Skip to content

Commit fc01664

Browse files
n1v0lgn1v0lg
committed
Fix and simplify
1 parent 83f2148 commit fc01664

File tree

6 files changed

+82
-86
lines changed

6 files changed

+82
-86
lines changed

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/permission/Role.java‎

Lines changed: 44 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -255,6 +255,19 @@ public Builder add(IndexPrivilege privilege, String... indices) {
255255
return add(FieldPermissions.DEFAULT, null, privilege, false, indices);
256256
}
257257

258+
public Builder add(
259+
FieldPermissions fieldPermissions,
260+
Set<BytesReference> query,
261+
Set<IndexPrivilege> privilegesSplitBySelector,
262+
boolean allowRestrictedIndices,
263+
String... indices
264+
) {
265+
for (var indexPrivilege : privilegesSplitBySelector) {
266+
add(fieldPermissions, query, indexPrivilege, allowRestrictedIndices, indices);
267+
}
268+
return this;
269+
}
270+
258271
public Builder add(
259272
FieldPermissions fieldPermissions,
260273
Set<BytesReference> query,
@@ -266,6 +279,20 @@ public Builder add(
266279
return this;
267280
}
268281

282+
public Builder addRemoteIndicesGroup(
283+
final Set<String> remoteClusterAliases,
284+
final FieldPermissions fieldPermissions,
285+
final Set<BytesReference> query,
286+
final Set<IndexPrivilege> privilegesSplitBySelector,
287+
final boolean allowRestrictedIndices,
288+
final String... indices
289+
) {
290+
for (var indexPrivilege : privilegesSplitBySelector) {
291+
addRemoteIndicesGroup(remoteClusterAliases, fieldPermissions, query, indexPrivilege, allowRestrictedIndices, indices);
292+
}
293+
return this;
294+
}
295+
269296
public Builder addRemoteIndicesGroup(
270297
final Set<String> remoteClusterAliases,
271298
final FieldPermissions fieldPermissions,
@@ -405,38 +432,32 @@ static SimpleRole buildFromRoleDescriptor(
405432
);
406433

407434
for (RoleDescriptor.IndicesPrivileges indexPrivilege : roleDescriptor.getIndicesPrivileges()) {
408-
FieldPermissions fieldPermissions = fieldPermissionsCache.getFieldPermissions(
409-
new FieldPermissionsDefinition(indexPrivilege.getGrantedFields(), indexPrivilege.getDeniedFields())
435+
builder.add(
436+
fieldPermissionsCache.getFieldPermissions(
437+
new FieldPermissionsDefinition(indexPrivilege.getGrantedFields(), indexPrivilege.getDeniedFields())
438+
),
439+
indexPrivilege.getQuery() == null ? null : Collections.singleton(indexPrivilege.getQuery()),
440+
IndexPrivilege.getSplitBySelector(Set.of(indexPrivilege.getPrivileges())),
441+
indexPrivilege.allowRestrictedIndices(),
442+
indexPrivilege.getIndices()
410443
);
411-
Set<BytesReference> query = indexPrivilege.getQuery() == null ? null : Collections.singleton(indexPrivilege.getQuery());
412-
boolean allowRestrictedIndices = indexPrivilege.allowRestrictedIndices();
413-
Set<IndexPrivilege> splitPrivileges = IndexPrivilege.getSplitBySelector(Set.of(indexPrivilege.getPrivileges()));
414-
for (var entry : splitPrivileges) {
415-
builder.add(fieldPermissions, query, entry, allowRestrictedIndices, indexPrivilege.getIndices());
416-
}
417444
}
418445

419446
for (RoleDescriptor.RemoteIndicesPrivileges remoteIndicesPrivileges : roleDescriptor.getRemoteIndicesPrivileges()) {
420447
final String[] clusterAliases = remoteIndicesPrivileges.remoteClusters();
421448
assert Arrays.equals(new String[] { "*" }, clusterAliases)
422449
: "reserved role should not define remote indices privileges for specific clusters";
423450
final RoleDescriptor.IndicesPrivileges indexPrivilege = remoteIndicesPrivileges.indicesPrivileges();
424-
FieldPermissions fieldPermissions = fieldPermissionsCache.getFieldPermissions(
425-
new FieldPermissionsDefinition(indexPrivilege.getGrantedFields(), indexPrivilege.getDeniedFields())
451+
builder.addRemoteIndicesGroup(
452+
Set.of(clusterAliases),
453+
fieldPermissionsCache.getFieldPermissions(
454+
new FieldPermissionsDefinition(indexPrivilege.getGrantedFields(), indexPrivilege.getDeniedFields())
455+
),
456+
indexPrivilege.getQuery() == null ? null : Collections.singleton(indexPrivilege.getQuery()),
457+
IndexPrivilege.getSplitBySelector(Set.of(indexPrivilege.getPrivileges())),
458+
indexPrivilege.allowRestrictedIndices(),
459+
indexPrivilege.getIndices()
426460
);
427-
Set<BytesReference> query = indexPrivilege.getQuery() == null ? null : Collections.singleton(indexPrivilege.getQuery());
428-
boolean allowRestrictedIndices = indexPrivilege.allowRestrictedIndices();
429-
Set<IndexPrivilege> splitPrivileges = IndexPrivilege.getSplitBySelector(Set.of(indexPrivilege.getPrivileges()));
430-
for (var entry : splitPrivileges) {
431-
builder.addRemoteIndicesGroup(
432-
Set.of(clusterAliases),
433-
fieldPermissions,
434-
query,
435-
entry,
436-
allowRestrictedIndices,
437-
indexPrivilege.getIndices()
438-
);
439-
}
440461
}
441462

442463
RemoteClusterPermissions remoteClusterPermissions = roleDescriptor.getRemoteClusterPermissions();

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/IndexPrivilege.java‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -194,11 +194,6 @@ public final class IndexPrivilege extends Privilege {
194194
public static final IndexPrivilege CREATE_DOC = new IndexPrivilege("create_doc", CREATE_DOC_AUTOMATON);
195195
public static final IndexPrivilege MONITOR = new IndexPrivilege("monitor", MONITOR_AUTOMATON);
196196
public static final IndexPrivilege MANAGE = new IndexPrivilege("manage", MANAGE_AUTOMATON);
197-
public static final IndexPrivilege MANAGE_FAILURE_STORE_INTERNAL = new IndexPrivilege(
198-
"manage_failure_store_internal",
199-
MANAGE_AUTOMATON,
200-
IndexComponentSelectorPrivilege.FAILURES
201-
);
202197
public static final IndexPrivilege DELETE_INDEX = new IndexPrivilege("delete_index", DELETE_INDEX_AUTOMATON);
203198
public static final IndexPrivilege CREATE_INDEX = new IndexPrivilege("create_index", CREATE_INDEX_AUTOMATON);
204199
public static final IndexPrivilege VIEW_METADATA = new IndexPrivilege("view_index_metadata", VIEW_METADATA_AUTOMATON);
@@ -248,8 +243,7 @@ public final class IndexPrivilege extends Privilege {
248243
entry("auto_configure", AUTO_CONFIGURE),
249244
entry("cross_cluster_replication", CROSS_CLUSTER_REPLICATION),
250245
entry("cross_cluster_replication_internal", CROSS_CLUSTER_REPLICATION_INTERNAL),
251-
DataStream.isFailureStoreFeatureFlagEnabled() ? entry("read_failure_store", READ_FAILURE_STORE) : null,
252-
DataStream.isFailureStoreFeatureFlagEnabled() ? entry("manage_failure_store_internal", MANAGE_FAILURE_STORE_INTERNAL) : null
246+
DataStream.isFailureStoreFeatureFlagEnabled() ? entry("read_failure_store", READ_FAILURE_STORE) : null
253247
).filter(Objects::nonNull).collect(Collectors.toUnmodifiableMap(Map.Entry::getKey, Map.Entry::getValue))
254248
);
255249

@@ -347,7 +341,7 @@ private static Set<IndexPrivilege> resolve(Set<String> name) {
347341
}
348342

349343
final Set<IndexPrivilege> result = combineIntoResult(allAccessPrivileges, failureAccessPrivileges, dataAccessPrivileges, actions);
350-
assertNamesMatch(result, name);
344+
assertNamesMatch(name, result);
351345
return result;
352346
}
353347

@@ -376,8 +370,12 @@ private static Set<IndexPrivilege> combineIntoResult(
376370
return result;
377371
}
378372

379-
private static void assertNamesMatch(Set<IndexPrivilege> privileges, Set<String> names) {
380-
assert names.equals(privileges.stream().map(Privilege::name).flatMap(Set::stream).collect(Collectors.toSet()))
373+
private static void assertNamesMatch(Set<String> names, Set<IndexPrivilege> privileges) {
374+
// TODO clean up
375+
assert names.stream()
376+
.map(n -> n.toLowerCase(Locale.ROOT))
377+
.collect(Collectors.toSet())
378+
.equals(privileges.stream().map(Privilege::name).flatMap(Set::stream).collect(Collectors.toSet()))
381379
: "mismatch between names [" + names + "] and names on split privileges [" + privileges + "]";
382380
}
383381

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java‎

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
import org.elasticsearch.action.admin.cluster.repositories.get.GetRepositoriesAction;
1212
import org.elasticsearch.action.admin.indices.alias.TransportIndicesAliasesAction;
1313
import org.elasticsearch.action.admin.indices.rollover.RolloverAction;
14-
import org.elasticsearch.cluster.metadata.DataStream;
1514
import org.elasticsearch.common.Strings;
1615
import org.elasticsearch.common.settings.Setting;
1716
import org.elasticsearch.common.util.set.Sets;
@@ -79,12 +78,8 @@ public class ReservedRolesStore implements BiConsumer<Set<String>, ActionListene
7978
RoleDescriptor.IndicesPrivileges.builder().indices("*").privileges("all").allowRestrictedIndices(false).build(),
8079
RoleDescriptor.IndicesPrivileges.builder()
8180
.indices("*")
82-
.privileges(
83-
// TODO are there edge-cases where this is a bad idea?
84-
DataStream.isFailureStoreFeatureFlagEnabled()
85-
? new String[] { "monitor", "read", "view_index_metadata", "read_cross_cluster", "read_failure_store" }
86-
: new String[] { "monitor", "read", "view_index_metadata", "read_cross_cluster" }
87-
)
81+
// TODO add read_failure_store when failures authorization is implemented
82+
.privileges("monitor", "read", "view_index_metadata", "read_cross_cluster")
8883
.allowRestrictedIndices(true)
8984
.build() },
9085
new RoleDescriptor.ApplicationResourcePrivileges[] {
@@ -101,12 +96,8 @@ public class ReservedRolesStore implements BiConsumer<Set<String>, ActionListene
10196
new RoleDescriptor.RemoteIndicesPrivileges(
10297
RoleDescriptor.IndicesPrivileges.builder()
10398
.indices("*")
104-
.privileges(
105-
// TODO are there edge-cases where this is a bad idea?
106-
DataStream.isFailureStoreFeatureFlagEnabled()
107-
? new String[] { "monitor", "read", "view_index_metadata", "read_cross_cluster", "read_failure_store" }
108-
: new String[] { "monitor", "read", "view_index_metadata", "read_cross_cluster" }
109-
)
99+
// TODO add read_failure_store when failures authorization is implemented
100+
.privileges("monitor", "read", "view_index_metadata", "read_cross_cluster")
110101
.allowRestrictedIndices(true)
111102
.build(),
112103
"*"

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java‎

Lines changed: 24 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@
3131
import org.elasticsearch.xpack.core.security.authz.RoleDescriptor.IndicesPrivileges;
3232
import org.elasticsearch.xpack.core.security.authz.RoleDescriptor.RemoteIndicesPrivileges;
3333
import org.elasticsearch.xpack.core.security.authz.accesscontrol.DocumentSubsetBitsetCache;
34-
import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions;
3534
import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsCache;
3635
import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsDefinition;
3736
import org.elasticsearch.xpack.core.security.authz.permission.FieldPermissionsDefinition.FieldGrantExcludeGroup;
@@ -542,43 +541,38 @@ public static void buildRoleFromDescriptors(
542541

543542
for (Map.Entry<Set<String>, MergeableIndicesPrivilege> entry : indicesPrivilegesMap.entrySet()) {
544543
MergeableIndicesPrivilege indicesPrivilege = entry.getValue();
545-
FieldPermissions fieldPermissions = fieldPermissionsCache.getFieldPermissions(indicesPrivilege.fieldPermissionsDefinition);
546-
String[] indices = indicesPrivilege.indices.toArray(Strings.EMPTY_ARRAY);
547-
Set<IndexPrivilege> splitPrivileges = IndexPrivilege.getSplitBySelector(indicesPrivilege.privileges);
548-
for (var splitPrivilege : splitPrivileges) {
549-
builder.add(fieldPermissions, indicesPrivilege.query, splitPrivilege, false, indices);
550-
}
544+
builder.add(
545+
fieldPermissionsCache.getFieldPermissions(indicesPrivilege.fieldPermissionsDefinition),
546+
indicesPrivilege.query,
547+
IndexPrivilege.getSplitBySelector(indicesPrivilege.privileges),
548+
false,
549+
indicesPrivilege.indices.toArray(Strings.EMPTY_ARRAY)
550+
);
551+
551552
}
552553
for (Map.Entry<Set<String>, MergeableIndicesPrivilege> entry : restrictedIndicesPrivilegesMap.entrySet()) {
553554
MergeableIndicesPrivilege indicesPrivilege = entry.getValue();
554-
FieldPermissions fieldPermissions = fieldPermissionsCache.getFieldPermissions(indicesPrivilege.fieldPermissionsDefinition);
555-
String[] indices = indicesPrivilege.indices.toArray(Strings.EMPTY_ARRAY);
556-
Set<IndexPrivilege> splitPrivileges = IndexPrivilege.getSplitBySelector(indicesPrivilege.privileges);
557-
for (var splitPrivilege : splitPrivileges) {
558-
builder.add(fieldPermissions, indicesPrivilege.query, splitPrivilege, true, indices);
559-
}
555+
builder.add(
556+
fieldPermissionsCache.getFieldPermissions(indicesPrivilege.fieldPermissionsDefinition),
557+
indicesPrivilege.query,
558+
IndexPrivilege.getSplitBySelector(indicesPrivilege.privileges),
559+
true,
560+
indicesPrivilege.indices.toArray(Strings.EMPTY_ARRAY)
561+
);
560562
}
561563

562564
remoteIndicesPrivilegesByCluster.forEach((clusterAliasKey, remoteIndicesPrivilegesForCluster) -> {
563565
remoteIndicesPrivilegesForCluster.forEach((privilege) -> {
564-
FieldPermissions fieldPermissions = fieldPermissionsCache.getFieldPermissions(
565-
new FieldPermissionsDefinition(privilege.getGrantedFields(), privilege.getDeniedFields())
566-
);
567-
Set<BytesReference> query = privilege.getQuery() == null ? null : newHashSet(privilege.getQuery());
568-
String[] indices = newHashSet(Objects.requireNonNull(privilege.getIndices())).toArray(new String[0]);
569-
Set<IndexPrivilege> splitPrivileges = IndexPrivilege.getSplitBySelector(
570-
Set.of(Objects.requireNonNull(privilege.getPrivileges()))
566+
builder.addRemoteIndicesGroup(
567+
clusterAliasKey,
568+
fieldPermissionsCache.getFieldPermissions(
569+
new FieldPermissionsDefinition(privilege.getGrantedFields(), privilege.getDeniedFields())
570+
),
571+
privilege.getQuery() == null ? null : newHashSet(privilege.getQuery()),
572+
IndexPrivilege.getSplitBySelector(Set.of(Objects.requireNonNull(privilege.getPrivileges()))),
573+
privilege.allowRestrictedIndices(),
574+
newHashSet(Objects.requireNonNull(privilege.getIndices())).toArray(new String[0])
571575
);
572-
for (var indexPrivilege : splitPrivileges) {
573-
builder.addRemoteIndicesGroup(
574-
clusterAliasKey,
575-
fieldPermissions,
576-
query,
577-
indexPrivilege,
578-
privilege.allowRestrictedIndices(),
579-
indices
580-
);
581-
}
582576
});
583577
});
584578

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/rest/action/privilege/RestGetBuiltinPrivilegesAction.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,7 @@ public class RestGetBuiltinPrivilegesAction extends SecurityBaseRestHandler {
4343

4444
private static final Logger logger = LogManager.getLogger(RestGetBuiltinPrivilegesAction.class);
4545
// TODO remove this once we can update docs tests again
46-
private static final Set<String> FAILURE_STORE_PRIVILEGES_TO_EXCLUDE = Set.of(
47-
IndexPrivilege.READ_FAILURE_STORE.getSingleName(),
48-
IndexPrivilege.MANAGE_FAILURE_STORE_INTERNAL.getSingleName()
49-
);
46+
private static final Set<String> FAILURE_STORE_PRIVILEGES_TO_EXCLUDE = Set.of(IndexPrivilege.READ_FAILURE_STORE.getSingleName());
5047
private final GetBuiltinPrivilegesResponseTranslator responseTranslator;
5148

5249
public RestGetBuiltinPrivilegesAction(

‎x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/support/QueryableBuiltInRolesUtilsTests.java‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@
77

88
package org.elasticsearch.xpack.security.support;
99

10-
import org.elasticsearch.cluster.metadata.DataStream;
1110
import org.elasticsearch.test.ESTestCase;
1211
import org.elasticsearch.xpack.core.security.authz.RoleDescriptor;
1312
import org.elasticsearch.xpack.core.security.authz.RoleDescriptorTestHelper;
@@ -41,11 +40,7 @@ public static void setupReservedRolesStore() {
4140
public void testCalculateHash() {
4241
assertThat(
4342
QueryableBuiltInRolesUtils.calculateHash(ReservedRolesStore.SUPERUSER_ROLE_DESCRIPTOR),
44-
equalTo(
45-
DataStream.isFailureStoreFeatureFlagEnabled()
46-
? "qgdWamvjudRKGezTGfjoSCr230sFDdh2t6xFUPYiW2Q="
47-
: "bWEFdFo4WX229wdhdecfiz5QHMYEssh3ex8hizRgg+Q="
48-
)
43+
equalTo("bWEFdFo4WX229wdhdecfiz5QHMYEssh3ex8hizRgg+Q=")
4944
);
5045
}
5146

0 commit comments

Comments
 (0)