Rename methods in o.e.x.c.security.support.Automatons (#114594)

cbuescher · web-flow · commit bd54bffab2e4 · 2024-10-22T16:43:42.000+02:00
Lucene 10 stopped relying in on automaton minimization and moved the underlying Hopcroft algorithm to test code (for reasoning see apache/lucene#528). With the upgrade to Lucene 10 we currently also only determinize automata. The security Automatons utility class currently contains several methods that sound like they would minimize the automaton, but this has changed so this PR also changes the method names accordingly.
diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/ApplicationPermission.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/ApplicationPermission.java
@@ -53,7 +53,7 @@ public final class ApplicationPermission {
                 return new PermissionEntry(
                     appPriv,
                     Sets.union(existing.resourceNames, resourceNames),
-                    Automatons.unionAndMinimize(Arrays.asList(existing.resourceAutomaton, patterns))
+                    Automatons.unionAndDeterminize(Arrays.asList(existing.resourceAutomaton, patterns))
                 );
             }
         }));
diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/ClusterPermission.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/ClusterPermission.java
@@ -137,7 +137,7 @@ public ClusterPermission build() {
             }
             List<PermissionCheck> checks = this.permissionChecks;
             if (false == actionAutomatons.isEmpty()) {
-                final Automaton mergedAutomaton = Automatons.unionAndMinimize(this.actionAutomatons);
+                final Automaton mergedAutomaton = Automatons.unionAndDeterminize(this.actionAutomatons);
                 checks = new ArrayList<>(this.permissionChecks.size() + 1);
                 checks.add(new AutomatonPermissionCheck(mergedAutomaton));
                 checks.addAll(this.permissionChecks);
@@ -156,7 +156,7 @@ private static Automaton createAutomaton(Set<String> allowedActionPatterns, Set<
             } else {
                 final Automaton allowedAutomaton = Automatons.patterns(allowedActionPatterns);
                 final Automaton excludedAutomaton = Automatons.patterns(excludeActionPatterns);
-                return Automatons.minusAndMinimize(allowedAutomaton, excludedAutomaton);
+                return Automatons.minusAndDeterminize(allowedAutomaton, excludedAutomaton);
             }
         }
     }
diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/FieldPermissions.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/FieldPermissions.java
@@ -147,7 +147,7 @@ public static Automaton initializePermittedFieldsAutomaton(FieldPermissionsDefin
         List<Automaton> automatonList = groups.stream()
             .map(g -> FieldPermissions.buildPermittedFieldsAutomaton(g.getGrantedFields(), g.getExcludedFields()))
             .collect(Collectors.toList());
-        return Automatons.unionAndMinimize(automatonList);
+        return Automatons.unionAndDeterminize(automatonList);
     }
 
     /**
@@ -189,7 +189,7 @@ public static Automaton buildPermittedFieldsAutomaton(final String[] grantedFiel
             );
         }
 
-        grantedFieldsAutomaton = Automatons.minusAndMinimize(grantedFieldsAutomaton, deniedFieldsAutomaton);
+        grantedFieldsAutomaton = Automatons.minusAndDeterminize(grantedFieldsAutomaton, deniedFieldsAutomaton);
         return grantedFieldsAutomaton;
     }
 
@@ -206,7 +206,10 @@ public static Automaton buildPermittedFieldsAutomaton(final String[] grantedFiel
     public FieldPermissions limitFieldPermissions(FieldPermissions limitedBy) {
         if (hasFieldLevelSecurity() && limitedBy != null && limitedBy.hasFieldLevelSecurity()) {
             // TODO: cache the automaton computation with FieldPermissionsCache
-            Automaton _permittedFieldsAutomaton = Automatons.intersectAndMinimize(getIncludeAutomaton(), limitedBy.getIncludeAutomaton());
+            Automaton _permittedFieldsAutomaton = Automatons.intersectAndDeterminize(
+                getIncludeAutomaton(),
+                limitedBy.getIncludeAutomaton()
+            );
             return new FieldPermissions(
                 CollectionUtils.concatLists(fieldPermissionsDefinitions, limitedBy.fieldPermissionsDefinitions),
                 _permittedFieldsAutomaton
diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/FieldPermissionsCache.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/FieldPermissionsCache.java
@@ -107,7 +107,7 @@ FieldPermissions union(Collection<FieldPermissions> fieldPermissionsCollection)
                     List<Automaton> automatonList = fieldPermissionsCollection.stream()
                         .map(FieldPermissions::getIncludeAutomaton)
                         .collect(Collectors.toList());
-                    return new FieldPermissions(key, Automatons.unionAndMinimize(automatonList));
+                    return new FieldPermissions(key, Automatons.unionAndDeterminize(automatonList));
                 });
             } catch (ExecutionException e) {
                 throw new ElasticsearchException("unable to compute field permissions", e);
diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java
@@ -283,14 +283,14 @@ public boolean checkResourcePrivileges(
         for (String forIndexPattern : checkForIndexPatterns) {
             Automaton checkIndexAutomaton = Automatons.patterns(forIndexPattern);
             if (false == allowRestrictedIndices && false == isConcreteRestrictedIndex(forIndexPattern)) {
-                checkIndexAutomaton = Automatons.minusAndMinimize(checkIndexAutomaton, restrictedIndices.getAutomaton());
+                checkIndexAutomaton = Automatons.minusAndDeterminize(checkIndexAutomaton, restrictedIndices.getAutomaton());
             }
             if (false == Operations.isEmpty(checkIndexAutomaton)) {
                 Automaton allowedIndexPrivilegesAutomaton = null;
                 for (var indexAndPrivilegeAutomaton : indexGroupAutomatons.entrySet()) {
                     if (Automatons.subsetOf(checkIndexAutomaton, indexAndPrivilegeAutomaton.getValue())) {
                         if (allowedIndexPrivilegesAutomaton != null) {
-                            allowedIndexPrivilegesAutomaton = Automatons.unionAndMinimize(
+                            allowedIndexPrivilegesAutomaton = Automatons.unionAndDeterminize(
                                 Arrays.asList(allowedIndexPrivilegesAutomaton, indexAndPrivilegeAutomaton.getKey())
                             );
                         } else {
@@ -342,7 +342,7 @@ public Automaton allowedActionsMatcher(String index) {
                 automatonList.add(group.privilege.getAutomaton());
             }
         }
-        return automatonList.isEmpty() ? Automatons.EMPTY : Automatons.unionAndMinimize(automatonList);
+        return automatonList.isEmpty() ? Automatons.EMPTY : Automatons.unionAndDeterminize(automatonList);
     }
 
     /**
@@ -704,7 +704,7 @@ private Map<Automaton, Automaton> indexGroupAutomatons(boolean combine) {
             Automaton indexAutomaton = group.getIndexMatcherAutomaton();
             allAutomatons.compute(
                 group.privilege().getAutomaton(),
-                (key, value) -> value == null ? indexAutomaton : Automatons.unionAndMinimize(List.of(value, indexAutomaton))
+                (key, value) -> value == null ? indexAutomaton : Automatons.unionAndDeterminize(List.of(value, indexAutomaton))
             );
             if (combine) {
                 List<Tuple<Automaton, Automaton>> combinedAutomatons = new ArrayList<>();
@@ -714,7 +714,7 @@ private Map<Automaton, Automaton> indexGroupAutomatons(boolean combine) {
                         group.privilege().getAutomaton()
                     );
                     if (Operations.isEmpty(intersectingPrivileges) == false) {
-                        Automaton indexPatternAutomaton = Automatons.unionAndMinimize(
+                        Automaton indexPatternAutomaton = Automatons.unionAndDeterminize(
                             List.of(indexAndPrivilegeAutomatons.getValue(), indexAutomaton)
                         );
                         combinedAutomatons.add(new Tuple<>(intersectingPrivileges, indexPatternAutomaton));
@@ -723,7 +723,7 @@ private Map<Automaton, Automaton> indexGroupAutomatons(boolean combine) {
                 combinedAutomatons.forEach(
                     automatons -> allAutomatons.compute(
                         automatons.v1(),
-                        (key, value) -> value == null ? automatons.v2() : Automatons.unionAndMinimize(List.of(value, automatons.v2()))
+                        (key, value) -> value == null ? automatons.v2() : Automatons.unionAndDeterminize(List.of(value, automatons.v2()))
                     )
                 );
             }
@@ -768,7 +768,7 @@ public Group(
                 this.indexNameMatcher = StringMatcher.of(indices).and(name -> restrictedIndices.isRestricted(name) == false);
                 this.indexNameAutomaton = () -> indexNameAutomatonMemo.computeIfAbsent(
                     indices,
-                    k -> Automatons.minusAndMinimize(Automatons.patterns(indices), restrictedIndices.getAutomaton())
+                    k -> Automatons.minusAndDeterminize(Automatons.patterns(indices), restrictedIndices.getAutomaton())
                 );
             }
             this.fieldPermissions = Objects.requireNonNull(fieldPermissions);
diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/LimitedRole.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/LimitedRole.java
@@ -212,7 +212,7 @@ public IsResourceAuthorizedPredicate allowedIndicesMatcher(String action) {
     public Automaton allowedActionsMatcher(String index) {
         final Automaton allowedMatcher = baseRole.allowedActionsMatcher(index);
         final Automaton limitedByMatcher = limitedByRole.allowedActionsMatcher(index);
-        return Automatons.intersectAndMinimize(allowedMatcher, limitedByMatcher);
+        return Automatons.intersectAndDeterminize(allowedMatcher, limitedByMatcher);
     }
 
     /**
diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java
@@ -57,7 +57,7 @@
 
 import static java.util.Map.entry;
 import static org.elasticsearch.xpack.core.security.support.Automatons.patterns;
-import static org.elasticsearch.xpack.core.security.support.Automatons.unionAndMinimize;
+import static org.elasticsearch.xpack.core.security.support.Automatons.unionAndDeterminize;
 
 /**
  * The name of an index related action always being with `indices:` followed by a sequence of slash-separated terms
@@ -110,7 +110,7 @@ public final class IndexPrivilege extends Privilege {
     private static final Automaton DELETE_AUTOMATON = patterns("indices:data/write/delete*", "indices:data/write/bulk*");
     private static final Automaton WRITE_AUTOMATON = patterns("indices:data/write/*", TransportAutoPutMappingAction.TYPE.name());
     private static final Automaton MONITOR_AUTOMATON = patterns("indices:monitor/*");
-    private static final Automaton MANAGE_AUTOMATON = unionAndMinimize(
+    private static final Automaton MANAGE_AUTOMATON = unionAndDeterminize(
         Arrays.asList(
             MONITOR_AUTOMATON,
             patterns("indices:admin/*", TransportFieldCapabilitiesAction.NAME + "*", GetRollupIndexCapsAction.NAME + "*")
@@ -303,7 +303,7 @@ private static IndexPrivilege resolve(Set<String> name) {
         if (actions.isEmpty() == false) {
             automata.add(patterns(actions));
         }
-        return new IndexPrivilege(name, unionAndMinimize(automata));
+        return new IndexPrivilege(name, unionAndDeterminize(automata));
     }
 
     static Map<String, IndexPrivilege> values() {
diff --git a/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/support/Automatons.java b/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/support/Automatons.java
@@ -112,7 +112,7 @@ public static Automaton patterns(Collection<String> patterns) {
 
     private static Automaton buildAutomaton(Collection<String> patterns) {
         if (patterns.size() == 1) {
-            return minimize(pattern(patterns.iterator().next()));
+            return determinize(pattern(patterns.iterator().next()));
         }
 
         final Function<Collection<String>, Automaton> build = strings -> {
@@ -121,7 +121,7 @@ private static Automaton buildAutomaton(Collection<String> patterns) {
                 final Automaton patternAutomaton = pattern(pattern);
                 automata.add(patternAutomaton);
             }
-            return unionAndMinimize(automata);
+            return unionAndDeterminize(automata);
         };
 
         // We originally just compiled each automaton separately and then unioned them all.
@@ -188,7 +188,7 @@ private static Automaton buildAutomaton(Collection<String> patterns) {
         if (misc.isEmpty() == false) {
             automata.add(build.apply(misc));
         }
-        return unionAndMinimize(automata);
+        return unionAndDeterminize(automata);
     }
 
     /**
@@ -277,22 +277,22 @@ static Automaton wildcard(String text) {
         return Operations.determinize(concatenate(automata), Operations.DEFAULT_DETERMINIZE_WORK_LIMIT);
     }
 
-    public static Automaton unionAndMinimize(Collection<Automaton> automata) {
+    public static Automaton unionAndDeterminize(Collection<Automaton> automata) {
         Automaton res = automata.size() == 1 ? automata.iterator().next() : union(automata);
-        return minimize(res);
+        return determinize(res);
     }
 
-    public static Automaton minusAndMinimize(Automaton a1, Automaton a2) {
+    public static Automaton minusAndDeterminize(Automaton a1, Automaton a2) {
         Automaton res = minus(a1, a2, maxDeterminizedStates);
-        return minimize(res);
+        return determinize(res);
     }
 
-    public static Automaton intersectAndMinimize(Automaton a1, Automaton a2) {
+    public static Automaton intersectAndDeterminize(Automaton a1, Automaton a2) {
         Automaton res = intersection(a1, a2);
-        return minimize(res);
+        return determinize(res);
     }
 
-    private static Automaton minimize(Automaton automaton) {
+    private static Automaton determinize(Automaton automaton) {
         return Operations.determinize(automaton, maxDeterminizedStates);
     }
 

Original file line number	Diff line number	Diff line change
`@@ -53,7 +53,7 @@ public final class ApplicationPermission {`
`53`	`53`	`return new PermissionEntry(`
`54`	`54`	`appPriv,`
`55`	`55`	`Sets.union(existing.resourceNames, resourceNames),`
`56`		`- Automatons.unionAndMinimize(Arrays.asList(existing.resourceAutomaton, patterns))`
	`56`	`+ Automatons.unionAndDeterminize(Arrays.asList(existing.resourceAutomaton, patterns))`
`57`	`57`	`);`
`58`	`58`	`}`
`59`	`59`	`}));`
Original file line number	Diff line number	Diff line change
`@@ -137,7 +137,7 @@ public ClusterPermission build() {`
`137`	`137`	`}`
`138`	`138`	`List<PermissionCheck> checks = this.permissionChecks;`
`139`	`139`	`if (false == actionAutomatons.isEmpty()) {`
`140`		`- final Automaton mergedAutomaton = Automatons.unionAndMinimize(this.actionAutomatons);`
	`140`	`+ final Automaton mergedAutomaton = Automatons.unionAndDeterminize(this.actionAutomatons);`
`141`	`141`	`checks = new ArrayList<>(this.permissionChecks.size() + 1);`
`142`	`142`	`checks.add(new AutomatonPermissionCheck(mergedAutomaton));`
`143`	`143`	`checks.addAll(this.permissionChecks);`
`@@ -156,7 +156,7 @@ private static Automaton createAutomaton(Set<String> allowedActionPatterns, Set<`
`156`	`156`	`} else {`
`157`	`157`	`final Automaton allowedAutomaton = Automatons.patterns(allowedActionPatterns);`
`158`	`158`	`final Automaton excludedAutomaton = Automatons.patterns(excludeActionPatterns);`
`159`		`- return Automatons.minusAndMinimize(allowedAutomaton, excludedAutomaton);`
	`159`	`+ return Automatons.minusAndDeterminize(allowedAutomaton, excludedAutomaton);`
`160`	`160`	`}`
`161`	`161`	`}`
`162`	`162`	`}`
Original file line number	Diff line number	Diff line change
`@@ -212,7 +212,7 @@ public IsResourceAuthorizedPredicate allowedIndicesMatcher(String action) {`
`212`	`212`	`public Automaton allowedActionsMatcher(String index) {`
`213`	`213`	`final Automaton allowedMatcher = baseRole.allowedActionsMatcher(index);`
`214`	`214`	`final Automaton limitedByMatcher = limitedByRole.allowedActionsMatcher(index);`
`215`		`- return Automatons.intersectAndMinimize(allowedMatcher, limitedByMatcher);`
	`215`	`+ return Automatons.intersectAndDeterminize(allowedMatcher, limitedByMatcher);`
`216`	`216`	`}`
`217`	`217`
`218`	`218`	`/**`
Original file line number	Diff line number	Diff line change
`@@ -112,7 +112,7 @@ public static Automaton patterns(Collection<String> patterns) {`
`112`	`112`
`113`	`113`	`private static Automaton buildAutomaton(Collection<String> patterns) {`
`114`	`114`	`if (patterns.size() == 1) {`
`115`		`- return minimize(pattern(patterns.iterator().next()));`
	`115`	`+ return determinize(pattern(patterns.iterator().next()));`
`116`	`116`	`}`
`117`	`117`
`118`	`118`	`final Function<Collection<String>, Automaton> build = strings -> {`
`@@ -121,7 +121,7 @@ private static Automaton buildAutomaton(Collection<String> patterns) {`
`121`	`121`	`final Automaton patternAutomaton = pattern(pattern);`
`122`	`122`	`automata.add(patternAutomaton);`
`123`	`123`	`}`
`124`		`- return unionAndMinimize(automata);`
	`124`	`+ return unionAndDeterminize(automata);`
`125`	`125`	`};`
`126`	`126`
`127`	`127`	`// We originally just compiled each automaton separately and then unioned them all.`
`@@ -188,7 +188,7 @@ private static Automaton buildAutomaton(Collection<String> patterns) {`
`188`	`188`	`if (misc.isEmpty() == false) {`
`189`	`189`	`automata.add(build.apply(misc));`
`190`	`190`	`}`
`191`		`- return unionAndMinimize(automata);`
	`191`	`+ return unionAndDeterminize(automata);`
`192`	`192`	`}`
`193`	`193`
`194`	`194`	`/**`
`@@ -277,22 +277,22 @@ static Automaton wildcard(String text) {`
`277`	`277`	`return Operations.determinize(concatenate(automata), Operations.DEFAULT_DETERMINIZE_WORK_LIMIT);`
`278`	`278`	`}`
`279`	`279`
`280`		`- public static Automaton unionAndMinimize(Collection<Automaton> automata) {`
	`280`	`+ public static Automaton unionAndDeterminize(Collection<Automaton> automata) {`
`281`	`281`	`Automaton res = automata.size() == 1 ? automata.iterator().next() : union(automata);`
`282`		`- return minimize(res);`
	`282`	`+ return determinize(res);`
`283`	`283`	`}`
`284`	`284`
`285`		`- public static Automaton minusAndMinimize(Automaton a1, Automaton a2) {`
	`285`	`+ public static Automaton minusAndDeterminize(Automaton a1, Automaton a2) {`
`286`	`286`	`Automaton res = minus(a1, a2, maxDeterminizedStates);`
`287`		`- return minimize(res);`
	`287`	`+ return determinize(res);`
`288`	`288`	`}`
`289`	`289`
`290`		`- public static Automaton intersectAndMinimize(Automaton a1, Automaton a2) {`
	`290`	`+ public static Automaton intersectAndDeterminize(Automaton a1, Automaton a2) {`
`291`	`291`	`Automaton res = intersection(a1, a2);`
`292`		`- return minimize(res);`
	`292`	`+ return determinize(res);`
`293`	`293`	`}`
`294`	`294`
`295`		`- private static Automaton minimize(Automaton automaton) {`
	`295`	`+ private static Automaton determinize(Automaton automaton) {`
`296`	`296`	`return Operations.determinize(automaton, maxDeterminizedStates);`
`297`	`297`	`}`
`298`	`298`