Skip to content

Commit

Permalink
Revert part of the change that made ES|QL not error out on explicitly
Browse files Browse the repository at this point in the history
missing index in the index pattern.
Adjust existing tests and add more tests.
  • Loading branch information
astefan committed Aug 21, 2024
1 parent bf1ec5d commit eac941b
Show file tree
Hide file tree
Showing 8 changed files with 425 additions and 45 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ public void testAllowedIndices() throws Exception {
.entry("values", List.of(List.of(72.0d)));
assertMap(entityAsMap(resp), matcher);
}
for (var index : List.of("index-user2", "index-user1,index-user2", "index-user*", "index*")) {
for (var index : List.of("index-user2", "index-user*", "index*")) {
Response resp = runESQLCommand("metadata1_read2", "from " + index + " | stats sum=sum(value)");
assertOK(resp);
MapMatcher matcher = responseMatcher().entry("columns", List.of(Map.of("name", "sum", "type", "double")))
Expand All @@ -170,7 +170,7 @@ public void testAllowedIndices() throws Exception {
}

public void testAliases() throws Exception {
for (var index : List.of("second-alias", "second-alias,index-user2", "second-*", "second-*,index*")) {
for (var index : List.of("second-alias", "second-*", "second-*,index*")) {
Response resp = runESQLCommand(
"alias_user2",
"from " + index + " METADATA _index" + "| stats sum=sum(value), index=VALUES(_index)"
Expand All @@ -185,7 +185,7 @@ public void testAliases() throws Exception {
}

public void testAliasFilter() throws Exception {
for (var index : List.of("first-alias", "first-alias,index-user1", "first-alias,index-*", "first-*,index-*")) {
for (var index : List.of("first-alias", "first-alias,index-*", "first-*,index-*")) {
Response resp = runESQLCommand("alias_user1", "from " + index + " METADATA _index" + "| KEEP _index, org, value | LIMIT 10");
assertOK(resp);
MapMatcher matcher = responseMatcher().entry(
Expand Down Expand Up @@ -222,18 +222,60 @@ public void testInsufficientPrivilege() {
}

public void testLimitedPrivilege() throws Exception {
Response resp = runESQLCommand("metadata1_read2", """
FROM index-user1,index-user2 METADATA _index
| STATS sum=sum(value), index=VALUES(_index)
""");
assertOK(resp);
Map<String, Object> respMap = entityAsMap(resp);
ResponseException resp = expectThrows(
ResponseException.class,
() -> runESQLCommand(
"metadata1_read2",
"FROM index-user1,index-user2 METADATA _index | STATS sum=sum(value), index=VALUES(_index)"
)
);
assertThat(
respMap.get("columns"),
equalTo(List.of(Map.of("name", "sum", "type", "double"), Map.of("name", "index", "type", "keyword")))
EntityUtils.toString(resp.getResponse().getEntity()),
containsString(
"unauthorized for user [test-admin] run as [metadata1_read2] with effective roles [metadata1_read2] on indices [index-user1]"
)
);
assertThat(resp.getResponse().getStatusLine().getStatusCode(), equalTo(HttpStatus.SC_FORBIDDEN));

resp = expectThrows(
ResponseException.class,
() -> runESQLCommand("metadata1_read2", "FROM index-user1,index-user2 | STATS sum=sum(value)")
);
assertThat(
EntityUtils.toString(resp.getResponse().getEntity()),
containsString(
"unauthorized for user [test-admin] run as [metadata1_read2] with effective roles [metadata1_read2] on indices [index-user1]"
)
);
assertThat(respMap.get("values"), equalTo(List.of(List.of(72.0, "index-user2"))));
assertThat(resp.getResponse().getStatusLine().getStatusCode(), equalTo(HttpStatus.SC_FORBIDDEN));

resp = expectThrows(
ResponseException.class,
() -> runESQLCommand("alias_user1", "FROM first-alias,index-user1 METADATA _index | KEEP _index, org, value | LIMIT 10")
);
assertThat(
EntityUtils.toString(resp.getResponse().getEntity()),
containsString(
"unauthorized for user [test-admin] run as [alias_user1] with effective roles [alias_user1] on indices [index-user1]"
)
);
assertThat(resp.getResponse().getStatusLine().getStatusCode(), equalTo(HttpStatus.SC_FORBIDDEN));

resp = expectThrows(
ResponseException.class,
() -> runESQLCommand(
"alias_user2",
"from second-alias,index-user2 METADATA _index | stats sum=sum(value), index=VALUES(_index)"
)
);
System.out.println(EntityUtils.toString(resp.getResponse().getEntity()));
assertThat(
EntityUtils.toString(resp.getResponse().getEntity()),
containsString(
"unauthorized for user [test-admin] run as [alias_user2] with effective roles [alias_user2] on indices [index-user2]"
)
);
assertThat(resp.getResponse().getStatusLine().getStatusCode(), equalTo(HttpStatus.SC_FORBIDDEN));
}

public void testDocumentLevelSecurity() throws Exception {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,13 @@
import org.elasticsearch.test.cluster.util.Version;

public class Clusters {

static final String REMOTE_CLUSTER_NAME = "remote_cluster";
static final String LOCAL_CLUSTER_NAME = "local_cluster";

public static ElasticsearchCluster remoteCluster() {
return ElasticsearchCluster.local()
.name("remote_cluster")
.name(REMOTE_CLUSTER_NAME)
.distribution(DistributionType.DEFAULT)
.version(Version.fromString(System.getProperty("tests.old_cluster_version")))
.nodes(2)
Expand All @@ -28,7 +32,7 @@ public static ElasticsearchCluster remoteCluster() {

public static ElasticsearchCluster localCluster(ElasticsearchCluster remoteCluster) {
return ElasticsearchCluster.local()
.name("local_cluster")
.name(LOCAL_CLUSTER_NAME)
.distribution(DistributionType.DEFAULT)
.version(Version.CURRENT)
.nodes(2)
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,81 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/

package org.elasticsearch.xpack.esql.ccq;

import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;

import org.apache.http.HttpHost;
import org.elasticsearch.client.RestClient;
import org.elasticsearch.core.IOUtils;
import org.elasticsearch.test.TestClustersThreadFilter;
import org.elasticsearch.test.cluster.ElasticsearchCluster;
import org.elasticsearch.xpack.esql.qa.rest.EsqlRestValidationTestCase;
import org.junit.AfterClass;
import org.junit.ClassRule;
import org.junit.rules.RuleChain;
import org.junit.rules.TestRule;

import java.io.IOException;
import java.util.StringJoiner;

import static org.elasticsearch.xpack.esql.ccq.Clusters.REMOTE_CLUSTER_NAME;

@ThreadLeakFilters(filters = TestClustersThreadFilter.class)
public class EsqlRestValidationIT extends EsqlRestValidationTestCase {
static ElasticsearchCluster remoteCluster = Clusters.remoteCluster();
static ElasticsearchCluster localCluster = Clusters.localCluster(remoteCluster);

@ClassRule
public static TestRule clusterRule = RuleChain.outerRule(remoteCluster).around(localCluster);
private static RestClient remoteClient;

@Override
protected String getTestRestCluster() {
return localCluster.getHttpAddresses();
}

@AfterClass
public static void closeRemoteClients() throws IOException {
try {
IOUtils.close(remoteClient);
} finally {
remoteClient = null;
}
}

@Override
protected String clusterSpecificIndexName(String pattern) {
StringJoiner sj = new StringJoiner(",");
for (String index : pattern.split(",")) {
sj.add(remoteClusterIndex(index));
}
return sj.toString();
}

private static String remoteClusterIndex(String indexName) {
return REMOTE_CLUSTER_NAME + ":" + indexName;
}

@Override
protected RestClient provisioningClient() throws IOException {
return remoteClusterClient();
}

@Override
protected RestClient provisioningAdminClient() throws IOException {
return remoteClusterClient();
}

private RestClient remoteClusterClient() throws IOException {
if (remoteClient == null) {
var clusterHosts = parseClusterHosts(remoteCluster.getHttpAddresses());
remoteClient = buildClient(restClientSettings(), clusterHosts.toArray(new HttpHost[0]));
}
return remoteClient;
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/

package org.elasticsearch.xpack.esql.qa.multi_node;

import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;

import org.elasticsearch.test.TestClustersThreadFilter;
import org.elasticsearch.test.cluster.ElasticsearchCluster;
import org.elasticsearch.xpack.esql.qa.rest.EsqlRestValidationTestCase;
import org.junit.ClassRule;

@ThreadLeakFilters(filters = TestClustersThreadFilter.class)
public class EsqlRestValidationIT extends EsqlRestValidationTestCase {

@ClassRule
public static ElasticsearchCluster cluster = Clusters.testCluster(spec -> {});

@Override
protected String getTestRestCluster() {
return cluster.getHttpAddresses();
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
/*
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
* or more contributor license agreements. Licensed under the Elastic License
* 2.0; you may not use this file except in compliance with the Elastic License
* 2.0.
*/

package org.elasticsearch.xpack.esql.qa.single_node;

import com.carrotsearch.randomizedtesting.annotations.ThreadLeakFilters;

import org.elasticsearch.test.TestClustersThreadFilter;
import org.elasticsearch.test.cluster.ElasticsearchCluster;
import org.elasticsearch.xpack.esql.qa.rest.EsqlRestValidationTestCase;
import org.junit.ClassRule;

@ThreadLeakFilters(filters = TestClustersThreadFilter.class)
public class EsqlRestValidationIT extends EsqlRestValidationTestCase {

@ClassRule
public static ElasticsearchCluster cluster = Clusters.testCluster();

@Override
protected String getTestRestCluster() {
return cluster.getHttpAddresses();
}
}
Loading

0 comments on commit eac941b

Please sign in to comment.