Skip to content

Commit 2a05ce4

Browse files
sandeshkr419sandeshkr419
authored
Fix data-stream name resolution for wild-cards (#1716)
Signed-off-by: Sandesh Kumar <sandeshkr419@gmail.com>
1 parent 1d40b80 commit 2a05ce4

File tree

3 files changed

+84
-10
lines changed

3 files changed

+84
-10
lines changed

‎src/main/java/org/opensearch/security/resolver/IndexResolverReplacer.java‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,7 @@ private void resolveIndexPatterns(final String name, final IndicesOptions indice
224224

225225
final Collection<String> matchingAliases;
226226
Collection<String> matchingAllIndices;
227+
Collection<String> matchingDataStreams = null;
227228

228229
if (isLocalAll(original)) {
229230
if (isTraceEnabled) {
@@ -259,8 +260,11 @@ private void resolveIndexPatterns(final String name, final IndicesOptions indice
259260
final boolean isDebugEnabled = log.isDebugEnabled();
260261
try {
261262
matchingAllIndices = Arrays.asList(resolver.concreteIndexNames(state, indicesOptions, localRequestedPatterns.toArray(new String[0])));
263+
matchingDataStreams = resolver.dataStreamNames(state, indicesOptions, localRequestedPatterns.toArray(new String[0]));
264+
262265
if (isDebugEnabled) {
263-
log.debug("Resolved pattern {} to {}", localRequestedPatterns, matchingAllIndices);
266+
log.debug("Resolved pattern {} to indices: {} and data-streams: {}",
267+
localRequestedPatterns, matchingAllIndices, matchingDataStreams);
264268
}
265269
} catch (IndexNotFoundException e1) {
266270
if (isDebugEnabled) {
@@ -271,13 +275,16 @@ private void resolveIndexPatterns(final String name, final IndicesOptions indice
271275
}
272276
}
273277

274-
if (isTraceEnabled) {
275-
log.trace("Resolved patterns {} for {} ({}) to [aliases {}, allIndices {}, originalRequested{}, remote indices {}]",
276-
original, name, this.name, matchingAliases, matchingAllIndices, Arrays.toString(original), remoteIndices);
278+
if (matchingDataStreams == null || matchingDataStreams.size() == 0) {
279+
matchingDataStreams = Arrays.asList(NOOP);
277280
}
278281

279-
resolveTo(matchingAliases, matchingAllIndices, original, remoteIndices);
282+
if (isTraceEnabled) {
283+
log.trace("Resolved patterns {} for {} ({}) to [aliases {}, allIndices {}, dataStreams {}, originalRequested{}, remote indices {}]",
284+
original, name, this.name, matchingAliases, matchingAllIndices, matchingDataStreams, Arrays.toString(original), remoteIndices);
285+
}
280286

287+
resolveTo(matchingAliases, matchingAllIndices, matchingDataStreams, original, remoteIndices);
281288
}
282289

283290
private void resolveToLocalAll() {
@@ -286,9 +293,11 @@ private void resolveToLocalAll() {
286293
originalRequested.add(Resolved.ANY);
287294
}
288295

289-
private void resolveTo(Iterable<String> matchingAliases, Iterable<String> matchingAllIndices, String[] original, Iterable<String> remoteIndices) {
296+
private void resolveTo(Iterable<String> matchingAliases, Iterable<String> matchingAllIndices,
297+
Iterable<String> matchingDataStreams, String[] original, Iterable<String> remoteIndices) {
290298
aliases.addAll(matchingAliases);
291299
allIndices.addAll(matchingAllIndices);
300+
allIndices.addAll(matchingDataStreams);
292301
originalRequested.add(original);
293302
this.remoteIndices.addAll(remoteIndices);
294303
}

‎src/test/java/org/opensearch/security/DataStreamIntegrationTests.java‎

Lines changed: 68 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@ public void createSampleDataStreams(RestHelper rh) throws Exception{
3434
rh.executePutRequest("/_index_template/my-data-stream-template", getIndexTemplateBody(), encodeBasicHeader("ds1", "nagilum"));
3535

3636
rh.executePutRequest("/_data_stream/my-data-stream11", getIndexTemplateBody(), encodeBasicHeader("ds3", "nagilum"));
37+
rh.executePutRequest("/_data_stream/my-data-stream21", getIndexTemplateBody(), encodeBasicHeader("ds3", "nagilum"));
3738
rh.executePutRequest("/_data_stream/my-data-stream22", getIndexTemplateBody(), encodeBasicHeader("ds3", "nagilum"));
39+
rh.executePutRequest("/_data_stream/my-data-stream23", getIndexTemplateBody(), encodeBasicHeader("ds3", "nagilum"));
3840
rh.executePutRequest("/_data_stream/my-data-stream33", getIndexTemplateBody(), encodeBasicHeader("ds3", "nagilum"));
3941
}
4042

@@ -89,6 +91,27 @@ public void testGetDataStream() throws Exception {
8991

9092
response = rh.executeGetRequest("/_data_stream/my-data-stream33", encodeBasicHeader("ds3", "nagilum"));
9193
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
94+
95+
response = rh.executeGetRequest("/_data_stream/my-data-stream*", encodeBasicHeader("ds0", "nagilum"));
96+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
97+
98+
response = rh.executeGetRequest("/_data_stream/my-data-stream21,my-data-stream22", encodeBasicHeader("ds0", "nagilum"));
99+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
100+
101+
response = rh.executeGetRequest("/_data_stream/my-data-stream*", encodeBasicHeader("ds1", "nagilum"));
102+
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
103+
104+
response = rh.executeGetRequest("/_data_stream/my-data-stream2*", encodeBasicHeader("ds2", "nagilum"));
105+
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
106+
107+
response = rh.executeGetRequest("/_data_stream/my-data-stream21,my-data-stream22", encodeBasicHeader("ds2", "nagilum"));
108+
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
109+
110+
response = rh.executeGetRequest("/_data_stream/my-data-stream*", encodeBasicHeader("ds2", "nagilum"));
111+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
112+
113+
response = rh.executeGetRequest("/_data_stream/my-data-stream*", encodeBasicHeader("ds3", "nagilum"));
114+
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
92115
}
93116

94117
@Test
@@ -103,18 +126,39 @@ public void testDeleteDataStream() throws Exception {
103126
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
104127

105128
response = rh.executeDeleteRequest("/_data_stream/my-data-stream11", encodeBasicHeader("ds1", "nagilum"));
106-
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
129+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
107130

108131
response = rh.executeDeleteRequest("/_data_stream/my-data-stream11", encodeBasicHeader("ds2", "nagilum"));
109132
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
110133

111134
response = rh.executeDeleteRequest("/_data_stream/my-data-stream22", encodeBasicHeader("ds2", "nagilum"));
135+
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
136+
137+
response = rh.executeDeleteRequest("/_data_stream/my-data-stream33", encodeBasicHeader("ds3", "nagilum"));
138+
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
139+
140+
response = rh.executeDeleteRequest("/_data_stream/my-data-stream*", encodeBasicHeader("ds0", "nagilum"));
141+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
142+
143+
response = rh.executeDeleteRequest("/_data_stream/my-data-stream21,my-data-stream22", encodeBasicHeader("ds0", "nagilum"));
112144
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
113145

114-
response = rh.executeDeleteRequest("/_data_stream/my-data-stream22", encodeBasicHeader("ds1", "nagilum"));
146+
response = rh.executeDeleteRequest("/_data_stream/my-data-stream*", encodeBasicHeader("ds1", "nagilum"));
147+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
148+
149+
response = rh.executeDeleteRequest("/_data_stream/my-data-stream21,my-data-stream22", encodeBasicHeader("ds1", "nagilum"));
150+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
151+
152+
response = rh.executeDeleteRequest("/_data_stream/my-data-stream2*", encodeBasicHeader("ds2", "nagilum"));
115153
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
116154

117-
response = rh.executeDeleteRequest("/_data_stream/my-data-stream33", encodeBasicHeader("ds3", "nagilum"));
155+
response = rh.executeDeleteRequest("/_data_stream/my-data-stream21,my-data-stream22", encodeBasicHeader("ds2", "nagilum"));
156+
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
157+
158+
response = rh.executeDeleteRequest("/_data_stream/my-data-stream*", encodeBasicHeader("ds2", "nagilum"));
159+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
160+
161+
response = rh.executeDeleteRequest("/_data_stream/my-data-stream*", encodeBasicHeader("ds3", "nagilum"));
118162
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
119163
}
120164

@@ -143,5 +187,26 @@ public void testDataStreamStats() throws Exception {
143187

144188
response = rh.executeGetRequest("/_data_stream/my-data-stream33/_stats", encodeBasicHeader("ds3", "nagilum"));
145189
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
190+
191+
response = rh.executeGetRequest("/_data_stream/my-data-stream*/_stats", encodeBasicHeader("ds0", "nagilum"));
192+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
193+
194+
response = rh.executeGetRequest("/_data_stream/my-data-stream21,my-data-stream22/_stats", encodeBasicHeader("ds0", "nagilum"));
195+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
196+
197+
response = rh.executeGetRequest("/_data_stream/my-data-stream*/_stats", encodeBasicHeader("ds1", "nagilum"));
198+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
199+
200+
response = rh.executeGetRequest("/_data_stream/my-data-stream2*/_stats", encodeBasicHeader("ds2", "nagilum"));
201+
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
202+
203+
response = rh.executeGetRequest("/_data_stream/my-data-stream21,my-data-stream22/_stats", encodeBasicHeader("ds2", "nagilum"));
204+
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
205+
206+
response = rh.executeGetRequest("/_data_stream/my-data-stream*/_stats", encodeBasicHeader("ds2", "nagilum"));
207+
Assert.assertEquals(HttpStatus.SC_FORBIDDEN, response.getStatusCode());
208+
209+
response = rh.executeGetRequest("/_data_stream/my-data-stream*/_stats", encodeBasicHeader("ds3", "nagilum"));
210+
Assert.assertEquals(HttpStatus.SC_OK, response.getStatusCode());
146211
}
147212
}

‎src/test/resources/roles.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1091,7 +1091,6 @@ data_stream_1:
10911091
allowed_actions:
10921092
- "indices:admin/data_stream/get"
10931093
- "indices:admin/data_stream/create"
1094-
- "indices:admin/data_stream/delete"
10951094

10961095
data_stream_2:
10971096
reserved: true
@@ -1105,6 +1104,7 @@ data_stream_2:
11051104
- "indices:admin/data_stream/get"
11061105
- "indices:admin/data_stream/create"
11071106
- "indices:monitor/data_stream/stats"
1107+
- "indices:admin/data_stream/delete"
11081108

11091109
data_stream_3:
11101110
reserved: true

0 commit comments

Comments
 (0)