Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Workspace]Deny get or bulkGet for global data source #8043

Merged
merged 2 commits into from
Sep 6, 2024
Merged

[Workspace]Deny get or bulkGet for global data source #8043

merged 2 commits into from
Sep 6, 2024

Conversation

wanglam
Copy link
Contributor

@wanglam wanglam commented Sep 6, 2024 •
edited
Loading

Description

This PR is for adding permission validation in saved objects client's get or bulkGet methods. Currently, a user can call get / bulkGet with data source id for global data source (not assigned to any workspace). These two methods will throw error when operating on these global data sources.

Issues Resolved

#8044

Screenshot

No UI changes

Testing the changes

  • Clone branch code and run yarn osd bootstrap --single-version ignore
  • Add below configs in config/opensearch_dashboards.yml
savedObjects.permission.enabled: true
workspace.enabled: true
uiSettings:
  overrides:
    'home:useNewHomePage': true
opensearchDashboards.dashboardAdmin.users: ['admin']
  • Run yarn start --no-base-path
  • Login with admin user
  • Create a data source and record the data source id
  • Create a test-user with kibanauser backend roles
  • Call curl with created data source use below commands, it should response error
  • Test bulkGet
# Test with get
curl 'http://localhost:5601/api/saved_objects/data-source/<created_data_source_id>"' \
  -H 'Accept: */*' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Content-Type: application/json' \
  -H 'Origin: http://localhost:5601' \
  -H 'Pragma: no-cache' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-origin' \
  -H 'osd-version: 3.0.0' \
  -H 'osd-xsrf: osd-fetch' \
  -H 'authorization: Basic <TOKEN_TO_TEST_USER>'

# Test with bulk get
curl 'http://localhost:5601/api/saved_objects/_bulk_get' \
  -H 'Accept: */*' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Content-Type: application/json' \
  -H 'Origin: http://localhost:5601' \
  -H 'Pragma: no-cache' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-origin' \
  -H 'osd-version: 3.0.0' \
  -H 'osd-xsrf: osd-fetch' \
  -H 'authorization: Basic <TOKEN_TO_TEST_USER>' \
  --data-raw '[{"id":"<created_data_source_id>","type":"data-source"}]'

These two commands should response {"statusCode":403,"error":"Forbidden","message":"Invalid data source permission, please associate it to current workspace"}

Changelog

  • feat: [Workspace]Deny get or bulkGet for global data source

Check List

  • All tests pass
    • yarn test:jest
    • yarn test:jest_integration
  • New functionality includes testing.
  • New functionality has been documented.
  • Update CHANGELOG.md
  • Commits are signed per the DCO using --signoff

@wanglam
Deny get or bulkGet for global data source
e31be8f 
Signed-off-by: Lin Wang <wonglam@amazon.com>
@codecov Codecov
Copy link

codecov bot commented Sep 6, 2024 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 60.59%. Comparing base (d9c9aad) to head (e569c44).
Report is 79 commits behind head on main.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #8043      +/-   ##
==========================================
- Coverage   60.60%   60.59%   -0.02%     
==========================================
  Files        3732     3732              
  Lines       88427    88431       +4     
  Branches    13701    13702       +1     
==========================================
- Hits        53589    53581       -8     
- Misses      31579    31591      +12     
  Partials     3259     3259
Flag Coverage Δ
Linux_1 28.76% <100.00%> (+<0.01%) ⬆️
Linux_2 56.26% <ø> (ø)
Linux_3 37.44% <ø> (ø)
Linux_4 29.64% <ø> (ø)
Windows_1 28.77% <100.00%> (-0.02%) ⬇️
Windows_2 56.21% <ø> (ø)
Windows_3 37.44% <ø> (ø)
Windows_4 29.64% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@wanglam wanglam marked this pull request as ready for review September 6, 2024 08:11
@SuZhou-Joe SuZhou-Joe merged commit d22b68b into opensearch-project:main Sep 6, 2024
81 of 82 checks passed
opensearch-trigger-bot bot pushed a commit that referenced this pull request Sep 6, 2024
@github-actions @opensearch-changeset-bot
[Workspace]Deny get or bulkGet for global data source (#8043)
46630fb 
* Deny get or bulkGet for global data source

Signed-off-by: Lin Wang <wonglam@amazon.com>

* Changeset file for PR #8043 created/updated

---------

Signed-off-by: Lin Wang <wonglam@amazon.com>
Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com>
(cherry picked from commit d22b68b)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@opensearch-trigger-bot opensearch-trigger-bot bot mentioned this pull request Sep 6, 2024
Merged
@opensearch-trigger-bot
Copy link
Contributor

The backport to 2.17 failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-2.17 2.17
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-2.17
# Create a new branch
git switch --create backport/backport-8043-to-2.17
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 d22b68b3ea439fd97e0ed8363fb9fb79c1f89dd6
# Push it to GitHub
git push --set-upstream origin backport/backport-8043-to-2.17
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-2.17

Then, create a pull request where the base branch is 2.17 and the compare/head branch is backport/backport-8043-to-2.17.

SuZhou-Joe pushed a commit that referenced this pull request Sep 6, 2024
@opensearch-trigger-bot @github-actions @opensearch-changeset-bot
[Workspace]Deny get or bulkGet for global data source (#8043) (#8051)
27cce8e 
* Deny get or bulkGet for global data source



* Changeset file for PR #8043 created/updated

---------



(cherry picked from commit d22b68b)

Signed-off-by: Lin Wang <wonglam@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com>
opensearch-trigger-bot bot pushed a commit that referenced this pull request Sep 6, 2024
@github-actions @opensearch-changeset-bot
[Workspace]Deny get or bulkGet for global data source (#8043) (#8051)
efb7058 
* Deny get or bulkGet for global data source

* Changeset file for PR #8043 created/updated

---------

(cherry picked from commit d22b68b)

Signed-off-by: Lin Wang <wonglam@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com>
(cherry picked from commit 27cce8e)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
SuZhou-Joe pushed a commit that referenced this pull request Sep 6, 2024
@opensearch-trigger-bot @github-actions @opensearch-changeset-bot
[Workspace]Deny get or bulkGet for global data source (#8043) (#8051) (…
d3099bf 
…#8056)

* Deny get or bulkGet for global data source

* Changeset file for PR #8043 created/updated

---------

(cherry picked from commit d22b68b)





(cherry picked from commit 27cce8e)

Signed-off-by: Lin Wang <wonglam@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@SuZhou-Joe SuZhou-Joe SuZhou-Joe approved these changes

@ruanyl ruanyl ruanyl approved these changes

@ananzh ananzh Awaiting requested review from ananzh ananzh is a code owner

@kavilla kavilla Awaiting requested review from kavilla kavilla is a code owner

@AMoo-Miki AMoo-Miki Awaiting requested review from AMoo-Miki AMoo-Miki is a code owner

@ashwin-pc ashwin-pc Awaiting requested review from ashwin-pc ashwin-pc is a code owner

@joshuarrrr joshuarrrr Awaiting requested review from joshuarrrr joshuarrrr is a code owner

@abbyhu2000 abbyhu2000 Awaiting requested review from abbyhu2000 abbyhu2000 is a code owner

@zengyan-amazon zengyan-amazon Awaiting requested review from zengyan-amazon zengyan-amazon is a code owner

@zhongnansu zhongnansu Awaiting requested review from zhongnansu zhongnansu is a code owner

@manasvinibs manasvinibs Awaiting requested review from manasvinibs manasvinibs is a code owner

@ZilongX ZilongX Awaiting requested review from ZilongX ZilongX is a code owner

@Flyingliuhub Flyingliuhub Awaiting requested review from Flyingliuhub Flyingliuhub is a code owner

@curq curq Awaiting requested review from curq curq is a code owner

@bandinib-amzn bandinib-amzn Awaiting requested review from bandinib-amzn bandinib-amzn is a code owner

@BionIT BionIT Awaiting requested review from BionIT BionIT is a code owner

@xinruiba xinruiba Awaiting requested review from xinruiba xinruiba is a code owner

@zhyuanqi zhyuanqi Awaiting requested review from zhyuanqi zhyuanqi is a code owner

@mengweieric mengweieric Awaiting requested review from mengweieric mengweieric is a code owner

@LDrago27 LDrago27 Awaiting requested review from LDrago27 LDrago27 is a code owner

@virajsanghvi virajsanghvi Awaiting requested review from virajsanghvi virajsanghvi is a code owner

@sejli sejli Awaiting requested review from sejli sejli is a code owner

@joshuali925 joshuali925 Awaiting requested review from joshuali925 joshuali925 is a code owner

@huyaboo huyaboo Awaiting requested review from huyaboo huyaboo is a code owner

Assignees
No one assigned
Labels
all-star-contributor backport 2.x backport 2.17 in-next v2.17.0 workspace
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@wanglam @ruanyl @SuZhou-Joe @AMoo-Miki