[APM] Solution navigation: Restricted permissions to view app should be reflected in the navigation options

[formgeist]

Summary

Follow-up to #99883

We need to ensure that restricted access to APM through RBAC is reflected in the navigation. E.g. a Space has limited access to the APM app, should not show the APM section in the navigation but reflect the same as in the main Kibana menu where the APM is not available as an option.

This is documented in the component docs https://github.com/elastic/kibana/tree/master/x-pack/plugins/observability/public/components/shared/page_template

cc @sqren

[elasticmachine]

Pinging @elastic/apm-ui (Team:apm)

[sorenlouv]

Good catch!
@weltenwort Is this something you've thought about? I did see this in the readme:

Solutions are expected to handle their own permissions, and what should or should not be displayed at any time, the Observability plugin will not add and remove items for you.

However, the navigation items are registered during the plugin's setup phase which does not take the user context into account (afair) - so how can we, at the same time, conditionally display the nav to certain users, and not to others?

[weltenwort]

As with all registrations taking place during setup() which require access to start()-phase information, core.getStartServices() would be the way to go. Since the registration takes an observable it should be easy to do something like the following:

    pluginsSetup.observability.navigation.registerSections(
      from(core.getStartServices()).pipe(
        map(([{ application: { capabilities } }]) =>
          capabilities[myAppId].show
            ? [
                /* sections go here */
              ]
            : []
        )
      )
    );

Does that make sense? Or do you think the nav should somehow be coupled to the capabilities behind the scenes?

[sorenlouv]

Does that make sense?

Yes! When I wrote my comment I was of the impression that this was happening on the server. It's obviously happening on the client in which case we'll have access to the end user's capabilities.
Thanks!