Skip to content

Commit 6d58ef4

Browse files
nibixnibix
committed
Reinstated first commit from "Optimized Privilege Evaluation (opensearch-project#4380)"
Signed-off-by: Nils Bandener <[email protected]>
1 parent 563e7fe commit 6d58ef4

36 files changed

+4502
-653
lines changed

‎src/integrationTest/java/org/opensearch/security/privileges/ActionPrivilegesTest.java‎

Lines changed: 1040 additions & 0 deletions
Large diffs are not rendered by default.

‎src/integrationTest/java/org/opensearch/security/privileges/IndexPatternTest.java‎

Lines changed: 235 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*
8+
* Modifications Copyright OpenSearch Contributors. See
9+
* GitHub history for details.
10+
*/
11+
package org.opensearch.security.privileges;
12+
13+
import java.time.ZonedDateTime;
14+
import java.time.temporal.ChronoField;
15+
16+
import com.google.common.collect.ImmutableMap;
17+
import com.google.common.collect.ImmutableSet;
18+
import org.junit.Test;
19+
20+
import org.opensearch.cluster.ClusterState;
21+
import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
22+
import org.opensearch.cluster.metadata.Metadata;
23+
import org.opensearch.common.settings.Settings;
24+
import org.opensearch.common.util.concurrent.ThreadContext;
25+
import org.opensearch.security.resolver.IndexResolverReplacer;
26+
import org.opensearch.security.support.WildcardMatcher;
27+
import org.opensearch.security.user.User;
28+
29+
import static org.opensearch.security.util.MockIndexMetadataBuilder.indices;
30+
import static org.junit.Assert.assertEquals;
31+
import static org.junit.Assert.assertFalse;
32+
import static org.junit.Assert.assertTrue;
33+
34+
public class IndexPatternTest {
35+
final static int CURRENT_YEAR = ZonedDateTime.now().get(ChronoField.YEAR);
36+
final static int NEXT_YEAR = CURRENT_YEAR + 1;
37+
38+
final static Metadata INDEX_METADATA = //
39+
indices("index_a11", "index_a12", "index_a21", "index_a22", "index_b1", "index_b2")//
40+
.alias("alias_a")
41+
.of("index_a11", "index_a12", "index_a21", "index_a22")//
42+
.alias("alias_b")
43+
.of("index_b1", "index_b2")//
44+
.dataStream("data_stream_a1")//
45+
.dataStream("data_stream_b1")//
46+
.index("index_year_" + CURRENT_YEAR)//
47+
.index("index_year_" + NEXT_YEAR)//
48+
.alias("alias_year_" + CURRENT_YEAR)
49+
.of("index_current_year")//
50+
.alias("alias_year_" + NEXT_YEAR)
51+
.of("index_next_year")//
52+
.build();
53+
final static ClusterState CLUSTER_STATE = ClusterState.builder(ClusterState.EMPTY_STATE).metadata(INDEX_METADATA).build();
54+
55+
@Test
56+
public void constantIndex() throws Exception {
57+
IndexPattern indexPattern = IndexPattern.from("index_a11");
58+
assertTrue(indexPattern.hasStaticPattern());
59+
assertFalse(indexPattern.hasDynamicPattern());
60+
assertFalse(indexPattern.isEmpty());
61+
assertTrue(indexPattern.dynamicOnly().isEmpty());
62+
assertEquals("index_a11", indexPattern.toString());
63+
64+
assertTrue(indexPattern.matches("index_a11", ctx(), INDEX_METADATA.getIndicesLookup()));
65+
assertFalse(indexPattern.matches("index_a12", ctx(), INDEX_METADATA.getIndicesLookup()));
66+
}
67+
68+
@Test
69+
public void constantAlias() throws Exception {
70+
IndexPattern indexPattern = IndexPattern.from("alias_a");
71+
assertTrue(indexPattern.hasStaticPattern());
72+
assertFalse(indexPattern.hasDynamicPattern());
73+
74+
assertTrue(indexPattern.matches("alias_a", ctx(), INDEX_METADATA.getIndicesLookup()));
75+
assertFalse(indexPattern.matches("alias_a1", ctx(), INDEX_METADATA.getIndicesLookup()));
76+
}
77+
78+
@Test
79+
public void constantAlias_onIndex() throws Exception {
80+
IndexPattern indexPattern = IndexPattern.from("alias_a");
81+
assertTrue(indexPattern.hasStaticPattern());
82+
assertFalse(indexPattern.hasDynamicPattern());
83+
84+
assertTrue(indexPattern.matches("index_a11", ctx(), INDEX_METADATA.getIndicesLookup()));
85+
assertFalse(indexPattern.matches("index_b1", ctx(), INDEX_METADATA.getIndicesLookup()));
86+
}
87+
88+
@Test
89+
public void constantDataStream_onIndex() throws Exception {
90+
IndexPattern indexPattern = IndexPattern.from("data_stream_a1");
91+
assertTrue(indexPattern.hasStaticPattern());
92+
assertFalse(indexPattern.hasDynamicPattern());
93+
94+
assertTrue(indexPattern.matches(".ds-data_stream_a1-000001", ctx(), INDEX_METADATA.getIndicesLookup()));
95+
assertFalse(indexPattern.matches(".ds-data_stream_a2-000001", ctx(), INDEX_METADATA.getIndicesLookup()));
96+
}
97+
98+
@Test
99+
public void patternIndex() throws Exception {
100+
IndexPattern indexPattern = IndexPattern.from("index_a1*");
101+
assertTrue(indexPattern.hasStaticPattern());
102+
assertFalse(indexPattern.hasDynamicPattern());
103+
104+
assertTrue(indexPattern.matches("index_a11", ctx(), INDEX_METADATA.getIndicesLookup()));
105+
assertFalse(indexPattern.matches("index_a21", ctx(), INDEX_METADATA.getIndicesLookup()));
106+
}
107+
108+
@Test
109+
public void patternAlias() throws Exception {
110+
IndexPattern indexPattern = IndexPattern.from("alias_a*");
111+
assertTrue(indexPattern.hasStaticPattern());
112+
assertFalse(indexPattern.hasDynamicPattern());
113+
114+
assertTrue(indexPattern.matches("alias_a", ctx(), INDEX_METADATA.getIndicesLookup()));
115+
assertFalse(indexPattern.matches("alias_b", ctx(), INDEX_METADATA.getIndicesLookup()));
116+
}
117+
118+
@Test
119+
public void patternAlias_onIndex() throws Exception {
120+
IndexPattern indexPattern = IndexPattern.from("alias_a*");
121+
assertTrue(indexPattern.hasStaticPattern());
122+
assertFalse(indexPattern.hasDynamicPattern());
123+
124+
assertTrue(indexPattern.matches("index_a11", ctx(), INDEX_METADATA.getIndicesLookup()));
125+
assertFalse(indexPattern.matches("index_b1", ctx(), INDEX_METADATA.getIndicesLookup()));
126+
}
127+
128+
@Test
129+
public void patternDataStream_onIndex() throws Exception {
130+
IndexPattern indexPattern = IndexPattern.from("data_stream_a*");
131+
assertTrue(indexPattern.hasStaticPattern());
132+
assertFalse(indexPattern.hasDynamicPattern());
133+
134+
assertTrue(indexPattern.matches(".ds-data_stream_a1-000001", ctx(), INDEX_METADATA.getIndicesLookup()));
135+
assertFalse(indexPattern.matches(".ds-data_stream_b1-000001", ctx(), INDEX_METADATA.getIndicesLookup()));
136+
}
137+
138+
/**
139+
* Static invalid regular expressions are just ignored
140+
*/
141+
@Test
142+
public void regex_invalid() throws Exception {
143+
IndexPattern indexPattern = IndexPattern.from("/index_x\\/");
144+
assertFalse(indexPattern.hasStaticPattern());
145+
assertFalse(indexPattern.hasDynamicPattern());
146+
}
147+
148+
@Test
149+
public void dateMathIndex() throws Exception {
150+
IndexPattern indexPattern = IndexPattern.from("<index_year_{now/y{yyyy}}>");
151+
assertFalse(indexPattern.hasStaticPattern());
152+
assertTrue(indexPattern.hasDynamicPattern());
153+
assertEquals("<index_year_{now/y{yyyy}}>", indexPattern.toString());
154+
155+
assertTrue(indexPattern.matches("index_year_" + CURRENT_YEAR, ctx(), INDEX_METADATA.getIndicesLookup()));
156+
assertFalse(indexPattern.matches("index_year_" + NEXT_YEAR, ctx(), INDEX_METADATA.getIndicesLookup()));
157+
}
158+
159+
@Test
160+
public void dateMathAlias_onIndex() throws Exception {
161+
IndexPattern indexPattern = IndexPattern.from("<alias_year_{now/y{yyyy}}>");
162+
assertFalse(indexPattern.hasStaticPattern());
163+
assertTrue(indexPattern.hasDynamicPattern());
164+
165+
assertTrue(indexPattern.matches("index_current_year", ctx(), INDEX_METADATA.getIndicesLookup()));
166+
assertFalse(indexPattern.matches("index_next_year", ctx(), INDEX_METADATA.getIndicesLookup()));
167+
}
168+
169+
@Test(expected = PrivilegesEvaluationException.class)
170+
public void dateMathIndex_invalid() throws Exception {
171+
IndexPattern indexPattern = IndexPattern.from("<index_year_{now/y{yyyy}>");
172+
indexPattern.matches("index_year_" + CURRENT_YEAR, ctx(), INDEX_METADATA.getIndicesLookup());
173+
}
174+
175+
@Test
176+
public void templatedIndex() throws Exception {
177+
IndexPattern indexPattern = IndexPattern.from("index_${attrs.a11}");
178+
assertFalse(indexPattern.hasStaticPattern());
179+
assertTrue(indexPattern.hasDynamicPattern());
180+
assertEquals(indexPattern, indexPattern.dynamicOnly());
181+
182+
assertTrue(indexPattern.matches("index_a11", ctx(), INDEX_METADATA.getIndicesLookup()));
183+
assertFalse(indexPattern.matches("index_a12", ctx(), INDEX_METADATA.getIndicesLookup()));
184+
}
185+
186+
@Test(expected = PrivilegesEvaluationException.class)
187+
public void templatedIndex_invalid() throws Exception {
188+
IndexPattern indexPattern = IndexPattern.from("/index_${attrs.a11}\\/");
189+
assertFalse(indexPattern.hasStaticPattern());
190+
assertTrue(indexPattern.hasDynamicPattern());
191+
192+
indexPattern.matches("whatever", ctx(), INDEX_METADATA.getIndicesLookup());
193+
}
194+
195+
@Test
196+
public void mixed() throws Exception {
197+
IndexPattern indexPattern = IndexPattern.from("index_${attrs.a11}", "index_a12");
198+
assertTrue(indexPattern.hasStaticPattern());
199+
assertTrue(indexPattern.hasDynamicPattern());
200+
201+
assertEquals(WildcardMatcher.from("index_a12"), indexPattern.getStaticPattern());
202+
assertEquals(IndexPattern.from("index_${attrs.a11}"), indexPattern.dynamicOnly());
203+
assertEquals("index_a12 index_${attrs.a11}", indexPattern.toString());
204+
}
205+
206+
@Test
207+
public void mixed2() throws Exception {
208+
IndexPattern indexPattern = IndexPattern.from("<index_year_{now/y{yyyy}}>", "index_a12");
209+
assertTrue(indexPattern.hasStaticPattern());
210+
assertTrue(indexPattern.hasDynamicPattern());
211+
212+
assertEquals(WildcardMatcher.from("index_a12"), indexPattern.getStaticPattern());
213+
assertEquals(IndexPattern.from("<index_year_{now/y{yyyy}}>"), indexPattern.dynamicOnly());
214+
assertEquals("index_a12 <index_year_{now/y{yyyy}}>", indexPattern.toString());
215+
}
216+
217+
private static PrivilegesEvaluationContext ctx() {
218+
IndexNameExpressionResolver indexNameExpressionResolver = new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY));
219+
IndexResolverReplacer indexResolverReplacer = new IndexResolverReplacer(indexNameExpressionResolver, () -> CLUSTER_STATE, null);
220+
User user = new User("test_user");
221+
user.addAttributes(ImmutableMap.of("attrs.a11", "a11"));
222+
user.addAttributes(ImmutableMap.of("attrs.year", "year"));
223+
224+
return new PrivilegesEvaluationContext(
225+
user,
226+
ImmutableSet.of(),
227+
"indices:action/test",
228+
null,
229+
null,
230+
indexResolverReplacer,
231+
indexNameExpressionResolver,
232+
() -> CLUSTER_STATE
233+
);
234+
}
235+
}

0 commit comments

Comments
 (0)