Declare credential and *.Authorization as sensitive param in create connector API (#4308)

* Declare credential.openai_key as sensitive param in create connector API

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Do the same for headers

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Revert actions.headers

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Use automaton syntax

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Apply the same to Register Model Action

Signed-off-by: Craig Perkins <cwperx@amazon.com>

* Apply on update endpoints

Signed-off-by: Craig Perkins <cwperx@amazon.com>

---------

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Author: cwperks

plugin/src/main/java/org/opensearch/ml/rest/RestMLCreateConnectorAction.java

@@ -13,6 +13,7 @@
 import java.io.IOException;
 import java.util.List;
 import java.util.Locale;
+import java.util.Set;
 
 import org.opensearch.core.xcontent.XContentParser;
 import org.opensearch.ml.common.settings.MLFeatureEnabledSetting;
@@ -21,13 +22,14 @@
 import org.opensearch.ml.common.transport.connector.MLCreateConnectorRequest;
 import org.opensearch.rest.BaseRestHandler;
 import org.opensearch.rest.RestRequest;
+import org.opensearch.rest.RestRequestFilter;
 import org.opensearch.rest.action.RestToXContentListener;
 import org.opensearch.transport.client.node.NodeClient;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
 
-public class RestMLCreateConnectorAction extends BaseRestHandler {
+public class RestMLCreateConnectorAction extends BaseRestHandler implements RestRequestFilter {
     private static final String ML_CREATE_CONNECTOR_ACTION = "ml_create_connector_action";
     private final MLFeatureEnabledSetting mlFeatureEnabledSetting;
 
@@ -76,4 +78,9 @@ MLCreateConnectorRequest getRequest(RestRequest request) throws IOException {
         mlCreateConnectorInput.setTenantId(tenantId);
         return new MLCreateConnectorRequest(mlCreateConnectorInput);
     }
+
+    @Override
+    public Set<String> getFilteredFields() {
+        return Set.of("credential", "*.Authorization");
+    }
 }

plugin/src/main/java/org/opensearch/ml/rest/RestMLRegisterModelAction.java

@@ -17,6 +17,7 @@
 import java.io.IOException;
 import java.util.List;
 import java.util.Locale;
+import java.util.Set;
 
 import org.opensearch.cluster.service.ClusterService;
 import org.opensearch.common.settings.Settings;
@@ -28,13 +29,14 @@
 import org.opensearch.ml.common.transport.register.MLRegisterModelRequest;
 import org.opensearch.rest.BaseRestHandler;
 import org.opensearch.rest.RestRequest;
+import org.opensearch.rest.RestRequestFilter;
 import org.opensearch.rest.action.RestToXContentListener;
 import org.opensearch.transport.client.node.NodeClient;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
 
-public class RestMLRegisterModelAction extends BaseRestHandler {
+public class RestMLRegisterModelAction extends BaseRestHandler implements RestRequestFilter {
     private static final String ML_REGISTER_MODEL_ACTION = "ml_register_model_action";
     private final MLFeatureEnabledSetting mlFeatureEnabledSetting;
 
@@ -107,4 +109,9 @@ MLRegisterModelRequest getRequest(RestRequest request) throws IOException {
         }
         return new MLRegisterModelRequest(mlInput);
     }
+
+    @Override
+    public Set<String> getFilteredFields() {
+        return Set.of("connector.credential", "*.Authorization");
+    }
 }

plugin/src/main/java/org/opensearch/ml/rest/RestMLUpdateConnectorAction.java

@@ -15,6 +15,7 @@
 import java.io.IOException;
 import java.util.List;
 import java.util.Locale;
+import java.util.Set;
 
 import org.opensearch.OpenSearchParseException;
 import org.opensearch.core.xcontent.XContentParser;
@@ -23,13 +24,14 @@
 import org.opensearch.ml.common.transport.connector.MLUpdateConnectorRequest;
 import org.opensearch.rest.BaseRestHandler;
 import org.opensearch.rest.RestRequest;
+import org.opensearch.rest.RestRequestFilter;
 import org.opensearch.rest.action.RestToXContentListener;
 import org.opensearch.transport.client.node.NodeClient;
 
 import com.google.common.annotations.VisibleForTesting;
 import com.google.common.collect.ImmutableList;
 
-public class RestMLUpdateConnectorAction extends BaseRestHandler {
+public class RestMLUpdateConnectorAction extends BaseRestHandler implements RestRequestFilter {
     private static final String ML_UPDATE_CONNECTOR_ACTION = "ml_update_connector_action";
     private MLFeatureEnabledSetting mlFeatureEnabledSetting;
 
@@ -76,4 +78,9 @@ private MLUpdateConnectorRequest getRequest(RestRequest request) throws IOExcept
             throw new OpenSearchParseException(illegalStateException.getMessage());
         }
     }
+
+    @Override
+    public Set<String> getFilteredFields() {
+        return Set.of("credential", "*.Authorization");
+    }
 }

plugin/src/main/java/org/opensearch/ml/rest/RestMLUpdateModelAction.java

@@ -14,6 +14,7 @@
 import java.io.IOException;
 import java.util.List;
 import java.util.Locale;
+import java.util.Set;
 
 import org.opensearch.OpenSearchParseException;
 import org.opensearch.OpenSearchStatusException;
@@ -25,12 +26,13 @@
 import org.opensearch.ml.common.transport.model.MLUpdateModelRequest;
 import org.opensearch.rest.BaseRestHandler;
 import org.opensearch.rest.RestRequest;
+import org.opensearch.rest.RestRequestFilter;
 import org.opensearch.rest.action.RestToXContentListener;
 import org.opensearch.transport.client.node.NodeClient;
 
 import com.google.common.collect.ImmutableList;
 
-public class RestMLUpdateModelAction extends BaseRestHandler {
+public class RestMLUpdateModelAction extends BaseRestHandler implements RestRequestFilter {
 
     private static final String ML_UPDATE_MODEL_ACTION = "ml_update_model_action";
     private MLFeatureEnabledSetting mlFeatureEnabledSetting;
@@ -90,4 +92,9 @@ private MLUpdateModelRequest getRequest(RestRequest request) throws IOException
             throw new OpenSearchParseException(e.getMessage());
         }
     }
+
+    @Override
+    public Set<String> getFilteredFields() {
+        return Set.of("connector.credential", "*.Authorization");
+    }
 }