[Workspace][Feature] Add ACL related functions (opensearch-project#5084)

* [Workspace] Add ACL related functions for workspace (opensearch-project#146) * [Workspace] Add acl related functions for workspace Signed-off-by: gaobinlong <[email protected]> * Minor change Signed-off-by: gaobinlong <[email protected]> --------- Signed-off-by: gaobinlong <[email protected]> * Modify changelog Signed-off-by: gaobinlong <[email protected]> * Add more unit test cases Signed-off-by: gaobinlong <[email protected]> * Modify test case Signed-off-by: gaobinlong <[email protected]> * Some minor change Signed-off-by: gaobinlong <[email protected]> * Add more test cases Signed-off-by: gaobinlong <[email protected]> * Optimize some code and the comments of the functions Signed-off-by: gaobinlong <[email protected]> * Add more comments for some basic functions Signed-off-by: gaobinlong <[email protected]> * Export more interfaces Signed-off-by: gaobinlong <[email protected]> * consume permissions in repository Signed-off-by: SuZhou-Joe <[email protected]> * feat: consume permissions in serializer Signed-off-by: SuZhou-Joe <[email protected]> * Add unit tests for consuming permissions in repository Signed-off-by: gaobinlong <[email protected]> * Remove double exclamation Signed-off-by: gaobinlong <[email protected]> * Rename some variables Signed-off-by: gaobinlong <[email protected]> * Remove duplicated semicolon Signed-off-by: gaobinlong <[email protected]> * Add permissions field to the mapping only if the permission control is enabled Signed-off-by: gaobinlong <[email protected]> * Fix test failure Signed-off-by: gaobinlong <[email protected]> * Add feature flag config to the yml file Signed-off-by: gaobinlong <[email protected]> * Make the comment of feature flag more clear Signed-off-by: gaobinlong <[email protected]> * Make comment more clear Signed-off-by: gaobinlong <[email protected]> * Remove management permission type Signed-off-by: gaobinlong <[email protected]> * Fix test failure Signed-off-by: gaobinlong <[email protected]> --------- Signed-off-by: gaobinlong <[email protected]> Signed-off-by: SuZhou-Joe <[email protected]> Co-authored-by: Josh Romero <[email protected]> Co-authored-by: SuZhou-Joe <[email protected]>
gaobinlong · Mar 8, 2024 · 631f310 · 631f310
1 parent 1e582e2
commit 631f310
Show file tree

Hide file tree

Showing 20 changed files with 518 additions and 396 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -26,6 +26,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - Replace OuiSelect component with OuiSuperSelect in data-source plugin ([#5315](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/5315))
 - [Workspace] Add core workspace service module to enable the implementation of workspace features within OSD plugins ([#5092](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/5092))
 - [Workspace] Setup workspace skeleton and implement basic CRUD API ([#5075](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/5075))
+- [Workspace] Add ACL related functions ([#5084](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/5084/))
 - [Decouple] Add new cross compatibility check core service which export functionality for plugins to verify if their OpenSearch plugin counterpart is installed on the cluster or has incompatible version to configure the plugin behavior([#4710](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/4710))
 - [Discover] Add long numerals support [#5592](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/5592)
 - [Discover] Display inner properties in the left navigation bar [#5429](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/5429)

diff --git a/config/opensearch_dashboards.yml b/config/opensearch_dashboards.yml
@@ -276,8 +276,10 @@
 # Set the value of this setting to true to enable plugin augmentation on Dashboard
 # vis_augmenter.pluginAugmentationEnabled: true
 
+# Set the value to true to enable permission control for saved objects
+# Permission control depends on OpenSearch Dashboards has authentication enabled, set it to false when the security plugin is not installed,
+# if the security plugin is not installed and this config is true, permission control takes no effect.
+# savedObjects.permission.enabled: true
+
 # Set the value to true to enable workspace feature
 # workspace.enabled: false
-# Set the value to false to disable permission check on workspace
-# Permission check depends on OpenSearch Dashboards has authentication enabled, set it to false if no authentication is configured
-# workspace.permission.enabled: true
diff --git a/...ore/server/saved_objects/migrations/core/__snapshots__/build_active_mappings.test.ts.snap b/...ore/server/saved_objects/migrations/core/__snapshots__/build_active_mappings.test.ts.snap
diff --git a/src/core/server/saved_objects/migrations/core/build_active_mappings.test.ts b/src/core/server/saved_objects/migrations/core/build_active_mappings.test.ts
@@ -93,6 +93,12 @@ describe('buildActiveMappings', () => {
     expect(hashes.aaa).not.toEqual(hashes.ccc);
   });
 
+  test('permissions field is added when permission control flag is enabled', () => {
+    const rawConfig = configMock.create();
+    rawConfig.get.mockReturnValue(true);
+    expect(buildActiveMappings({}, rawConfig)).toHaveProperty('properties.permissions');
+  });
+
   test('workspaces field is added when workspace feature flag is enabled', () => {
     const rawConfig = configMock.create();
     rawConfig.get.mockReturnValue(true);

diff --git a/src/core/server/saved_objects/migrations/core/build_active_mappings.ts b/src/core/server/saved_objects/migrations/core/build_active_mappings.ts
@@ -56,6 +56,29 @@ export function buildActiveMappings(
 
   let mergedProperties = validateAndMerge(mapping.properties, typeDefinitions);
   // if permission control for saved objects is enabled, the permissions field should be added to the mapping
+  if (opensearchDashboardsRawConfig?.get('savedObjects.permission.enabled')) {
+    const principals: SavedObjectsFieldMapping = {
+      properties: {
+        users: {
+          type: 'keyword',
+        },
+        groups: {
+          type: 'keyword',
+        },
+      },
+    };
+    mergedProperties = validateAndMerge(mapping.properties, {
+      permissions: {
+        properties: {
+          read: principals,
+          write: principals,
+          library_read: principals,
+          library_write: principals,
+        },
+      },
+    });
+  }
+
   if (opensearchDashboardsRawConfig?.get('workspace.enabled')) {
     mergedProperties = validateAndMerge(mapping.properties, {
       workspaces: {
@@ -148,16 +171,6 @@ function findChangedProp(actual: any, expected: any) {
  * @returns {IndexMapping}
  */
 function defaultMapping(): IndexMapping {
-  const principals: SavedObjectsFieldMapping = {
-    properties: {
-      users: {
-        type: 'keyword',
-      },
-      groups: {
-        type: 'keyword',
-      },
-    },
-  };
   return {
     dynamic: 'strict',
     properties: {
@@ -196,15 +209,6 @@ function defaultMapping(): IndexMapping {
           },
         },
       },
-      permissions: {
-        properties: {
-          read: principals,
-          write: principals,
-          management: principals,
-          library_read: principals,
-          library_write: principals,
-        },
-      },
     },
   };
 }