Entitlement reporting mode

Author: prdoyle

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/PolicyManager.java

@@ -43,6 +43,7 @@
 import java.util.stream.Stream;
 
 import static java.lang.StackWalker.Option.RETAIN_CLASS_REFERENCE;
+import static java.util.Collections.newSetFromMap;
 import static java.util.Objects.requireNonNull;
 import static java.util.function.Predicate.not;
 import static java.util.stream.Collectors.groupingBy;
@@ -192,15 +193,13 @@ private void neverEntitled(Class<?> callerClass, Supplier<String> operationDescr
             return;
         }
 
-        throw new NotEntitledException(
-            Strings.format(
-                "Not entitled: component [%s], module [%s], class [%s], operation [%s]",
-                getEntitlements(requestingClass).componentName(),
-                requestingClass.getModule().getName(),
-                requestingClass,
-                operationDescription.get()
-            )
-        );
+        notEntitled(Strings.format(
+            "Not entitled: component [%s], module [%s], class [%s], operation [%s]",
+            getEntitlements(requestingClass).componentName(),
+            requestingClass.getModule().getName(),
+            requestingClass,
+            operationDescription.get()
+        ));
     }
 
     public void checkExitVM(Class<?> callerClass) {
@@ -251,15 +250,13 @@ public void checkFileRead(Class<?> callerClass, Path path) {
 
         ModuleEntitlements entitlements = getEntitlements(requestingClass);
         if (entitlements.fileAccess().canRead(path) == false) {
-            throw new NotEntitledException(
-                Strings.format(
-                    "Not entitled: component [%s], module [%s], class [%s], entitlement [file], operation [read], path [%s]",
-                    entitlements.componentName(),
-                    requestingClass.getModule(),
-                    requestingClass,
-                    path
-                )
-            );
+            notEntitled(Strings.format(
+                "Not entitled: component [%s], module [%s], class [%s], entitlement [file], operation [read], path [%s]",
+                entitlements.componentName(),
+                requestingClass.getModule(),
+                requestingClass,
+                path
+            ));
         }
     }
 
@@ -276,15 +273,13 @@ public void checkFileWrite(Class<?> callerClass, Path path) {
 
         ModuleEntitlements entitlements = getEntitlements(requestingClass);
         if (entitlements.fileAccess().canWrite(path) == false) {
-            throw new NotEntitledException(
-                Strings.format(
-                    "Not entitled: component [%s], module [%s], class [%s], entitlement [file], operation [write], path [%s]",
-                    entitlements.componentName(),
-                    requestingClass.getModule(),
-                    requestingClass,
-                    path
-                )
-            );
+            notEntitled(Strings.format(
+                "Not entitled: component [%s], module [%s], class [%s], entitlement [file], operation [write], path [%s]",
+                entitlements.componentName(),
+                requestingClass.getModule(),
+                requestingClass,
+                path
+            ));
         }
     }
 
@@ -325,15 +320,13 @@ private static void checkFlagEntitlement(
         Class<?> requestingClass
     ) {
         if (classEntitlements.hasEntitlement(entitlementClass) == false) {
-            throw new NotEntitledException(
-                Strings.format(
-                    "Not entitled: component [%s], module [%s], class [%s], entitlement [%s]",
-                    classEntitlements.componentName(),
-                    requestingClass.getModule().getName(),
-                    requestingClass,
-                    PolicyParser.getEntitlementTypeName(entitlementClass)
-                )
-            );
+            notEntitled(Strings.format(
+                "Not entitled: component [%s], module [%s], class [%s], entitlement [%s]",
+                classEntitlements.componentName(),
+                requestingClass.getModule().getName(),
+                requestingClass,
+                PolicyParser.getEntitlementTypeName(entitlementClass)
+            ));
         }
         logger.debug(
             () -> Strings.format(
@@ -365,17 +358,27 @@ public void checkWriteProperty(Class<?> callerClass, String property) {
             );
             return;
         }
-        throw new NotEntitledException(
-            Strings.format(
-                "Not entitled: component [%s], module [%s], class [%s], entitlement [write_system_properties], property [%s]",
-                entitlements.componentName(),
-                requestingClass.getModule().getName(),
-                requestingClass,
-                property
-            )
-        );
+        notEntitled(Strings.format(
+            "Not entitled: component [%s], module [%s], class [%s], entitlement [write_system_properties], property [%s]",
+            entitlements.componentName(),
+            requestingClass.getModule().getName(),
+            requestingClass,
+            property
+        ));
+    }
+
+    private static void notEntitled(String message) {
+        if (true) {
+            if (ALREADY_REPORTED.add(message)) {
+                System.err.println(message);
+            }
+        } else {
+            throw new NotEntitledException(message);
+        }
     }
 
+    private static final Set<String> ALREADY_REPORTED = newSetFromMap(new ConcurrentHashMap<>());
+
     public void checkManageThreadsEntitlement(Class<?> callerClass) {
         checkEntitlementPresent(callerClass, ManageThreadsEntitlement.class);
     }

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/ManageThreadsEntitlement.java

@@ -12,6 +12,6 @@
 import org.elasticsearch.entitlement.runtime.policy.ExternalEntitlement;
 
 public record ManageThreadsEntitlement() implements Entitlement {
-    @ExternalEntitlement
+    @ExternalEntitlement(esModulesOnly = false)
     public ManageThreadsEntitlement {}
 }