Validate api_type matches path in ClusterMetricsInput (#912) (#914)

When creating a cluster metrics monitor, the api_type field was silently
ignored during deserialization. This allowed creating monitors with
mismatched api_type and path fields, which then could not be deleted
via the DeleteMonitor API.

Added validation in parseInner to reject requests where the provided
api_type does not match the API derived from the path.

Resolves opensearch-project/alerting#1987



(cherry picked from commit 5103490)

Signed-off-by: Manaswini Ragamouni <ragamanu@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Manaswini Ragamouni <ragamanu@amazon.com>

Author: 3 people

src/main/kotlin/org/opensearch/commons/alerting/model/ClusterMetricsInput.kt

@@ -123,6 +123,7 @@ data class ClusterMetricsInput(
             var path = ""
             var pathParams = ""
             var url = ""
+            var apiType = ""
             val clusters = mutableListOf<String>()
 
             XContentParserUtils.ensureExpectedToken(XContentParser.Token.START_OBJECT, xcp.currentToken(), xcp)
@@ -131,6 +132,7 @@ data class ClusterMetricsInput(
                 val fieldName = xcp.currentName()
                 xcp.nextToken()
                 when (fieldName) {
+                    API_TYPE_FIELD -> apiType = xcp.text()
                     PATH_FIELD -> path = xcp.text()
                     PATH_PARAMS_FIELD -> pathParams = xcp.text()
                     URL_FIELD -> url = xcp.text()
@@ -144,6 +146,17 @@ data class ClusterMetricsInput(
                     }
                 }
             }
+
+            if (apiType.isNotEmpty() && path.isNotEmpty()) {
+                val derivedType = ClusterMetricType.values()
+                    .filter { it != ClusterMetricType.BLANK }
+                    .find { path.startsWith(it.prependPath) || path.startsWith(it.defaultPath) }
+
+                require(derivedType != null && derivedType.name == apiType) {
+                    "The provided api_type [$apiType] does not match the path [$path]."
+                }
+            }
+
             return ClusterMetricsInput(path, pathParams, url, clusters)
         }
     }

src/test/kotlin/org/opensearch/commons/alerting/model/ClusterMetricsInputTests.kt

@@ -591,4 +591,43 @@ class ClusterMetricsInputTests {
             )
         }
     }
+
+    @Test
+    fun `test parseInner rejects mismatched api_type and path`() {
+        val inputJson = """
+            {"uri":{"api_type":"CLUSTER_STATS","path":"/_cat/indices","path_params":"","url":"","clusters":[]}}
+        """.trimIndent()
+        val xcp = org.opensearch.common.xcontent.json.JsonXContent.jsonXContent
+            .createParser(
+                org.opensearch.core.xcontent.NamedXContentRegistry.EMPTY,
+                org.opensearch.core.xcontent.DeprecationHandler.THROW_UNSUPPORTED_OPERATION,
+                inputJson
+            )
+        xcp.nextToken() // START_OBJECT (root)
+        xcp.nextToken() // FIELD_NAME "uri"
+        xcp.nextToken() // START_OBJECT (uri)
+
+        assertFailsWith<IllegalArgumentException>("The provided api_type") {
+            ClusterMetricsInput.parseInner(xcp)
+        }
+    }
+
+    @Test
+    fun `test parseInner accepts matching api_type and path`() {
+        val inputJson = """
+            {"uri":{"api_type":"CAT_INDICES","path":"/_cat/indices","path_params":"","url":"","clusters":[]}}
+        """.trimIndent()
+        val xcp = org.opensearch.common.xcontent.json.JsonXContent.jsonXContent
+            .createParser(
+                org.opensearch.core.xcontent.NamedXContentRegistry.EMPTY,
+                org.opensearch.core.xcontent.DeprecationHandler.THROW_UNSUPPORTED_OPERATION,
+                inputJson
+            )
+        xcp.nextToken()
+        xcp.nextToken()
+        xcp.nextToken()
+
+        val input = ClusterMetricsInput.parseInner(xcp)
+        assertEquals(ClusterMetricsInput.ClusterMetricType.CAT_INDICES, input.clusterMetricType)
+    }
 }