merge

Author: n1v0lg

server/src/main/java/org/elasticsearch/cluster/metadata/IndexAbstractionResolver.java

@@ -105,7 +105,7 @@ && isIndexVisible(
                 resolveSelectorsAndCombine(indexAbstraction, selectorString, indicesOptions, resolvedIndices, metadata);
                 if (minus) {
                     finalIndices.removeAll(resolvedIndices);
-                    // TODO problem here is that we say the index is "authorized" but it actually isn't, due to the selector
+                    // TODO if selector is *, we need to run two authz checks, one for data and one for failures
                 } else if (indicesOptions.ignoreUnavailable() == false || isAuthorized.test(indexAbstraction, selectorString)) {
                     // Unauthorized names are considered unavailable, so if `ignoreUnavailable` is `true` they should be silently
                     // discarded from the `finalIndices` list. Other "ways of unavailable" must be handled by the action