merge

Author: john-wagster

docs/changelog/128925.yaml

@@ -0,0 +1,5 @@
+pr: 128925
+summary: ES|QL - Add `match_phrase` full text function (tech preview)
+area: ES|QL
+type: enhancement
+issues: []

docs/reference/query-languages/esql/_snippets/functions/description/match_phrase.md

@@ -1,7 +1,6 @@
 * [preview] [`KQL`](../../functions-operators/search-functions.md#esql-kql)
 * [preview] [`MATCH`](../../functions-operators/search-functions.md#esql-match)
-  % * [preview] [
-  `MATCH_PHRASE`](../../functions-operators/search-functions.md#esql-match-phrase)
+* [preview] [`MATCH_PHRASE`](../../functions-operators/search-functions.md#esql-match_phrase)
 * [preview] [`QSTR`](../../functions-operators/search-functions.md#esql-qstr)
   % * [preview] [
   `TERM`](../../functions-operators/search-functions.md#esql-term)

docs/reference/query-languages/esql/_snippets/functions/parameters/match_phrase.md

@@ -36,9 +36,8 @@ for information on the limitations of full text search.
 :::{include} ../_snippets/functions/layout/match.md
 :::
 
-% MATCH_PHRASE is currently hidden
-% :::{include} ../_snippets/functions/layout/match_phrase.md
-% :::
+:::{include} ../_snippets/functions/layout/match_phrase.md
+:::
 
 :::{include} ../_snippets/functions/layout/qstr.md
 :::

docs/reference/query-languages/esql/_snippets/lists/search-functions.md

@@ -37,10 +37,11 @@
 import static org.objectweb.asm.ClassWriter.COMPUTE_FRAMES;
 import static org.objectweb.asm.ClassWriter.COMPUTE_MAXS;
 import static org.objectweb.asm.Opcodes.ACC_STATIC;
+import static org.objectweb.asm.Opcodes.CHECKCAST;
 import static org.objectweb.asm.Opcodes.INVOKEINTERFACE;
 import static org.objectweb.asm.Opcodes.INVOKESTATIC;
 
-public class InstrumenterImpl implements Instrumenter {
+public final class InstrumenterImpl implements Instrumenter {
     private static final Logger logger = LogManager.getLogger(InstrumenterImpl.class);
 
     private final String getCheckerClassMethodDescriptor;
@@ -271,7 +272,8 @@ public void visitCode() {
         }
 
         private void pushEntitlementChecker() {
-            InstrumenterImpl.this.pushEntitlementChecker(mv);
+            mv.visitMethodInsn(INVOKESTATIC, handleClass, "instance", getCheckerClassMethodDescriptor, false);
+            mv.visitTypeInsn(CHECKCAST, checkMethod.className());
         }
 
         private void pushCallerClass() {
@@ -319,10 +321,7 @@ private void invokeInstrumentationMethod() {
                 true
             );
         }
-    }
 
-    protected void pushEntitlementChecker(MethodVisitor mv) {
-        mv.visitMethodInsn(INVOKESTATIC, handleClass, "instance", getCheckerClassMethodDescriptor, false);
     }
 
     record ClassFileInfo(String fileName, byte[] bytecodes) {}

docs/reference/query-languages/esql/functions-operators/search-functions.md

@@ -14,9 +14,11 @@
 import com.sun.tools.attach.AttachNotSupportedException;
 import com.sun.tools.attach.VirtualMachine;
 
+import org.elasticsearch.core.Nullable;
 import org.elasticsearch.core.PathUtils;
 import org.elasticsearch.core.SuppressForbidden;
 import org.elasticsearch.entitlement.initialization.EntitlementInitialization;
+import org.elasticsearch.entitlement.runtime.policy.PathLookup;
 import org.elasticsearch.entitlement.runtime.policy.PathLookupImpl;
 import org.elasticsearch.entitlement.runtime.policy.Policy;
 import org.elasticsearch.entitlement.runtime.policy.PolicyManager;
@@ -26,6 +28,7 @@
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.Collection;
 import java.util.Map;
 import java.util.Set;
 import java.util.function.Function;
@@ -38,20 +41,20 @@ public class EntitlementBootstrap {
      * calls to methods protected by entitlements from classes without a valid
      * policy will throw {@link org.elasticsearch.entitlement.runtime.api.NotEntitledException}.
      *
-     * @param serverPolicyPatch a policy with additional entitlements to patch the embedded server layer policy
-     * @param pluginPolicies a map holding policies for plugins (and modules), by plugin (or module) name.
-     * @param scopeResolver a functor to map a Java Class to the component and module it belongs to.
-     * @param settingResolver a functor to resolve a setting name pattern for one or more Elasticsearch settings.
-     * @param dataDirs       data directories for Elasticsearch
-     * @param sharedRepoDirs shared repository directories for Elasticsearch
-     * @param configDir      the config directory for Elasticsearch
-     * @param libDir         the lib directory for Elasticsearch
-     * @param modulesDir     the directory where Elasticsearch modules are
-     * @param pluginsDir     the directory where plugins are installed for Elasticsearch
-     * @param sourcePaths    a map holding the path to each plugin or module jars, by plugin (or module) name.
-     * @param tempDir        the temp directory for Elasticsearch
-     * @param logsDir        the log directory for Elasticsearch
-     * @param pidFile        path to a pid file for Elasticsearch, or {@code null} if one was not specified
+     * @param serverPolicyPatch            additional entitlements to patch the embedded server layer policy
+     * @param pluginPolicies               maps each plugin name to the corresponding {@link Policy}
+     * @param scopeResolver                a functor to map a Java Class to the component and module it belongs to.
+     * @param settingResolver              a functor to resolve a setting name pattern for one or more Elasticsearch settings.
+     * @param dataDirs                     data directories for Elasticsearch
+     * @param sharedRepoDirs               shared repository directories for Elasticsearch
+     * @param configDir                    the config directory for Elasticsearch
+     * @param libDir                       the lib directory for Elasticsearch
+     * @param modulesDir                   the directory where Elasticsearch modules are
+     * @param pluginsDir                   the directory where plugins are installed for Elasticsearch
+     * @param pluginSourcePaths            maps each plugin name to the location of that plugin's code
+     * @param tempDir                      the temp directory for Elasticsearch
+     * @param logsDir                      the log directory for Elasticsearch
+     * @param pidFile                      path to a pid file for Elasticsearch, or {@code null} if one was not specified
      * @param suppressFailureLogPackages   packages for which we do not need or want to log Entitlements failures
      */
     public static void bootstrap(
@@ -65,35 +68,33 @@ public static void bootstrap(
         Path libDir,
         Path modulesDir,
         Path pluginsDir,
-        Map<String, Path> sourcePaths,
+        Map<String, Collection<Path>> pluginSourcePaths,
         Path logsDir,
         Path tempDir,
-        Path pidFile,
+        @Nullable Path pidFile,
         Set<Package> suppressFailureLogPackages
     ) {
         logger.debug("Loading entitlement agent");
         if (EntitlementInitialization.initializeArgs != null) {
             throw new IllegalStateException("initialization data is already set");
         }
+        PathLookupImpl pathLookup = new PathLookupImpl(
+            getUserHome(),
+            configDir,
+            dataDirs,
+            sharedRepoDirs,
+            libDir,
+            modulesDir,
+            pluginsDir,
+            logsDir,
+            tempDir,
+            pidFile,
+            settingResolver
+        );
         EntitlementInitialization.initializeArgs = new EntitlementInitialization.InitializeArgs(
-            serverPolicyPatch,
-            pluginPolicies,
-            scopeResolver,
-            new PathLookupImpl(
-                getUserHome(),
-                configDir,
-                dataDirs,
-                sharedRepoDirs,
-                libDir,
-                modulesDir,
-                pluginsDir,
-                logsDir,
-                tempDir,
-                pidFile,
-                settingResolver
-            ),
-            sourcePaths,
-            suppressFailureLogPackages
+            pathLookup,
+            suppressFailureLogPackages,
+            createPolicyManager(pluginPolicies, pathLookup, serverPolicyPatch, scopeResolver, pluginSourcePaths)
         );
         exportInitializationToAgent();
         loadAgent(findAgentJar(), EntitlementInitialization.class.getName());
@@ -151,5 +152,24 @@ static String findAgentJar() {
         }
     }
 
+    private static PolicyManager createPolicyManager(
+        Map<String, Policy> pluginPolicies,
+        PathLookup pathLookup,
+        Policy serverPolicyPatch,
+        Function<Class<?>, PolicyManager.PolicyScope> scopeResolver,
+        Map<String, Collection<Path>> pluginSourcePaths
+    ) {
+        FilesEntitlementsValidation.validate(pluginPolicies, pathLookup);
+
+        return new PolicyManager(
+            HardcodedEntitlements.serverPolicy(pathLookup.pidFile(), serverPolicyPatch),
+            HardcodedEntitlements.agentEntitlements(),
+            pluginPolicies,
+            scopeResolver,
+            pluginSourcePaths,
+            pathLookup
+        );
+    }
+
     private static final Logger logger = LogManager.getLogger(EntitlementBootstrap.class);
 }

docs/reference/query-languages/esql/kibana/definition/functions/match_phrase.json

@@ -7,7 +7,7 @@
  * License v3.0 only", or the "Server Side Public License, v 1".
  */
 
-package org.elasticsearch.entitlement.initialization;
+package org.elasticsearch.entitlement.bootstrap;
 
 import org.elasticsearch.core.Strings;
 import org.elasticsearch.entitlement.runtime.policy.FileAccessTree;
@@ -17,6 +17,7 @@
 
 import java.nio.file.Path;
 import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
@@ -44,7 +45,7 @@ static void validate(Map<String, Policy> pluginPolicies, PathLookup pathLookup)
                     .map(x -> ((FilesEntitlement) x))
                     .findFirst();
                 if (filesEntitlement.isPresent()) {
-                    var fileAccessTree = FileAccessTree.withoutExclusivePaths(filesEntitlement.get(), pathLookup, null);
+                    var fileAccessTree = FileAccessTree.withoutExclusivePaths(filesEntitlement.get(), pathLookup, List.of());
                     validateReadFilesEntitlements(pluginPolicy.getKey(), scope.moduleName(), fileAccessTree, readAccessForbidden);
                     validateWriteFilesEntitlements(pluginPolicy.getKey(), scope.moduleName(), fileAccessTree, writeAccessForbidden);
                 }