow',
+        name: 'servicenow itsm connector',
+        isMissingSecrets: false,
+        config: {
+          apiUrl: 'https://servicenow',
+        },
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '4',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.pagerduty',
+        name: 'pagerduty connector',
+        isMissingSecrets: false,
+        config: {
+          apiUrl: 'https://pagerduty',
+        },
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '5',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.jira',
+        name: 'jira connector',
+        isMissingSecrets: false,
+        config: {
+          apiUrl: 'https://jira',
+          projectKey: 'foo',
+        },
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '6',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.teams',
+        name: 'teams connector',
+        isMissingSecrets: false,
+        config: {},
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '7',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.slack',
+        name: 'slack connector',
+        isMissingSecrets: false,
+        config: {},
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '8',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.servicenow-sir',
+        name: 'servicenow sir connector',
+        isMissingSecrets: false,
+        config: {
+          apiUrl: 'https://servicenow-sir',
+        },
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+    {
+      id: '8',
+      type: 'action',
+      attributes: {
+        actionTypeId: '.webhook',
+        name: 'webhook connector with auth',
+        isMissingSecrets: false,
+        config: {
+          method: 'post',
+          hasAuth: true,
+          url: 'https://webhook',
+          headers: {},
+        },
+        secrets: 'asbqw4tqbef',
+      },
+      references: [],
+    },
+  ];
+
+  it('should not change connectors without secrets', () => {
+    expect(transformConnectorsForExport(connectorsWithNoSecrets, actionTypeRegistry)).toEqual(
+      connectorsWithNoSecrets
+    );
+  });
+
+  it('should remove secrets for connectors with secrets', () => {
+    expect(transformConnectorsForExport(connectorsWithSecrets, actionTypeRegistry)).toEqual(
+      connectorsWithSecrets.map((connector) => ({
+        ...connector,
+        attributes: {
+          ...connector.attributes,
+          isMissingSecrets: true,
+        },
+      }))
+    );
+  });
+});

x-pack/plugins/actions/server/saved_objects/transform_connectors_for_export.ts

@@ -0,0 +1,50 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { SavedObject } from 'kibana/server';
+import { ActionTypeRegistry } from '../action_type_registry';
+import { validateSecrets } from '../lib';
+import { RawAction, ActionType } from '../types';
+
+export function transformConnectorsForExport(
+  connectors: SavedObject[],
+  actionTypeRegistry: ActionTypeRegistry
+): Array<SavedObject<RawAction>> {
+  return connectors.map((c) => {
+    const connector = c as SavedObject<RawAction>;
+    return transformConnectorForExport(
+      connector,
+      actionTypeRegistry.get(connector.attributes.actionTypeId)
+    );
+  });
+}
+
+function transformConnectorForExport(
+  connector: SavedObject<RawAction>,
+  actionType: ActionType
+): SavedObject<RawAction> {
+  let isMissingSecrets = false;
+  try {
+    // If connector requires secrets, this will throw an error
+    validateSecrets(actionType, {});
+
+    // If connector has optional (or no) secrets, set isMissingSecrets value to value of hasAuth
+    // If connector doesn't have hasAuth value, default to isMissingSecrets: false
+    isMissingSecrets = (connector?.attributes?.config?.hasAuth as boolean) ?? false;
+  } catch (err) {
+    isMissingSecrets = true;
+  }
+
+  // Skip connectors
+  return {
+    ...connector,
+    attributes: {
+      ...connector.attributes,
+      isMissingSecrets,
+    },
+  };
+}