Skip to content

Commit 16668b0

Browse files
n1v0lgn1v0lg
committed
Automaton and fls dls test
1 parent 12d00b8 commit 16668b0

File tree

11 files changed

+72
-30
lines changed

11 files changed

+72
-30
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/role/RoleDescriptorRequestValidator.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ public static ActionRequestValidationException validate(
4949
if (roleDescriptor.getIndicesPrivileges() != null) {
5050
for (RoleDescriptor.IndicesPrivileges idp : roleDescriptor.getIndicesPrivileges()) {
5151
try {
52-
IndexPrivilege.getSplitBySelectorAccess(Set.of(idp.getPrivileges()));
52+
IndexPrivilege.splitBySelectorAccess(Set.of(idp.getPrivileges()));
5353
} catch (IllegalArgumentException ile) {
5454
validationException = addValidationError(ile.getMessage(), validationException);
5555
}
@@ -61,7 +61,7 @@ public static ActionRequestValidationException validate(
6161
validationException = addValidationError("remote index cluster alias cannot be an empty string", validationException);
6262
}
6363
try {
64-
var privileges = IndexPrivilege.getSplitBySelectorAccess(Set.of(ridp.indicesPrivileges().getPrivileges()));
64+
var privileges = IndexPrivilege.splitBySelectorAccess(Set.of(ridp.indicesPrivileges().getPrivileges()));
6565
if (privileges.stream().anyMatch(p -> p.getSelectorPredicate() == IndexComponentSelectorPredicate.FAILURES)) {
6666
validationException = addValidationError(
6767
"remote index privileges cannot contain privileges that grant access to the failure store",

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/Role.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -437,7 +437,7 @@ static SimpleRole buildFromRoleDescriptor(
437437
new FieldPermissionsDefinition(indexPrivilege.getGrantedFields(), indexPrivilege.getDeniedFields())
438438
),
439439
indexPrivilege.getQuery() == null ? null : Collections.singleton(indexPrivilege.getQuery()),
440-
IndexPrivilege.getSplitBySelectorAccess(Set.of(indexPrivilege.getPrivileges())),
440+
IndexPrivilege.splitBySelectorAccess(Set.of(indexPrivilege.getPrivileges())),
441441
indexPrivilege.allowRestrictedIndices(),
442442
indexPrivilege.getIndices()
443443
);
@@ -454,7 +454,7 @@ static SimpleRole buildFromRoleDescriptor(
454454
new FieldPermissionsDefinition(indicesPrivileges.getGrantedFields(), indicesPrivileges.getDeniedFields())
455455
),
456456
indicesPrivileges.getQuery() == null ? null : Collections.singleton(indicesPrivileges.getQuery()),
457-
IndexPrivilege.getSplitBySelectorAccess(Set.of(indicesPrivileges.getPrivileges())),
457+
IndexPrivilege.splitBySelectorAccess(Set.of(indicesPrivileges.getPrivileges())),
458458
indicesPrivileges.allowRestrictedIndices(),
459459
indicesPrivileges.getIndices()
460460
);

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/ConfigurableClusterPrivileges.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -414,9 +414,7 @@ public ManageRolesPrivilege(List<ManageRolesIndexPermissionGroup> manageRolesInd
414414
this.requestPredicateSupplier = (restrictedIndices) -> {
415415
IndicesPermission.Builder indicesPermissionBuilder = new IndicesPermission.Builder(restrictedIndices);
416416
for (ManageRolesIndexPermissionGroup indexPatternPrivilege : manageRolesIndexPermissionGroups) {
417-
Set<IndexPrivilege> splitBySelector = IndexPrivilege.getSplitBySelectorAccess(
418-
Set.of(indexPatternPrivilege.privileges())
419-
);
417+
Set<IndexPrivilege> splitBySelector = IndexPrivilege.splitBySelectorAccess(Set.of(indexPatternPrivilege.privileges()));
420418
for (IndexPrivilege indexPrivilege : splitBySelector) {
421419
indicesPermissionBuilder.addGroup(
422420
indexPrivilege,

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexComponentSelectorPredicate.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
/**
1717
* A predicate to capture role access by {@link IndexComponentSelector}.
1818
* This is assigned to each {@link org.elasticsearch.xpack.core.security.authz.permission.IndicesPermission.Group} during role building.
19-
* See also {@link org.elasticsearch.xpack.core.security.authz.privilege.IndexPrivilege#getSplitBySelectorAccess(Set)}.
19+
* See also {@link org.elasticsearch.xpack.core.security.authz.privilege.IndexPrivilege#splitBySelectorAccess(Set)}.
2020
*/
2121
public record IndexComponentSelectorPredicate(Set<String> names, Predicate<IndexComponentSelector> predicate)
2222
implements

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,8 @@ public final class IndexPrivilege extends Privilege {
184184
public static final IndexPrivilege ALL = new IndexPrivilege("all", ALL_AUTOMATON, IndexComponentSelectorPredicate.ALL);
185185
public static final IndexPrivilege READ_FAILURE_STORE = new IndexPrivilege(
186186
"read_failure_store",
187-
READ_AUTOMATON,
187+
// TODO use READ_AUTOMATON here in authorization follow-up
188+
Automatons.EMPTY,
188189
IndexComponentSelectorPredicate.FAILURES
189190
);
190191
public static final IndexPrivilege READ = new IndexPrivilege("read", READ_AUTOMATON);
@@ -274,13 +275,13 @@ private IndexPrivilege(Set<String> name, Automaton automaton, IndexComponentSele
274275
}
275276

276277
/**
277-
* Delegates to {@link #getSplitBySelectorAccess(Set)} but throws if the result is not a singleton, i.e., covers more than one selector.
278+
* Delegates to {@link #splitBySelectorAccess(Set)} but throws if the result is not a singleton, i.e., covers more than one selector.
278279
* Use this method if you know that the input name set corresponds to privileges covering the same selector, for instance if you have a
279280
* single input name, or multiple names that all grant access to one selector e.g., {@link IndexComponentSelector#DATA}.
280281
* @throws IllegalArgumentException if privileges and actions for input names cover access to more than one selector
281282
*/
282283
public static IndexPrivilege getWithSingleSelectorAccess(Set<String> names) {
283-
final Set<IndexPrivilege> splitBySelector = getSplitBySelectorAccess(names);
284+
final Set<IndexPrivilege> splitBySelector = splitBySelectorAccess(names);
284285
if (splitBySelector.size() != 1) {
285286
throw new IllegalArgumentException(
286287
"index privilege patterns " + names + " did not map to a single selector " + splitBySelector
@@ -299,14 +300,14 @@ public static IndexPrivilege getWithSingleSelectorAccess(Set<String> names) {
299300
* selector boundaries since their underlying automata would be combined, granting more access than is valid.
300301
* This method conceptually splits the input names into ones that correspond to different selector access, and return an index privilege
301302
* for each partition.
302-
* For instance, `getSplitBySelectorAccess(Set.of("view_index_metadata", "write", "read_failure_store"))` will return two index
303+
* For instance, `splitBySelectorAccess(Set.of("view_index_metadata", "write", "read_failure_store"))` will return two index
303304
* privileges one covering `view_index_metadata` and `write` for a {@link IndexComponentSelectorPredicate#DATA}, the other covering
304305
* `read_failure_store` for a {@link IndexComponentSelectorPredicate#FAILURES} selector.
305306
* A notable exception is the {@link IndexPrivilege#ALL} privilege. If this privilege is included in the input name set, this method
306307
* returns a single index privilege that grants access to all selectors.
307308
* All raw actions are treated as granting access to the {@link IndexComponentSelector#DATA} selector.
308309
*/
309-
public static Set<IndexPrivilege> getSplitBySelectorAccess(Set<String> names) {
310+
public static Set<IndexPrivilege> splitBySelectorAccess(Set<String> names) {
310311
return CACHE.computeIfAbsent(names, (theName) -> {
311312
if (theName.isEmpty()) {
312313
return Set.of(NONE);

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/permission/SimpleRoleTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ public void testGetRoleDescriptorsIntersectionForRemoteCluster() {
176176
Set.of(randomAlphaOfLength(8)),
177177
new FieldPermissions(new FieldPermissionsDefinition(new String[] { randomAlphaOfLength(5) }, null)),
178178
null,
179-
IndexPrivilege.getSplitBySelectorAccess(Set.of(randomFrom(IndexPrivilege.names()))),
179+
IndexPrivilege.splitBySelectorAccess(Set.of(randomFrom(IndexPrivilege.names()))),
180180
randomBoolean(),
181181
randomAlphaOfLength(9)
182182
)

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilegeTests.java‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -146,22 +146,20 @@ public void testGetWithSingleSelectorAccessFailuresSelector() {
146146
);
147147
}
148148

149-
public void testGetSplitBySelectorAccess() {
149+
public void testSplitBySelectorAccess() {
150150
assumeTrue("requires failure store feature", DataStream.isFailureStoreFeatureFlagEnabled());
151151
{
152-
Set<IndexPrivilege> actual = IndexPrivilege.getSplitBySelectorAccess(Set.of("read_failure_store"));
152+
Set<IndexPrivilege> actual = IndexPrivilege.splitBySelectorAccess(Set.of("read_failure_store"));
153153
assertThat(actual, containsInAnyOrder(IndexPrivilege.READ_FAILURE_STORE));
154154
assertThat(actual.iterator().next().getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.FAILURES));
155155
}
156156
{
157-
Set<IndexPrivilege> actual = IndexPrivilege.getSplitBySelectorAccess(Set.of("read_failure_store", "READ_FAILURE_STORE"));
157+
Set<IndexPrivilege> actual = IndexPrivilege.splitBySelectorAccess(Set.of("read_failure_store", "READ_FAILURE_STORE"));
158158
assertThat(actual, containsInAnyOrder(IndexPrivilege.READ_FAILURE_STORE));
159159
assertThat(actual.iterator().next().getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.FAILURES));
160160
}
161161
{
162-
Set<IndexPrivilege> actual = IndexPrivilege.getSplitBySelectorAccess(
163-
Set.of("read_failure_store", "read", "READ_FAILURE_STORE")
164-
);
162+
Set<IndexPrivilege> actual = IndexPrivilege.splitBySelectorAccess(Set.of("read_failure_store", "read", "READ_FAILURE_STORE"));
165163
assertThat(actual, containsInAnyOrder(IndexPrivilege.READ_FAILURE_STORE, IndexPrivilege.READ));
166164
List<IndexComponentSelectorPredicate> actualPredicates = actual.stream().map(IndexPrivilege::getSelectorPredicate).toList();
167165
assertThat(
@@ -170,9 +168,7 @@ public void testGetSplitBySelectorAccess() {
170168
);
171169
}
172170
{
173-
Set<IndexPrivilege> actual = IndexPrivilege.getSplitBySelectorAccess(
174-
Set.of("read_failure_store", "read", "view_index_metadata")
175-
);
171+
Set<IndexPrivilege> actual = IndexPrivilege.splitBySelectorAccess(Set.of("read_failure_store", "read", "view_index_metadata"));
176172
assertThat(
177173
actual,
178174
containsInAnyOrder(
@@ -187,7 +183,7 @@ public void testGetSplitBySelectorAccess() {
187183
);
188184
}
189185
{
190-
Set<IndexPrivilege> actual = IndexPrivilege.getSplitBySelectorAccess(
186+
Set<IndexPrivilege> actual = IndexPrivilege.splitBySelectorAccess(
191187
Set.of("read_failure_store", "read", "indices:data/read/search", "view_index_metadata")
192188
);
193189
assertThat(
@@ -204,7 +200,7 @@ public void testGetSplitBySelectorAccess() {
204200
);
205201
}
206202
{
207-
Set<IndexPrivilege> actual = IndexPrivilege.getSplitBySelectorAccess(
203+
Set<IndexPrivilege> actual = IndexPrivilege.splitBySelectorAccess(
208204
Set.of("read_failure_store", "all", "read", "indices:data/read/search", "view_index_metadata")
209205
);
210206
assertThat(

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/privilege/PrivilegeTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,7 @@ public void testIndexCollapse() {
218218
IndexPrivilege second = values[randomIntBetween(0, values.length - 1)];
219219

220220
Set<String> name = Sets.newHashSet(first.name().iterator().next(), second.name().iterator().next());
221-
Set<IndexPrivilege> indices = IndexPrivilege.getSplitBySelectorAccess(name);
221+
Set<IndexPrivilege> indices = IndexPrivilege.splitBySelectorAccess(name);
222222

223223
Automaton automaton = null;
224224
if (indices.size() == 1) {

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -543,7 +543,7 @@ public static void buildRoleFromDescriptors(
543543
(key, privilege) -> builder.add(
544544
fieldPermissionsCache.getFieldPermissions(privilege.fieldPermissionsDefinition),
545545
privilege.query,
546-
IndexPrivilege.getSplitBySelectorAccess(privilege.privileges),
546+
IndexPrivilege.splitBySelectorAccess(privilege.privileges),
547547
false,
548548
privilege.indices.toArray(Strings.EMPTY_ARRAY)
549549
)
@@ -552,7 +552,7 @@ public static void buildRoleFromDescriptors(
552552
(key, privilege) -> builder.add(
553553
fieldPermissionsCache.getFieldPermissions(privilege.fieldPermissionsDefinition),
554554
privilege.query,
555-
IndexPrivilege.getSplitBySelectorAccess(privilege.privileges),
555+
IndexPrivilege.splitBySelectorAccess(privilege.privileges),
556556
true,
557557
privilege.indices.toArray(Strings.EMPTY_ARRAY)
558558
)
@@ -566,7 +566,7 @@ public static void buildRoleFromDescriptors(
566566
new FieldPermissionsDefinition(privilege.getGrantedFields(), privilege.getDeniedFields())
567567
),
568568
privilege.getQuery() == null ? null : newHashSet(privilege.getQuery()),
569-
IndexPrivilege.getSplitBySelectorAccess(newHashSet(Objects.requireNonNull(privilege.getPrivileges()))),
569+
IndexPrivilege.splitBySelectorAccess(newHashSet(Objects.requireNonNull(privilege.getPrivileges()))),
570570
privilege.allowRestrictedIndices(),
571571
newHashSet(Objects.requireNonNull(privilege.getIndices())).toArray(new String[0])
572572
)

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/RBACEngineTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1616,7 +1616,7 @@ public void testGetRoleDescriptorsIntersectionForRemoteClusterHasDeterministicOr
16161616
final int numGroups = randomIntBetween(2, 5);
16171617
int extraGroups = 0;
16181618
for (int i = 0; i < numGroups; i++) {
1619-
Set<IndexPrivilege> splitBySelector = IndexPrivilege.getSplitBySelectorAccess(
1619+
Set<IndexPrivilege> splitBySelector = IndexPrivilege.splitBySelectorAccess(
16201620
Set.copyOf(randomSubsetOf(randomIntBetween(1, 4), IndexPrivilege.names()))
16211621
);
16221622
// If we end up with failure and data access, we will split and end up with extra groups. Need to account for this for the

0 commit comments

Comments
 (0)