Skip to content

Commit c26772d

Browse files
nibixnibix
committed
Tests of IndicesRequestModifier and IndicesRequestResolver
Signed-off-by: Nils Bandener <nils.bandener@eliatra.com>
1 parent a7c1ea4 commit c26772d

File tree

6 files changed

+138
-12
lines changed

6 files changed

+138
-12
lines changed

‎src/integrationTest/java/org/opensearch/security/privileges/IndexRequestModifierTest.java‎

Lines changed: 48 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,20 +31,66 @@
3131

3232
import java.util.Arrays;
3333
import java.util.Collection;
34+
import java.util.Collections;
3435
import java.util.Map;
3536

37+
import static org.junit.Assert.assertArrayEquals;
3638
import static org.junit.Assert.assertEquals;
3739
import static org.junit.Assert.assertFalse;
3840
import static org.junit.Assert.assertTrue;
3941

4042
@RunWith(Suite.class)
4143
@Suite.SuiteClasses({
44+
IndexRequestModifierTest.SetLocalIndices.class,
4245
IndexRequestModifierTest.SetLocalIndicesToEmpty.class })
4346
public class IndexRequestModifierTest {
4447

4548
static final IndexNameExpressionResolver indexNameExpressionResolver = new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY));
46-
static final Metadata metadata = MockIndexMetadataBuilder.indices("index").build();
49+
static final Metadata metadata = MockIndexMetadataBuilder.indices("index", "index1", "index2", "index3").build();
4750
final static ClusterState clusterState = ClusterState.builder(ClusterState.EMPTY_STATE).metadata(metadata).build();
51+
static final IndicesRequestModifier subject = new IndicesRequestModifier();
52+
53+
public static class SetLocalIndices {
54+
@Test
55+
public void basic() {
56+
ResolvedIndices resolvedIndices = ResolvedIndices.of("index1");
57+
SearchRequest request = new SearchRequest("index1", "index2", "index3");
58+
59+
boolean success = subject.setLocalIndices(request, resolvedIndices, Collections.singletonList("index1"));
60+
assertTrue(success);
61+
assertArrayEquals(new String [] {"index1"}, request.indices());
62+
}
63+
64+
@Test
65+
public void withRemote() {
66+
ResolvedIndices resolvedIndices = ResolvedIndices.of("index1").withRemoteIndices(Map.of("remote", new OriginalIndices(new String[] {"index_remote"}, IndicesOptions.LENIENT_EXPAND_OPEN)));
67+
SearchRequest request = new SearchRequest("index1", "index2", "index3", "remote:index_remote");
68+
69+
boolean success = subject.setLocalIndices(request, resolvedIndices, Collections.singletonList("index1"));
70+
assertTrue(success);
71+
assertArrayEquals(new String [] {"index1", "remote:index_remote"}, request.indices());
72+
}
73+
74+
@Test
75+
public void empty() {
76+
ResolvedIndices resolvedIndices = ResolvedIndices.of("index1");
77+
SearchRequest request = new SearchRequest("index1", "index2", "index3");
78+
79+
boolean success = subject.setLocalIndices(request, resolvedIndices, Collections.emptyList());
80+
assertTrue(success);
81+
String [] finalResolvedIndices = indexNameExpressionResolver.concreteIndexNames(clusterState, request);
82+
assertArrayEquals(new String [0], finalResolvedIndices);
83+
}
84+
85+
@Test
86+
public void unsupportedType() {
87+
ResolvedIndices resolvedIndices = ResolvedIndices.of("index1");
88+
IndexRequest request = new IndexRequest("index1");
89+
90+
boolean success = subject.setLocalIndices(request, resolvedIndices, Collections.singletonList("index1"));
91+
assertFalse(success);
92+
}
93+
}
4894

4995
@RunWith(Parameterized.class)
5096
public static class SetLocalIndicesToEmpty {
@@ -62,7 +108,7 @@ public void setLocalIndicesToEmpty() {
62108
resolvedIndices = resolvedIndices.withRemoteIndices(Map.of("remote", new OriginalIndices(new String [] {"index"}, request.indicesOptions())));
63109
}
64110

65-
boolean success = new IndicesRequestModifier().setLocalIndicesToEmpty((ActionRequest) request, resolvedIndices);
111+
boolean success = subject.setLocalIndicesToEmpty((ActionRequest) request, resolvedIndices);
66112

67113
if (!(request instanceof IndicesRequest.Replaceable)) {
68114
assertFalse(success);

‎src/integrationTest/java/org/opensearch/security/privileges/IndicesRequestResolverTest.java‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*
8+
* Modifications Copyright OpenSearch Contributors. See
9+
* GitHub history for details.
10+
*/
11+
12+
package org.opensearch.security.privileges;
13+
import org.junit.Test;
14+
import org.opensearch.action.admin.cluster.state.ClusterStateRequest;
15+
import org.opensearch.action.admin.cluster.stats.ClusterStatsRequest;
16+
import org.opensearch.action.admin.indices.settings.put.UpdateSettingsRequest;
17+
import org.opensearch.action.search.SearchRequest;
18+
import org.opensearch.action.support.ActionRequestMetadata;
19+
import org.opensearch.cluster.ClusterState;
20+
import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
21+
import org.opensearch.cluster.metadata.Metadata;
22+
import org.opensearch.cluster.metadata.ResolvedIndices;
23+
import org.opensearch.common.settings.Settings;
24+
import org.opensearch.common.util.concurrent.ThreadContext;
25+
import org.opensearch.security.util.MockIndexMetadataBuilder;
26+
import org.opensearch.security.util.MockPrivilegeEvaluationContextBuilder;
27+
28+
import java.util.Optional;
29+
import java.util.Set;
30+
31+
import static org.mockito.Mockito.mock;
32+
import static org.mockito.Mockito.when;
33+
34+
import static org.junit.Assert.assertArrayEquals;
35+
import static org.junit.Assert.assertEquals;
36+
import static org.junit.Assert.assertFalse;
37+
import static org.junit.Assert.assertTrue;
38+
39+
public class IndicesRequestResolverTest {
40+
41+
static final Metadata metadata = MockIndexMetadataBuilder.indices("index1", "index2", "index3").build();
42+
final static ClusterState clusterState = ClusterState.builder(ClusterState.EMPTY_STATE).metadata(metadata).build();
43+
static final IndicesRequestResolver subject = new IndicesRequestResolver(new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY)));
44+
45+
@Test
46+
public void resolve_normal() {
47+
SearchRequest request = new SearchRequest("index1");
48+
ActionRequestMetadata<SearchRequest, ?> actionRequestMetadata = mock();
49+
ResolvedIndices resolvedIndices = ResolvedIndices.of("index1");
50+
when(actionRequestMetadata.resolvedIndices()).thenReturn(Optional.of(resolvedIndices));
51+
52+
ResolvedIndices returnedResolvedIndices = subject.resolve(request, actionRequestMetadata, () -> clusterState);
53+
assertEquals(resolvedIndices, returnedResolvedIndices);
54+
}
55+
56+
@Test
57+
public void resolve_fallback() {
58+
SearchRequest request = new SearchRequest("index1");
59+
ActionRequestMetadata<SearchRequest, ?> actionRequestMetadata = mock();
60+
when(actionRequestMetadata.resolvedIndices()).thenReturn(Optional.empty());
61+
62+
ResolvedIndices returnedResolvedIndices = subject.resolve(request, actionRequestMetadata, () -> clusterState);
63+
assertEquals(Set.of("index1"), returnedResolvedIndices.local().names());
64+
}
65+
66+
@Test
67+
public void resolve_fallbackUnsupported() {
68+
ClusterStatsRequest request = new ClusterStatsRequest();
69+
ActionRequestMetadata<SearchRequest, ?> actionRequestMetadata = mock();
70+
when(actionRequestMetadata.resolvedIndices()).thenReturn(Optional.empty());
71+
72+
ResolvedIndices returnedResolvedIndices = subject.resolve(request, actionRequestMetadata, () -> clusterState);
73+
assertTrue("Expected isAll(), got: " + returnedResolvedIndices, returnedResolvedIndices.local().isAll());
74+
}
75+
76+
@Test
77+
public void resolve_withPrivilegesEvaluationContext() {
78+
SearchRequest request = new SearchRequest("index*");
79+
ActionRequestMetadata<SearchRequest, ?> actionRequestMetadata = mock();
80+
when(actionRequestMetadata.resolvedIndices()).thenReturn(Optional.empty());
81+
PrivilegesEvaluationContext context = MockPrivilegeEvaluationContextBuilder.ctx().clusterState(clusterState).get();
82+
83+
ResolvedIndices returnedResolvedIndices = subject.resolve(request, actionRequestMetadata, context);
84+
assertEquals(Set.of("index1", "index2", "index3"), returnedResolvedIndices.local().names());
85+
}
86+
}

‎src/main/java/org/opensearch/security/privileges/IndicesRequestModifier.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
*/
2828
public class IndicesRequestModifier {
2929

30-
public boolean reduceLocalIndices(ActionRequest targetRequest, ResolvedIndices resolvedIndices, Collection<String> newIndices) {
30+
public boolean setLocalIndices(ActionRequest targetRequest, ResolvedIndices resolvedIndices, Collection<String> newIndices) {
3131
if (newIndices.isEmpty()) {
3232
return setLocalIndicesToEmpty(targetRequest, resolvedIndices);
3333
}

‎src/main/java/org/opensearch/security/privileges/IndicesRequestResolver.java‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,7 @@ public ResolvedIndices resolve(
4646
ActionRequestMetadata<?, ?> actionRequestMetadata,
4747
PrivilegesEvaluationContext context
4848
) {
49-
Optional<ResolvedIndices> providedIndices = actionRequestMetadata.resolvedIndices();
50-
if (providedIndices.isPresent()) {
51-
return providedIndices.get();
52-
} else {
53-
// The action does not implement the resolution mechanism; we have to do it by ourselves
54-
return resolveFallback(request, context.clusterState());
55-
}
49+
return resolve(request, actionRequestMetadata, context::clusterState);
5650
}
5751

5852
private ResolvedIndices resolveFallback(ActionRequest request, ClusterState clusterState) {

‎src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -609,7 +609,7 @@ public PrivilegesEvaluatorResponse evaluate(PrivilegesEvaluationContext context)
609609

610610
if (presponse.isPartiallyOk()) {
611611
if (dnfofPossible) {
612-
if (this.indicesRequestModifier.reduceLocalIndices(request, resolvedIndices, presponse.getAvailableIndices())) {
612+
if (this.indicesRequestModifier.setLocalIndices(request, resolvedIndices, presponse.getAvailableIndices())) {
613613
return PrivilegesEvaluatorResponse.ok();
614614
}
615615
}

‎src/main/java/org/opensearch/security/privileges/SystemIndexAccessEvaluator.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,7 @@ else if (containsSystemIndex && !isSystemIndexPermissionEnabled) {
322322
presponse.markComplete();
323323
return;
324324
}
325-
this.indicesRequestModifier.reduceLocalIndices(request, requestedResolved, allWithoutSecurity);
325+
this.indicesRequestModifier.setLocalIndices(request, requestedResolved, allWithoutSecurity);
326326
if (log.isDebugEnabled()) {
327327
log.debug("Filtered '{}', resulting list is {}", securityIndex, allWithoutSecurity);
328328
}

0 commit comments

Comments
 (0)