Api token authc/z implementation with Cache

src/integrationTest/java/org/opensearch/security/privileges/ActionPrivilegesTest.java

@@ -38,14 +38,20 @@
 import org.opensearch.common.util.concurrent.ThreadContext;
 import org.opensearch.core.common.unit.ByteSizeUnit;
 import org.opensearch.core.common.unit.ByteSizeValue;
+import org.opensearch.security.action.apitokens.ApiToken;
+import org.opensearch.security.action.apitokens.ApiTokenRepository;
+import org.opensearch.security.action.apitokens.Permissions;
 import org.opensearch.security.resolver.IndexResolverReplacer;
 import org.opensearch.security.securityconf.FlattenedActionGroups;
 import org.opensearch.security.securityconf.impl.CType;
 import org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration;
+import org.opensearch.security.securityconf.impl.v7.ActionGroupsV7;
 import org.opensearch.security.securityconf.impl.v7.RoleV7;
 import org.opensearch.security.user.User;
 import org.opensearch.security.util.MockIndexMetadataBuilder;
 
+import org.mockito.Mockito;
+
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.opensearch.security.privileges.PrivilegeEvaluatorResponseMatcher.isAllowed;
 import static org.opensearch.security.privileges.PrivilegeEvaluatorResponseMatcher.isForbidden;
@@ -57,6 +63,7 @@
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
 
 /**
  * Unit tests for ActionPrivileges. As the ActionPrivileges provides quite a few different code paths for checking
@@ -280,6 +287,63 @@ public void hasAny_wildcard() throws Exception {
                 isForbidden(missingPrivileges("cluster:whatever"))
             );
         }
+
+        @Test
+        public void apiToken_explicit_failsWithWildcard() throws Exception {
+            SecurityDynamicConfiguration<RoleV7> roles = SecurityDynamicConfiguration.empty(CType.ROLES);
+            ActionPrivileges subject = new ActionPrivileges(roles, FlattenedActionGroups.EMPTY, null, Settings.EMPTY);
+            String token = "blah";
+            PrivilegesEvaluationContext context = ctxForApiToken("apitoken:" + token, new Permissions(List.of("*"), List.of()));
+            // Explicit fails
+            assertThat(
+                subject.hasExplicitClusterPrivilege(context, "cluster:whatever"),
+                isForbidden(missingPrivileges("cluster:whatever"))
+            );
+            // Not explicit succeeds
+            assertThat(subject.hasClusterPrivilege(context, "cluster:whatever"), isAllowed());
+            // Any succeeds
+            assertThat(subject.hasAnyClusterPrivilege(context, ImmutableSet.of("cluster:whatever")), isAllowed());
+        }
+
+        @Test
+        public void apiToken_succeedsWithExactMatch() throws Exception {
+            SecurityDynamicConfiguration<RoleV7> roles = SecurityDynamicConfiguration.empty(CType.ROLES);
+            ActionPrivileges subject = new ActionPrivileges(roles, FlattenedActionGroups.EMPTY, null, Settings.EMPTY);
+            String token = "blah";
+            PrivilegesEvaluationContext context = ctxForApiToken(
+                "apitoken:" + token,
+                new Permissions(List.of("cluster:whatever"), List.of())
+            );
+            // Explicit succeeds
+            assertThat(subject.hasExplicitClusterPrivilege(context, "cluster:whatever"), isAllowed());
+            // Not explicit succeeds
+            assertThat(subject.hasClusterPrivilege(context, "cluster:whatever"), isAllowed());
+            // Any succeeds
+            assertThat(subject.hasAnyClusterPrivilege(context, ImmutableSet.of("cluster:whatever")), isAllowed());
+            // Any succeeds
+            assertThat(subject.hasAnyClusterPrivilege(context, ImmutableSet.of("cluster:whatever", "cluster:other")), isAllowed());
+        }
+
+        @Test
+        public void apiToken_succeedsWithActionGroupsExapnded() throws Exception {
+            SecurityDynamicConfiguration<RoleV7> roles = SecurityDynamicConfiguration.empty(CType.ROLES);
+
+            SecurityDynamicConfiguration<ActionGroupsV7> config = SecurityDynamicConfiguration.fromYaml(
+                "CLUSTER_ALL:\n  allowed_actions:\n    - \"cluster:*\"",
+                CType.ACTIONGROUPS
+            );
+
+            FlattenedActionGroups actionGroups = new FlattenedActionGroups(config);
+            ActionPrivileges subject = new ActionPrivileges(roles, actionGroups, null, Settings.EMPTY);
+            String token = "blah";
+            PrivilegesEvaluationContext context = ctxForApiToken("apitoken:" + token, new Permissions(List.of("CLUSTER_ALL"), List.of()));
+            // Explicit succeeds
+            assertThat(subject.hasExplicitClusterPrivilege(context, "cluster:whatever"), isAllowed());
+            // Not explicit succeeds
+            assertThat(subject.hasClusterPrivilege(context, "cluster:whatever"), isAllowed());
+            // Any succeeds
+            assertThat(subject.hasClusterPrivilege(context, "cluster:monitor/main"), isAllowed());
+        }
     }
 
     /**
@@ -314,6 +378,17 @@ public void positive_full() throws Exception {
                 assertThat(result, isAllowed());
             }
 
+            @Test
+            public void apiTokens_positive_full() throws Exception {
+                String token = "blah";
+                PrivilegesEvaluationContext context = ctxForApiToken(
+                    "apitoken:" + token,
+                    new Permissions(List.of("index_a11"), List.of(new ApiToken.IndexPermission(List.of("index_a11"), List.of("*"))))
+                );
+                PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(context, requiredActions, resolved("index_a11"));
+                assertThat(result, isAllowed());
+            }
+
             @Test
             public void positive_partial() throws Exception {
                 PrivilegesEvaluationContext ctx = ctx("test_role");
@@ -368,6 +443,18 @@ public void negative_wrongRole() throws Exception {
                 assertThat(result, isForbidden(missingPrivileges(requiredActions)));
             }
 
+            @Test
+            public void apiToken_negative_noPermissions() throws Exception {
+                String token = "blah";
+                PrivilegesEvaluationContext context = ctxForApiToken(
+                    "apitoken:" + token,
+                    new Permissions(List.of(), List.of(new ApiToken.IndexPermission(List.of(), List.of())))
+                );
+
+                PrivilegesEvaluatorResponse result = subject.hasIndexPrivilege(context, requiredActions, resolved("index_a11"));
+                assertThat(result, isForbidden(missingPrivileges(requiredActions)));
+            }
+
             @Test
             public void negative_wrongAction() throws Exception {
                 PrivilegesEvaluationContext ctx = ctx("test_role");
@@ -397,6 +484,20 @@ public void positive_hasExplicit_full() {
                 }
             }
 
+            @Test
+            public void apiTokens_positive_hasExplicit_full() {
+                String token = "blah";
+                PrivilegesEvaluationContext context = ctxForApiToken(
+                    "apitoken:" + token,
+                    new Permissions(List.of("index_a11"), List.of(new ApiToken.IndexPermission(List.of("index_a11"), List.of("*"))))
+                );
+
+                PrivilegesEvaluatorResponse result = subject.hasExplicitIndexPrivilege(context, requiredActions, resolved("index_a11"));
+
+                assertThat(result, isForbidden(missingPrivileges(requiredActions)));
+
+            }
+
             private boolean covers(PrivilegesEvaluationContext ctx, String... indices) {
                 for (String index : indices) {
                     if (!indexSpec.covers(ctx.getUser(), index)) {
@@ -1040,8 +1141,13 @@ static SecurityDynamicConfiguration<RoleV7> createRoles(int numberOfRoles, int n
     }
 
     static PrivilegesEvaluationContext ctx(String... roles) {
-        User user = new User("test_user");
+        return ctxWithUserName("test-user", roles);
+    }
+
+    static PrivilegesEvaluationContext ctxWithUserName(String userName, String... roles) {
+        User user = new User(userName);
         user.addAttributes(ImmutableMap.of("attrs.dept_no", "a11"));
+        ApiTokenRepository mockRepository = Mockito.mock(ApiTokenRepository.class);
         return new PrivilegesEvaluationContext(
             user,
             ImmutableSet.copyOf(roles),
@@ -1050,7 +1156,25 @@ static PrivilegesEvaluationContext ctx(String... roles) {
             null,
             null,
             new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY)),
-            null
+            null,
+            mock(ApiTokenRepository.class)
+        );
+    }
+
+    static PrivilegesEvaluationContext ctxForApiToken(String userName, Permissions permissions) {
+        User user = new User(userName);
+        user.addAttributes(ImmutableMap.of("attrs.dept_no", "a11"));
+        ApiTokenRepository mockRepository = Mockito.mock(ApiTokenRepository.class);
+        return new PrivilegesEvaluationContext(
+            user,
+            ImmutableSet.of(),
+            null,
+            null,
+            null,
+            null,
+            new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY)),
+            null,
+            permissions
         );
     }
 
@@ -1065,7 +1189,8 @@ static PrivilegesEvaluationContext ctxByUsername(String username) {
             null,
             null,
             new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY)),
-            null
+            null,
+            mock(ApiTokenRepository.class)
         );
     }
 }

src/integrationTest/java/org/opensearch/security/privileges/IndexPatternTest.java

@@ -22,6 +22,7 @@
 import org.opensearch.cluster.metadata.Metadata;
 import org.opensearch.common.settings.Settings;
 import org.opensearch.common.util.concurrent.ThreadContext;
+import org.opensearch.security.action.apitokens.ApiTokenRepository;
 import org.opensearch.security.resolver.IndexResolverReplacer;
 import org.opensearch.security.support.WildcardMatcher;
 import org.opensearch.security.user.User;
@@ -31,6 +32,7 @@
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotEquals;
 import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
 
 public class IndexPatternTest {
     final static int CURRENT_YEAR = ZonedDateTime.now().get(ChronoField.YEAR);
@@ -246,7 +248,8 @@ private static PrivilegesEvaluationContext ctx() {
             null,
             indexResolverReplacer,
             indexNameExpressionResolver,
-            () -> CLUSTER_STATE
+            () -> CLUSTER_STATE,
+            mock(ApiTokenRepository.class)
         );
     }
 }

src/integrationTest/java/org/opensearch/security/privileges/RestEndpointPermissionTests.java

@@ -44,6 +44,7 @@
 
 import org.opensearch.common.settings.Settings;
 import org.opensearch.security.DefaultObjectMapper;
+import org.opensearch.security.action.apitokens.ApiTokenRepository;
 import org.opensearch.security.dlic.rest.api.Endpoint;
 import org.opensearch.security.dlic.rest.api.RestApiAdminPrivilegesEvaluator.PermissionBuilder;
 import org.opensearch.security.securityconf.FlattenedActionGroups;
@@ -56,6 +57,7 @@
 import static org.opensearch.security.dlic.rest.api.RestApiAdminPrivilegesEvaluator.ENDPOINTS_WITH_PERMISSIONS;
 import static org.opensearch.security.dlic.rest.api.RestApiAdminPrivilegesEvaluator.RELOAD_CERTS_ACTION;
 import static org.opensearch.security.dlic.rest.api.RestApiAdminPrivilegesEvaluator.SECURITY_CONFIG_UPDATE;
+import static org.mockito.Mockito.mock;
 
 /**
  * Moved from https://github.com/opensearch-project/security/blob/54361468f5c4b3a57f3ecffaf1bbe8dccee562be/src/test/java/org/opensearch/security/securityconf/SecurityRolesPermissionsTest.java
@@ -251,7 +253,17 @@ static SecurityDynamicConfiguration<RoleV7> createRolesConfig() throws IOExcepti
     }
 
     static PrivilegesEvaluationContext ctx(String... roles) {
-        return new PrivilegesEvaluationContext(new User("test_user"), ImmutableSet.copyOf(roles), null, null, null, null, null, null);
+        return new PrivilegesEvaluationContext(
+            new User("test_user"),
+            ImmutableSet.copyOf(roles),
+            null,
+            null,
+            null,
+            null,
+            null,
+            null,
+            mock(ApiTokenRepository.class)
+        );
     }
 
 }

src/integrationTest/java/org/opensearch/security/privileges/dlsfls/DlsFlsLegacyHeadersTest.java

@@ -35,6 +35,7 @@
 import org.opensearch.index.query.RangeQueryBuilder;
 import org.opensearch.index.query.TermQueryBuilder;
 import org.opensearch.search.internal.ShardSearchRequest;
+import org.opensearch.security.action.apitokens.ApiTokenRepository;
 import org.opensearch.security.privileges.PrivilegesEvaluationContext;
 import org.opensearch.security.securityconf.impl.SecurityDynamicConfiguration;
 import org.opensearch.security.securityconf.impl.v7.RoleV7;
@@ -55,6 +56,7 @@
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
 
 public class DlsFlsLegacyHeadersTest {
     static NamedXContentRegistry xContentRegistry = new NamedXContentRegistry(
@@ -255,11 +257,11 @@ public void performHeaderDecoration_oldNode() throws Exception {
         Metadata metadata = exampleMetadata();
         DlsFlsProcessedConfig dlsFlsProcessedConfig = dlsFlsProcessedConfig(exampleRolesConfig(), metadata);
 
-        Transport.Connection connection = Mockito.mock(Transport.Connection.class);
+        Transport.Connection connection = mock(Transport.Connection.class);
         Mockito.when(connection.getVersion()).thenReturn(Version.V_2_0_0);
 
         // ShardSearchRequest does not extend ActionRequest, thus the headers must be set
-        ShardSearchRequest request = Mockito.mock(ShardSearchRequest.class);
+        ShardSearchRequest request = mock(ShardSearchRequest.class);
 
         Map<String, String> headerSink = new HashMap<>();
 
@@ -277,7 +279,7 @@ public void performHeaderDecoration_actionRequest() throws Exception {
         Metadata metadata = exampleMetadata();
         DlsFlsProcessedConfig dlsFlsProcessedConfig = dlsFlsProcessedConfig(exampleRolesConfig(), metadata);
 
-        Transport.Connection connection = Mockito.mock(Transport.Connection.class);
+        Transport.Connection connection = mock(Transport.Connection.class);
         Mockito.when(connection.getVersion()).thenReturn(Version.V_2_0_0);
 
         // SearchRequest does extend ActionRequest, thus the headers must not be set
@@ -296,11 +298,11 @@ public void performHeaderDecoration_newNode() throws Exception {
         Metadata metadata = exampleMetadata();
         DlsFlsProcessedConfig dlsFlsProcessedConfig = dlsFlsProcessedConfig(exampleRolesConfig(), metadata);
 
-        Transport.Connection connection = Mockito.mock(Transport.Connection.class);
+        Transport.Connection connection = mock(Transport.Connection.class);
         Mockito.when(connection.getVersion()).thenReturn(Version.V_3_0_0);
 
         // ShardSearchRequest does not extend ActionRequest, thus the headers must be set
-        ShardSearchRequest request = Mockito.mock(ShardSearchRequest.class);
+        ShardSearchRequest request = mock(ShardSearchRequest.class);
 
         Map<String, String> headerSink = new HashMap<>();
 
@@ -345,7 +347,8 @@ public void prepare_ccs() throws Exception {
             null,
             null,
             new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY)),
-            () -> clusterState
+            () -> clusterState,
+            mock(ApiTokenRepository.class)
         );
 
         DlsFlsLegacyHeaders.prepare(threadContext, ctx, dlsFlsProcessedConfig(exampleRolesConfig(), metadata), metadata, false);
@@ -364,7 +367,8 @@ static PrivilegesEvaluationContext ctx(Metadata metadata, String... roles) {
             null,
             null,
             new IndexNameExpressionResolver(new ThreadContext(Settings.EMPTY)),
-            () -> clusterState
+            () -> clusterState,
+            mock(ApiTokenRepository.class)
         );
     }