[WorkplaceAI][PerUserAuth] Add unit tests for OAuth Code Grant Flow by lorenabalan · Pull Request #252566 · elastic/kibana

lorenabalan · 2026-02-10T15:36:37Z

Summary

Closes https://github.com/elastic/search-team/issues/12681

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

lorenabalan · 2026-02-13T09:58:37Z

...ns/shared/encrypted_saved_objects/integration_tests/ci_checks/check_registered_types.test.ts


    expect(modelVersionMap).toMatchInlineSnapshot(`
      Array [
+        "action|2",


This was likely added because of 2865111 - although quite weird that the CI checks didn't complain there 🤔
It was added as a result of running node scripts/jest_integration x-pack/platform/plugins/shared/encrypted_saved_objects/integration_tests/ci_checks/check_registered_types.test.ts -u locally.

kc13greiner

Test changes LGTM!

lorenabalan · 2026-02-16T09:11:10Z

@elasticmachine merge upstream

elasticmachine · 2026-02-16T09:11:13Z

There are no new commits on the base branch.

Copilot

Pull request overview

This PR adds comprehensive unit test coverage for the OAuth 2.0 Authorization Code Grant Flow with PKCE implementation in the Actions plugin. The changes focus on testing the OAuth authorization and callback routes, along with their supporting services and utilities.

Changes:

Added unit tests for OAuth callback route handling various scenarios (success, errors, rate limiting)
Added unit tests for OAuth authorization route including validation and URL generation
Added tests for OAuth state management (creation, retrieval, expiration, cleanup)
Added tests for OAuth authorization service configuration and URL building
Enhanced tests for OAuth token request utility covering Basic Auth scenarios
Updated encrypted saved objects integration test to reflect new action model version

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`oauth_callback.test.ts`	New comprehensive test suite for OAuth callback endpoint covering error cases, token exchange, and redirect flows
`oauth_authorize.test.ts`	New test suite for OAuth authorization initiation endpoint including rate limiting and validation
`oauth_state_client.test.ts`	New tests for OAuth state persistence, retrieval, expiration handling, and cleanup operations
`oauth_authorization_service.test.ts`	New tests for OAuth configuration retrieval and authorization URL construction
`request_oauth_token.test.ts`	Enhanced existing tests with Basic Auth header handling and credential management scenarios
`check_registered_types.test.ts`	Updated snapshot to include new action model version 2

x-pack/platform/plugins/shared/actions/server/lib/oauth_state_client.test.ts

elasticmachine · 2026-02-17T11:03:59Z

💔 Build Failed

Buildkite Build
Commit: 064201e

Failed CI Steps

Post-Build

Metrics [docs]

‼️ ERROR: no builds found for mergeBase sha [a63cbfd]

History

…lastic#252566) ## Summary Closes elastic/search-team#12681

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - #246655 - #251873 - #251717 - #252566 - #252104 - #252307 - #252262 - #252501 - #253606 - #254589 - #254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

## Description Currently, all Kibana connectors use a shared service account for authentication. This approach lacks per user level access support, as it does not distinguish between individual users and service account user levels of permission. To support more secure, flexible, and user-aware integrations, we need to introduce per-user authentication for connectors in Kibana, alongside the existing service account method. ## 2-step release As there are changes that require a 2-step release, this PR won't add `oauth_authorization_code` auth type to any connector type. Therefore, it won't be usable for now. The changes that require a 2-step release are: - we are adding `refreshTokenExpiresAt` to AAD for `connector_token` SO - we are adding `refreshToken` as an encrypted attribute for `connector_token` SO ## Config to run this locally ``` uiSettings: overrides: 'workflows:ui:enabled': true server.publicBaseUrl: 'http://localhost:5601' ``` Also, the auth type needs to be used in a connector. Reach out privately to get the necessary info. ## Involved PRs: - elastic#246655 - elastic#251873 - elastic#251717 - elastic#252566 - elastic#252104 - elastic#252307 - elastic#252262 - elastic#252501 - elastic#253606 - elastic#254589 - elastic#254916 - Rename rate limit kbn setting 15d2c19 - Fix refresh token 34708e5 --------- Co-authored-by: Sean Story <sean.story@elastic.co> Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Lorena Bălan <lorena.balan@elastic.co> Co-authored-by: Janki Salvi <117571355+js-jankisalvi@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Christos Nasikas <xristosnasikas@gmail.com> Co-authored-by: Dennis Tismenko <dennis.tismenko@elastic.co>

Add unit tests - init commit

6a83f9c

lorenabalan added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting labels Feb 10, 2026

lorenabalan changed the title ~~Add unit tests - init commit~~ [WorkplaceAI][PerUserAuth] Add unit tests for OAuth Code Grant Flow Feb 10, 2026

lorenabalan mentioned this pull request Feb 11, 2026

[Connectors v2] OAuth 2.0 Authorization Code Grant #252369

Merged

lorenabalan added 5 commits February 11, 2026 12:41

Small readability improvements

a016ab7

Use actions mocks

0df0156

Use never instead of any

c536ca9

Consolidate tests to avoid redundant code

690101b

More anys into nevers

d3d6e43

lorenabalan marked this pull request as ready for review February 11, 2026 13:01

lorenabalan requested a review from a team as a code owner February 11, 2026 13:01

Update snapshot

e6a526f

lorenabalan requested a review from a team as a code owner February 11, 2026 16:24

lorenabalan requested a review from kc13greiner February 11, 2026 16:24

lorenabalan added 3 commits February 12, 2026 17:33

Merge branch 'connectors-auth-code-grant' into lb/add-tests

ab0c221

Update snapshot

e1915e2

Update tests

b1be5a9

lorenabalan commented Feb 13, 2026

View reviewed changes

kc13greiner approved these changes Feb 13, 2026

View reviewed changes

jcger requested a review from Copilot February 17, 2026 08:35

Copilot AI reviewed Feb 17, 2026

View reviewed changes

jcger approved these changes Feb 17, 2026

View reviewed changes

x-pack/platform/plugins/shared/actions/server/lib/oauth_state_client.test.ts Show resolved Hide resolved

lorenabalan added 2 commits February 17, 2026 10:21

Reset fake time

ab4906b

Merge branch 'connectors-auth-code-grant' into lb/add-tests

064201e

lorenabalan merged commit fe99023 into connectors-auth-code-grant Feb 17, 2026
11 of 13 checks passed

lorenabalan deleted the lb/add-tests branch February 17, 2026 09:57

dennis-tismenko pushed a commit to dennis-tismenko/kibana that referenced this pull request Feb 18, 2026

[WorkplaceAI][PerUserAuth] Add unit tests for OAuth Code Grant Flow (e…

1e22796

…lastic#252566) ## Summary Closes elastic/search-team#12681

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WorkplaceAI][PerUserAuth] Add unit tests for OAuth Code Grant Flow#252566

[WorkplaceAI][PerUserAuth] Add unit tests for OAuth Code Grant Flow#252566
lorenabalan merged 12 commits intoconnectors-auth-code-grantfrom
lb/add-tests

lorenabalan commented Feb 10, 2026

Uh oh!

lorenabalan Feb 13, 2026 •

edited

Loading

Uh oh!

kc13greiner left a comment

Uh oh!

lorenabalan commented Feb 16, 2026

Uh oh!

elasticmachine commented Feb 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Feb 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

lorenabalan commented Feb 10, 2026

Summary

Checklist

Uh oh!

lorenabalan Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kc13greiner left a comment

Choose a reason for hiding this comment

Uh oh!

lorenabalan commented Feb 16, 2026

Uh oh!

elasticmachine commented Feb 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Feb 17, 2026

💔 Build Failed

Failed CI Steps

Metrics [docs]

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

lorenabalan Feb 13, 2026 •

edited

Loading