update

Author: ywangd

docs/reference/elasticsearch/rest-apis/api-conventions.md

@@ -284,9 +284,10 @@ In multi-target syntax, you can use a comma-separated list to run a request on m
 
 Targets can be excluded by prefixing with the `-` character. This applies to both concrete names and wildcard patterns.
 For example, `test*,-test3` resolves to all resources that start with `test` except for the resource named `test3`.
-It is possible for exclusion to exclude all resources. For example, `test*,-test*` resolves to an empty set.
+It is possible for exclusion to exclude all resources. For example, both `test*,-test*` and `test,-test` resolve to an empty set.
 An exclusion affects targets listed _before_ it and has no impact on targets listed _after_ it.
-For example, `-test3,test*` resolves to all resources that start with `test`, including `test3`.
+For example, `test3*,-test3,test*` resolves to all resources that start with `test`, including `test3`, because it is included
+by the last `test*` pattern.
 
 ::::{important}
 Aliases are resolved after wildcard expressions. This can result in a request that targets an excluded alias. For example, if `test3` is an index alias, the pattern `test*,-test3` still targets the indices for `test3`. To avoid this, exclude the concrete indices for the alias instead.

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/IndicesAndAliasesResolverTests.java

@@ -658,22 +658,51 @@ public void testExclusionByItself() {
 
     public void testExclusionDoesNotAffectFollowingExpressions() {
         final var userAvailableIndices = getUserAvailableIndices();
-        // Exclusion does not affect anything after it
-        var request = new SearchRequest(randomIndexExclusion(userAvailableIndices), "*");
+        final String indexExclusion = randomIndexExclusion(userAvailableIndices);
         final boolean expandToClosedIndices = randomBoolean();
         final boolean expandToHiddenIndices = randomBoolean();
-        request.indicesOptions(IndicesOptions.fromOptions(false, false, true, expandToClosedIndices, expandToHiddenIndices));
-        final var expectedIndices = Arrays.stream(userAvailableIndices)
-            .filter(name -> expandToClosedIndices || name.contains("closed") == false)
-            .filter(name -> expandToHiddenIndices || name.startsWith(".") == false && name.contains("hidden") == false)
-            .toArray(String[]::new);
 
-        List<String> indices = resolveIndices(request, buildAuthorizedIndices(user, TransportSearchAction.TYPE.name())).getLocal();
-        assertThat(indices, containsInAnyOrder(expectedIndices));
-        assertThat(request.indices(), arrayContainingInAnyOrder(expectedIndices));
-        ResolvedIndexExpressions actual = request.getResolvedIndexExpressions();
-        assertThat(actual, is(notNullValue()));
-        assertThat(actual.expressions(), contains(resolvedIndexExpression("*", Set.of(expectedIndices), SUCCESS)));
+        {
+            // Exclusion does not affect anything after it
+            var request = new SearchRequest(indexExclusion, "*");
+            request.indicesOptions(IndicesOptions.fromOptions(false, false, true, expandToClosedIndices, expandToHiddenIndices));
+            final var expectedIndices = Arrays.stream(userAvailableIndices)
+                .filter(name -> expandToClosedIndices || name.contains("closed") == false)
+                .filter(name -> expandToHiddenIndices || name.startsWith(".") == false && name.contains("hidden") == false)
+                .toArray(String[]::new);
+
+            List<String> indices = resolveIndices(request, buildAuthorizedIndices(user, TransportSearchAction.TYPE.name())).getLocal();
+            assertThat(indices, containsInAnyOrder(expectedIndices));
+            assertThat(request.indices(), arrayContainingInAnyOrder(expectedIndices));
+            ResolvedIndexExpressions actual = request.getResolvedIndexExpressions();
+            assertThat(actual, is(notNullValue()));
+
+            assertThat(actual.expressions(), contains(resolvedIndexExpression("*", Set.of(expectedIndices), SUCCESS)));
+        }
+
+        {
+            // Exclusion excludes from prior wildcard but still included by the later wildcard
+            var request = new SearchRequest("*", indexExclusion, "*");
+            request.indicesOptions(IndicesOptions.fromOptions(false, false, true, expandToClosedIndices, expandToHiddenIndices));
+            final var expectedIndices = Arrays.stream(userAvailableIndices)
+                .filter(name -> expandToClosedIndices || name.contains("closed") == false)
+                .filter(name -> expandToHiddenIndices || name.startsWith(".") == false && name.contains("hidden") == false)
+                .toArray(String[]::new);
+
+            List<String> indices = resolveIndices(request, buildAuthorizedIndices(user, TransportSearchAction.TYPE.name())).getLocal();
+            assertThat(Set.copyOf(indices), containsInAnyOrder(expectedIndices));
+            assertThat(Set.copyOf(List.of(request.indices())), containsInAnyOrder(expectedIndices));
+            ResolvedIndexExpressions actual = request.getResolvedIndexExpressions();
+            assertThat(actual, is(notNullValue()));
+
+            assertThat(actual.expressions(), contains(resolvedIndexExpression("*", Arrays.stream(expectedIndices).filter(name -> {
+                if (indexExclusion.endsWith("*")) {
+                    return Regex.simpleMatch(indexExclusion.substring(1), name) == false;
+                } else {
+                    return name.equals(indexExclusion.substring(1)) == false;
+                }
+            }).collect(Collectors.toSet()), SUCCESS), resolvedIndexExpression("*", Set.of(expectedIndices), SUCCESS)));
+        }
     }
 
     public void testExclusionWithoutPriorWildcards() {