Skip to content

Commit 55ad845

Browse files
nibixnibix
committed
Introduced explicit index resolution API
Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>
1 parent 5d34dd3 commit 55ad845

34 files changed

+509
-1488
lines changed

‎src/integrationTest/java/org/opensearch/security/privileges/IndexPatternTest.java‎

Lines changed: 6 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -13,18 +13,12 @@
1313
import java.time.ZonedDateTime;
1414
import java.time.temporal.ChronoField;
1515

16-
import com.google.common.collect.ImmutableMap;
17-
import com.google.common.collect.ImmutableSet;
1816
import org.junit.Test;
1917

2018
import org.opensearch.cluster.ClusterState;
21-
import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
2219
import org.opensearch.cluster.metadata.Metadata;
23-
import org.opensearch.common.settings.Settings;
24-
import org.opensearch.common.util.concurrent.ThreadContext;
25-
import org.opensearch.security.resolver.IndexResolverReplacer;
2620
import org.opensearch.security.support.WildcardMatcher;
27-
import org.opensearch.security.user.User;
21+
import org.opensearch.security.util.MockPrivilegeEvaluationContextBuilder;
2822

2923
import static org.opensearch.security.util.MockIndexMetadataBuilder.indices;
3024
import static org.junit.Assert.assertEquals;
@@ -232,19 +226,10 @@ public void equals() {
232226
}
233227

234228
private static PrivilegesEvaluationContext ctx() {
235-
IndexNameExpressionResolver indexNameExpressionResolver = new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY));
236-
IndexResolverReplacer indexResolverReplacer = new IndexResolverReplacer(indexNameExpressionResolver, () -> CLUSTER_STATE, null);
237-
User user = new User("test_user").withAttributes(ImmutableMap.of("attrs.a11", "a11", "attrs.year", "year"));
238-
return new PrivilegesEvaluationContext(
239-
user,
240-
ImmutableSet.of(),
241-
"indices:action/test",
242-
null,
243-
null,
244-
indexResolverReplacer,
245-
indexNameExpressionResolver,
246-
() -> CLUSTER_STATE,
247-
ActionPrivileges.EMPTY
248-
);
229+
return MockPrivilegeEvaluationContextBuilder.ctx()
230+
.action("indices:action/test")
231+
.attr("attrs.a11", "a11")
232+
.attr("attrs.year", "year")
233+
.get();
249234
}
250235
}

‎src/integrationTest/java/org/opensearch/security/privileges/actionlevel/EmptyActionPrivilegesTest.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@
1515

1616
import org.junit.Test;
1717

18+
import org.opensearch.cluster.metadata.ResolvedIndices;
1819
import org.opensearch.security.privileges.ActionPrivileges;
1920
import org.opensearch.security.privileges.PrivilegesEvaluatorResponse;
20-
import org.opensearch.security.resolver.IndexResolverReplacer;
2121

2222
import static org.hamcrest.MatcherAssert.assertThat;
2323
import static org.opensearch.security.privileges.PrivilegeEvaluatorResponseMatcher.isForbidden;
@@ -50,7 +50,7 @@ public void hasIndexPrivilege() {
5050
PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(
5151
ctx().get(),
5252
Set.of("indices:data/write/index"),
53-
IndexResolverReplacer.Resolved.ofIndex("any_index")
53+
ResolvedIndices.of("any_index")
5454
);
5555
assertThat(result, isForbidden());
5656
}
@@ -60,7 +60,7 @@ public void hasExplicitIndexPrivilege() {
6060
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
6161
ctx().get(),
6262
Set.of("indices:data/write/index"),
63-
IndexResolverReplacer.Resolved.ofIndex("any_index")
63+
ResolvedIndices.of("any_index")
6464
);
6565
assertThat(result, isForbidden());
6666
}

‎src/integrationTest/java/org/opensearch/security/privileges/actionlevel/RoleBasedActionPrivilegesTest.java‎

Lines changed: 37 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
import java.util.ArrayList;
1414
import java.util.Arrays;
1515
import java.util.Collection;
16+
import java.util.Collections;
1617
import java.util.HashMap;
1718
import java.util.List;
1819
import java.util.Map;
@@ -29,16 +30,17 @@
2930
import org.junit.runners.Parameterized;
3031
import org.junit.runners.Suite;
3132

33+
import org.opensearch.action.OriginalIndices;
3234
import org.opensearch.action.support.IndicesOptions;
3335
import org.opensearch.cluster.metadata.IndexAbstraction;
3436
import org.opensearch.cluster.metadata.IndexMetadata;
3537
import org.opensearch.cluster.metadata.Metadata;
38+
import org.opensearch.cluster.metadata.ResolvedIndices;
3639
import org.opensearch.common.settings.Settings;
3740
import org.opensearch.core.common.unit.ByteSizeUnit;
3841
import org.opensearch.core.common.unit.ByteSizeValue;
3942
import org.opensearch.security.privileges.PrivilegesEvaluationContext;
4043
import org.opensearch.security.privileges.PrivilegesEvaluatorResponse;
41-
import org.opensearch.security.resolver.IndexResolverReplacer;
4244
import org.opensearch.security.securityconf.FlattenedActionGroups;
4345
import org.opensearch.security.securityconf.impl.CType;
4446
import org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration;
@@ -352,13 +354,13 @@ public void positive_partial2() throws Exception {
352354

353355
@Test
354356
public void positive_noLocal() throws Exception {
355-
IndexResolverReplacer.Resolved resolved = new IndexResolverReplacer.Resolved(
356-
ImmutableSet.of(),
357-
ImmutableSet.of(),
358-
ImmutableSet.of("remote:a"),
359-
ImmutableSet.of("remote:a"),
360-
IndicesOptions.LENIENT_EXPAND_OPEN
361-
);
357+
ResolvedIndices resolved = ResolvedIndices.of(Collections.emptySet())
358+
.withRemoteIndices(
359+
Map.of(
360+
"remote",
361+
new OriginalIndices(new String[] { "a" }, IndicesOptions.STRICT_SINGLE_INDEX_NO_EXPAND_FORBID_CLOSED)
362+
)
363+
);
362364
PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(
363365
ctx().roles("test_role").indexMetadata(INDEX_METADATA).get(),
364366
requiredActions,
@@ -481,14 +483,8 @@ public IndicesAndAliases(IndexSpec indexSpec, ActionSpec actionSpec, Statefulnes
481483
.of("index_b1", "index_b2")//
482484
.build();
483485

484-
static IndexResolverReplacer.Resolved resolved(String... indices) {
485-
return new IndexResolverReplacer.Resolved(
486-
ImmutableSet.of(),
487-
ImmutableSet.copyOf(indices),
488-
ImmutableSet.copyOf(indices),
489-
ImmutableSet.of(),
490-
IndicesOptions.LENIENT_EXPAND_OPEN
491-
);
486+
static ResolvedIndices resolved(String... indices) {
487+
return ResolvedIndices.of(indices);
492488
}
493489

494490
}
@@ -648,28 +644,24 @@ public DataStreams(IndexSpec indexSpec, ActionSpec actionSpec, Statefulness stat
648644
dataStreams("data_stream_a11", "data_stream_a12", "data_stream_a21", "data_stream_a22", "data_stream_b1", "data_stream_b2")
649645
.build();
650646

651-
static IndexResolverReplacer.Resolved resolved(String... indices) {
652-
ImmutableSet.Builder<String> allIndices = ImmutableSet.builder();
653-
654-
for (String index : indices) {
655-
IndexAbstraction indexAbstraction = INDEX_METADATA.getIndicesLookup().get(index);
647+
static ResolvedIndices resolved(String... indices) {
648+
return ResolvedIndices.of(indices);
649+
// TODO check
650+
// ImmutableSet.Builder<String> allIndices = ImmutableSet.builder();
651+
//
652+
//
653+
// for (String index : indices) {
654+
// IndexAbstraction indexAbstraction = INDEX_METADATA.getIndicesLookup().get(index);
655+
//
656+
// if (indexAbstraction instanceof IndexAbstraction.DataStream) {
657+
// allIndices.addAll(
658+
// indexAbstraction.getIndices().stream().map(i -> i.getIndex().getName()).collect(Collectors.toList())
659+
// );
660+
// }
661+
//
662+
// allIndices.add(index);
663+
// }
656664

657-
if (indexAbstraction instanceof IndexAbstraction.DataStream) {
658-
allIndices.addAll(
659-
indexAbstraction.getIndices().stream().map(i -> i.getIndex().getName()).collect(Collectors.toList())
660-
);
661-
}
662-
663-
allIndices.add(index);
664-
}
665-
666-
return new IndexResolverReplacer.Resolved(
667-
ImmutableSet.of(),
668-
allIndices.build(),
669-
ImmutableSet.copyOf(indices),
670-
ImmutableSet.of(),
671-
IndicesOptions.LENIENT_EXPAND_OPEN
672-
);
673665
}
674666
}
675667

@@ -871,7 +863,7 @@ public void hasIndexPrivilege_errors() throws Exception {
871863
PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(
872864
ctx().roles("role_with_errors").get(),
873865
Set.of("indices:some_action", "indices:data/write/index"),
874-
IndexResolverReplacer.Resolved.ofIndex("any_index")
866+
ResolvedIndices.of("any_index")
875867
);
876868
assertThat(result, isForbidden());
877869
assertTrue(result.hasEvaluationExceptions());
@@ -897,7 +889,7 @@ public void hasExplicitIndexPrivilege_positive() throws Exception {
897889
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
898890
ctx().roles("test_role").get(),
899891
Set.of("system:admin/system_index"),
900-
IndexResolverReplacer.Resolved.ofIndex("test_index")
892+
ResolvedIndices.of("test_index")
901893
);
902894
assertThat(result, isAllowed());
903895
}
@@ -917,7 +909,7 @@ public void hasExplicitIndexPrivilege_positive_wildcard() throws Exception {
917909
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
918910
ctx().roles("test_role").get(),
919911
Set.of("system:admin/system_index"),
920-
IndexResolverReplacer.Resolved.ofIndex("test_index")
912+
ResolvedIndices.of("test_index")
921913
);
922914
assertThat(result, isAllowed());
923915
}
@@ -934,7 +926,7 @@ public void hasExplicitIndexPrivilege_noWildcard() throws Exception {
934926
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
935927
ctx().roles("test_role").get(),
936928
Set.of("system:admin/system_index"),
937-
IndexResolverReplacer.Resolved.ofIndex("test_index")
929+
ResolvedIndices.of("test_index")
938930
);
939931
assertThat(result, isForbidden());
940932
}
@@ -954,7 +946,7 @@ public void hasExplicitIndexPrivilege_negative_wrongAction() throws Exception {
954946
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
955947
ctx().roles("test_role").get(),
956948
Set.of("system:admin/system_foo"),
957-
IndexResolverReplacer.Resolved.ofIndex("test_index")
949+
ResolvedIndices.of("test_index")
958950
);
959951
assertThat(result, isForbidden());
960952
}
@@ -974,7 +966,7 @@ public void hasExplicitIndexPrivilege_errors() throws Exception {
974966
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
975967
ctx().roles("role_with_errors").get(),
976968
Set.of("system:admin/system_index"),
977-
IndexResolverReplacer.Resolved.ofIndex("any_index")
969+
ResolvedIndices.of("any_index")
978970
);
979971
assertThat(result, isForbidden());
980972
assertTrue(result.hasEvaluationExceptions());
@@ -1004,14 +996,14 @@ public void aliasesOnDataStreamBackingIndices() throws Exception {
1004996
PrivilegesEvaluatorResponse resultForIndexCoveredByAlias = subject.hasIndexPrivilege(
1005997
ctx().roles("role").indexMetadata(metadata).get(),
1006998
Set.of("indices:data/write/index"),
1007-
IndexResolverReplacer.Resolved.ofIndex(".ds-ds_a-000001")
999+
ResolvedIndices.of(".ds-ds_a-000001")
10081000
);
10091001
assertThat(resultForIndexCoveredByAlias, isAllowed());
10101002

10111003
PrivilegesEvaluatorResponse resultForIndexNotCoveredByAlias = subject.hasIndexPrivilege(
10121004
ctx().roles("role").indexMetadata(metadata).get(),
10131005
Set.of("indices:data/write/index"),
1014-
IndexResolverReplacer.Resolved.ofIndex(".ds-ds_a-000002")
1006+
ResolvedIndices.of(".ds-ds_a-000002")
10151007
);
10161008
assertThat(resultForIndexNotCoveredByAlias, isForbidden());
10171009
}

‎src/integrationTest/java/org/opensearch/security/privileges/actionlevel/SubjectBasedActionPrivilegesTest.java‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
import java.util.ArrayList;
1414
import java.util.Arrays;
1515
import java.util.Collection;
16+
import java.util.Collections;
1617
import java.util.List;
1718
import java.util.Map;
1819
import java.util.Set;
@@ -27,12 +28,13 @@
2728
import org.junit.runners.Parameterized;
2829
import org.junit.runners.Suite;
2930

31+
import org.opensearch.action.OriginalIndices;
3032
import org.opensearch.action.support.IndicesOptions;
3133
import org.opensearch.cluster.metadata.IndexAbstraction;
3234
import org.opensearch.cluster.metadata.Metadata;
35+
import org.opensearch.cluster.metadata.ResolvedIndices;
3336
import org.opensearch.security.privileges.PrivilegesEvaluationContext;
3437
import org.opensearch.security.privileges.PrivilegesEvaluatorResponse;
35-
import org.opensearch.security.resolver.IndexResolverReplacer;
3638
import org.opensearch.security.securityconf.FlattenedActionGroups;
3739
import org.opensearch.security.securityconf.impl.CType;
3840
import org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration;
@@ -224,13 +226,13 @@ public void positive_partial2() throws Exception {
224226

225227
@Test
226228
public void positive_noLocal() throws Exception {
227-
IndexResolverReplacer.Resolved resolved = new IndexResolverReplacer.Resolved(
228-
ImmutableSet.of(),
229-
ImmutableSet.of(),
230-
ImmutableSet.of("remote:a"),
231-
ImmutableSet.of("remote:a"),
232-
IndicesOptions.LENIENT_EXPAND_OPEN
233-
);
229+
ResolvedIndices resolved = ResolvedIndices.of(Collections.emptySet())
230+
.withRemoteIndices(
231+
Map.of(
232+
"remote",
233+
new OriginalIndices(new String[] { "a" }, IndicesOptions.STRICT_SINGLE_INDEX_NO_EXPAND_FORBID_CLOSED)
234+
)
235+
);
234236
PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(
235237
ctx().indexMetadata(INDEX_METADATA).get(),
236238
requiredActions,
@@ -330,14 +332,8 @@ public IndicesAndAliases(IndexSpec indexSpec, ActionSpec actionSpec) throws Exce
330332
.of("index_b1", "index_b2")//
331333
.build();
332334

333-
static IndexResolverReplacer.Resolved resolved(String... indices) {
334-
return new IndexResolverReplacer.Resolved(
335-
ImmutableSet.of(),
336-
ImmutableSet.copyOf(indices),
337-
ImmutableSet.copyOf(indices),
338-
ImmutableSet.of(),
339-
IndicesOptions.LENIENT_EXPAND_OPEN
340-
);
335+
static ResolvedIndices resolved(String... indices) {
336+
return ResolvedIndices.of(indices);
341337
}
342338

343339
}
@@ -473,7 +469,9 @@ public DataStreams(IndexSpec indexSpec, ActionSpec actionSpec) throws Exception
473469
dataStreams("data_stream_a11", "data_stream_a12", "data_stream_a21", "data_stream_a22", "data_stream_b1", "data_stream_b2")
474470
.build();
475471

476-
static IndexResolverReplacer.Resolved resolved(String... indices) {
472+
static ResolvedIndices resolved(String... indices) {
473+
return ResolvedIndices.of(indices);
474+
/* TODO CHECK
477475
ImmutableSet.Builder<String> allIndices = ImmutableSet.builder();
478476
479477
for (String index : indices) {
@@ -495,6 +493,8 @@ static IndexResolverReplacer.Resolved resolved(String... indices) {
495493
ImmutableSet.of(),
496494
IndicesOptions.LENIENT_EXPAND_OPEN
497495
);
496+
497+
*/
498498
}
499499
}
500500

@@ -630,7 +630,7 @@ public void hasExplicitIndexPrivilege_positive() throws Exception {
630630
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
631631
ctx().get(),
632632
Set.of("system:admin/system_index"),
633-
IndexResolverReplacer.Resolved.ofIndex("test_index")
633+
ResolvedIndices.of("test_index")
634634
);
635635
assertThat(result, isAllowed());
636636
}
@@ -648,7 +648,7 @@ public void hasExplicitIndexPrivilege_positive_pattern() throws Exception {
648648
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
649649
ctx().get(),
650650
Set.of("system:admin/system_index"),
651-
IndexResolverReplacer.Resolved.ofIndex("test_index")
651+
ResolvedIndices.of("test_index")
652652
);
653653
assertThat(result, isAllowed());
654654
}
@@ -665,7 +665,7 @@ public void hasExplicitIndexPrivilege_noWildcard() throws Exception {
665665
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
666666
ctx().get(),
667667
Set.of("system:admin/system_index"),
668-
IndexResolverReplacer.Resolved.ofIndex("test_index")
668+
ResolvedIndices.of("test_index")
669669
);
670670
assertThat(result, isForbidden());
671671
}
@@ -682,7 +682,7 @@ public void hasExplicitIndexPrivilege_negative_wrongAction() throws Exception {
682682
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
683683
ctx().get(),
684684
Set.of("system:admin/system_foo"),
685-
IndexResolverReplacer.Resolved.ofIndex("test_index")
685+
ResolvedIndices.of("test_index")
686686
);
687687
assertThat(result, isForbidden());
688688
}
@@ -699,7 +699,7 @@ public void hasExplicitIndexPrivilege_errors() throws Exception {
699699
PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(
700700
ctx().get(),
701701
Set.of("system:admin/system_index"),
702-
IndexResolverReplacer.Resolved.ofIndex("test_index")
702+
ResolvedIndices.of("test_index")
703703
);
704704
assertThat(result, isForbidden());
705705
assertTrue(result.hasEvaluationExceptions());

0 commit comments

Comments
 (0)