diff --git a/src/main/java/org/opensearch/security/privileges/PitAccessEvaluator.java b/src/main/java/org/opensearch/security/privileges/PitPrivilegesEvaluator.java similarity index 91% rename from src/main/java/org/opensearch/security/privileges/PitAccessEvaluator.java rename to src/main/java/org/opensearch/security/privileges/PitPrivilegesEvaluator.java index 48e7c753c2..c817b9529a 100644 --- a/src/main/java/org/opensearch/security/privileges/PitAccessEvaluator.java +++ b/src/main/java/org/opensearch/security/privileges/PitPrivilegesEvaluator.java @@ -61,7 +61,7 @@ /** * This class evaluates privileges for point in time (Delete and List all) operations */ -public class PitAccessEvaluator { +public class PitPrivilegesEvaluator { protected final Logger log = LogManager.getLogger(this.getClass()); private boolean isDebugEnabled = log.isDebugEnabled(); @@ -69,7 +69,7 @@ public class PitAccessEvaluator { public PrivilegesEvaluatorResponse evaluate(final ActionRequest request, final ClusterService clusterService, final User user, final SecurityRoles securityRoles, final String action, final IndexNameExpressionResolver resolver, - boolean dnfofEnabled, final PrivilegesEvaluatorResponse presponse) { + boolean dnfOfEmptyResultsEnabled, final PrivilegesEvaluatorResponse presponse) { // Skip pit evaluation for "NodesGetAllPITs" action, since it fetches all PITs across the cluster // for privilege evaluation @@ -82,26 +82,26 @@ public PrivilegesEvaluatorResponse evaluate(final ActionRequest request, final C return presponse; } return handleGetAllPitsAccess(request, clusterService, user, securityRoles, - action, resolver, dnfofEnabled, presponse); + action, resolver, dnfOfEmptyResultsEnabled, presponse); } else if (request instanceof DeletePitRequest) { DeletePitRequest deletePitRequest = (DeletePitRequest) request; List pitIds = deletePitRequest.getPitIds(); if (pitIds.size() == 1 && "_all".equals(pitIds.get(0))) { return handleDeleteAllPitAccess(deletePitRequest, clusterService, user, securityRoles, - action, resolver, dnfofEnabled, presponse); + action, resolver, dnfOfEmptyResultsEnabled, presponse); } else { return handleExplicitPitsAccess(deletePitRequest.getPitIds(), clusterService, user, securityRoles, - action, resolver, dnfofEnabled, presponse); + action, resolver, dnfOfEmptyResultsEnabled, presponse); } } else if (request instanceof PitSegmentsRequest) { PitSegmentsRequest pitSegmentsRequest = (PitSegmentsRequest) request; List pitIds = pitSegmentsRequest.getPitIds(); if (pitIds.size() == 1 && "_all".equals(pitIds.get(0))) { return handleGetAllPitSegmentsAccess(pitSegmentsRequest, clusterService, user, securityRoles, - action, resolver, dnfofEnabled, presponse); + action, resolver, dnfOfEmptyResultsEnabled, presponse); } else { return handleExplicitPitsAccess(pitSegmentsRequest.getPitIds(), clusterService, user, securityRoles, - action, resolver, dnfofEnabled, presponse); + action, resolver, dnfOfEmptyResultsEnabled, presponse); } } } catch(InterruptedException e) { @@ -117,11 +117,12 @@ public PrivilegesEvaluatorResponse evaluate(final ActionRequest request, final C private PrivilegesEvaluatorResponse handleGetAllPitsAccess(final ActionRequest request, final ClusterService clusterService, final User user, SecurityRoles securityRoles, final String action, IndexNameExpressionResolver resolver, - boolean dnfofEnabled, PrivilegesEvaluatorResponse presponse) throws InterruptedException { + boolean dnfOfEmptyResultsEnabled, PrivilegesEvaluatorResponse presponse) throws InterruptedException { List pitInfos = getAllPitInfos((GetAllPitNodesRequest) request); - // if cluster has no PITs, then allow the operation to pass with empty response + // if cluster has no PITs, then allow the operation to pass with empty response if dnfOfEmptyResultsEnabled + // config property is true, otherwise fail the operation if(pitInfos.isEmpty()) { - if(dnfofEnabled) { + if(dnfOfEmptyResultsEnabled) { presponse.allowed = true; presponse.markComplete(); } @@ -172,12 +173,13 @@ private PrivilegesEvaluatorResponse handleGetAllPitsAccess(final ActionRequest r private PrivilegesEvaluatorResponse handleDeleteAllPitAccess(DeletePitRequest deletePitRequest, ClusterService clusterService, User user, SecurityRoles securityRoles, final String action, IndexNameExpressionResolver resolver, - boolean dnfofEnabled, PrivilegesEvaluatorResponse presponse) throws InterruptedException { + boolean dnfOfEmptyResultsEnabled, PrivilegesEvaluatorResponse presponse) throws InterruptedException { List permittedPits = new ArrayList<>(); List pitIds = getAllPitIds(); - // allow delete pit operation if there are no pits in the cluster ( response should be empty ) + // if cluster has no PITs, then allow the operation to pass with empty response if dnfOfEmptyResultsEnabled + // config property is true, otherwise fail the operation if(pitIds.isEmpty()) { - if(dnfofEnabled) { + if(dnfOfEmptyResultsEnabled) { deletePitRequest.clearAndSetPitIds(pitIds); presponse.allowed = true; presponse.markComplete(); @@ -216,12 +218,13 @@ private PrivilegesEvaluatorResponse handleDeleteAllPitAccess(DeletePitRequest de private PrivilegesEvaluatorResponse handleGetAllPitSegmentsAccess(PitSegmentsRequest pitSegmentsRequest, ClusterService clusterService, User user, SecurityRoles securityRoles, final String action, IndexNameExpressionResolver resolver, - boolean dnfofEnabled, PrivilegesEvaluatorResponse presponse) throws InterruptedException { + boolean dnfOfEmptyResultsEnabled, PrivilegesEvaluatorResponse presponse) throws InterruptedException { List permittedPits = new ArrayList<>(); List pitIds = getAllPitIds(); - // allow pit segments operation if there are no pits in the cluster ( response should be empty ) + // if cluster has no PITs, then allow the operation to pass with empty response if dnfOfEmptyResultsEnabled + // config property is true, otherwise fail the operation if(pitIds.isEmpty()) { - if(dnfofEnabled) { + if(dnfOfEmptyResultsEnabled) { pitSegmentsRequest.clearAndSetPitIds(pitIds); presponse.allowed = true; presponse.markComplete(); diff --git a/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java b/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java index 0cc850ecc6..10662e6f40 100644 --- a/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java +++ b/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java @@ -130,7 +130,7 @@ public class PrivilegesEvaluator { private final SecurityIndexAccessEvaluator securityIndexAccessEvaluator; private final ProtectedIndexAccessEvaluator protectedIndexAccessEvaluator; private final TermsAggregationEvaluator termsAggregationEvaluator; - private final PitAccessEvaluator pitAccessEvaluator; + private final PitPrivilegesEvaluator pitPrivilegesEvaluator; private final boolean dlsFlsEnabled; private final boolean dfmEmptyOverwritesAll; private DynamicConfigModel dcm; @@ -159,7 +159,7 @@ public PrivilegesEvaluator(final ClusterService clusterService, final ThreadPool securityIndexAccessEvaluator = new SecurityIndexAccessEvaluator(settings, auditLog, irr); protectedIndexAccessEvaluator = new ProtectedIndexAccessEvaluator(settings, auditLog); termsAggregationEvaluator = new TermsAggregationEvaluator(); - pitAccessEvaluator = new PitAccessEvaluator(); + pitPrivilegesEvaluator = new PitPrivilegesEvaluator(); this.namedXContentRegistry = namedXContentRegistry; this.dlsFlsEnabled = dlsFlsEnabled; this.dfmEmptyOverwritesAll = settings.getAsBoolean(ConfigConstants.SECURITY_DFM_EMPTY_OVERRIDES_ALL, false); @@ -285,8 +285,8 @@ public PrivilegesEvaluatorResponse evaluate(final User user, String action0, fin } // check access for point in time requests - if(pitAccessEvaluator.evaluate(request, clusterService, user, securityRoles, - action0, resolver, dcm.isDnfofEnabled(), presponse).isComplete()) { + if(pitPrivilegesEvaluator.evaluate(request, clusterService, user, securityRoles, + action0, resolver, dcm.isDnfofForEmptyResultsEnabled(), presponse).isComplete()) { return presponse; }