Skip to content

Commit 6fdab03

Browse files
nibixnibix
committed
Test fixes
Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>
1 parent 66cd038 commit 6fdab03

File tree

6 files changed

+85
-113
lines changed

6 files changed

+85
-113
lines changed

‎src/integrationTest/java/org/opensearch/security/privileges/actionlevel/RoleBasedActionPrivilegesTest.java‎

Lines changed: 66 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -551,19 +551,27 @@ public static class DataStreams {
551551
final String primaryAction;
552552
final ImmutableSet<String> requiredActions;
553553
final ImmutableSet<String> otherActions;
554-
final RoleBasedActionPrivileges subject;
554+
final Statefulness statefulness;
555555

556556
@Test
557557
public void positive_full() throws Exception {
558558
PrivilegesEvaluationContext ctx = ctx().roles("test_role").indexMetadata(INDEX_METADATA).get();
559-
PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(ctx, requiredActions, resolved("data_stream_a11"));
559+
PrivilegesEvaluatorResponse result = subject(false).hasIndexPrivilege(ctx, requiredActions, resolved("data_stream_a11"));
560560
if (covers(ctx, "data_stream_a11")) {
561561
assertThat(result, isAllowed());
562-
} else if (covers(ctx, ".ds-data_stream_a11-000001")) {
563-
assertThat(
564-
result,
565-
isPartiallyOk(".ds-data_stream_a11-000001", ".ds-data_stream_a11-000002", ".ds-data_stream_a11-000003")
566-
);
562+
} else {
563+
assertThat(result, isForbidden(missingPrivileges(requiredActions)));
564+
}
565+
}
566+
567+
@Test
568+
public void positive_full_breakDownAliases() throws Exception {
569+
PrivilegesEvaluationContext ctx = ctx().roles("test_role").indexMetadata(INDEX_METADATA).get();
570+
PrivilegesEvaluatorResponse result = subject(true).hasIndexPrivilege(ctx, requiredActions, resolved("data_stream_a11"));
571+
if (covers(ctx, "data_stream_a11")) {
572+
assertThat(result, isAllowed());
573+
} else if (covers(ctx, ".ds-data_stream_a11")) {
574+
assertThat(result, isAllowed());
567575
} else {
568576
assertThat(result, isForbidden(missingPrivileges(requiredActions)));
569577
}
@@ -572,7 +580,7 @@ public void positive_full() throws Exception {
572580
@Test
573581
public void positive_partial() throws Exception {
574582
PrivilegesEvaluationContext ctx = ctx().roles("test_role").indexMetadata(INDEX_METADATA).get();
575-
PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(
583+
PrivilegesEvaluatorResponse result = subject(false).hasIndexPrivilege(
576584
ctx,
577585
requiredActions,
578586
resolved("data_stream_a11", "data_stream_a12")
@@ -584,16 +592,38 @@ public void positive_partial() throws Exception {
584592
assertThat(
585593
result,
586594
isPartiallyOk(
587-
"data_stream_a11",
588-
".ds-data_stream_a11-000001",
589-
".ds-data_stream_a11-000002",
590-
".ds-data_stream_a11-000003"
595+
"data_stream_a11"
591596
)
592597
);
593-
} else if (covers(ctx, ".ds-data_stream_a11-000001")) {
598+
} else {
599+
assertThat(result, isForbidden(missingPrivileges(requiredActions)));
600+
}
601+
}
602+
603+
@Test
604+
public void positive_partial_breakDownAliases() throws Exception {
605+
PrivilegesEvaluationContext ctx = ctx().roles("test_role").indexMetadata(INDEX_METADATA).get();
606+
PrivilegesEvaluatorResponse result = subject(true).hasIndexPrivilege(
607+
ctx,
608+
requiredActions,
609+
resolved("data_stream_a11", "data_stream_a12")
610+
);
611+
612+
if (covers(ctx, "data_stream_a11", "data_stream_a12")) {
613+
assertThat(result, isAllowed());
614+
} else if (covers(ctx, "data_stream_a11")) {
594615
assertThat(
595-
result,
596-
isPartiallyOk(".ds-data_stream_a11-000001", ".ds-data_stream_a11-000002", ".ds-data_stream_a11-000003")
616+
result,
617+
isPartiallyOk(
618+
"data_stream_a11"
619+
)
620+
);
621+
} else if (covers(ctx, ".ds-data_stream_a11")) {
622+
assertThat(
623+
result,
624+
isPartiallyOk(
625+
"data_stream_a11"
626+
)
597627
);
598628
} else {
599629
assertThat(result, isForbidden(missingPrivileges(requiredActions)));
@@ -603,14 +633,14 @@ public void positive_partial() throws Exception {
603633
@Test
604634
public void negative_wrongRole() throws Exception {
605635
PrivilegesEvaluationContext ctx = ctx().roles("other_role").indexMetadata(INDEX_METADATA).get();
606-
PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(ctx, requiredActions, resolved("data_stream_a11"));
636+
PrivilegesEvaluatorResponse result = subject(false).hasIndexPrivilege(ctx, requiredActions, resolved("data_stream_a11"));
607637
assertThat(result, isForbidden(missingPrivileges(requiredActions)));
608638
}
609639

610640
@Test
611641
public void negative_wrongAction() throws Exception {
612642
PrivilegesEvaluationContext ctx = ctx().roles("test_role").indexMetadata(INDEX_METADATA).get();
613-
PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(ctx, otherActions, resolved("data_stream_a11"));
643+
PrivilegesEvaluatorResponse result = subject(false).hasIndexPrivilege(ctx, otherActions, resolved("data_stream_a11"));
614644
assertThat(result, isForbidden(missingPrivileges(otherActions)));
615645
}
616646

@@ -676,28 +706,33 @@ public DataStreams(IndexSpec indexSpec, ActionSpec actionSpec, Statefulness stat
676706
? ImmutableSet.of("indices:data/write/update")
677707
: ImmutableSet.of("indices:foobar/unknown");
678708
this.indexSpec.indexMetadata = INDEX_METADATA.getIndicesLookup();
709+
this.statefulness = statefulness;
710+
}
679711

712+
private RoleBasedActionPrivileges subject(boolean breakDownAliases) {
680713
Settings settings = Settings.EMPTY;
681714
if (statefulness == Statefulness.STATEFUL_LIMITED) {
682715
settings = Settings.builder()
683-
.put(
684-
RoleBasedActionPrivileges.PRECOMPUTED_PRIVILEGES_MAX_HEAP_SIZE.getKey(),
685-
new ByteSizeValue(10, ByteSizeUnit.BYTES)
686-
)
687-
.build();
716+
.put(
717+
RoleBasedActionPrivileges.PRECOMPUTED_PRIVILEGES_MAX_HEAP_SIZE.getKey(),
718+
new ByteSizeValue(10, ByteSizeUnit.BYTES)
719+
)
720+
.build();
688721
}
689722

690-
this.subject = new RoleBasedActionPrivileges(
691-
roles,
692-
FlattenedActionGroups.EMPTY,
693-
RuntimeOptimizedActionPrivileges.SpecialIndexProtection.NONE,
694-
settings,
695-
false
723+
RoleBasedActionPrivileges result = new RoleBasedActionPrivileges(
724+
roles,
725+
FlattenedActionGroups.EMPTY,
726+
RuntimeOptimizedActionPrivileges.SpecialIndexProtection.NONE,
727+
settings,
728+
breakDownAliases
696729
);
697730

698731
if (statefulness == Statefulness.STATEFUL || statefulness == Statefulness.STATEFUL_LIMITED) {
699-
this.subject.updateStatefulIndexPrivileges(INDEX_METADATA.getIndicesLookup(), 1);
732+
result.updateStatefulIndexPrivileges(INDEX_METADATA.getIndicesLookup(), 1);
700733
}
734+
735+
return result;
701736
}
702737

703738
final static Metadata INDEX_METADATA = //
@@ -706,22 +741,6 @@ public DataStreams(IndexSpec indexSpec, ActionSpec actionSpec, Statefulness stat
706741

707742
static ResolvedIndices resolved(String... indices) {
708743
return ResolvedIndices.of(indices);
709-
// TODO check
710-
// ImmutableSet.Builder<String> allIndices = ImmutableSet.builder();
711-
//
712-
//
713-
// for (String index : indices) {
714-
// IndexAbstraction indexAbstraction = INDEX_METADATA.getIndicesLookup().get(index);
715-
//
716-
// if (indexAbstraction instanceof IndexAbstraction.DataStream) {
717-
// allIndices.addAll(
718-
// indexAbstraction.getIndices().stream().map(i -> i.getIndex().getName()).collect(Collectors.toList())
719-
// );
720-
// }
721-
//
722-
// allIndices.add(index);
723-
// }
724-
725744
}
726745
}
727746

@@ -849,21 +868,6 @@ enum Statefulness {
849868
}
850869

851870
public static class Misc {
852-
@Test
853-
public void relevantOnly_identity() throws Exception {
854-
Map<String, IndexAbstraction> metadata = //
855-
indices("index_a11", "index_a12", "index_b")//
856-
.alias("alias_a")
857-
.of("index_a11", "index_a12")//
858-
.build()
859-
.getIndicesLookup();
860-
861-
assertTrue(
862-
"relevantOnly() returned identical object",
863-
RoleBasedActionPrivileges.StatefulIndexPrivileges.relevantOnly(metadata, i -> false) == metadata
864-
);
865-
}
866-
867871
@Test
868872
public void relevantOnly_closed() throws Exception {
869873
Map<String, IndexAbstraction> metadata = indices("index_open_1", "index_open_2")//
@@ -942,7 +946,7 @@ public void hasIndexPrivilege_errors() throws Exception {
942946
assertTrue(
943947
"Result mentions role_with_errors: " + result.getEvaluationExceptionInfo(),
944948
result.getEvaluationExceptionInfo()
945-
.startsWith("Exceptions encountered during privilege evaluation:\n" + "Error while evaluating")
949+
.contains("Exceptions encountered during privilege evaluation:\n" + "Error while evaluating")
946950
);
947951
}
948952

@@ -1075,7 +1079,7 @@ public void hasExplicitIndexPrivilege_errors() throws Exception {
10751079
assertTrue(
10761080
"Result mentions role_with_errors: " + result.getEvaluationExceptionInfo(),
10771081
result.getEvaluationExceptionInfo()
1078-
.startsWith("Exceptions encountered during privilege evaluation:\n" + "Error while evaluating role role_with_errors")
1082+
.contains("Exceptions encountered during privilege evaluation:\n" + "Error while evaluating role role_with_errors")
10791083
);
10801084
}
10811085

‎src/integrationTest/java/org/opensearch/security/privileges/actionlevel/SubjectBasedActionPrivilegesTest.java‎

Lines changed: 2 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -404,11 +404,6 @@ public void positive_full() throws Exception {
404404
PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(ctx, requiredActions, resolved("data_stream_a11"));
405405
if (covers(ctx, "data_stream_a11")) {
406406
assertThat(result, isAllowed());
407-
} else if (covers(ctx, ".ds-data_stream_a11-000001")) {
408-
assertThat(
409-
result,
410-
isPartiallyOk(".ds-data_stream_a11-000001", ".ds-data_stream_a11-000002", ".ds-data_stream_a11-000003")
411-
);
412407
} else {
413408
assertThat(result, isForbidden(missingPrivileges(requiredActions)));
414409
}
@@ -429,17 +424,9 @@ public void positive_partial() throws Exception {
429424
assertThat(
430425
result,
431426
isPartiallyOk(
432-
"data_stream_a11",
433-
".ds-data_stream_a11-000001",
434-
".ds-data_stream_a11-000002",
435-
".ds-data_stream_a11-000003"
427+
"data_stream_a11"
436428
)
437429
);
438-
} else if (covers(ctx, ".ds-data_stream_a11-000001")) {
439-
assertThat(
440-
result,
441-
isPartiallyOk(".ds-data_stream_a11-000001", ".ds-data_stream_a11-000002", ".ds-data_stream_a11-000003")
442-
);
443430
} else {
444431
assertThat(result, isForbidden(missingPrivileges(requiredActions)));
445432
}
@@ -516,7 +503,7 @@ public DataStreams(IndexSpec indexSpec, ActionSpec actionSpec) throws Exception
516503
config,
517504
FlattenedActionGroups.EMPTY,
518505
RuntimeOptimizedActionPrivileges.SpecialIndexProtection.NONE,
519-
true
506+
false // breakDownAliases = true is already sufficiently checked in RoleBasedActionPrivilegesTest
520507
);
521508
}
522509

@@ -526,30 +513,6 @@ public DataStreams(IndexSpec indexSpec, ActionSpec actionSpec) throws Exception
526513

527514
static ResolvedIndices resolved(String... indices) {
528515
return ResolvedIndices.of(indices);
529-
/* TODO CHECK
530-
ImmutableSet.Builder<String> allIndices = ImmutableSet.builder();
531-
532-
for (String index : indices) {
533-
IndexAbstraction indexAbstraction = INDEX_METADATA.getIndicesLookup().get(index);
534-
535-
if (indexAbstraction instanceof IndexAbstraction.DataStream) {
536-
allIndices.addAll(
537-
indexAbstraction.getIndices().stream().map(i -> i.getIndex().getName()).collect(Collectors.toList())
538-
);
539-
}
540-
541-
allIndices.add(index);
542-
}
543-
544-
return new IndexResolverReplacer.Resolved(
545-
ImmutableSet.of(),
546-
allIndices.build(),
547-
ImmutableSet.copyOf(indices),
548-
ImmutableSet.of(),
549-
IndicesOptions.LENIENT_EXPAND_OPEN
550-
);
551-
552-
*/
553516
}
554517
}
555518

‎src/main/java/org/opensearch/security/privileges/IndexPattern.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,15 @@ public class IndexPattern {
5353
* Index patterns which contain date math (like <index_{now}>)
5454
*/
5555
private final ImmutableList<String> dateMathExpressions;
56-
private final int hashCode;
56+
57+
/**
58+
* If this is true, this pattern will also match an alias or data stream if it actually matches ALL child indices of
59+
* of the alias or data stream.
60+
*/
5761
private final boolean memberIndexPrivilegesYieldAliasPrivileges;
5862

63+
private final int hashCode;
64+
5965
private IndexPattern(
6066
WildcardMatcher staticPattern,
6167
ImmutableList<String> patternTemplates,

‎src/test/java/org/opensearch/security/multitenancy/test/MultitenancyTests.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -406,7 +406,7 @@ public void testMtMulti() throws Exception {
406406
Assert.assertTrue(res.getBody().contains(dashboardsIndex));
407407

408408
// get
409-
assertThat(
409+
assertThat(res.getBody(),
410410
HttpStatus.SC_OK,
411411
is(
412412
(res = rh.executeGetRequest(
@@ -416,10 +416,10 @@ public void testMtMulti() throws Exception {
416416
)).getStatusCode()
417417
)
418418
);
419-
Assert.assertFalse(res.getBody().contains("exception"));
420-
Assert.assertTrue(res.getBody().contains("humanresources"));
421-
Assert.assertTrue(res.getBody().contains("\"found\" : true"));
422-
Assert.assertTrue(res.getBody().contains(dashboardsIndex));
419+
Assert.assertFalse(res.getBody(),res.getBody().contains("exception"));
420+
Assert.assertTrue(res.getBody(),res.getBody().contains("humanresources"));
421+
Assert.assertTrue(res.getBody(),res.getBody().contains("\"found\" : true"));
422+
Assert.assertTrue(res.getBody(),res.getBody().contains(dashboardsIndex));
423423

424424
// mget
425425
body = "{\"docs\" : [{\"_index\" : \".kibana\",\"_id\" : \"index-pattern:9fbbd1a0-c3c5-11e8-a13f-71b8ea5a4f7b\"}]}";
@@ -563,7 +563,7 @@ public void testDashboardsAlias65() throws Exception {
563563
)).getStatusCode()
564564
)
565565
);
566-
Assert.assertTrue(res.getBody().contains(".kibana_-900636979_kibanaro"));
566+
Assert.assertTrue(res.getBody(), res.getBody().contains(".kibana_-900636979_kibanaro"));
567567
}
568568

569569
@Test
@@ -638,12 +638,12 @@ public void testMultitenancyAnonymousUser() throws Exception {
638638

639639
/* The anonymous user has access to its tenant */
640640
res = rh.executeGetRequest(url, new BasicHeader("securitytenant", anonymousTenant));
641-
assertThat(res.getStatusCode(), is(HttpStatus.SC_OK));
642-
assertThat(res.findValueInJson("_source.tenant"), is(anonymousTenant));
641+
assertThat(res.getBody(), res.getStatusCode(), is(HttpStatus.SC_OK));
642+
assertThat(res.getBody(), res.findValueInJson("_source.tenant"), is(anonymousTenant));
643643

644644
/* No access to other tenants */
645645
res = rh.executeGetRequest(url, new BasicHeader("securitytenant", "human_resources"));
646-
assertThat(res.getStatusCode(), is(HttpStatus.SC_FORBIDDEN));
646+
assertThat(res.getBody(), res.getStatusCode(), is(HttpStatus.SC_FORBIDDEN));
647647
}
648648

649649
@Test

‎src/test/java/org/opensearch/security/system_indices/SystemIndexDisabledTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -394,7 +394,7 @@ private void testSnapshotWithUser(String user, Header header) {
394394
"{ \"rename_pattern\": \"(.+)\", \"rename_replacement\": \"restored_index_with_global_state_$1\" }",
395395
header
396396
);
397-
validateForbiddenResponse(res, action, user);
397+
assertThat(res.getStatusCode(), is(HttpStatus.SC_FORBIDDEN));
398398
}
399399
}
400400
}

‎src/test/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurerTests.java‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,6 @@
5757
import static org.junit.Assert.fail;
5858

5959
@SuppressWarnings("removal")
60-
@RunWith(RandomizedRunner.class)
6160
public class SecuritySettingsConfigurerTests {
6261

6362
private final ByteArrayOutputStream outContent = new ByteArrayOutputStream();

0 commit comments

Comments
 (0)