Skip to content

Commit e7109db

Browse files
DarshitChanpuraDarshitChanpura
committed
Adds test for Share API
Signed-off-by: Darshit Chanpura <dchanp@amazon.com>
1 parent 7ab5686 commit e7109db

File tree

2 files changed

+334
-1
lines changed

2 files changed

+334
-1
lines changed

‎sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/ShareApiTests.java‎

Lines changed: 236 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,236 @@
1+
/*
2+
* SPDX-License-Identifier: Apache-2.0
3+
*
4+
* The OpenSearch Contributors require contributions made to
5+
* this file be licensed under the Apache-2.0 license or a
6+
* compatible open source license.
7+
*/
8+
9+
package org.opensearch.sample.resource;
10+
11+
import java.util.HashMap;
12+
import java.util.HashSet;
13+
import java.util.List;
14+
import java.util.Map;
15+
import java.util.Set;
16+
17+
import com.carrotsearch.randomizedtesting.RandomizedRunner;
18+
import com.carrotsearch.randomizedtesting.annotations.ThreadLeakScope;
19+
import org.apache.http.HttpStatus;
20+
import org.junit.After;
21+
import org.junit.Before;
22+
import org.junit.ClassRule;
23+
import org.junit.Test;
24+
import org.junit.runner.RunWith;
25+
import org.junit.runners.Suite;
26+
27+
import org.opensearch.Version;
28+
import org.opensearch.painless.PainlessModulePlugin;
29+
import org.opensearch.plugins.PluginInfo;
30+
import org.opensearch.sample.SampleResourcePlugin;
31+
import org.opensearch.security.OpenSearchSecurityPlugin;
32+
import org.opensearch.security.spi.resources.sharing.Recipient;
33+
import org.opensearch.security.spi.resources.sharing.Recipients;
34+
import org.opensearch.test.framework.cluster.ClusterManager;
35+
import org.opensearch.test.framework.cluster.LocalCluster;
36+
import org.opensearch.test.framework.cluster.TestRestClient;
37+
38+
import static org.hamcrest.MatcherAssert.assertThat;
39+
import static org.hamcrest.Matchers.containsString;
40+
import static org.hamcrest.Matchers.equalTo;
41+
import static org.hamcrest.Matchers.not;
42+
import static org.opensearch.sample.resource.TestHelper.FULL_ACCESS_USER;
43+
import static org.opensearch.sample.resource.TestHelper.LIMITED_ACCESS_USER;
44+
import static org.opensearch.sample.resource.TestHelper.NO_ACCESS_USER;
45+
import static org.opensearch.sample.resource.TestHelper.RESOURCE_SHARING_INDEX;
46+
import static org.opensearch.sample.resource.TestHelper.SECURITY_SHARE_ENDPOINT;
47+
import static org.opensearch.sample.resource.TestHelper.putSharingInfoPayload;
48+
import static org.opensearch.sample.resource.TestHelper.sampleAllAG;
49+
import static org.opensearch.sample.resource.TestHelper.sampleReadOnlyAG;
50+
import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
51+
import static org.opensearch.security.spi.resources.FeatureConfigConstants.OPENSEARCH_RESOURCE_SHARING_ENABLED;
52+
import static org.opensearch.security.support.ConfigConstants.SECURITY_SYSTEM_INDICES_ENABLED_KEY;
53+
import static org.opensearch.test.framework.TestSecurityConfig.AuthcDomain.AUTHC_HTTPBASIC_INTERNAL;
54+
import static org.opensearch.test.framework.TestSecurityConfig.User.USER_ADMIN;
55+
56+
/**
57+
* This test file tests the share API defined by the security plugin.
58+
* Resource access control feature and system index protection are assumed to be enabled
59+
*/
60+
@RunWith(Suite.class)
61+
@Suite.SuiteClasses({ ShareApiTests.RoutesTests.class })
62+
public class ShareApiTests {
63+
/**
64+
* Base test class providing shared cluster setup and teardown
65+
*/
66+
public static abstract class BaseTests {
67+
@ClassRule
68+
public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.SINGLENODE)
69+
.plugin(
70+
new PluginInfo(
71+
SampleResourcePlugin.class.getName(),
72+
"classpath plugin",
73+
"NA",
74+
Version.CURRENT,
75+
"1.8",
76+
SampleResourcePlugin.class.getName(),
77+
null,
78+
List.of(OpenSearchSecurityPlugin.class.getName()),
79+
false
80+
)
81+
)
82+
.plugin(PainlessModulePlugin.class)
83+
.anonymousAuth(true)
84+
.authc(AUTHC_HTTPBASIC_INTERNAL)
85+
.users(USER_ADMIN, FULL_ACCESS_USER, LIMITED_ACCESS_USER, NO_ACCESS_USER)
86+
.actionGroups(sampleReadOnlyAG, sampleAllAG)
87+
.nodeSettings(Map.of(OPENSEARCH_RESOURCE_SHARING_ENABLED, true, SECURITY_SYSTEM_INDICES_ENABLED_KEY, true))
88+
.build();
89+
90+
@After
91+
public void clearIndices() {
92+
try (TestRestClient client = cluster.getRestClient(cluster.getAdminCertificate())) {
93+
client.delete(RESOURCE_INDEX_NAME);
94+
client.delete(RESOURCE_SHARING_INDEX);
95+
}
96+
}
97+
}
98+
99+
/**
100+
* Tests exercising the share API endpoints, GET, PUT & PATCH
101+
*/
102+
@RunWith(RandomizedRunner.class)
103+
@ThreadLeakScope(ThreadLeakScope.Scope.NONE)
104+
public static class RoutesTests extends BaseTests {
105+
private final TestHelper.ApiHelper api = new TestHelper.ApiHelper(cluster);
106+
private String adminResId;
107+
108+
@Before
109+
public void setup() {
110+
adminResId = api.createSampleResourceAs(USER_ADMIN);
111+
api.awaitSharingEntry();
112+
}
113+
114+
@Test
115+
public void testPutSharingInfo() {
116+
// non-permission user cannot share resource
117+
try (TestRestClient client = cluster.getRestClient(LIMITED_ACCESS_USER)) {
118+
TestRestClient.HttpResponse response = client.putJson(
119+
SECURITY_SHARE_ENDPOINT,
120+
putSharingInfoPayload(adminResId, RESOURCE_INDEX_NAME, sampleReadOnlyAG.name(), NO_ACCESS_USER.getName())
121+
);
122+
response.assertStatusCode(HttpStatus.SC_FORBIDDEN);
123+
}
124+
125+
// a sharing entry should be created successfully since admin has access to share API
126+
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
127+
TestRestClient.HttpResponse response = client.putJson(
128+
SECURITY_SHARE_ENDPOINT,
129+
putSharingInfoPayload(adminResId, RESOURCE_INDEX_NAME, sampleAllAG.name(), LIMITED_ACCESS_USER.getName())
130+
);
131+
response.assertStatusCode(HttpStatus.SC_OK);
132+
assertThat(response.getBody(), containsString(LIMITED_ACCESS_USER.getName()));
133+
assertThat(response.getBody(), not(containsString(NO_ACCESS_USER.getName())));
134+
}
135+
136+
// non-permission user will now have access to directly call share API
137+
try (TestRestClient client = cluster.getRestClient(LIMITED_ACCESS_USER)) {
138+
TestRestClient.HttpResponse response = client.putJson(
139+
SECURITY_SHARE_ENDPOINT,
140+
putSharingInfoPayload(adminResId, RESOURCE_INDEX_NAME, sampleReadOnlyAG.name(), NO_ACCESS_USER.getName())
141+
);
142+
response.assertStatusCode(HttpStatus.SC_OK);
143+
assertThat(response.getBody(), containsString(NO_ACCESS_USER.getName()));
144+
}
145+
}
146+
147+
@Test
148+
public void testGetSharingInfo() {
149+
// non-permission user cannot list shared resources,
150+
try (TestRestClient client = cluster.getRestClient(FULL_ACCESS_USER)) {
151+
TestRestClient.HttpResponse response = client.get(
152+
SECURITY_SHARE_ENDPOINT + "?resource_id=" + adminResId + "&resource_index=" + RESOURCE_INDEX_NAME
153+
);
154+
response.assertStatusCode(HttpStatus.SC_FORBIDDEN);
155+
}
156+
157+
// a sharing entry should be created successfully since admin has access to share API
158+
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
159+
TestRestClient.HttpResponse response = client.putJson(
160+
SECURITY_SHARE_ENDPOINT,
161+
putSharingInfoPayload(adminResId, RESOURCE_INDEX_NAME, sampleAllAG.name(), FULL_ACCESS_USER.getName())
162+
);
163+
response.assertStatusCode(HttpStatus.SC_OK);
164+
assertThat(response.getBody(), containsString(FULL_ACCESS_USER.getName()));
165+
}
166+
167+
// non-permission user can now list shared_with resources by calling share API
168+
try (TestRestClient client = cluster.getRestClient(FULL_ACCESS_USER)) {
169+
TestRestClient.HttpResponse response = client.get(
170+
SECURITY_SHARE_ENDPOINT + "?resource_id=" + adminResId + "&resource_index=" + RESOURCE_INDEX_NAME
171+
);
172+
response.assertStatusCode(HttpStatus.SC_OK);
173+
assertThat(response.bodyAsJsonNode().get("sharing_info").get("resource_id").asText(), equalTo(adminResId));
174+
}
175+
}
176+
177+
@Test
178+
public void testPatchSharingInfo() {
179+
Map<Recipient, Set<String>> recs = new HashMap<>();
180+
Set<String> users = new HashSet<>();
181+
users.add(FULL_ACCESS_USER.getName());
182+
recs.put(Recipient.USERS, users);
183+
Recipients recipients = new Recipients(recs);
184+
185+
TestHelper.PatchSharingInfoPayloadBuilder patchSharingInfoPayloadBuilder = new TestHelper.PatchSharingInfoPayloadBuilder();
186+
patchSharingInfoPayloadBuilder.resourceId(adminResId).resourceIndex(RESOURCE_INDEX_NAME).share(recipients, sampleAllAG.name());
187+
188+
// full-access user cannot share with itself since user doesn't have permission to share
189+
try (TestRestClient client = cluster.getRestClient(FULL_ACCESS_USER)) {
190+
TestRestClient.HttpResponse response = client.patch(SECURITY_SHARE_ENDPOINT, patchSharingInfoPayloadBuilder.build());
191+
response.assertStatusCode(HttpStatus.SC_FORBIDDEN);
192+
}
193+
194+
// a sharing entry should be created successfully since admin has access to share API
195+
try (TestRestClient client = cluster.getRestClient(USER_ADMIN)) {
196+
TestRestClient.HttpResponse response = client.patch(SECURITY_SHARE_ENDPOINT, patchSharingInfoPayloadBuilder.build());
197+
response.assertStatusCode(HttpStatus.SC_OK);
198+
assertThat(response.getBody(), containsString(FULL_ACCESS_USER.getName()));
199+
}
200+
201+
// limited access user will not be able to call patch endpoint
202+
try (TestRestClient client = cluster.getRestClient(LIMITED_ACCESS_USER)) {
203+
TestRestClient.HttpResponse response = client.patch(SECURITY_SHARE_ENDPOINT, patchSharingInfoPayloadBuilder.build());
204+
response.assertStatusCode(HttpStatus.SC_FORBIDDEN);
205+
}
206+
207+
// full-access user will now be able to patch and grant access to limited access user
208+
// they can also shoot themselves in the foot and remove own access
209+
try (TestRestClient client = cluster.getRestClient(FULL_ACCESS_USER)) {
210+
// add limited user
211+
users.add(LIMITED_ACCESS_USER.getName());
212+
patchSharingInfoPayloadBuilder.share(recipients, sampleAllAG.name());
213+
// remove self
214+
Set<String> revokedUsers = new HashSet<>();
215+
revokedUsers.add(FULL_ACCESS_USER.getName());
216+
recs.put(Recipient.USERS, revokedUsers);
217+
recipients = new Recipients(recs);
218+
patchSharingInfoPayloadBuilder.revoke(recipients, sampleAllAG.name());
219+
220+
TestRestClient.HttpResponse response = client.patch(SECURITY_SHARE_ENDPOINT, patchSharingInfoPayloadBuilder.build());
221+
response.assertStatusCode(HttpStatus.SC_OK);
222+
}
223+
224+
// limited access user will now be able to call patch endpoint, but full-access won't
225+
try (TestRestClient client = cluster.getRestClient(LIMITED_ACCESS_USER)) {
226+
TestRestClient.HttpResponse response = client.patch(SECURITY_SHARE_ENDPOINT, patchSharingInfoPayloadBuilder.build());
227+
response.assertStatusCode(HttpStatus.SC_OK);
228+
}
229+
try (TestRestClient client = cluster.getRestClient(FULL_ACCESS_USER)) {
230+
TestRestClient.HttpResponse response = client.patch(SECURITY_SHARE_ENDPOINT, patchSharingInfoPayloadBuilder.build());
231+
response.assertStatusCode(HttpStatus.SC_FORBIDDEN);
232+
}
233+
}
234+
}
235+
236+
}

‎sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/TestHelper.java‎

Lines changed: 98 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,20 @@
88

99
package org.opensearch.sample.resource;
1010

11+
import java.io.IOException;
1112
import java.time.Duration;
13+
import java.util.ArrayList;
14+
import java.util.HashMap;
15+
import java.util.List;
16+
import java.util.Map;
1217

1318
import org.apache.http.HttpStatus;
1419
import org.awaitility.Awaitility;
1520

21+
import org.opensearch.common.xcontent.XContentFactory;
22+
import org.opensearch.core.xcontent.ToXContent;
23+
import org.opensearch.core.xcontent.XContentBuilder;
24+
import org.opensearch.security.spi.resources.sharing.Recipients;
1625
import org.opensearch.test.framework.TestSecurityConfig;
1726
import org.opensearch.test.framework.certificate.CertificateData;
1827
import org.opensearch.test.framework.cluster.LocalCluster;
@@ -60,7 +69,8 @@ public final class TestHelper {
6069
"sample_plugin_index_all_access",
6170
TestSecurityConfig.ActionGroup.Type.INDEX,
6271
"indices:*",
63-
"cluster:admin/sample-resource-plugin/*"
72+
"cluster:admin/sample-resource-plugin/*",
73+
"cluster:admin/security/resource/share"
6474
);
6575

6676
public static final String SAMPLE_RESOURCE_CREATE_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/create";
@@ -71,6 +81,7 @@ public final class TestHelper {
7181
public static final String SAMPLE_RESOURCE_REVOKE_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/revoke";
7282

7383
static final String RESOURCE_SHARING_MIGRATION_ENDPOINT = "_plugins/_security/api/resources/migrate";
84+
static final String SECURITY_SHARE_ENDPOINT = "_plugins/_security/api/resource/share";
7485

7586
static String shareWithPayload(String user, String accessLevel) {
7687
return """
@@ -161,6 +172,92 @@ static String migrationPayload_missingBackendRoles() {
161172
""".formatted(RESOURCE_INDEX_NAME, "user/name");
162173
}
163174

175+
static String putSharingInfoPayload(String resourceId, String resourceIndex, String accessLevel, String user) {
176+
return """
177+
{
178+
"resource_id": "%s",
179+
"resource_index": "%s",
180+
"share_with": {
181+
"%s" : {
182+
"users": ["%s"]
183+
}
184+
}
185+
}
186+
""".formatted(resourceId, resourceIndex, accessLevel, user);
187+
}
188+
189+
public static class PatchSharingInfoPayloadBuilder {
190+
private String resourceId;
191+
private String resourceIndex;
192+
private final Map<String, Recipients> share = new HashMap<>();
193+
private final Map<String, Recipients> revoke = new HashMap<>();
194+
195+
public PatchSharingInfoPayloadBuilder resourceId(String resourceId) {
196+
this.resourceId = resourceId;
197+
return this;
198+
}
199+
200+
public PatchSharingInfoPayloadBuilder resourceIndex(String resourceIndex) {
201+
this.resourceIndex = resourceIndex;
202+
return this;
203+
}
204+
205+
public void share(Recipients recipients, String accessLevel) {
206+
Recipients existing = share.getOrDefault(accessLevel, new Recipients(new HashMap<>()));
207+
existing.share(recipients);
208+
share.put(accessLevel, existing);
209+
}
210+
211+
public void revoke(Recipients recipients, String accessLevel) {
212+
Recipients existing = revoke.getOrDefault(accessLevel, new Recipients(new HashMap<>()));
213+
// intentionally share() is called here since we are building a shareWith object, this final object will be used to remove
214+
// access
215+
// think of it as currentShareWith.removeAll(revokeShareWith)
216+
existing.share(recipients);
217+
revoke.put(accessLevel, existing);
218+
}
219+
220+
private String buildJsonString(Map<String, Recipients> input) {
221+
222+
List<String> output = new ArrayList<>();
223+
for (Map.Entry<String, Recipients> entry : input.entrySet()) {
224+
try {
225+
XContentBuilder builder = XContentFactory.jsonBuilder();
226+
entry.getValue().toXContent(builder, ToXContent.EMPTY_PARAMS);
227+
String recipJson = builder.toString();
228+
output.add("""
229+
"%s" : %s
230+
""".formatted(entry.getKey(), recipJson));
231+
} catch (IOException e) {
232+
throw new RuntimeException(e);
233+
}
234+
235+
}
236+
237+
return String.join(",", output);
238+
239+
}
240+
241+
public String build() {
242+
String allShares = buildJsonString(share);
243+
String allRevokes = buildJsonString(revoke);
244+
return """
245+
{
246+
"resource_id": "%s",
247+
"resource_index": "%s",
248+
"patch":{
249+
"share_with": {
250+
%s
251+
},
252+
"revoke": {
253+
%s
254+
}
255+
}
256+
}
257+
""".formatted(resourceId, resourceIndex, allShares, allRevokes);
258+
}
259+
}
260+
164261
public static class ApiHelper {
165262
private final LocalCluster cluster;
166263

0 commit comments

Comments
 (0)