[WorkplaceAI][PerUserAuth] Escape callback html and oauth state client params by lorenabalan · Pull Request #251717 · elastic/kibana

lorenabalan · 2026-02-04T16:34:31Z

Summary

Fixes https://github.com/elastic/search-team/issues/12682

While here, also fixing some SO tests broken by #246655
The Scout and AB tests should be fixed by merging latest main into feature branch.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

seanstory

LGTM, but Claude flags that escapeQuotes is more for KQL than for HTML. It suggests lodash.escape:

  import { escape } from 'lodash';                                                                                                                                                                                                       
  const formatted = escape(format.convert(value, 'text'));

lorenabalan · 2026-02-09T09:38:16Z

@elasticmachine merge upstream

elasticmachine · 2026-02-09T09:38:20Z

There are no new commits on the base branch.

x-pack/platform/plugins/shared/actions/server/lib/oauth_state_client.ts

…escape-params

elasticmachine · 2026-02-10T13:35:16Z

💔 Build Failed

Buildkite Build
Commit: 78cef50

Failed CI Steps

Test Failures

[job] [logs] Jest Integration Tests #5 / checking changes on all registered encrypted SO types detecting changes to encryption registration definitions
[job] [logs] Jest Integration Tests #5 / checking changes on all registered encrypted SO types detecting changes to encryption registration definitions

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [6ae9569]

History

…nt params (elastic#251717) ## Summary Fixes elastic/search-team#12682 While here, also fixing some SO tests broken by elastic#246655 The Scout and AB tests should be fixed by merging latest `main` into feature branch. ### Checklist Check the PR satisfies following conditions. Reviewers should verify this PR satisfies this list as well. - [ ] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md) - [ ] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [ ] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios - [ ] If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker) - [ ] This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The `release_note:breaking` label should be applied in these situations. - [ ] [Flaky Test Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was used on any tests changed - [x] The PR description includes the appropriate Release Notes section, and the correct `release_note:*` label is applied per the [guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process) - [x] Review the [backport guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing) and apply applicable `backport:*` labels. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - #246655 - #251873 - #251717 - #252566 - #252104 - #252307 - #252262 - #252501 - #253606 - #254589 - #254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - elastic#246655 - elastic#251873 - elastic#251717 - elastic#252566 - elastic#252104 - elastic#252307 - elastic#252262 - elastic#252501 - elastic#253606 - elastic#254589 - elastic#254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

lorenabalan added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Feb 4, 2026

Escape params

d4f1fee

lorenabalan force-pushed the lb/escape-params branch from bef6a20 to d4f1fee Compare February 4, 2026 16:36

lorenabalan marked this pull request as ready for review February 4, 2026 17:22

lorenabalan requested a review from a team as a code owner February 4, 2026 17:22

Fix backend tests

553d33d

lorenabalan requested a review from a team as a code owner February 5, 2026 09:32

lorenabalan requested a review from kc13greiner February 5, 2026 09:32

seanstory approved these changes Feb 6, 2026

View reviewed changes

Use escape from lodash

175b30a

jcger mentioned this pull request Feb 9, 2026

[Connectors v2] OAuth 2.0 Authorization Code Grant #252369

Merged

jcger reviewed Feb 9, 2026

View reviewed changes

x-pack/platform/plugins/shared/actions/server/lib/oauth_state_client.ts Outdated Show resolved Hide resolved

x-pack/platform/plugins/shared/actions/server/lib/oauth_state_client.ts Outdated Show resolved Hide resolved

lorenabalan and others added 3 commits February 10, 2026 20:10

Merge branch 'connectors-auth-code-grant' into lb/escape-params

098754f

Changes from yarn openapi:bundle

c2f7b69

Address review comments

ecdd0b9

lorenabalan requested a review from jcger February 10, 2026 09:53

jcger approved these changes Feb 10, 2026

View reviewed changes

Reset oas files

b617be3

lorenabalan force-pushed the lb/escape-params branch from 68ae17f to b617be3 Compare February 10, 2026 10:09

kibanamachine and others added 3 commits February 10, 2026 10:26

Changes from yarn openapi:bundle

5113134

Gitignore files

1555e69

Merge branch 'lb/escape-params' of github.com:elastic/kibana into lb/…

78cef50

…escape-params

lorenabalan force-pushed the lb/escape-params branch from bff807f to 78cef50 Compare February 10, 2026 11:22

lorenabalan merged commit 52cc7e8 into connectors-auth-code-grant Feb 10, 2026
11 of 13 checks passed

lorenabalan deleted the lb/escape-params branch February 10, 2026 11:39

lorenabalan changed the title ~~[Workplace AI][PerUserAuth] Escape callback html and oauth state client params~~ [WorkplaceAI][PerUserAuth] Escape callback html and oauth state client params Feb 10, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WorkplaceAI][PerUserAuth] Escape callback html and oauth state client params #251717

[WorkplaceAI][PerUserAuth] Escape callback html and oauth state client params #251717
lorenabalan merged 10 commits intoconnectors-auth-code-grantfrom
lb/escape-params

lorenabalan commented Feb 4, 2026 •

edited

Loading

Uh oh!

seanstory left a comment

Uh oh!

lorenabalan commented Feb 9, 2026

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Feb 10, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

lorenabalan commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Checklist

Uh oh!

seanstory left a comment

Choose a reason for hiding this comment

Uh oh!

lorenabalan commented Feb 9, 2026

Uh oh!

elasticmachine commented Feb 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💔 Build Failed

Failed CI Steps

Test Failures

Metrics [docs]

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

lorenabalan commented Feb 4, 2026 •

edited

Loading

elasticmachine commented Feb 10, 2026 •

edited

Loading