[ES query rule] CPS POC

Author: mbondyra

src/platform/packages/shared/kbn-cps-utils/components/project_picker.tsx

@@ -34,13 +34,15 @@ export interface ProjectPickerProps {
   fetchProjects: () => Promise<ProjectsData | null>;
   isReadonly?: boolean;
   settingsComponent?: React.ReactNode;
+  shouldDisplayReadonlyCallout?: boolean;
 }
 
 export const ProjectPicker = ({
   projectRouting,
   onProjectRoutingChange,
   fetchProjects,
   isReadonly = false,
+  shouldDisplayReadonlyCallout = true,
   settingsComponent,
 }: ProjectPickerProps) => {
   const [showPopover, setShowPopover] = useState(false);
@@ -121,6 +123,7 @@ export const ProjectPicker = ({
           onProjectRoutingChange={onProjectRoutingChange}
           fetchProjects={fetchProjects}
           isReadonly={isReadonly}
+          shouldDisplayReadonlyCallout={shouldDisplayReadonlyCallout}
           settingsComponent={settingsComponent}
         />
       </EuiPopover>

src/platform/packages/shared/kbn-cps-utils/components/project_picker_content.tsx

@@ -35,6 +35,7 @@ export interface ProjectPickerContentProps {
   fetchProjects: () => Promise<ProjectsData | null>;
   isReadonly?: boolean;
   settingsComponent?: React.ReactNode;
+  shouldDisplayReadonlyCallout?: boolean;
 }
 
 const projectPickerOptions = [
@@ -55,6 +56,7 @@ export const ProjectPickerContent = ({
   onProjectRoutingChange,
   fetchProjects,
   isReadonly = false,
+  shouldDisplayReadonlyCallout = true,
   settingsComponent,
 }: ProjectPickerContentProps) => {
   const styles = useMemoCss(projectPickerContentStyles);
@@ -83,7 +85,7 @@ export const ProjectPickerContent = ({
             {settingsComponent && <EuiFlexItem grow={false}>{settingsComponent}</EuiFlexItem>}
           </EuiFlexGroup>
         </EuiPopoverTitle>
-        {isReadonly && (
+        {isReadonly && shouldDisplayReadonlyCallout && (
           <EuiCallOut
             size="s"
             css={styles.callout}

src/platform/plugins/shared/cps/public/services/access_control.ts

@@ -71,6 +71,9 @@ export const ACCESS_CONTROL_CONFIG: AccessControlConfig = {
   lens: {
     defaultAccess: ProjectRoutingAccess.EDITABLE,
   },
+  management: {
+    defaultAccess: ProjectRoutingAccess.READONLY,
+  },
   maps: {
     defaultAccess: ProjectRoutingAccess.EDITABLE,
   },

src/platform/plugins/shared/cps/public/services/cps_manager.ts

@@ -60,8 +60,8 @@ export class CPSManager implements ICPSManager {
       )
       .subscribe((access) => {
         this.projectPickerAccess$.next(access);
-        // Reset project routing to default when access is disabled
-        if (access === ProjectRoutingAccess.DISABLED) {
+        // Reset project routing to default when access is disabled or readonly
+        if (access === ProjectRoutingAccess.DISABLED || access === ProjectRoutingAccess.READONLY) {
           this.projectRouting$.next(DEFAULT_PROJECT_ROUTING);
         }
       });

x-pack/platform/packages/shared/response-ops/rule_params/es_query/v1.ts

@@ -140,6 +140,14 @@ const EsQueryRuleParamsSchemaProperties = {
       },
     }
   ),
+  project_routing: schema.maybe(
+    schema.string({
+      meta: {
+        description:
+          'The project routing value for cross-project search. Determines which projects to include in the search.',
+      },
+    })
+  ),
   // esQuery rule params only
   esQuery: schema.conditional(
     schema.siblingRef('searchType'),

x-pack/platform/plugins/shared/stack_alerts/public/rule_types/components/data_source_selector.tsx

@@ -0,0 +1,120 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React, { useCallback, useEffect, useState } from 'react';
+import { EuiFlexGroup, EuiFlexItem, EuiSwitch, type EuiSwitchEvent } from '@elastic/eui';
+import { i18n } from '@kbn/i18n';
+import type { ProjectRouting } from '@kbn/es-query';
+import { ProjectPicker } from '@kbn/cps-utils';
+import type { CPSPluginStart } from '@kbn/cps/public';
+import type { DataViewSelectPopoverProps } from './data_view_select_popover';
+import { DataViewSelectPopover } from './data_view_select_popover';
+
+export interface DataSourceSelectorProps extends DataViewSelectPopoverProps {
+  cps?: CPSPluginStart;
+  projectRouting?: ProjectRouting;
+  onProjectRoutingChange: (projectRouting: ProjectRouting | undefined) => void;
+  hasPersistedProjectRouting: boolean;
+}
+
+export const DataSourceSelector: React.FC<DataSourceSelectorProps> = ({
+  cps,
+  projectRouting,
+  onProjectRoutingChange,
+  hasPersistedProjectRouting,
+  dependencies,
+  dataView,
+  metadata,
+  onSelectDataView,
+  onChangeMetaData,
+}) => {
+  const cpsManager = cps?.cpsManager;
+  // Override is enabled if there's a persisted project_routing value
+  const [isOverrideEnabled, setIsOverrideEnabled] = useState(hasPersistedProjectRouting);
+  // Local display value for when override is disabled (follows global scope)
+  const [displayProjectRouting, setDisplayProjectRouting] = useState<ProjectRouting | undefined>(
+    projectRouting
+  );
+
+  // Subscribe to global project routing changes when override is disabled
+  useEffect(() => {
+    if (!cpsManager || isOverrideEnabled) {
+      return;
+    }
+
+    const subscription = cpsManager.getProjectRouting$().subscribe((globalProjectRouting) => {
+      // Only update local display, don't persist
+      setDisplayProjectRouting(globalProjectRouting);
+    });
+
+    return () => subscription.unsubscribe();
+  }, [cpsManager, isOverrideEnabled]);
+
+  // Sync display value with prop when override is enabled
+  useEffect(() => {
+    if (isOverrideEnabled) {
+      setDisplayProjectRouting(projectRouting);
+    }
+  }, [isOverrideEnabled, projectRouting]);
+
+  const handleOverrideChange = useCallback(
+    (e: EuiSwitchEvent) => {
+      const newOverrideValue = e.target.checked;
+      setIsOverrideEnabled(newOverrideValue);
+
+      if (newOverrideValue) {
+        // When enabling override, set the current display value as the persisted value
+        const valueToSave = displayProjectRouting ?? cpsManager?.getProjectRouting();
+        if (valueToSave) {
+          onProjectRoutingChange(valueToSave);
+        }
+      } else {
+        // When disabling override, clear the persisted value (set to undefined)
+        onProjectRoutingChange(undefined);
+      }
+    },
+    [cpsManager, displayProjectRouting, onProjectRoutingChange]
+  );
+
+  const settingsComponent = (
+    <EuiSwitch
+      label={i18n.translate('xpack.stackAlerts.components.dataSourceSelector.overrideGlobalScope', {
+        defaultMessage: 'Override global scope',
+      })}
+      checked={isOverrideEnabled}
+      onChange={handleOverrideChange}
+      compressed
+      data-test-subj="override-global-scope-switch"
+    />
+  );
+
+  return (
+    <EuiFlexGroup gutterSize="s" alignItems="center" responsive={false}>
+      {cpsManager && (
+        <EuiFlexItem grow={false}>
+          <ProjectPicker
+            projectRouting={displayProjectRouting}
+            onProjectRoutingChange={onProjectRoutingChange}
+            fetchProjects={() => cpsManager.fetchProjects()}
+            isReadonly={!isOverrideEnabled}
+            shouldDisplayReadonlyCallout={false}
+            settingsComponent={settingsComponent}
+          />
+        </EuiFlexItem>
+      )}
+      <EuiFlexItem>
+        <DataViewSelectPopover
+          dependencies={dependencies}
+          dataView={dataView}
+          metadata={metadata}
+          onSelectDataView={onSelectDataView}
+          onChangeMetaData={onChangeMetaData}
+        />
+      </EuiFlexItem>
+    </EuiFlexGroup>
+  );
+};

x-pack/platform/plugins/shared/stack_alerts/public/rule_types/es_query/expression/search_source_expression.tsx

@@ -43,6 +43,7 @@ export const SearchSourceExpression = ({
     termField,
     termSize,
     excludeHitsFromPreviousRun,
+    project_routing,
   } = ruleParams;
   const { data, isServerless } = useTriggerUiActionServices();
 
@@ -94,6 +95,7 @@ export const SearchSourceExpression = ({
             excludeHitsFromPreviousRun ?? DEFAULT_VALUES.EXCLUDE_PREVIOUS_HITS,
           // The sourceFields param is ignored
           sourceFields: [],
+          project_routing,
         });
         setSearchSource(createdSearchSource);
       } catch (error) {

x-pack/platform/plugins/shared/stack_alerts/public/rule_types/es_query/expression/search_source_expression_form.tsx

@@ -8,7 +8,7 @@
 import React, { Fragment, useCallback, useEffect, useMemo, useReducer, useState } from 'react';
 import deepEqual from 'fast-deep-equal';
 import { lastValueFrom } from 'rxjs';
-import type { Filter, Query } from '@kbn/es-query';
+import type { Filter, ProjectRouting, Query } from '@kbn/es-query';
 import { FormattedMessage } from '@kbn/i18n-react';
 import { EuiFormRow, EuiSpacer, EuiTitle } from '@elastic/eui';
 import type { IErrorObject } from '@kbn/triggers-actions-ui-plugin/public';
@@ -35,7 +35,7 @@ import type {
   SourceField,
 } from '../types';
 import { DEFAULT_VALUES, SERVERLESS_DEFAULT_VALUES } from '../constants';
-import { DataViewSelectPopover } from '../../components/data_view_select_popover';
+import { DataSourceSelector } from '../../components/data_source_selector';
 import { RuleCommonExpressions } from '../rule_common_expressions';
 import { useTriggerUiActionServices, convertFieldSpecToFieldOption } from '../util';
 import { hasExpressionValidationErrors } from '../validation';
@@ -82,12 +82,26 @@ const isSearchSourceParam = (action: LocalStateAction): action is SearchSourcePa
 export const SearchSourceExpressionForm = (props: SearchSourceExpressionFormProps) => {
   const services = useTriggerUiActionServices();
   const unifiedSearch = services.unifiedSearch;
+  const cps = services.cps;
   const { dataViews, dataViewEditor, isServerless } = useTriggerUiActionServices();
   const { searchSource, errors, initialSavedQuery, setParam, ruleParams } = props;
   const [savedQuery, setSavedQuery] = useState<SavedQuery>();
+  const [projectRouting, setProjectRouting] = useState<ProjectRouting | undefined>(
+    ruleParams.project_routing
+  );
+  // Track if we had a persisted value when the component mounted (for editing existing rules)
+  const [hasPersistedProjectRouting] = useState(ruleParams.project_routing !== undefined);
 
   useEffect(() => setSavedQuery(initialSavedQuery), [initialSavedQuery]);
 
+  const onProjectRoutingChange = useCallback(
+    (newProjectRouting: ProjectRouting | undefined) => {
+      setProjectRouting(newProjectRouting);
+      setParam('project_routing', newProjectRouting);
+    },
+    [setParam]
+  );
+
   const [ruleConfiguration, dispatch] = useReducer<LocalStateReducer>(
     (currentState, action) => {
       if (isSearchSourceParam(action)) {
@@ -291,13 +305,19 @@ export const SearchSourceExpressionForm = (props: SearchSourceExpressionFormProp
     const isGroupAgg = isGroupAggregation(ruleParams.termField);
     const isCountAgg = isCountAggregation(ruleParams.aggType);
     const testSearchSource = createTestSearchSource();
-    const { rawResponse } = await lastValueFrom(testSearchSource.fetch$());
+    const { rawResponse } = await lastValueFrom(testSearchSource.fetch$({ projectRouting }));
     return {
       testResults: parseAggregationResults({ isCountAgg, isGroupAgg, esResult: rawResponse }),
       isGrouped: isGroupAgg,
       timeWindow,
     };
-  }, [timeWindow, createTestSearchSource, ruleParams.aggType, ruleParams.termField]);
+  }, [
+    timeWindow,
+    createTestSearchSource,
+    ruleParams.aggType,
+    ruleParams.termField,
+    projectRouting,
+  ]);
 
   return (
     <Fragment>
@@ -306,11 +326,15 @@ export const SearchSourceExpressionForm = (props: SearchSourceExpressionFormProp
         label={
           <FormattedMessage
             id="xpack.stackAlerts.esQuery.ui.selectDataViewPrompt"
-            defaultMessage="Select a data view"
+            defaultMessage="Select a data source"
           />
         }
       >
-        <DataViewSelectPopover
+        <DataSourceSelector
+          cps={cps}
+          projectRouting={projectRouting}
+          onProjectRoutingChange={onProjectRoutingChange}
+          hasPersistedProjectRouting={hasPersistedProjectRouting}
           dependencies={{ dataViews, dataViewEditor }}
           dataView={dataView}
           metadata={props.metadata}

x-pack/platform/plugins/shared/stack_alerts/public/rule_types/es_query/types.ts

@@ -9,7 +9,7 @@ import type { RuleTypeParams } from '@kbn/alerting-plugin/common';
 import type { SerializedSearchSourceFields } from '@kbn/data-plugin/common';
 import type { EuiComboBoxOptionOption } from '@elastic/eui';
 import type { DataView } from '@kbn/data-views-plugin/public';
-import type { AggregateQuery } from '@kbn/es-query';
+import type { AggregateQuery, ProjectRouting } from '@kbn/es-query';
 
 export enum SearchType {
   esQuery = 'esQuery',
@@ -62,6 +62,7 @@ export interface OnlySearchSourceRuleParams {
   searchType?: 'searchSource';
   searchConfiguration?: SerializedSearchSourceFields;
   savedQueryId?: string;
+  project_routing?: ProjectRouting;
 }
 
 export interface OnlyEsqlQueryRuleParams {

x-pack/platform/plugins/shared/triggers_actions_ui/kibana.jsonc

@@ -30,7 +30,7 @@
       "uiActions",
       "contentManagement"
     ],
-    "optionalPlugins": ["cloud", "features", "home", "spaces", "serverless", "share"],
+    "optionalPlugins": ["cloud", "cps", "features", "home", "spaces", "serverless", "share"],
     "requiredBundles": ["alerting", "esUiShared", "kibanaReact", "kibanaUtils", "actions"],
     "extraPublicDirs": ["public/common", "public/common/constants"]
   }