Add special origin to call refresh shard

Author: kingherc

server/src/main/java/org/elasticsearch/action/termvectors/EnsureDocsSearchableAction.java

@@ -30,6 +30,7 @@ public class EnsureDocsSearchableAction {
 
     private static final String ACTION_NAME = "internal:index/data/read/eds";
     public static final ActionType<ActionResponse.Empty> TYPE = new ActionType<>(ACTION_NAME);
+    public static final String ENSURE_DOCS_SEARCHABLE_ORIGIN = "ensure_docs_searchable";
 
     public static final class EnsureDocsSearchableRequest extends SingleShardRequest<EnsureDocsSearchableRequest> {
 

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/SystemPrivilege.java

@@ -45,7 +45,7 @@ public final class SystemPrivilege extends Privilege {
         CompletionPersistentTaskAction.INSTANCE.name(), // needed for ShardFollowTaskCleaner
         "indices:data/write/*", // needed for SystemIndexMigrator
         "indices:data/read/*", // needed for SystemIndexMigrator
-        "indices:admin/refresh*", // needed for SystemIndexMigrator and EnsureDocsSearchableAction
+        "indices:admin/refresh", // needed for SystemIndexMigrator
         "indices:admin/aliases", // needed for SystemIndexMigrator
         TransportCreateIndexAction.TYPE.name() + "*", // needed for SystemIndexMigrator
         TransportAddIndexBlockAction.TYPE.name() + "*", // needed for SystemIndexMigrator

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/AuthorizationUtils.java

@@ -22,6 +22,7 @@
 import static org.elasticsearch.action.admin.cluster.node.tasks.get.TransportGetTaskAction.TASKS_ORIGIN;
 import static org.elasticsearch.action.bulk.TransportBulkAction.LAZY_ROLLOVER_ORIGIN;
 import static org.elasticsearch.action.support.replication.PostWriteRefresh.POST_WRITE_REFRESH_ORIGIN;
+import static org.elasticsearch.action.termvectors.EnsureDocsSearchableAction.ENSURE_DOCS_SEARCHABLE_ORIGIN;
 import static org.elasticsearch.cluster.metadata.DataStreamLifecycle.DATA_STREAM_LIFECYCLE_ORIGIN;
 import static org.elasticsearch.ingest.IngestService.INGEST_ORIGIN;
 import static org.elasticsearch.persistent.PersistentTasksService.PERSISTENT_TASK_ORIGIN;
@@ -132,6 +133,7 @@ public static void switchUserBasedOnActionOriginAndExecute(
             case SECURITY_PROFILE_ORIGIN:
                 securityContext.executeAsInternalUser(InternalUsers.SECURITY_PROFILE_USER, version, consumer);
                 break;
+            case ENSURE_DOCS_SEARCHABLE_ORIGIN:
             case POST_WRITE_REFRESH_ORIGIN:
                 securityContext.executeAsInternalUser(InternalUsers.STORAGE_USER, version, consumer);
                 break;