Only log saved object which have no permission

Signed-off-by: gaobinlong <gbinlong@amazon.com>
gaobinlong · Sep 11, 2023 · ea48051 · ea48051
1 parent ada1a01
commit ea48051
Showing 1 changed file with 14 additions and 9 deletions.
diff --git a/src/core/server/saved_objects/permission_control/client.ts b/src/core/server/saved_objects/permission_control/client.ts
@@ -109,23 +109,28 @@ export class SavedObjectsPermissionControl {
     }
 
     const principals = this.getPrincipalsFromRequest(request);
+    let savedObjectsBasicInfo: any[] = [];
     const hasAllPermission = savedObjectsGet.every((item) => {
       // for object that doesn't contain ACL like config, return true
       if (!item.permissions) {
         return true;
       }
       const aclInstance = new ACL(item.permissions);
-      return aclInstance.hasPermission(permissionModes, principals);
+      const hasPermission = aclInstance.hasPermission(permissionModes, principals);
+      if (!hasPermission) {
+        savedObjectsBasicInfo = [
+          ...savedObjectsBasicInfo,
+          {
+            id: item.id,
+            type: item.type,
+            workspaces: item.workspaces,
+            permissions: item.permissions,
+          },
+        ];
+      }
+      return hasPermission;
     });
     if (!hasAllPermission) {
-      const savedObjectsBasicInfo = savedObjectsGet.map((item) => {
-        return {
-          id: item.id,
-          type: item.type,
-          workspaces: item.workspaces,
-          permissions: item.permissions,
-        };
-      });
       this.logger.debug(
         `Authorization failed, principals: ${JSON.stringify(
           principals