Skip to content

Commit fed1804

Browse files
nibixnibix
committed
Moved DLS/FLS to ResolvedIndices
Signed-off-by: Nils Bandener <[email protected]>
1 parent 46e5937 commit fed1804

16 files changed

+217
-152
lines changed

‎src/integrationTest/java/org/opensearch/security/privileges/IndexPatternTest.java‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import org.opensearch.security.resolver.IndexResolverReplacer;
2626
import org.opensearch.security.support.WildcardMatcher;
2727
import org.opensearch.security.user.User;
28+
import org.opensearch.security.util.MockPrivilegeEvaluationContextBuilder;
2829

2930
import static org.opensearch.security.util.MockIndexMetadataBuilder.indices;
3031
import static org.junit.Assert.assertEquals;
@@ -232,19 +233,10 @@ public void equals() {
232233
}
233234

234235
private static PrivilegesEvaluationContext ctx() {
235-
IndexNameExpressionResolver indexNameExpressionResolver = new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY));
236-
IndexResolverReplacer indexResolverReplacer = new IndexResolverReplacer(indexNameExpressionResolver, () -> CLUSTER_STATE, null);
237-
User user = new User("test_user").withAttributes(ImmutableMap.of("attrs.a11", "a11", "attrs.year", "year"));
238-
return new PrivilegesEvaluationContext(
239-
user,
240-
ImmutableSet.of(),
241-
"indices:action/test",
242-
null,
243-
null,
244-
indexResolverReplacer,
245-
indexNameExpressionResolver,
246-
() -> CLUSTER_STATE,
247-
ActionPrivileges.EMPTY
248-
);
236+
return MockPrivilegeEvaluationContextBuilder.ctx()
237+
.action("indices:action/test")
238+
.attr("attrs.a11", "a11")
239+
.attr("attrs.year", "year")
240+
.get();
249241
}
250242
}

‎src/integrationTest/java/org/opensearch/security/privileges/dlsfls/DlsFlsLegacyHeadersTest.java‎

Lines changed: 7 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,12 @@
1515
import java.util.Map;
1616

1717
import com.google.common.collect.ImmutableList;
18-
import com.google.common.collect.ImmutableSet;
1918
import org.junit.Test;
2019

2120
import org.opensearch.Version;
2221
import org.opensearch.action.admin.cluster.shards.ClusterSearchShardsRequest;
2322
import org.opensearch.action.search.SearchRequest;
2423
import org.opensearch.cluster.ClusterState;
25-
import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
2624
import org.opensearch.cluster.metadata.Metadata;
2725
import org.opensearch.common.CheckedFunction;
2826
import org.opensearch.common.settings.Settings;
@@ -35,14 +33,13 @@
3533
import org.opensearch.index.query.RangeQueryBuilder;
3634
import org.opensearch.index.query.TermQueryBuilder;
3735
import org.opensearch.search.internal.ShardSearchRequest;
38-
import org.opensearch.security.privileges.ActionPrivileges;
3936
import org.opensearch.security.privileges.PrivilegesEvaluationContext;
4037
import org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration;
4138
import org.opensearch.security.securityconf.impl.v7.RoleV7;
4239
import org.opensearch.security.support.Base64Helper;
4340
import org.opensearch.security.support.ConfigConstants;
44-
import org.opensearch.security.user.User;
4541
import org.opensearch.security.util.MockIndexMetadataBuilder;
42+
import org.opensearch.security.util.MockPrivilegeEvaluationContextBuilder;
4643
import org.opensearch.test.framework.TestSecurityConfig;
4744
import org.opensearch.transport.Transport;
4845

@@ -335,40 +332,21 @@ public void prepare_ccs() throws Exception {
335332

336333
ThreadContext threadContext = new ThreadContext(Settings.EMPTY);
337334
threadContext.putTransient(ConfigConstants.OPENDISTRO_SECURITY_SSL_TRANSPORT_TRUSTED_CLUSTER_REQUEST, true);
338-
User user = new User("test_user");
339335
ClusterState clusterState = ClusterState.builder(ClusterState.EMPTY_STATE).metadata(metadata).build();
340336

341-
PrivilegesEvaluationContext ctx = new PrivilegesEvaluationContext(
342-
user,
343-
ImmutableSet.of("test_role"),
344-
null,
345-
new ClusterSearchShardsRequest(),
346-
null,
347-
null,
348-
new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY)),
349-
() -> clusterState,
350-
ActionPrivileges.EMPTY
351-
);
337+
PrivilegesEvaluationContext ctx = MockPrivilegeEvaluationContextBuilder.ctx()
338+
.roles("test_role")
339+
.request(new ClusterSearchShardsRequest())
340+
.clusterState(clusterState)
341+
.get();
352342

353343
DlsFlsLegacyHeaders.prepare(threadContext, ctx, dlsFlsProcessedConfig(exampleRolesConfig(), metadata), metadata, false);
354344
assertTrue(threadContext.getResponseHeaders().containsKey(ConfigConstants.OPENDISTRO_SECURITY_DLS_QUERY_HEADER));
355345
}
356346

357347
static PrivilegesEvaluationContext ctx(Metadata metadata, String... roles) {
358-
User user = new User("test_user");
359348
ClusterState clusterState = ClusterState.builder(ClusterState.EMPTY_STATE).metadata(metadata).build();
360-
361-
return new PrivilegesEvaluationContext(
362-
user,
363-
ImmutableSet.copyOf(roles),
364-
null,
365-
null,
366-
null,
367-
null,
368-
new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY)),
369-
() -> clusterState,
370-
ActionPrivileges.EMPTY
371-
);
349+
return MockPrivilegeEvaluationContextBuilder.ctx().roles(roles).clusterState(clusterState).get();
372350
}
373351

374352
static DlsFlsProcessedConfig dlsFlsProcessedConfig(SecurityDynamicConfiguration<RoleV7> rolesConfig, Metadata metadata) {

‎src/integrationTest/java/org/opensearch/security/privileges/dlsfls/DocumentPrivilegesTest.java‎

Lines changed: 12 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,12 @@
3232
import org.junit.runners.Parameterized;
3333
import org.junit.runners.Suite;
3434

35-
import org.opensearch.action.IndicesRequest;
36-
import org.opensearch.action.support.IndicesOptions;
35+
import org.opensearch.action.support.ActionRequestMetadata;
3736
import org.opensearch.cluster.ClusterState;
3837
import org.opensearch.cluster.metadata.IndexAbstraction;
3938
import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
4039
import org.opensearch.cluster.metadata.Metadata;
40+
import org.opensearch.cluster.metadata.ResolvedIndices;
4141
import org.opensearch.common.CheckedFunction;
4242
import org.opensearch.common.settings.Settings;
4343
import org.opensearch.common.util.concurrent.ThreadContext;
@@ -56,7 +56,6 @@
5656
import org.opensearch.security.privileges.PrivilegesEvaluationContext;
5757
import org.opensearch.security.privileges.PrivilegesEvaluationException;
5858
import org.opensearch.security.privileges.actionlevel.RoleBasedActionPrivileges;
59-
import org.opensearch.security.resolver.IndexResolverReplacer;
6059
import org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration;
6160
import org.opensearch.security.securityconf.impl.v7.RoleV7;
6261
import org.opensearch.security.user.User;
@@ -531,6 +530,7 @@ public IndicesAndAliases_getRestriction(
531530
null,
532531
null,
533532
null,
533+
null,
534534
() -> CLUSTER_STATE,
535535
ActionPrivileges.EMPTY
536536
);
@@ -567,17 +567,12 @@ public static class IndicesAndAliases_isUnrestricted {
567567
final static IndexNameExpressionResolver INDEX_NAME_EXPRESSION_RESOLVER = new IndexNameExpressionResolver(
568568
new ThreadContext(Settings.EMPTY)
569569
);
570-
final static IndexResolverReplacer RESOLVER_REPLACER = new IndexResolverReplacer(
571-
INDEX_NAME_EXPRESSION_RESOLVER,
572-
() -> CLUSTER_STATE,
573-
null
574-
);
575570

576571
final Statefulness statefulness;
577572
final UserSpec userSpec;
578573
final User user;
579574
final IndicesSpec indicesSpec;
580-
final IndexResolverReplacer.Resolved resolvedIndices;
575+
final ResolvedIndices resolvedIndices;
581576
final PrivilegesEvaluationContext context;
582577
final boolean dfmEmptyOverridesAll;
583578

@@ -685,7 +680,7 @@ public void alias_static() throws Exception {
685680
DocumentPrivileges subject = createSubject(roleConfig);
686681
boolean result = subject.isUnrestricted(context, resolvedIndices);
687682

688-
if (resolvedIndices.getAllIndices().contains("index_b1")) {
683+
if (resolvedIndices.local().names().contains("index_b1")) {
689684
// index_b1 is not covered by any of the above roles, so there should be always a restriction
690685
assertFalse(result);
691686
} else if (dfmEmptyOverridesAll && userSpec.roles.contains("non_dls_role")) {
@@ -741,7 +736,7 @@ public void alias_wildcard() throws Exception {
741736
DocumentPrivileges subject = createSubject(roleConfig);
742737
boolean result = subject.isUnrestricted(context, resolvedIndices);
743738

744-
if (resolvedIndices.getAllIndices().contains("index_b1")) {
739+
if (resolvedIndices.local().names().contains("index_b1")) {
745740
// index_b1 is not covered by any of the above roles, so there should be always a restriction
746741
assertFalse(result);
747742
} else if (dfmEmptyOverridesAll && userSpec.roles.contains("non_dls_role")) {
@@ -771,7 +766,7 @@ public void alias_template() throws Exception {
771766
if (userSpec.attributes.isEmpty()) {
772767
// All roles defined above use attributes. If there are no user attributes, we must get a restricted result.
773768
assertFalse(result);
774-
} else if (resolvedIndices.getAllIndices().contains("index_b1")) {
769+
} else if (resolvedIndices.local().names().contains("index_b1")) {
775770
// index_b1 is not covered by any of the above roles, so there should be always a restriction
776771
assertFalse(result);
777772
} else if (dfmEmptyOverridesAll && userSpec.roles.contains("non_dls_role")) {
@@ -828,30 +823,15 @@ public IndicesAndAliases_isUnrestricted(
828823
this.userSpec = userSpec;
829824
this.indicesSpec = indicesSpec;
830825
this.user = userSpec.buildUser();
831-
this.resolvedIndices = RESOLVER_REPLACER.resolveRequest(new IndicesRequest.Replaceable() {
832-
833-
@Override
834-
public String[] indices() {
835-
return indicesSpec.indices.toArray(new String[0]);
836-
}
837-
838-
@Override
839-
public IndicesOptions indicesOptions() {
840-
return IndicesOptions.LENIENT_EXPAND_OPEN_CLOSED;
841-
}
842-
843-
@Override
844-
public IndicesRequest indices(String... strings) {
845-
return this;
846-
}
847-
});
826+
this.resolvedIndices = ResolvedIndices.of(indicesSpec.indices);
848827
this.context = new PrivilegesEvaluationContext(
849828
this.user,
850829
ImmutableSet.copyOf(userSpec.roles),
851830
null,
852831
null,
832+
ActionRequestMetadata.empty(),
833+
null,
853834
null,
854-
RESOLVER_REPLACER,
855835
INDEX_NAME_EXPRESSION_RESOLVER,
856836
() -> CLUSTER_STATE,
857837
ActionPrivileges.EMPTY
@@ -1151,7 +1131,9 @@ public DataStreams_getRestriction(
11511131
null,
11521132
null,
11531133
null,
1134+
null,
11541135
() -> CLUSTER_STATE,
1136+
11551137
ActionPrivileges.EMPTY
11561138
);
11571139
this.statefulness = statefulness;

‎src/integrationTest/java/org/opensearch/security/privileges/dlsfls/FieldMaskingTest.java‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
import java.nio.charset.StandardCharsets;
1414
import java.util.Arrays;
1515

16-
import com.google.common.collect.ImmutableSet;
1716
import org.apache.lucene.util.BytesRef;
1817
import org.junit.Test;
1918
import org.junit.runner.RunWith;
@@ -22,13 +21,12 @@
2221
import org.opensearch.cluster.ClusterState;
2322
import org.opensearch.cluster.metadata.Metadata;
2423
import org.opensearch.common.settings.Settings;
25-
import org.opensearch.security.privileges.ActionPrivileges;
2624
import org.opensearch.security.privileges.PrivilegesConfigurationValidationException;
2725
import org.opensearch.security.privileges.PrivilegesEvaluationContext;
2826
import org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration;
2927
import org.opensearch.security.securityconf.impl.v7.RoleV7;
3028
import org.opensearch.security.support.WildcardMatcher;
31-
import org.opensearch.security.user.User;
29+
import org.opensearch.security.util.MockPrivilegeEvaluationContextBuilder;
3230
import org.opensearch.test.framework.TestSecurityConfig;
3331

3432
import static org.opensearch.security.privileges.dlsfls.FieldMasking.Config.BLAKE2B_LEGACY_DEFAULT;
@@ -117,17 +115,7 @@ static FieldMasking createSubject(SecurityDynamicConfiguration<RoleV7> roleConfi
117115
}
118116

119117
static PrivilegesEvaluationContext ctx(String... roles) {
120-
return new PrivilegesEvaluationContext(
121-
new User("test_user"),
122-
ImmutableSet.copyOf(roles),
123-
null,
124-
null,
125-
null,
126-
null,
127-
null,
128-
() -> CLUSTER_STATE,
129-
ActionPrivileges.EMPTY
130-
);
118+
return MockPrivilegeEvaluationContextBuilder.ctx().roles(roles).get();
131119
}
132120
}
133121

‎src/integrationTest/java/org/opensearch/security/privileges/dlsfls/FieldPrivilegesTest.java‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,21 +13,19 @@
1313
import java.util.Arrays;
1414
import java.util.Collections;
1515

16-
import com.google.common.collect.ImmutableSet;
1716
import org.junit.Test;
1817
import org.junit.runner.RunWith;
1918
import org.junit.runners.Suite;
2019

2120
import org.opensearch.cluster.ClusterState;
2221
import org.opensearch.cluster.metadata.Metadata;
2322
import org.opensearch.common.settings.Settings;
24-
import org.opensearch.security.privileges.ActionPrivileges;
2523
import org.opensearch.security.privileges.PrivilegesConfigurationValidationException;
2624
import org.opensearch.security.privileges.PrivilegesEvaluationContext;
2725
import org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration;
2826
import org.opensearch.security.securityconf.impl.v7.RoleV7;
2927
import org.opensearch.security.support.WildcardMatcher;
30-
import org.opensearch.security.user.User;
28+
import org.opensearch.security.util.MockPrivilegeEvaluationContextBuilder;
3129
import org.opensearch.test.framework.TestSecurityConfig;
3230

3331
import static org.opensearch.security.util.MockIndexMetadataBuilder.indices;
@@ -154,17 +152,7 @@ static FieldPrivileges createSubject(SecurityDynamicConfiguration<RoleV7> roleCo
154152
}
155153

156154
static PrivilegesEvaluationContext ctx(String... roles) {
157-
return new PrivilegesEvaluationContext(
158-
new User("test_user"),
159-
ImmutableSet.copyOf(roles),
160-
null,
161-
null,
162-
null,
163-
null,
164-
null,
165-
() -> CLUSTER_STATE,
166-
ActionPrivileges.EMPTY
167-
);
155+
return MockPrivilegeEvaluationContextBuilder.ctx().roles(roles).get();
168156
}
169157
}
170158

‎src/integrationTest/java/org/opensearch/security/util/MockPrivilegeEvaluationContextBuilder.java‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@
2020
import com.google.common.collect.ImmutableMap;
2121
import com.google.common.collect.ImmutableSet;
2222

23+
import org.opensearch.action.ActionRequest;
24+
import org.opensearch.action.support.ActionRequestMetadata;
2325
import org.opensearch.cluster.ClusterState;
2426
import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
2527
import org.opensearch.cluster.metadata.Metadata;
@@ -47,6 +49,8 @@ public static MockPrivilegeEvaluationContextBuilder ctx() {
4749
private Set<String> roles = new HashSet<>();
4850
private ClusterState clusterState = EMPTY_CLUSTER_STATE;
4951
private ActionPrivileges actionPrivileges = ActionPrivileges.EMPTY;
52+
private String action;
53+
private ActionRequest request;
5054

5155
public MockPrivilegeEvaluationContextBuilder attr(String key, String value) {
5256
this.attributes.put(key, value);
@@ -72,15 +76,26 @@ public MockPrivilegeEvaluationContextBuilder actionPrivileges(ActionPrivileges a
7276
return this;
7377
}
7478

79+
public MockPrivilegeEvaluationContextBuilder action(String action) {
80+
this.action = action;
81+
return this;
82+
}
83+
84+
public MockPrivilegeEvaluationContextBuilder request(ActionRequest request) {
85+
this.request = request;
86+
return this;
87+
}
88+
7589
public PrivilegesEvaluationContext get() {
7690
IndexNameExpressionResolver indexNameExpressionResolver = new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY));
7791

7892
User user = new User(this.username).withAttributes(ImmutableMap.copyOf(this.attributes));
7993
return new PrivilegesEvaluationContext(
8094
user,
8195
ImmutableSet.copyOf(roles),
82-
null,
83-
null,
96+
action,
97+
request,
98+
ActionRequestMetadata.empty(),
8499
null,
85100
new IndexResolverReplacer(indexNameExpressionResolver, () -> clusterState, null),
86101
indexNameExpressionResolver,

0 commit comments

Comments
 (0)