Better fix - mark non-existing failure store as not visible

Author: alexey-ivanov-es

server/src/main/java/org/elasticsearch/cluster/metadata/IndexAbstractionResolver.java

@@ -259,14 +259,6 @@ private static void resolveSelectorsAndCollect(
                 selectorString = IndexComponentSelector.DATA.getKey();
             }
 
-            // For the ::failures selector, only include the expression if the data stream actually has failure
-            // backing indices. A data stream can have failure store enabled in metadata (partially initialized)
-            // without any backing indices yet.
-            if (IndexComponentSelector.FAILURES.getKey().equals(selectorString)
-                && abstraction.getFailureIndices(projectMetadata).isEmpty()) {
-                return;
-            }
-
             // A selector is always passed along as-is, it's validity for this kind of abstraction is tested later
             collect.add(IndexNameExpressionResolver.combineSelectorExpression(indexAbstraction, selectorString));
         } else {
@@ -323,6 +315,7 @@ private static boolean isIndexVisible(
             || isHidden == false
             || indicesOptions.expandWildcardsHidden()
             || isVisibleDueToImplicitHidden(expression, index);
+        boolean isFailureStoreSelectorPresent = IndexComponentSelector.FAILURES.getKey().equals(selectorString);
         if (indexAbstraction.getType() == IndexAbstraction.Type.ALIAS) {
             // it's an alias, ignore expandWildcardsOpen and expandWildcardsClosed.
             // it's complicated to support those options with aliases pointing to multiple indices...
@@ -357,12 +350,9 @@ private static boolean isIndexVisible(
                 }
             }
 
-            if (isVisible && selectorString != null) {
-                // Check if a selector was present, and if it is, check if this alias is applicable to it
-                IndexComponentSelector selector = IndexComponentSelector.getByKey(selectorString);
-                if (IndexComponentSelector.FAILURES.equals(selector)) {
-                    isVisible = indexAbstraction.isDataStreamRelated();
-                }
+            // Check if a selector was present, and if it is, check if this alias is applicable to it
+            if (isVisible && isFailureStoreSelectorPresent) {
+                isVisible = indexAbstraction.isDataStreamRelated();
             }
             return isVisible;
         }
@@ -372,9 +362,13 @@ private static boolean isIndexVisible(
             }
             if (indexAbstraction.isSystem()) {
                 return isSystemIndexVisible(resolver, indexAbstraction);
-            } else {
-                return isVisible;
             }
+            // A data stream with the ::failures selector is not visible if it has no failure backing indices.
+            // A failure store can be enabled in metadata without any indices yet.
+            if (isFailureStoreSelectorPresent && indexAbstraction.getFailureIndices(projectMetadata).isEmpty()) {
+                return false;
+            }
+            return isVisible;
         }
         assert indexAbstraction.getIndices().size() == 1 : "concrete index must point to a single index";
         if (isVisible == false) {
@@ -397,8 +391,7 @@ private static boolean isIndexVisible(
         }
         if (selectorString != null && Regex.isMatchAllPattern(selectorString) == false) {
             // Check if a selector was present, and if it is, check if this index is applicable to it
-            IndexComponentSelector selector = IndexComponentSelector.getByKey(selectorString);
-            if (IndexComponentSelector.FAILURES.equals(selector)) {
+            if (isFailureStoreSelectorPresent) {
                 return false;
             }
         }

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/IndicesAndAliasesResolverTests.java

@@ -3180,10 +3180,11 @@ public void testCrossProjectSearchForAllIndicesAndSelector() {
             )
         );
 
-        // ::data is the default selector so that it is not attached to local index names
-        var expectedIndices = new String[] { "logs-foo", "logs-foobar" };
+        String[] expectedIndices;
         if (selector.equals("failures")) {
-            expectedIndices = Arrays.stream(expectedIndices).map(name -> name + "::" + selector).toArray(String[]::new);
+            expectedIndices = new String[] { "logs-foobar::failures" };
+        } else {
+            expectedIndices = new String[] { "logs-foo", "logs-foobar" };
         }
 
         assertThat(resolvedIndices.getLocal(), containsInAnyOrder(expectedIndices));