[9.3] Fix DHQ checkPermissions error handling (#257882) (#257941)

kibanamachine · szaffarano · web-flow · commit 532af403cc27 · 2026-03-16T09:27:56.000-07:00
# Backport This will backport the following commits from `main` to `9.3`: - [Fix DHQ checkPermissions error handling (#257882)](#257882)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Sebastián Zaffarano <sebastian.zaffarano@elastic.co>
diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_receiver.test.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_receiver.test.ts
@@ -473,11 +473,11 @@ describe('Security Solution - Health Diagnostic Queries - CircuitBreakingQueryEx
         queryExecutor.search({ query, circuitBreakers: [circuitBreaker] }),
         () => {
           expect(mockEsClient.indices.exists).toHaveBeenCalledWith({
-            index: ['test-index'],
+            index: 'test-index',
             allow_no_indices: false,
           });
           expect(mockEsClient.security.hasPrivileges).toHaveBeenCalledWith({
-            index: [{ names: ['test-index'], privileges: ['read'] }],
+            index: [{ names: 'test-index', privileges: ['read'] }],
           });
           expect(mockEsClient.openPointInTime).toHaveBeenCalled();
           done();
diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_receiver.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_receiver.ts
@@ -69,10 +69,10 @@ export class CircuitBreakingQueryExecutorImpl implements CircuitBreakingQueryExe
   streamEsql<T>(diagnosticQuery: HealthDiagnosticQuery, abortSignal: AbortSignal): Observable<T> {
     const regex = /^[\s\r\n]*FROM/;
 
-    return from(this.indicesFor(diagnosticQuery)).pipe(
-      mergeMap((index) =>
-        from(this.checkPermissions(index)).pipe(
-          mergeMap(() => {
+    return from(this.checkPermissions(diagnosticQuery.index)).pipe(
+      mergeMap(() =>
+        from(this.indicesFor(diagnosticQuery)).pipe(
+          mergeMap((index) => {
             const query = regex.test(diagnosticQuery.query)
               ? diagnosticQuery.query
               : `FROM ${index} | ${diagnosticQuery.query}`;
@@ -91,10 +91,10 @@ export class CircuitBreakingQueryExecutorImpl implements CircuitBreakingQueryExe
   }
 
   streamEql<T>(diagnosticQuery: HealthDiagnosticQuery, abortSignal: AbortSignal): Observable<T> {
-    return from(this.indicesFor(diagnosticQuery)).pipe(
-      mergeMap((index) =>
-        from(this.checkPermissions(index)).pipe(
-          mergeMap(() => {
+    return from(this.checkPermissions(diagnosticQuery.index)).pipe(
+      mergeMap(() =>
+        from(this.indicesFor(diagnosticQuery)).pipe(
+          mergeMap((index) => {
             const request: EqlSearchRequest = {
               index,
               query: diagnosticQuery.query,
@@ -173,52 +173,52 @@ export class CircuitBreakingQueryExecutorImpl implements CircuitBreakingQueryExe
       return this.client.search<T>(paginatedRequest, { signal: abortSignal });
     };
 
-    return from(this.indicesFor(diagnosticQuery)).pipe(
-      mergeMap((index) =>
-        from(this.checkPermissions(index)).pipe(
-          mergeMap(() => {
-            return from(this.client.openPointInTime({ index, keep_alive: pitKeepAlive }));
-          })
-        )
-      ),
-      map((res) => res.id),
+    return from(this.checkPermissions(diagnosticQuery.index)).pipe(
+      mergeMap(() =>
+        from(this.indicesFor(diagnosticQuery)).pipe(
+          mergeMap((index) =>
+            from(this.client.openPointInTime({ index, keep_alive: pitKeepAlive }))
+          ),
+          map((res) => res.id),
 
-      mergeMap((id) => {
-        pitId = id;
-        return from(fetchPage());
-      }),
-      expand((searchResponse) => {
-        const returnedPitId = (searchResponse as { pit_id?: string }).pit_id;
-        if (returnedPitId) {
-          pitId = returnedPitId;
-        }
+          mergeMap((id) => {
+            pitId = id;
+            return from(fetchPage());
+          }),
+          expand((searchResponse) => {
+            const returnedPitId = (searchResponse as { pit_id?: string }).pit_id;
+            if (returnedPitId) {
+              pitId = returnedPitId;
+            }
 
-        const hits = searchResponse.hits.hits;
-        const aggrs = searchResponse.aggregations;
+            const hits = searchResponse.hits.hits;
+            const aggrs = searchResponse.aggregations;
 
-        if (aggrs || hits.length === 0) {
-          return EMPTY;
-        }
+            if (aggrs || hits.length === 0) {
+              return EMPTY;
+            }
 
-        searchAfter = hits[hits.length - 1].sort;
-        return from(fetchPage());
-      }),
+            searchAfter = hits[hits.length - 1].sort;
+            return from(fetchPage());
+          }),
 
-      mergeMap((searchResponse) => {
-        if (searchResponse.aggregations) {
-          return [searchResponse.aggregations as T];
-        } else {
-          return searchResponse.hits.hits.map((h) => h._source as T);
-        }
-      }),
+          mergeMap((searchResponse) => {
+            if (searchResponse.aggregations) {
+              return [searchResponse.aggregations as T];
+            } else {
+              return searchResponse.hits.hits.map((h) => h._source as T);
+            }
+          }),
 
-      finalize(() => {
-        if (pitId !== undefined) {
-          this.client.closePointInTime({ id: pitId }).catch((error) => {
-            this.logger.warn('>> closePointInTime error', withErrorMessage(error));
-          });
-        }
-      })
+          finalize(() => {
+            if (pitId !== undefined) {
+              this.client.closePointInTime({ id: pitId }).catch((error) => {
+                this.logger.warn('>> closePointInTime error', withErrorMessage(error));
+              });
+            }
+          })
+        )
+      )
     );
   }
 
