Skip to content

Commit a45fd61

Browse files
rjernstrjernst
committed
Consolidate path setting files entitlements to config
The setting based paths could be either absolute or relative, and they are always relative to the config dir. This commit renames the path_setting to make it clear it is related to config, and removes the relative variant.
1 parent 9052226 commit a45fd61

File tree

3 files changed

+56
-106
lines changed

3 files changed

+56
-106
lines changed

‎libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java‎

Lines changed: 22 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -91,12 +91,8 @@ static FileData ofRelativePath(Path relativePath, BaseDir baseDir, Mode mode) {
9191
return new RelativePathFileData(relativePath, baseDir, mode, null, false);
9292
}
9393

94-
static FileData ofPathSetting(String setting, Mode mode, boolean ignoreUrl) {
95-
return new PathSettingFileData(setting, mode, ignoreUrl, null, false);
96-
}
97-
98-
static FileData ofRelativePathSetting(String setting, BaseDir baseDir, Mode mode, boolean ignoreUrl) {
99-
return new RelativePathSettingFileData(setting, baseDir, mode, ignoreUrl, null, false);
94+
static FileData ofConfigPathSetting(String setting, Mode mode, boolean ignoreUrl) {
95+
return new ConfigPathSettingFileData(setting, mode, ignoreUrl, null, false);
10096
}
10197

10298
/**
@@ -225,71 +221,39 @@ public FileData withPlatform(Platform platform) {
225221
}
226222
}
227223

228-
private record PathSettingFileData(String setting, Mode mode, boolean ignoreUrl, Platform platform, boolean exclusive)
224+
private record ConfigPathSettingFileData(String setting, Mode mode, boolean ignoreUrl, Platform platform, boolean exclusive)
229225
implements
230226
FileData {
231227

232228
@Override
233-
public PathSettingFileData withExclusive(boolean exclusive) {
234-
return new PathSettingFileData(setting, mode, ignoreUrl, platform, exclusive);
229+
public ConfigPathSettingFileData withExclusive(boolean exclusive) {
230+
return new ConfigPathSettingFileData(setting, mode, ignoreUrl, platform, exclusive);
235231
}
236232

237233
@Override
238234
public Stream<Path> resolvePaths(PathLookup pathLookup) {
239-
return resolvePathSettings(pathLookup, setting, ignoreUrl);
240-
}
241-
242-
@Override
243-
public FileData withPlatform(Platform platform) {
244-
if (platform == platform()) {
245-
return this;
235+
Stream<String> result;
236+
if (setting.contains("*")) {
237+
result = pathLookup.settingGlobResolver().apply(setting);
238+
} else {
239+
String path = pathLookup.settingResolver().apply(setting);
240+
result = path == null ? Stream.of() : Stream.of(path);
246241
}
247-
return new PathSettingFileData(setting, mode, ignoreUrl, platform, exclusive);
248-
}
249-
}
250-
251-
private record RelativePathSettingFileData(
252-
String setting,
253-
BaseDir baseDir,
254-
Mode mode,
255-
boolean ignoreUrl,
256-
Platform platform,
257-
boolean exclusive
258-
) implements FileData, RelativeFileData {
259-
260-
@Override
261-
public RelativePathSettingFileData withExclusive(boolean exclusive) {
262-
return new RelativePathSettingFileData(setting, baseDir, mode, ignoreUrl, platform, exclusive);
263-
}
264-
265-
@Override
266-
public Stream<Path> resolveRelativePaths(PathLookup pathLookup) {
267-
return resolvePathSettings(pathLookup, setting, ignoreUrl);
242+
if (ignoreUrl) {
243+
result = result.filter(s -> s.toLowerCase(Locale.ROOT).startsWith("https://") == false);
244+
}
245+
return result.map(pathLookup.configDir()::resolve);
268246
}
269247

270248
@Override
271249
public FileData withPlatform(Platform platform) {
272250
if (platform == platform()) {
273251
return this;
274252
}
275-
return new RelativePathSettingFileData(setting, baseDir, mode, ignoreUrl, platform, exclusive);
253+
return new ConfigPathSettingFileData(setting, mode, ignoreUrl, platform, exclusive);
276254
}
277255
}
278256

279-
private static Stream<Path> resolvePathSettings(PathLookup pathLookup, String setting, boolean ignoreUrl) {
280-
Stream<String> result;
281-
if (setting.contains("*")) {
282-
result = pathLookup.settingGlobResolver().apply(setting);
283-
} else {
284-
String path = pathLookup.settingResolver().apply(setting);
285-
result = path == null ? Stream.of() : Stream.of(path);
286-
}
287-
if (ignoreUrl) {
288-
result = result.filter(s -> s.toLowerCase(Locale.ROOT).startsWith("https://") == false);
289-
}
290-
return result.map(Path::of);
291-
}
292-
293257
private static Mode parseMode(String mode) {
294258
if (mode.equals("read")) {
295259
return Mode.READ;
@@ -370,8 +334,7 @@ public static FilesEntitlement build(List<Object> paths) {
370334
String pathAsString = checkString.apply(file, "path");
371335
String relativePathAsString = checkString.apply(file, "relative_path");
372336
String relativeTo = checkString.apply(file, "relative_to");
373-
String pathSetting = checkString.apply(file, "path_setting");
374-
String relativePathSetting = checkString.apply(file, "relative_path_setting");
337+
String configPathSetting = checkString.apply(file, "config_path_setting");
375338
String modeAsString = checkString.apply(file, "mode");
376339
String platformAsString = checkString.apply(file, "platform");
377340
Boolean ignoreUrlAsStringBoolean = checkBoolean.apply(file, "ignore_url");
@@ -382,11 +345,10 @@ public static FilesEntitlement build(List<Object> paths) {
382345
if (file.isEmpty() == false) {
383346
throw new PolicyValidationException("unknown key(s) [" + file + "] in a listed file for files entitlement");
384347
}
385-
int foundKeys = (pathAsString != null ? 1 : 0) + (relativePathAsString != null ? 1 : 0) + (pathSetting != null ? 1 : 0)
386-
+ (relativePathSetting != null ? 1 : 0);
348+
int foundKeys = (pathAsString != null ? 1 : 0) + (relativePathAsString != null ? 1 : 0) + (configPathSetting != null ? 1 : 0);
387349
if (foundKeys != 1) {
388350
throw new PolicyValidationException(
389-
"a files entitlement entry must contain one of " + "[path, relative_path, path_setting, relative_path_setting]"
351+
"a files entitlement entry must contain one of " + "[path, relative_path, config_path_setting]"
390352
);
391353
}
392354

@@ -405,7 +367,7 @@ public static FilesEntitlement build(List<Object> paths) {
405367
}
406368

407369
if (ignoreUrlAsStringBoolean != null && (relativePathAsString != null || pathAsString != null)) {
408-
throw new PolicyValidationException("'ignore_url' may only be used with `path_setting` or `relative_path_setting`");
370+
throw new PolicyValidationException("'ignore_url' may only be used with 'config_path_setting'");
409371
}
410372

411373
final FileData fileData;
@@ -424,13 +386,8 @@ public static FilesEntitlement build(List<Object> paths) {
424386
throw new PolicyValidationException("'path' [" + pathAsString + "] must be absolute");
425387
}
426388
fileData = FileData.ofPath(path, mode);
427-
} else if (pathSetting != null) {
428-
fileData = FileData.ofPathSetting(pathSetting, mode, ignoreUrlAsString);
429-
} else if (relativePathSetting != null) {
430-
if (baseDir == null) {
431-
throw new PolicyValidationException("files entitlement with a 'relative_path_setting' must specify 'relative_to'");
432-
}
433-
fileData = FileData.ofRelativePathSetting(relativePathSetting, baseDir, mode, ignoreUrlAsString);
389+
} else if (configPathSetting != null) {
390+
fileData = FileData.ofConfigPathSetting(configPathSetting, mode, ignoreUrlAsString);
434391
} else {
435392
throw new AssertionError("File entry validation error");
436393
}

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/PolicyParserTests.java‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -182,10 +182,7 @@ public void testParseFiles() throws IOException {
182182
mode: "read"
183183
- path: '%s'
184184
mode: "read_write"
185-
- path_setting: foo.bar
186-
mode: read
187-
- relative_path_setting: foo.bar
188-
relative_to: config
185+
- config_path_setting: foo.bar
189186
mode: read
190187
""", relativePathToFile, relativePathToDir, TEST_ABSOLUTE_PATH_TO_FILE).getBytes(StandardCharsets.UTF_8)),
191188
"test-policy.yaml",
@@ -202,8 +199,7 @@ public void testParseFiles() throws IOException {
202199
Map.of("relative_path", relativePathToFile, "mode", "read_write", "relative_to", "data"),
203200
Map.of("relative_path", relativePathToDir, "mode", "read", "relative_to", "config"),
204201
Map.of("path", TEST_ABSOLUTE_PATH_TO_FILE, "mode", "read_write"),
205-
Map.of("path_setting", "foo.bar", "mode", "read"),
206-
Map.of("relative_path_setting", "foo.bar", "relative_to", "config", "mode", "read")
202+
Map.of("config_path_setting", "foo.bar", "mode", "read")
207203
)
208204
)
209205
)

‎libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlementTests.java‎

Lines changed: 32 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@
2525
import java.util.List;
2626
import java.util.Map;
2727

28-
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.BaseDir.CONFIG;
2928
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ;
3029
import static org.elasticsearch.entitlement.runtime.policy.entitlements.FilesEntitlement.Mode.READ_WRITE;
3130
import static org.hamcrest.Matchers.contains;
@@ -98,72 +97,70 @@ public void testFileDataRelativeWithEmptyDirectory() {
9897
}
9998

10099
public void testPathSettingResolve() {
101-
var entitlement = FilesEntitlement.build(List.of(Map.of("path_setting", "foo.bar", "mode", "read")));
100+
var entitlement = FilesEntitlement.build(List.of(Map.of("config_path_setting", "foo.bar", "mode", "read")));
102101
var filesData = entitlement.filesData();
103-
assertThat(filesData, contains(FileData.ofPathSetting("foo.bar", READ, false)));
102+
assertThat(filesData, contains(FileData.ofConfigPathSetting("foo.bar", READ, false)));
104103

105-
var fileData = FileData.ofPathSetting("foo.bar", READ, false);
104+
var fileData = FileData.ofConfigPathSetting("foo.bar", READ, false);
106105
// empty settings
107106
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), empty());
108107

109-
fileData = FileData.ofPathSetting("foo.bar", READ, false);
108+
fileData = FileData.ofConfigPathSetting("foo.bar", READ, false);
110109
settings = Settings.builder().put("foo.bar", "/setting/path").build();
111110
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));
112111

113-
fileData = FileData.ofPathSetting("foo.*.bar", READ, false);
112+
fileData = FileData.ofConfigPathSetting("foo.*.bar", READ, false);
114113
settings = Settings.builder().put("foo.baz.bar", "/setting/path").build();
115114
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));
116115

117-
fileData = FileData.ofPathSetting("foo.*.bar", READ, false);
116+
fileData = FileData.ofConfigPathSetting("foo.*.bar", READ, false);
118117
settings = Settings.builder().put("foo.baz.bar", "/setting/path").put("foo.baz2.bar", "/other/path").build();
119118
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), containsInAnyOrder(Path.of("/setting/path"), Path.of("/other/path")));
120-
}
121119

122-
public void testExclusiveParsing() throws Exception {
123-
Policy parsedPolicy = new PolicyParser(new ByteArrayInputStream("""
124-
entitlement-module-name:
125-
- files:
126-
- path: /test
127-
mode: read
128-
exclusive: true
129-
""".getBytes(StandardCharsets.UTF_8)), "test-policy.yaml", true).parsePolicy();
130-
Policy expected = new Policy(
131-
"test-policy.yaml",
132-
List.of(
133-
new Scope(
134-
"entitlement-module-name",
135-
List.of(FilesEntitlement.build(List.of(Map.of("path", "/test", "mode", "read", "exclusive", true))))
136-
)
137-
)
138-
);
139-
assertEquals(expected, parsedPolicy);
120+
fileData = FileData.ofConfigPathSetting("foo.bar", READ, false);
121+
settings = Settings.builder().put("foo.bar", "relative_path").build();
122+
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/config/relative_path")));
140123
}
141124

142125
public void testPathSettingIgnoreUrl() {
143-
var fileData = FileData.ofPathSetting("foo.*.bar", READ, true);
126+
var fileData = FileData.ofConfigPathSetting("foo.*.bar", READ, true);
144127
settings = Settings.builder().put("foo.nonurl.bar", "/setting/path").put("foo.url.bar", "https://mysite").build();
145128
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/setting/path")));
146129
}
147130

148-
public void testRelativePathSettingIgnoreUrl() {
149-
var fileData = FileData.ofRelativePathSetting("foo.*.bar", CONFIG, READ, true);
150-
settings = Settings.builder().put("foo.nonurl.bar", "path").put("foo.url.bar", "https://mysite").build();
151-
assertThat(fileData.resolvePaths(TEST_PATH_LOOKUP).toList(), contains(Path.of("/config/path")));
152-
}
153-
154131
public void testIgnoreUrlValidation() {
155132
var e = expectThrows(
156133
PolicyValidationException.class,
157134
() -> FilesEntitlement.build(List.of(Map.of("path", "/foo", "mode", "read", "ignore_url", true)))
158135
);
159-
assertThat(e.getMessage(), is("'ignore_url' may only be used with `path_setting` or `relative_path_setting`"));
136+
assertThat(e.getMessage(), is("'ignore_url' may only be used with 'config_path_setting'"));
160137

161138
e = expectThrows(
162139
PolicyValidationException.class,
163140
() -> FilesEntitlement.build(
164141
List.of(Map.of("relative_path", "foo", "relative_to", "config", "mode", "read", "ignore_url", true))
165142
)
166143
);
167-
assertThat(e.getMessage(), is("'ignore_url' may only be used with `path_setting` or `relative_path_setting`"));
144+
assertThat(e.getMessage(), is("'ignore_url' may only be used with 'config_path_setting'"));
145+
}
146+
147+
public void testExclusiveParsing() throws Exception {
148+
Policy parsedPolicy = new PolicyParser(new ByteArrayInputStream("""
149+
entitlement-module-name:
150+
- files:
151+
- path: /test
152+
mode: read
153+
exclusive: true
154+
""".getBytes(StandardCharsets.UTF_8)), "test-policy.yaml", true).parsePolicy();
155+
Policy expected = new Policy(
156+
"test-policy.yaml",
157+
List.of(
158+
new Scope(
159+
"entitlement-module-name",
160+
List.of(FilesEntitlement.build(List.of(Map.of("path", "/test", "mode", "read", "exclusive", true))))
161+
)
162+
)
163+
);
164+
assertEquals(expected, parsedPolicy);
168165
}
169166
}

0 commit comments

Comments
 (0)