Skip to content

Commit e7fcf93

Browse files
n1v0lgn1v0lg
committed
Naming so hard
1 parent 8f2eddc commit e7fcf93

File tree

10 files changed

+54
-43
lines changed

10 files changed

+54
-43
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/IndicesPermission.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -302,7 +302,7 @@ public boolean checkResourcePrivileges(
302302
}
303303
}
304304
for (String privilege : checkForPrivileges) {
305-
IndexPrivilege indexPrivilege = IndexPrivilege.getSingleSelectorOrThrow(Collections.singleton(privilege));
305+
IndexPrivilege indexPrivilege = IndexPrivilege.getWithSingleSelectorAccess(Collections.singleton(privilege));
306306
if (allowedIndexPrivilegesAutomaton != null
307307
&& Automatons.subsetOf(indexPrivilege.getAutomaton(), allowedIndexPrivilegesAutomaton)) {
308308
if (resourcePrivilegesMapBuilder != null) {

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,8 @@
7373
*
7474
* Also note that the `internal:transport/proxy/` prefix is automatically added and stripped for actions that go
7575
* through a CCR/CCS proxy. No action should be explicitly named like that.
76+
*
77+
* Each named privilege is associated with an {@link IndexComponentSelector} it grants access to.
7678
*/
7779
public final class IndexPrivilege extends Privilege {
7880
private static final Logger logger = LogManager.getLogger(IndexPrivilege.class);
@@ -276,7 +278,7 @@ private IndexPrivilege(Set<String> name, Automaton automaton, IndexComponentSele
276278
* Use this method if you know that the input name set corresponds to privileges covering the same selector, for instance if you have a
277279
* single input name, or multiple names that all grant access to one selector e.g., {@link IndexComponentSelector#DATA}.
278280
*/
279-
public static IndexPrivilege getSingleSelectorOrThrow(Set<String> names) {
281+
public static IndexPrivilege getWithSingleSelectorAccess(Set<String> names) {
280282
final Set<IndexPrivilege> splitBySelector = getSplitBySelectorAccess(names);
281283
if (splitBySelector.size() != 1) {
282284
throw new IllegalArgumentException(

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/permission/LimitedRoleTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ private static FieldPermissions randomFlsPermissions(String... grantedFields) {
239239
}
240240

241241
private static IndexPrivilege randomIndexPrivilege() {
242-
return IndexPrivilege.getSingleSelectorOrThrow(Set.of(randomFrom(IndexPrivilege.names())));
242+
return IndexPrivilege.getWithSingleSelectorAccess(Set.of(randomFrom(IndexPrivilege.names())));
243243
}
244244

245245
public void testGetRoleDescriptorsIntersectionForRemoteClusterReturnsEmpty() {

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilegeTests.java‎

Lines changed: 33 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -70,35 +70,35 @@ public void testFindPrivilegesThatGrant() {
7070
assertThat(findPrivilegesThatGrant(RefreshAction.NAME), equalTo(List.of("maintenance", "manage", "all")));
7171
}
7272

73-
public void testGetSingleSelectorOrThrow() {
73+
public void testGetWithSingleSelectorAccess() {
7474
{
75-
IndexPrivilege actual = IndexPrivilege.getSingleSelectorOrThrow(Set.of("all"));
75+
IndexPrivilege actual = IndexPrivilege.getWithSingleSelectorAccess(Set.of("all"));
7676
assertThat(actual, equalTo(IndexPrivilege.ALL));
7777
assertThat(actual.getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.ALL));
7878
}
7979
{
80-
IndexPrivilege actual = IndexPrivilege.getSingleSelectorOrThrow(Set.of("read"));
80+
IndexPrivilege actual = IndexPrivilege.getWithSingleSelectorAccess(Set.of("read"));
8181
assertThat(actual, equalTo(IndexPrivilege.READ));
8282
assertThat(actual.getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.DATA));
8383
}
8484
{
85-
IndexPrivilege actual = IndexPrivilege.getSingleSelectorOrThrow(Set.of("none"));
85+
IndexPrivilege actual = IndexPrivilege.getWithSingleSelectorAccess(Set.of("none"));
8686
assertThat(actual, equalTo(IndexPrivilege.NONE));
8787
assertThat(actual.getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.DATA));
8888
}
8989
{
90-
IndexPrivilege actual = IndexPrivilege.getSingleSelectorOrThrow(Set.of());
90+
IndexPrivilege actual = IndexPrivilege.getWithSingleSelectorAccess(Set.of());
9191
assertThat(actual, equalTo(IndexPrivilege.NONE));
9292
assertThat(actual.getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.DATA));
9393
}
9494
{
95-
IndexPrivilege actual = IndexPrivilege.getSingleSelectorOrThrow(Set.of("indices:data/read/search"));
95+
IndexPrivilege actual = IndexPrivilege.getWithSingleSelectorAccess(Set.of("indices:data/read/search"));
9696
assertThat(actual.getSingleName(), equalTo("indices:data/read/search"));
9797
assertThat(actual.predicate.test("indices:data/read/search"), is(true));
9898
assertThat(actual.getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.DATA));
9999
}
100100
{
101-
IndexPrivilege actual = IndexPrivilege.getSingleSelectorOrThrow(Set.of("all", "read", "indices:data/read/search"));
101+
IndexPrivilege actual = IndexPrivilege.getWithSingleSelectorAccess(Set.of("all", "read", "indices:data/read/search"));
102102
assertThat(actual.name, equalTo(Set.of("all", "read", "indices:data/read/search")));
103103
assertThat(Automatons.subsetOf(IndexPrivilege.ALL.automaton, actual.automaton), is(true));
104104
assertThat(actual.getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.ALL));
@@ -108,36 +108,42 @@ public void testGetSingleSelectorOrThrow() {
108108
public void testGetSingleSelectorWithFailuresSelectorOrThrow() {
109109
assumeTrue("This test requires the failure store to be enabled", DataStream.isFailureStoreFeatureFlagEnabled());
110110
{
111-
IndexPrivilege actual = IndexPrivilege.getSingleSelectorOrThrow(Set.of("read_failure_store"));
111+
IndexPrivilege actual = IndexPrivilege.getWithSingleSelectorAccess(Set.of("read_failure_store"));
112112
assertThat(actual, equalTo(IndexPrivilege.READ_FAILURE_STORE));
113113
assertThat(actual.getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.FAILURES));
114114
}
115115
{
116-
IndexPrivilege actual = IndexPrivilege.getSingleSelectorOrThrow(Set.of("all", "read_failure_store"));
116+
IndexPrivilege actual = IndexPrivilege.getWithSingleSelectorAccess(Set.of("all", "read_failure_store"));
117117
assertThat(actual.name(), equalTo(Set.of("all", "read_failure_store")));
118118
assertThat(actual.getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.ALL));
119119
assertThat(Automatons.subsetOf(IndexPrivilege.ALL.automaton, actual.automaton), is(true));
120120
}
121121
{
122-
IndexPrivilege actual = IndexPrivilege.getSingleSelectorOrThrow(
122+
IndexPrivilege actual = IndexPrivilege.getWithSingleSelectorAccess(
123123
Set.of("all", "indices:data/read/search", "read_failure_store")
124124
);
125125
assertThat(actual.name(), equalTo(Set.of("all", "indices:data/read/search", "read_failure_store")));
126126
assertThat(actual.getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.ALL));
127127
assertThat(Automatons.subsetOf(IndexPrivilege.ALL.automaton, actual.automaton), is(true));
128128
}
129129
{
130-
IndexPrivilege actual = IndexPrivilege.getSingleSelectorOrThrow(Set.of("all", "read", "read_failure_store"));
130+
IndexPrivilege actual = IndexPrivilege.getWithSingleSelectorAccess(Set.of("all", "read", "read_failure_store"));
131131
assertThat(actual.name(), equalTo(Set.of("all", "read", "read_failure_store")));
132132
assertThat(actual.getSelectorPredicate(), equalTo(IndexComponentSelectorPredicate.ALL));
133133
assertThat(Automatons.subsetOf(IndexPrivilege.ALL.automaton, actual.automaton), is(true));
134134
}
135-
expectThrows(IllegalArgumentException.class, () -> IndexPrivilege.getSingleSelectorOrThrow(Set.of("read", "read_failure_store")));
136135
expectThrows(
137136
IllegalArgumentException.class,
138-
() -> IndexPrivilege.getSingleSelectorOrThrow(Set.of("indices:data/read/search", "read_failure_store"))
137+
() -> IndexPrivilege.getWithSingleSelectorAccess(Set.of("read", "read_failure_store"))
138+
);
139+
expectThrows(
140+
IllegalArgumentException.class,
141+
() -> IndexPrivilege.getWithSingleSelectorAccess(Set.of("indices:data/read/search", "read_failure_store"))
142+
);
143+
expectThrows(
144+
IllegalArgumentException.class,
145+
() -> IndexPrivilege.getWithSingleSelectorAccess(Set.of("none", "read_failure_store"))
139146
);
140-
expectThrows(IllegalArgumentException.class, () -> IndexPrivilege.getSingleSelectorOrThrow(Set.of("none", "read_failure_store")));
141147
}
142148

143149
public void testPrivilegesForRollupFieldCapsAction() {
@@ -155,39 +161,39 @@ public void testPrivilegesForGetCheckPointAction() {
155161
public void testRelationshipBetweenPrivileges() {
156162
assertThat(
157163
Automatons.subsetOf(
158-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("view_index_metadata")).automaton,
159-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("manage")).automaton
164+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("view_index_metadata")).automaton,
165+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("manage")).automaton
160166
),
161167
is(true)
162168
);
163169

164170
assertThat(
165171
Automatons.subsetOf(
166-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("monitor")).automaton,
167-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("manage")).automaton
172+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("monitor")).automaton,
173+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("manage")).automaton
168174
),
169175
is(true)
170176
);
171177

172178
assertThat(
173179
Automatons.subsetOf(
174-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("create", "create_doc", "index", "delete")).automaton,
175-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("write")).automaton
180+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("create", "create_doc", "index", "delete")).automaton,
181+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("write")).automaton
176182
),
177183
is(true)
178184
);
179185

180186
assertThat(
181187
Automatons.subsetOf(
182-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("create_index", "delete_index")).automaton,
183-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("manage")).automaton
188+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("create_index", "delete_index")).automaton,
189+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("manage")).automaton
184190
),
185191
is(true)
186192
);
187193
}
188194

189195
public void testCrossClusterReplicationPrivileges() {
190-
final IndexPrivilege crossClusterReplication = IndexPrivilege.getSingleSelectorOrThrow(Set.of("cross_cluster_replication"));
196+
final IndexPrivilege crossClusterReplication = IndexPrivilege.getWithSingleSelectorAccess(Set.of("cross_cluster_replication"));
191197
List.of(
192198
"indices:data/read/xpack/ccr/shard_changes",
193199
"indices:monitor/stats",
@@ -198,12 +204,12 @@ public void testCrossClusterReplicationPrivileges() {
198204
assertThat(
199205
Automatons.subsetOf(
200206
crossClusterReplication.automaton,
201-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("manage", "read", "monitor")).automaton
207+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("manage", "read", "monitor")).automaton
202208
),
203209
is(true)
204210
);
205211

206-
final IndexPrivilege crossClusterReplicationInternal = IndexPrivilege.getSingleSelectorOrThrow(
212+
final IndexPrivilege crossClusterReplicationInternal = IndexPrivilege.getWithSingleSelectorAccess(
207213
Set.of("cross_cluster_replication_internal")
208214
);
209215
List.of(
@@ -220,14 +226,14 @@ public void testCrossClusterReplicationPrivileges() {
220226
assertThat(
221227
Automatons.subsetOf(
222228
crossClusterReplicationInternal.automaton,
223-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("manage")).automaton
229+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("manage")).automaton
224230
),
225231
is(false)
226232
);
227233
assertThat(
228234
Automatons.subsetOf(
229235
crossClusterReplicationInternal.automaton,
230-
IndexPrivilege.getSingleSelectorOrThrow(Set.of("all")).automaton
236+
IndexPrivilege.getWithSingleSelectorAccess(Set.of("all")).automaton
231237
),
232238
is(true)
233239
);

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/privilege/PrivilegeTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,7 @@ public void testClusterAction() throws Exception {
205205

206206
public void testIndexAction() throws Exception {
207207
Set<String> actionName = Sets.newHashSet("indices:admin/mapping/delete");
208-
IndexPrivilege index = IndexPrivilege.getSingleSelectorOrThrow(actionName);
208+
IndexPrivilege index = IndexPrivilege.getWithSingleSelectorAccess(actionName);
209209
assertThat(index, notNullValue());
210210
assertThat(index.predicate().test("indices:admin/mapping/delete"), is(true));
211211
assertThat(index.predicate().test("indices:admin/mapping/dele"), is(false));

‎x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/support/AutomatonPatternsTests.java‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ public void testRemoteClusterPrivsDoNotOverlap() {
3737

3838
// check that the action patterns for remote CCS are not allowed by remote CCR privileges
3939
Arrays.stream(CCS_INDICES_PRIVILEGE_NAMES).forEach(ccsPrivilege -> {
40-
Automaton ccsAutomaton = IndexPrivilege.getSingleSelectorOrThrow(Set.of(ccsPrivilege)).getAutomaton();
40+
Automaton ccsAutomaton = IndexPrivilege.getWithSingleSelectorAccess(Set.of(ccsPrivilege)).getAutomaton();
4141
Automatons.getPatterns(ccsAutomaton).forEach(ccsPattern -> {
4242
// emulate an action name that could be allowed by a CCS privilege
4343
String actionName = ccsPattern.replaceAll("\\*", randomAlphaOfLengthBetween(1, 8));
@@ -49,14 +49,17 @@ public void testRemoteClusterPrivsDoNotOverlap() {
4949
ccrPrivileges,
5050
ccsPattern
5151
);
52-
assertFalse(errorMessage, IndexPrivilege.getSingleSelectorOrThrow(Set.of(ccrPrivileges)).predicate().test(actionName));
52+
assertFalse(
53+
errorMessage,
54+
IndexPrivilege.getWithSingleSelectorAccess(Set.of(ccrPrivileges)).predicate().test(actionName)
55+
);
5356
});
5457
});
5558
});
5659

5760
// check that the action patterns for remote CCR are not allowed by remote CCS privileges
5861
Arrays.stream(CCR_INDICES_PRIVILEGE_NAMES).forEach(ccrPrivilege -> {
59-
Automaton ccrAutomaton = IndexPrivilege.getSingleSelectorOrThrow(Set.of(ccrPrivilege)).getAutomaton();
62+
Automaton ccrAutomaton = IndexPrivilege.getWithSingleSelectorAccess(Set.of(ccrPrivilege)).getAutomaton();
6063
Automatons.getPatterns(ccrAutomaton).forEach(ccrPattern -> {
6164
// emulate an action name that could be allowed by a CCR privilege
6265
String actionName = ccrPattern.replaceAll("\\*", randomAlphaOfLengthBetween(1, 8));
@@ -74,7 +77,7 @@ public void testRemoteClusterPrivsDoNotOverlap() {
7477
);
7578
assertFalse(
7679
errorMessage,
77-
IndexPrivilege.getSingleSelectorOrThrow(Set.of(ccsPrivileges)).predicate().test(actionName)
80+
IndexPrivilege.getWithSingleSelectorAccess(Set.of(ccsPrivileges)).predicate().test(actionName)
7881
);
7982
}
8083
});

‎x-pack/plugin/security/qa/consistency-checks/src/test/java/org/elasticsearch/xpack/security/CrossClusterShardTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ public void testCheckForNewShardLevelTransportActions() throws Exception {
112112

113113
List<String> shardActions = transportActionBindings.stream()
114114
.map(binding -> binding.getProvider().get())
115-
.filter(action -> IndexPrivilege.getSingleSelectorOrThrow(crossClusterPrivilegeNames).predicate().test(action.actionName))
115+
.filter(action -> IndexPrivilege.getWithSingleSelectorAccess(crossClusterPrivilegeNames).predicate().test(action.actionName))
116116
.filter(this::actionIsLikelyShardAction)
117117
.map(action -> action.actionName)
118118
.toList();

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/DeprecationRoleDescriptorConsumer.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ private void logDeprecatedPermission(RoleDescriptor roleDescriptor) {
183183
for (Map.Entry<String, Set<String>> privilegesByAlias : privilegesByAliasMap.entrySet()) {
184184
final String aliasName = privilegesByAlias.getKey();
185185
final Set<String> aliasPrivilegeNames = privilegesByAlias.getValue();
186-
final Automaton aliasPrivilegeAutomaton = IndexPrivilege.getSingleSelectorOrThrow(aliasPrivilegeNames).getAutomaton();
186+
final Automaton aliasPrivilegeAutomaton = IndexPrivilege.getWithSingleSelectorAccess(aliasPrivilegeNames).getAutomaton();
187187
final SortedSet<String> inferiorIndexNames = new TreeSet<>();
188188
// check if the alias grants superiors privileges than the indices it points to
189189
for (Index index : aliasOrIndexMap.get(aliasName).getIndices()) {
@@ -193,7 +193,7 @@ private void logDeprecatedPermission(RoleDescriptor roleDescriptor) {
193193
// compute automaton once per index no matter how many times it is pointed to
194194
final Automaton indexPrivilegeAutomaton = indexAutomatonMap.computeIfAbsent(
195195
index.getName(),
196-
i -> IndexPrivilege.getSingleSelectorOrThrow(indexPrivileges).getAutomaton()
196+
i -> IndexPrivilege.getWithSingleSelectorAccess(indexPrivileges).getAutomaton()
197197
);
198198
if (false == Automatons.subsetOf(indexPrivilegeAutomaton, aliasPrivilegeAutomaton)) {
199199
inferiorIndexNames.add(index.getName());

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/RBACEngineTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1290,7 +1290,7 @@ public void testBuildUserPrivilegeResponse() {
12901290
{"term":{"public":true}}""");
12911291
final Role role = Role.builder(RESTRICTED_INDICES, "test", "role")
12921292
.cluster(Sets.newHashSet("monitor", "manage_watcher"), Collections.singleton(manageApplicationPrivileges))
1293-
.add(IndexPrivilege.getSingleSelectorOrThrow(Sets.newHashSet("read", "write")), "index-1")
1293+
.add(IndexPrivilege.getWithSingleSelectorAccess(Sets.newHashSet("read", "write")), "index-1")
12941294
.add(IndexPrivilege.ALL, "index-2", "index-3")
12951295
.add(
12961296
new FieldPermissions(new FieldPermissionsDefinition(new String[] { "public.*" }, new String[0])),

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1494,8 +1494,8 @@ public void testBuildRoleWithMultipleRemoteMergedAcrossPrivilegesAndDescriptors(
14941494
assertHasRemoteIndexGroupsForClusters(
14951495
role.remoteIndices(),
14961496
Set.of("remote-1"),
1497-
indexGroup(IndexPrivilege.getSingleSelectorOrThrow(Set.of("read")), false, "index-1"),
1498-
indexGroup(IndexPrivilege.getSingleSelectorOrThrow(Set.of("none")), false, "index-1")
1497+
indexGroup(IndexPrivilege.getWithSingleSelectorAccess(Set.of("read")), false, "index-1"),
1498+
indexGroup(IndexPrivilege.getWithSingleSelectorAccess(Set.of("none")), false, "index-1")
14991499
);
15001500
}
15011501

@@ -1606,7 +1606,7 @@ public void testBuildRoleWithAllPrivilegeIsNeverSplit() {
16061606
);
16071607
assertHasIndexGroups(
16081608
role.indices(),
1609-
indexGroup(IndexPrivilege.getSingleSelectorOrThrow(Set.of("read", "read_failure_store", "all")), false, indexPattern)
1609+
indexGroup(IndexPrivilege.getWithSingleSelectorAccess(Set.of("read", "read_failure_store", "all")), false, indexPattern)
16101610
);
16111611
}
16121612

@@ -1633,7 +1633,7 @@ public void testBuildRoleNeverSplitsWithoutFailureStoreRelatedPrivileges() {
16331633

16341634
final Role role = buildRole(roleDescriptorWithIndicesPrivileges("r1", indicesPrivileges));
16351635
final IndicesPermission actual = role.indices();
1636-
assertHasIndexGroups(actual, indexGroup(IndexPrivilege.getSingleSelectorOrThrow(usedPrivileges), false, indexPattern));
1636+
assertHasIndexGroups(actual, indexGroup(IndexPrivilege.getWithSingleSelectorAccess(usedPrivileges), false, indexPattern));
16371637
}
16381638

16391639
public void testCustomRolesProviderFailures() throws Exception {

0 commit comments

Comments
 (0)