Skip to content

Commit de6054e

Browse files
n1v0lgn1v0lg
committed
WIP fix unit tests
1 parent b790c94 commit de6054e

File tree

5 files changed

+19
-23
lines changed

5 files changed

+19
-23
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/Role.java‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -286,17 +286,6 @@ public Builder add(
286286
return add(fieldPermissions, query, privilege, allowRestrictedIndices, IndexComponentSelector.DATA, indices);
287287
}
288288

289-
public Builder add(
290-
FieldPermissions fieldPermissions,
291-
Set<BytesReference> query,
292-
IndexPrivilege privilege,
293-
boolean allowRestrictedIndices,
294-
boolean foo,
295-
String... indices
296-
) {
297-
return add(fieldPermissions, query, privilege, allowRestrictedIndices, IndexComponentSelector.DATA, indices);
298-
}
299-
300289
public Builder add(
301290
FieldPermissions fieldPermissions,
302291
Set<BytesReference> query,

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -324,6 +324,12 @@ public static Set<String> names() {
324324
* @see Privilege#sortByAccessLevel
325325
*/
326326
public static Collection<String> findPrivilegesThatGrant(String action) {
327-
return VALUES.entrySet().stream().filter(e -> e.getValue().predicate.test(action)).map(e -> e.getKey()).toList();
327+
return VALUES.entrySet()
328+
.stream()
329+
.filter(e -> e.getValue().predicate.test(action))
330+
.map(Map.Entry::getKey)
331+
// read_failures is special and should not show up here
332+
.filter(p -> false == p.equals("read_failures"))
333+
.toList();
328334
}
329335
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,8 @@ public class ReservedRolesStore implements BiConsumer<Set<String>, ActionListene
9595
new RoleDescriptor.RemoteIndicesPrivileges(
9696
RoleDescriptor.IndicesPrivileges.builder()
9797
.indices("*")
98-
.privileges("monitor", "read", "view_index_metadata", "read_cross_cluster")
98+
// TODO "read_failures" does not belong here
99+
.privileges("monitor", "read", "view_index_metadata", "read_cross_cluster", "read_failures")
99100
.allowRestrictedIndices(true)
100101
.build(),
101102
"*"

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/AuthorizedIndicesTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ public void testSecurityIndicesAreRestrictedForDefaultRole() {
188188

189189
public void testSecurityIndicesAreNotRemovedFromUnrestrictedRole() {
190190
Role role = Role.builder(RESTRICTED_INDICES, randomAlphaOfLength(8))
191-
.add(FieldPermissions.DEFAULT, null, IndexPrivilege.ALL, true, false, "*")
191+
.add(FieldPermissions.DEFAULT, null, IndexPrivilege.ALL, true, "*")
192192
.cluster(Set.of("all"), Set.of())
193193
.build();
194194
Settings indexSettings = Settings.builder().put(IndexMetadata.SETTING_VERSION_CREATED, IndexVersion.current()).build();

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/accesscontrol/IndicesPermissionTests.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ public void testAuthorize() {
7171
Set<BytesReference> query = Collections.singleton(new BytesArray("{}"));
7272
String[] fields = new String[] { "_field" };
7373
Role role = Role.builder(RESTRICTED_INDICES, "_role")
74-
.add(new FieldPermissions(fieldPermissionDef(fields, null)), query, IndexPrivilege.ALL, randomBoolean(), false, "_index")
74+
.add(new FieldPermissions(fieldPermissionDef(fields, null)), query, IndexPrivilege.ALL, randomBoolean(), "_index")
7575
.build();
7676
IndicesAccessControl permissions = role.authorize(
7777
TransportSearchAction.TYPE.name(),
@@ -88,7 +88,7 @@ public void testAuthorize() {
8888

8989
// no document level security:
9090
role = Role.builder(RESTRICTED_INDICES, "_role")
91-
.add(new FieldPermissions(fieldPermissionDef(fields, null)), null, IndexPrivilege.ALL, randomBoolean(), false, "_index")
91+
.add(new FieldPermissions(fieldPermissionDef(fields, null)), null, IndexPrivilege.ALL, randomBoolean(), "_index")
9292
.build();
9393
permissions = role.authorize(TransportSearchAction.TYPE.name(), Sets.newHashSet("_index"), md, fieldPermissionsCache);
9494
assertThat(permissions.getIndexPermissions("_index"), notNullValue());
@@ -99,7 +99,7 @@ public void testAuthorize() {
9999

100100
// no field level security:
101101
role = Role.builder(RESTRICTED_INDICES, "_role")
102-
.add(FieldPermissions.DEFAULT, query, IndexPrivilege.ALL, randomBoolean(), false, "_index")
102+
.add(FieldPermissions.DEFAULT, query, IndexPrivilege.ALL, randomBoolean(), "_index")
103103
.build();
104104
permissions = role.authorize(TransportSearchAction.TYPE.name(), Sets.newHashSet("_index"), md, fieldPermissionsCache);
105105
assertThat(permissions.getIndexPermissions("_index"), notNullValue());
@@ -110,7 +110,7 @@ public void testAuthorize() {
110110

111111
// index group associated with an alias:
112112
role = Role.builder(RESTRICTED_INDICES, "_role")
113-
.add(new FieldPermissions(fieldPermissionDef(fields, null)), query, IndexPrivilege.ALL, randomBoolean(), false, "_alias")
113+
.add(new FieldPermissions(fieldPermissionDef(fields, null)), query, IndexPrivilege.ALL, randomBoolean(), "_alias")
114114
.build();
115115
permissions = role.authorize(TransportSearchAction.TYPE.name(), Sets.newHashSet("_alias"), md, fieldPermissionsCache);
116116
assertThat(permissions.getIndexPermissions("_index"), notNullValue());
@@ -134,7 +134,7 @@ public void testAuthorize() {
134134
new String[] { randomAlphaOfLengthBetween(1, 10), "*" }
135135
);
136136
role = Role.builder(RESTRICTED_INDICES, "_role")
137-
.add(new FieldPermissions(fieldPermissionDef(allFields, null)), query, IndexPrivilege.ALL, randomBoolean(), false, "_alias")
137+
.add(new FieldPermissions(fieldPermissionDef(allFields, null)), query, IndexPrivilege.ALL, randomBoolean(), "_alias")
138138
.build();
139139
permissions = role.authorize(TransportSearchAction.TYPE.name(), Sets.newHashSet("_alias"), md, fieldPermissionsCache);
140140
assertThat(permissions.getIndexPermissions("_index"), notNullValue());
@@ -158,8 +158,8 @@ public void testAuthorize() {
158158
Set<BytesReference> fooQuery = Collections.singleton(new BytesArray("{foo}"));
159159
allFields = randomFrom(new String[] { "*" }, new String[] { "foo", "*" }, new String[] { randomAlphaOfLengthBetween(1, 10), "*" });
160160
role = Role.builder(RESTRICTED_INDICES, "_role")
161-
.add(new FieldPermissions(fieldPermissionDef(allFields, null)), fooQuery, IndexPrivilege.ALL, randomBoolean(), false, "_alias")
162-
.add(new FieldPermissions(fieldPermissionDef(allFields, null)), query, IndexPrivilege.ALL, randomBoolean(), false, "_alias")
161+
.add(new FieldPermissions(fieldPermissionDef(allFields, null)), fooQuery, IndexPrivilege.ALL, randomBoolean(), "_alias")
162+
.add(new FieldPermissions(fieldPermissionDef(allFields, null)), query, IndexPrivilege.ALL, randomBoolean(), "_alias")
163163
.build();
164164
permissions = role.authorize(TransportSearchAction.TYPE.name(), Sets.newHashSet("_alias"), md, fieldPermissionsCache);
165165
Set<BytesReference> bothQueries = Sets.union(fooQuery, query);
@@ -193,8 +193,8 @@ public void testAuthorizeMultipleGroupsMixedDls() {
193193
Set<BytesReference> query = Collections.singleton(new BytesArray("{}"));
194194
String[] fields = new String[] { "_field" };
195195
Role role = Role.builder(RESTRICTED_INDICES, "_role")
196-
.add(new FieldPermissions(fieldPermissionDef(fields, null)), query, IndexPrivilege.ALL, randomBoolean(), false, "_index")
197-
.add(new FieldPermissions(fieldPermissionDef(null, null)), null, IndexPrivilege.ALL, randomBoolean(), false, "*")
196+
.add(new FieldPermissions(fieldPermissionDef(fields, null)), query, IndexPrivilege.ALL, randomBoolean(), "_index")
197+
.add(new FieldPermissions(fieldPermissionDef(null, null)), null, IndexPrivilege.ALL, randomBoolean(), "*")
198198
.build();
199199
IndicesAccessControl permissions = role.authorize(
200200
TransportSearchAction.TYPE.name(),

0 commit comments

Comments
 (0)