1717import org .elasticsearch .threadpool .ThreadPool ;
1818import org .elasticsearch .xpack .core .security .authz .accesscontrol .IndicesAccessControl ;
1919
20- import java .util .Arrays ;
2120import java .util .Map ;
2221
2322public class FailureStoreRequestInterceptor extends FieldAndDocumentLevelSecurityRequestInterceptor {
@@ -32,24 +31,32 @@ void disableFeatures(
3231 Map <String , IndicesAccessControl .IndexAccessControl > indicesAccessControlByIndex ,
3332 ActionListener <Void > listener
3433 ) {
35- if ( indicesAccessControlByIndex .entrySet ()
36- . stream ()
37- . anyMatch ( iac -> hasFailureStoreSelectorSuffix ( iac . getKey ()) && hasDlsFlsPermissions ( iac . getValue ()))) {
38- listener . onFailure (
39- new ElasticsearchSecurityException (
40- "Failure store access is not allowed for users who have field or document level security enabled on one of the indices" ,
41- RestStatus .BAD_REQUEST
42- )
43- );
44- } else {
45- listener . onResponse ( null );
34+ for ( var indexAccessControl : indicesAccessControlByIndex .entrySet ()) {
35+ if ( hasFailureStoreSelectorSuffix ( indexAccessControl . getKey ()) && hasDlsFlsPermissions ( indexAccessControl . getValue ())) {
36+ listener . onFailure (
37+ new ElasticsearchSecurityException (
38+ "Failure store access is not allowed for users who have "
39+ + " field or document level security enabled on one of the indices" ,
40+ RestStatus .BAD_REQUEST
41+ )
42+ );
43+ return ;
44+ }
4645 }
46+ listener .onResponse (null );
4747 }
4848
4949 @ Override
5050 boolean supports (IndicesRequest request ) {
5151 // TODO: check if this is the right approach or should we only intercept search requests
52- return request .indicesOptions ().allowSelectors () && Arrays .stream (request .indices ()).anyMatch (this ::hasFailureStoreSelectorSuffix );
52+ if (request .indicesOptions ().allowSelectors ()) {
53+ for (String index : request .indices ()) {
54+ if (hasFailureStoreSelectorSuffix (index )) {
55+ return true ;
56+ }
57+ }
58+ }
59+ return false ;
5360 }
5461
5562 private boolean hasFailureStoreSelectorSuffix (String name ) {
0 commit comments