[Workspace] Only OSD admin can create workspace

changelogs/fragments/6831.yml

@@ -0,0 +1,2 @@
+feat:
+- [Workspace] Only OSD admin can create workspace ([#6831](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/6831))

src/plugins/workspace/server/saved_objects/integration_tests/workspace_saved_objects_client_wrapper.test.ts

@@ -316,6 +316,45 @@ describe('WorkspaceSavedObjectsClientWrapper', () => {
 
       expect(createResult.error).toBeUndefined();
     });
+
+    it('should throw forbidden error when user create a workspce and is not OSD admin', async () => {
+      let error;
+      try {
+        await permittedSavedObjectedClient.create('workspace', {}, {});
+      } catch (e) {
+        error = e;
+      }
+
+      expect(SavedObjectsErrorHelpers.isForbiddenError(error)).toBe(true);
+
+      try {
+        await permittedSavedObjectedClient.create('workspace', {}, { id: 'workspace-1' });
+      } catch (e) {
+        error = e;
+      }
+
+      expect(SavedObjectsErrorHelpers.isForbiddenError(error)).toBe(true);
+
+      try {
+        await permittedSavedObjectedClient.create('workspace', {}, { overwrite: true });
+      } catch (e) {
+        error = e;
+      }
+
+      expect(SavedObjectsErrorHelpers.isForbiddenError(error)).toBe(true);
+
+      try {
+        await permittedSavedObjectedClient.create(
+          'workspace',
+          {},
+          { id: 'no-exist', overwrite: true }
+        );
+      } catch (e) {
+        error = e;
+      }
+
+      expect(SavedObjectsErrorHelpers.isNotFoundError(error)).toBe(true);
+    });
   });
 
   describe('bulkCreate', () => {
@@ -384,6 +423,37 @@ describe('WorkspaceSavedObjectsClientWrapper', () => {
 
       expect(createResult.saved_objects).toHaveLength(1);
     });
+
+    it('should throw forbidden error when user bulkCreate workspace and is not OSD admin', async () => {
+      let error;
+      try {
+        await permittedSavedObjectedClient.bulkCreate([{ type: 'workspace', attributes: {} }]);
+      } catch (e) {
+        error = e;
+      }
+
+      expect(SavedObjectsErrorHelpers.isForbiddenError(error)).toBe(true);
+
+      try {
+        await permittedSavedObjectedClient.bulkCreate([{ type: 'workspace', attributes: {} }], {
+          overwrite: true,
+        });
+      } catch (e) {
+        error = e;
+      }
+
+      expect(SavedObjectsErrorHelpers.isForbiddenError(error)).toBe(true);
+
+      try {
+        await permittedSavedObjectedClient.bulkCreate([
+          { type: 'workspace', id: 'test', attributes: {} },
+        ]);
+      } catch (e) {
+        error = e;
+      }
+
+      expect(SavedObjectsErrorHelpers.isForbiddenError(error)).toBe(true);
+    });
   });
 
   describe('update', () => {

src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.test.ts

@@ -352,6 +352,30 @@ describe('WorkspaceSavedObjectsClientWrapper', () => {
           workspaces: ['workspace-1'],
         });
       });
+      it('should throw permission error when user bulkCreate workspace and is not dashboard admin', async () => {
+        const { wrapper } = generateWorkspaceSavedObjectsClientWrapper();
+        let errorCatched;
+        try {
+          await wrapper.bulkCreate([{ type: 'workspace', attributes: {} }]);
+        } catch (e) {
+          errorCatched = e;
+        }
+        expect(errorCatched?.message).toEqual('Invalid permission, please contact OSD admin');
+
+        try {
+          await wrapper.bulkCreate([{ type: 'workspace', id: 'test', attributes: {} }]);
+        } catch (e) {
+          errorCatched = e;
+        }
+        expect(errorCatched?.message).toEqual('Invalid permission, please contact OSD admin');
+
+        try {
+          await wrapper.bulkCreate([{ type: 'workspace', attributes: {} }], { overwrite: true });
+        } catch (e) {
+          errorCatched = e;
+        }
+        expect(errorCatched?.message).toEqual('Invalid permission, please contact OSD admin');
+      });
     });
 
     describe('create', () => {
@@ -426,6 +450,30 @@ describe('WorkspaceSavedObjectsClientWrapper', () => {
           }
         );
       });
+      it('should throw permission error when user create a workspace and is not dashboard admin', async () => {
+        const { wrapper } = generateWorkspaceSavedObjectsClientWrapper();
+        let errorCatched;
+        try {
+          await wrapper.create('workspace', { name: 'test' }, { overwrite: true });
+        } catch (e) {
+          errorCatched = e;
+        }
+        expect(errorCatched?.message).toEqual('Invalid permission, please contact OSD admin');
+
+        try {
+          await wrapper.create('workspace', { name: 'test' }, { id: 'test' });
+        } catch (e) {
+          errorCatched = e;
+        }
+        expect(errorCatched?.message).toEqual('Invalid permission, please contact OSD admin');
+
+        try {
+          await wrapper.create('workspace', { name: 'test' }, {});
+        } catch (e) {
+          errorCatched = e;
+        }
+        expect(errorCatched?.message).toEqual('Invalid permission, please contact OSD admin');
+      });
     });
     describe('get', () => {
       it('should return saved object if no need to validate permission', async () => {

src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts

@@ -53,6 +53,15 @@ const generateSavedObjectsPermissionError = () =>
     )
   );
 
+const generateOSDAdminPermissionError = () =>
+  SavedObjectsErrorHelpers.decorateForbiddenError(
+    new Error(
+      i18n.translate('dashboard.admin.permission.invalidate', {
+        defaultMessage: 'Invalid permission, please contact OSD admin',
+      })
+    )
+  );
+
 const intersection = <T extends string>(...args: T[][]) => {
   const occursCountMap: { [key: string]: number } = {};
   for (let i = 0; i < args.length; i++) {
@@ -272,6 +281,13 @@ export class WorkspaceSavedObjectsClientWrapper {
       objects: Array<SavedObjectsBulkCreateObject<T>>,
       options: SavedObjectsCreateOptions = {}
     ): Promise<SavedObjectsBulkResponse<T>> => {
+      // If objects contain workspace id and options.overwrite is true, it is a bulkCreate action.
+      const isUpdateWorkspaceMode =
+        objects.some((obj) => obj.id && obj.type === WORKSPACE_TYPE) && options.overwrite;
+      // Only OSD admin can bulkCreate workspace.
+      if (objects.some((obj) => obj.type === WORKSPACE_TYPE) && !isUpdateWorkspaceMode)
+        throw generateOSDAdminPermissionError();
+
       const hasTargetWorkspaces = options?.workspaces && options.workspaces.length > 0;
 
       if (
@@ -330,6 +346,11 @@ export class WorkspaceSavedObjectsClientWrapper {
       attributes: T,
       options?: SavedObjectsCreateOptions
     ) => {
+      // If options contains id and overwrite, it is an update action.
+      const isUpdateMode = options?.id && options?.overwrite;
+      // Only OSD admin can create workspace.
+      if (type === WORKSPACE_TYPE && !isUpdateMode) throw generateOSDAdminPermissionError();
+
       const hasTargetWorkspaces = options?.workspaces && options.workspaces.length > 0;
 
       if (