feat: enable find with acl permission check

Signed-off-by: SuZhou-Joe <suzhou@amazon.com>
ruanyl · Aug 4, 2023 · 2fdd9b7 · 2fdd9b7
1 parent 9bf4ffd
commit 2fdd9b7
Show file tree

Hide file tree

Showing 12 changed files with 158 additions and 83 deletions.
diff --git a/src/core/server/saved_objects/permission_control/acl.test.ts b/src/core/server/saved_objects/permission_control/acl.test.ts
@@ -111,13 +111,13 @@ describe('SavedObjectTypeRegistry', () => {
     expect(result?.length).toEqual(3);
   });
 
-  it('test genereate query DSL', () => {
+  it('test generate query DSL', () => {
     const principals = {
       users: ['user1'],
       groups: ['group1'],
     };
     const result = ACL.genereateGetPermittedSavedObjectsQueryDSL(
-      PermissionMode.Read,
+      [PermissionMode.Read],
       principals,
       'workspace'
     );

diff --git a/src/core/server/saved_objects/permission_control/acl.ts b/src/core/server/saved_objects/permission_control/acl.ts
@@ -10,7 +10,7 @@ export interface Principals {
   groups?: string[];
 }
 
-export type Permissions = Partial<Record<string, Principals>>;
+export type Permissions = Record<string, Principals>;
 
 export interface TransformedPermission {
   type: string;
@@ -204,11 +204,11 @@ export class ACL {
         generate query DSL by the specific conditions, used for fetching saved objects from the saved objects index
         */
   public static genereateGetPermittedSavedObjectsQueryDSL(
-    permissionType: string,
+    permissionTypes: string[],
     principals: Principals,
     savedObjectType?: string | string[]
   ) {
-    if (!principals || !permissionType) {
+    if (!principals || !permissionTypes) {
       return {
         query: {
           match_none: {},
@@ -222,30 +222,21 @@ export class ACL {
     const subBool: any = {
       should: [],
     };
-    if (!!principals.users) {
-      subBool.should.push({
-        terms: {
-          ['permissions.' + permissionType + '.users']: principals.users,
-        },
-      });
-      subBool.should.push({
-        term: {
-          ['permissions.' + permissionType + '.users']: '*',
-        },
-      });
-    }
-    if (!!principals.groups) {
-      subBool.should.push({
-        terms: {
-          ['permissions.' + permissionType + '.groups']: principals.groups,
-        },
-      });
-      subBool.should.push({
-        term: {
-          ['permissions.' + permissionType + '.groups']: '*',
-        },
+
+    permissionTypes.forEach((permissionType) => {
+      Object.entries(principals).forEach(([principalType, principalsInCurrentType]) => {
+        subBool.should.push({
+          terms: {
+            ['permissions.' + permissionType + `.${principalType}`]: principalsInCurrentType,
+          },
+        });
+        subBool.should.push({
+          term: {
+            ['permissions.' + permissionType + `.${principalType}`]: '*',
+          },
+        });
       });
-    }
+    });
 
     bool.filter.push({
       bool: subBool,

diff --git a/src/core/server/saved_objects/permission_control/client.mock.ts b/src/core/server/saved_objects/permission_control/client.mock.ts
@@ -9,8 +9,6 @@ export const savedObjectsPermissionControlMock: SavedObjectsPermissionControlCon
   setup: jest.fn(),
   validate: jest.fn(),
   batchValidate: jest.fn(),
-  addPrinciplesToObjects: jest.fn(),
-  removePrinciplesFromObjects: jest.fn(),
   getPrinciplesOfObjects: jest.fn(),
   getPermittedWorkspaceIds: jest.fn(),
 };
diff --git a/src/core/server/saved_objects/permission_control/client.ts b/src/core/server/saved_objects/permission_control/client.ts
@@ -4,8 +4,12 @@
  */
 
 import { OpenSearchDashboardsRequest } from '../../http';
+import { ensureRawRequest } from '../../http/router';
 import { SavedObjectsServiceStart } from '../saved_objects_service';
 import { SavedObjectsBulkGetObject } from '../service';
+import { ACL, Principals, TransformedPermission } from './acl';
+import { PrincipalType } from '../../../utils/constants';
+import { WORKSPACE_TYPE } from '../../workspaces';
 
 export type SavedObjectsPermissionControlContract = Pick<
   SavedObjectsPermissionControl,
@@ -14,21 +18,36 @@ export type SavedObjectsPermissionControlContract = Pick<
 
 export type SavedObjectsPermissionModes = string[];
 
+export interface AuthInfo {
+  backend_roles?: string[];
+  user_name?: string;
+}
+
 export class SavedObjectsPermissionControl {
-  private getScopedClient?: SavedObjectsServiceStart['getScopedClient'];
-  private getScopedSavedObjectsClient(request: OpenSearchDashboardsRequest) {
-    return this.getScopedClient?.(request);
+  private createScopedRepository?: SavedObjectsServiceStart['createScopedRepository'];
+  private getScopedRepository(request: OpenSearchDashboardsRequest) {
+    return this.createScopedRepository?.(request);
+  }
+  public getPrincipalsFromRequest(request: OpenSearchDashboardsRequest): Principals {
+    const rawRequest = ensureRawRequest(request);
+    const authInfo = rawRequest?.auth?.credentials?.authInfo as AuthInfo | null;
+    const payload: Principals = {};
+    if (authInfo?.backend_roles) {
+      payload[PrincipalType.Groups] = authInfo.backend_roles;
+    }
+    if (authInfo?.user_name) {
+      payload[PrincipalType.Users] = [authInfo.user_name];
+    }
+    return payload;
   }
   private async bulkGetSavedObjects(
     request: OpenSearchDashboardsRequest,
     savedObjects: SavedObjectsBulkGetObject[]
   ) {
-    return (
-      (await this.getScopedSavedObjectsClient(request)?.bulkGet(savedObjects))?.saved_objects || []
-    );
+    return (await this.getScopedRepository(request)?.bulkGet(savedObjects))?.saved_objects || [];
   }
-  public async setup(getScopedClient: SavedObjectsServiceStart['getScopedClient']) {
-    this.getScopedClient = getScopedClient;
+  public async setup(createScopedRepository: SavedObjectsServiceStart['createScopedRepository']) {
+    this.createScopedRepository = createScopedRepository;
   }
   public async validate(
     request: OpenSearchDashboardsRequest,
@@ -38,54 +57,70 @@ export class SavedObjectsPermissionControl {
     return await this.batchValidate(request, [savedObject], permissionModeOrModes);
   }
 
+  /**
+   * In batch validate case, the logic is a.withPermission && b.withPermission
+   * @param request
+   * @param savedObjects
+   * @param permissionModeOrModes
+   * @returns
+   */
   public async batchValidate(
     request: OpenSearchDashboardsRequest,
     savedObjects: SavedObjectsBulkGetObject[],
     permissionModeOrModes: SavedObjectsPermissionModes
   ) {
     const savedObjectsGet = await this.bulkGetSavedObjects(request, savedObjects);
     if (savedObjectsGet) {
+      const principals = this.getPrincipalsFromRequest(request);
+      const hasAllPermission = savedObjectsGet.every((item) => {
+        // item.permissions
+        const aclInstance = new ACL(item.permissions);
+        return aclInstance.hasPermission(permissionModeOrModes, principals);
+      });
       return {
         success: true,
-        result: true,
+        result: hasAllPermission,
       };
     }
 
     return {
-      success: true,
-      result: false,
+      success: false,
+      error: 'Can not find target saved objects.',
     };
   }
 
-  public async addPrinciplesToObjects(
-    request: OpenSearchDashboardsRequest,
-    savedObjects: SavedObjectsBulkGetObject[],
-    personas: string[],
-    permissionModeOrModes: SavedObjectsPermissionModes
-  ): Promise<boolean> {
-    return true;
-  }
-
-  public async removePrinciplesFromObjects(
-    request: OpenSearchDashboardsRequest,
-    savedObjects: SavedObjectsBulkGetObject[],
-    personas: string[],
-    permissionModeOrModes: SavedObjectsPermissionModes
-  ): Promise<boolean> {
-    return true;
-  }
-
   public async getPrinciplesOfObjects(
     request: OpenSearchDashboardsRequest,
     savedObjects: SavedObjectsBulkGetObject[]
-  ): Promise<Record<string, unknown>> {
-    return {};
+  ): Promise<Record<string, TransformedPermission>> {
+    const detailedSavedObjects = await this.bulkGetSavedObjects(request, savedObjects);
+    return detailedSavedObjects.reduce((total, current) => {
+      return {
+        ...total,
+        [current.id]: new ACL(current.permissions).transformPermissions(),
+      };
+    }, {});
   }
 
   public async getPermittedWorkspaceIds(
     request: OpenSearchDashboardsRequest,
     permissionModeOrModes: SavedObjectsPermissionModes
   ) {
-    return [];
+    const principals = this.getPrincipalsFromRequest(request);
+    const queryDSL = ACL.genereateGetPermittedSavedObjectsQueryDSL(
+      permissionModeOrModes,
+      principals,
+      [WORKSPACE_TYPE]
+    );
+    const repository = this.createScopedRepository?.(request);
+    try {
+      const result = await repository?.find({
+        type: [WORKSPACE_TYPE],
+        queryDSL,
+      });
+      return result?.saved_objects.map((item) => item.id);
+    } catch (e) {
+      return [];
+    }
   }
 }
diff --git a/src/core/server/saved_objects/saved_objects_service.ts b/src/core/server/saved_objects/saved_objects_service.ts
@@ -500,7 +500,7 @@ export class SavedObjectsService
     this.started = true;
 
     const getScopedClient = clientProvider.getClient.bind(clientProvider);
-    this.permissionControl?.setup(getScopedClient);
+    this.permissionControl?.setup(repositoryFactory.createScopedRepository);
 
     return {
       getScopedClient,

diff --git a/src/core/server/saved_objects/serialization/types.ts b/src/core/server/saved_objects/serialization/types.ts
@@ -28,6 +28,7 @@
  * under the License.
  */
 
+import { Permissions } from '../permission_control/acl';
 import { SavedObjectsMigrationVersion, SavedObjectReference } from '../types';
 
 /**
@@ -53,6 +54,7 @@ export interface SavedObjectsRawDocSource {
   references?: SavedObjectReference[];
   originId?: string;
   workspaces?: string[];
+  permissions?: Permissions;
 
   [typeMapping: string]: any;
 }

diff --git a/src/core/server/saved_objects/service/lib/repository.ts b/src/core/server/saved_objects/service/lib/repository.ts
@@ -769,6 +769,7 @@ export class SavedObjectsRepository {
       filter,
       preference,
       workspaces,
+      queryDSL,
     } = options;
 
     if (!type && !typeToNamespacesMap) {
@@ -843,6 +844,7 @@ export class SavedObjectsRepository {
           hasReference,
           kueryNode,
           workspaces,
+          queryDSL,
         }),
       },
     };
@@ -1897,7 +1899,7 @@ function getSavedObjectFromSource<T>(
   id: string,
   doc: { _seq_no?: number; _primary_term?: number; _source: SavedObjectsRawDocSource }
 ): SavedObject<T> {
-  const { originId, updated_at: updatedAt, workspaces } = doc._source;
+  const { originId, updated_at: updatedAt, workspaces, permissions } = doc._source;
 
   let namespaces: string[] = [];
   if (!registry.isNamespaceAgnostic(type)) {
@@ -1917,6 +1919,7 @@ function getSavedObjectFromSource<T>(
     attributes: doc._source[type],
     references: doc._source.references || [],
     migrationVersion: doc._source.migrationVersion,
+    permissions,
   };
 }
 

diff --git a/src/core/server/saved_objects/service/lib/search_dsl/query_params.ts b/src/core/server/saved_objects/service/lib/search_dsl/query_params.ts
@@ -27,7 +27,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-
+import { mergeWith, isArray } from 'lodash';
 // @ts-expect-error no ts
 import { opensearchKuery } from '../../../opensearch_query';
 type KueryNode = any;
@@ -174,6 +174,7 @@ interface QueryParams {
   hasReference?: HasReferenceQueryParams;
   kueryNode?: KueryNode;
   workspaces?: string[];
+  queryDSL?: Record<string, any>;
 }
 
 export function getClauseForReference(reference: HasReferenceQueryParams) {
@@ -231,6 +232,7 @@ export function getQueryParams({
   hasReference,
   kueryNode,
   workspaces,
+  queryDSL,
 }: QueryParams) {
   const types = getTypes(
     registry,
@@ -287,7 +289,16 @@ export function getQueryParams({
     }
   }
 
-  return { query: { bool } };
+  const result = { query: { bool } };
+
+  if (queryDSL) {
+    return mergeWith({}, result, queryDSL, (objValue, srcValue) => {
+      if (isArray(objValue)) {
+        return objValue.concat(srcValue);
+      }
+    });
+  }
+  return result;
 }
 
 // we only want to add match_phrase_prefix clauses

diff --git a/src/core/server/saved_objects/service/lib/search_dsl/search_dsl.ts b/src/core/server/saved_objects/service/lib/search_dsl/search_dsl.ts
@@ -53,6 +53,7 @@ interface GetSearchDslOptions {
   };
   kueryNode?: KueryNode;
   workspaces?: string[];
+  queryDSL?: Record<string, any>;
 }
 
 export function getSearchDsl(
@@ -73,6 +74,7 @@ export function getSearchDsl(
     hasReference,
     kueryNode,
     workspaces,
+    queryDSL,
   } = options;
 
   if (!type) {
@@ -96,6 +98,7 @@ export function getSearchDsl(
       hasReference,
       kueryNode,
       workspaces,
+      queryDSL,
     }),
     ...getSortingParams(mappings, type, sortField, sortOrder),
   };

diff --git a/src/core/server/saved_objects/types.ts b/src/core/server/saved_objects/types.ts
@@ -111,6 +111,7 @@ export interface SavedObjectsFindOptions {
   /** An optional OpenSearch preference value to be used for the query **/
   preference?: string;
   workspaces?: string[];
+  queryDSL?: Record<string, any>;
 }
 
 /**