Tests

Author: n1v0lg

x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/action/role/PutRoleRequestTests.java

@@ -8,6 +8,7 @@
 
 import org.elasticsearch.action.ActionRequestValidationException;
 import org.elasticsearch.action.support.WriteRequest;
+import org.elasticsearch.cluster.metadata.DataStream;
 import org.elasticsearch.test.ESTestCase;
 import org.elasticsearch.xpack.core.security.authz.RoleDescriptor.ApplicationResourcePrivileges;
 import org.elasticsearch.xpack.core.security.authz.permission.RemoteClusterPermissionGroup;
@@ -48,6 +49,22 @@ public void testValidationErrorWithUnknownClusterPrivilegeName() {
         assertValidationError("unknown cluster privilege [" + unknownClusterPrivilegeName.toLowerCase(Locale.ROOT) + "]", request);
     }
 
+    public void testValidationErrorWithFailureStorePrivilegeInRemoteIndices() {
+        assumeTrue("requires failure store feature", DataStream.isFailureStoreFeatureFlagEnabled());
+        final PutRoleRequest request = new PutRoleRequest();
+        request.name(randomAlphaOfLengthBetween(4, 9));
+        request.addRemoteIndex(
+            new String[] { "*" },
+            new String[] { "index" },
+            new String[] { "read_failure_store", "read", "indices:data/read" },
+            null,
+            null,
+            null,
+            randomBoolean()
+        );
+        assertValidationError("remote index privileges cannot contain privileges that grant access to the failure store", request);
+    }
+
     public void testValidationErrorWithTooLongRoleName() {
         final PutRoleRequest request = new PutRoleRequest();
         request.name(

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java

@@ -23,6 +23,7 @@
 import org.elasticsearch.action.support.PlainActionFuture;
 import org.elasticsearch.client.internal.Client;
 import org.elasticsearch.cluster.health.ClusterHealthStatus;
+import org.elasticsearch.cluster.metadata.DataStream;
 import org.elasticsearch.cluster.metadata.IndexAbstraction;
 import org.elasticsearch.cluster.metadata.IndexMetadata;
 import org.elasticsearch.cluster.metadata.Metadata;
@@ -86,6 +87,7 @@
 import org.elasticsearch.xpack.core.security.authz.privilege.ApplicationPrivilegeTests;
 import org.elasticsearch.xpack.core.security.authz.privilege.ClusterPrivilegeResolver;
 import org.elasticsearch.xpack.core.security.authz.privilege.ConfigurableClusterPrivilege;
+import org.elasticsearch.xpack.core.security.authz.privilege.IndexComponentSelectorPrivilege;
 import org.elasticsearch.xpack.core.security.authz.privilege.IndexPrivilege;
 import org.elasticsearch.xpack.core.security.authz.restriction.Workflow;
 import org.elasticsearch.xpack.core.security.authz.restriction.WorkflowResolver;
@@ -1531,6 +1533,7 @@ public void testBuildRoleWithMultipleRemoteClusterMerged() {
     }
 
     public void testBuildRoleWithReadFailureStorePrivilegeOnly() {
+        assumeTrue("requires failure store feature", DataStream.isFailureStoreFeatureFlagEnabled());
         String indexPattern = randomAlphanumericOfLength(10);
         final Role role = buildRole(
             roleDescriptorWithIndicesPrivileges(
@@ -1542,6 +1545,7 @@ public void testBuildRoleWithReadFailureStorePrivilegeOnly() {
     }
 
     public void testBuildRoleWithReadFailureStorePrivilegeDuplicatesMerged() {
+        assumeTrue("requires failure store feature", DataStream.isFailureStoreFeatureFlagEnabled());
         String indexPattern = randomAlphanumericOfLength(10);
         final Role role = buildRole(
             roleDescriptorWithIndicesPrivileges(
@@ -1555,6 +1559,7 @@ public void testBuildRoleWithReadFailureStorePrivilegeDuplicatesMerged() {
     }
 
     public void testBuildRoleWithReadFailureStoreAndReadPrivilegeSplit() {
+        assumeTrue("requires failure store feature", DataStream.isFailureStoreFeatureFlagEnabled());
         String indexPattern = randomAlphanumericOfLength(10);
         final Role role = buildRole(
             roleDescriptorWithIndicesPrivileges(
@@ -1571,6 +1576,7 @@ public void testBuildRoleWithReadFailureStoreAndReadPrivilegeSplit() {
     }
 
     public void testBuildRoleWithMultipleReadFailureStoreAndReadPrivilegeSplit() {
+        assumeTrue("requires failure store feature", DataStream.isFailureStoreFeatureFlagEnabled());
         String indexPattern = randomAlphanumericOfLength(10);
         final Role role = buildRole(
             roleDescriptorWithIndicesPrivileges(
@@ -1588,6 +1594,7 @@ public void testBuildRoleWithMultipleReadFailureStoreAndReadPrivilegeSplit() {
     }
 
     public void testBuildRoleWithAllPrivilegeIsNeverSplit() {
+        assumeTrue("requires failure store feature", DataStream.isFailureStoreFeatureFlagEnabled());
         String indexPattern = randomAlphanumericOfLength(10);
         final Role role = buildRole(
             roleDescriptorWithIndicesPrivileges(
@@ -1603,6 +1610,32 @@ public void testBuildRoleWithAllPrivilegeIsNeverSplit() {
         );
     }
 
+    public void testBuildRoleNeverSplitsWithoutFailureStoreRelatedPrivileges() {
+        String indexPattern = randomAlphanumericOfLength(10);
+        List<String> nonFailurePrivileges = IndexPrivilege.names()
+            .stream()
+            .filter(p -> IndexPrivilege.getNamedOrNull(p).getSelectorPrivilege() != IndexComponentSelectorPrivilege.FAILURES)
+            .toList();
+        Set<String> usedPrivileges = new HashSet<>();
+
+        int n = randomIntBetween(1, 5);
+        IndicesPrivileges[] indicesPrivileges = new IndicesPrivileges[n];
+        for (int i = 0; i < n; i++) {
+            IndicesPrivileges.Builder builder = IndicesPrivileges.builder();
+            // TODO this is due to an unrelated bug in index collation logic
+            List<String> privileges = randomValueOtherThanMany(
+                p -> p.get(0).equals("none"),
+                () -> randomNonEmptySubsetOf(nonFailurePrivileges)
+            );
+            usedPrivileges.addAll(privileges);
+            indicesPrivileges[i] = builder.indices(indexPattern).privileges(privileges).build();
+        }
+
+        final Role role = buildRole(roleDescriptorWithIndicesPrivileges("r1", indicesPrivileges));
+        final IndicesPermission actual = role.indices();
+        assertHasIndexGroups(actual, indexGroup(IndexPrivilege.getSingleSelector(usedPrivileges), false, indexPattern));
+    }
+
     public void testCustomRolesProviderFailures() throws Exception {
         final FileRolesStore fileRolesStore = mock(FileRolesStore.class);
         doCallRealMethod().when(fileRolesStore).accept(anySet(), anyActionListener());