Skip to content

Commit 3946eb8

Browse files
DarshitChanpuraDarshitChanpura
authored
Implement DocRequest on notification config and alerting request classes (#980)
* Implement DocRequest on notification config request classes Enables the security plugin's ResourceAccessEvaluator to automatically intercept and authorize GET, UPDATE, DELETE operations on protected notification_config resources at the transport layer. - GetNotificationConfigRequest: returns id() for single-ID requests, null for search/multi-ID (DLS handles those) - UpdateNotificationConfigRequest: returns configId - DeleteNotificationConfigRequest: returns id() for single-ID deletes, null for multi-ID - Added CONFIG_INDEX_NAME constant to NotificationConstants Note: CreateNotificationConfigRequest is NOT marked as DocRequest since create operations don't access existing resources — the security plugin's ResourceIndexListener handles ownership registration automatically on index write. Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Implement DocRequest on notification and alerting request classes Enables the security plugin's ResourceAccessEvaluator to automatically intercept and authorize operations on protected resources at the transport layer. Notifications: - GetNotificationConfigRequest: implements DocRequest with id() for single-ID requests, null for search/multi-ID (DLS handles those) - UpdateNotificationConfigRequest: implements DocRequest with configId - DeleteNotificationConfigRequest: implements DocRequest with id() for single-ID deletes, null for multi-ID - All override type() to return "notification_config" - Added CONFIG_INDEX_NAME and CONFIG_RESOURCE_TYPE constants Alerting: - DocRequest implemented on Get, Delete, Index, and Acknowledge request classes for monitors, workflows, comments, alerts, and findings Note: Create requests that generate new resources (without accessing existing ones) do NOT implement DocRequest. Signed-off-by: Darshit Chanpura <dchanp@amazon.com> * Fix incorrect index mappings in DocRequest impls - DeleteMonitorRequest, DeleteWorkflowRequest, DocLevelMonitorFanOutRequest: point at SCHEDULED_JOBS_INDEX (where monitors/workflows live) rather than the alerts index pattern. The previous mapping would make the security plugin's ActionFilter look up the resource in the wrong index and fail to gate access. - IndexCommentRequest: replace TODO stubs with the comments index and the (possibly-blank) commentId, matching DeleteCommentRequest. Signed-off-by: Darshit Chanpura <dchanp@amazon.com> --------- Signed-off-by: Darshit Chanpura <dchanp@amazon.com>
1 parent 1dff6f2 commit 3946eb8

19 files changed

Lines changed: 220 additions & 17 deletions

‎src/main/kotlin/org/opensearch/commons/alerting/action/AcknowledgeAlertRequest.kt‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,15 @@ package org.opensearch.commons.alerting.action
77

88
import org.opensearch.action.ActionRequest
99
import org.opensearch.action.ActionRequestValidationException
10+
import org.opensearch.action.DocRequest
1011
import org.opensearch.action.support.WriteRequest
12+
import org.opensearch.commons.alerting.model.ScheduledJob
1113
import org.opensearch.core.common.io.stream.StreamInput
1214
import org.opensearch.core.common.io.stream.StreamOutput
1315
import java.io.IOException
1416
import java.util.Collections
1517

16-
class AcknowledgeAlertRequest : ActionRequest {
18+
class AcknowledgeAlertRequest : ActionRequest, DocRequest {
1719
val monitorId: String
1820
val alertIds: List<String>
1921
val refreshPolicy: WriteRequest.RefreshPolicy
@@ -45,4 +47,12 @@ class AcknowledgeAlertRequest : ActionRequest {
4547
out.writeStringCollection(alertIds)
4648
refreshPolicy.writeTo(out)
4749
}
50+
51+
override fun index(): String? {
52+
return ScheduledJob.SCHEDULED_JOBS_INDEX
53+
}
54+
55+
override fun id(): String? {
56+
return monitorId
57+
}
4858
}

‎src/main/kotlin/org/opensearch/commons/alerting/action/AcknowledgeChainedAlertRequest.kt‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,15 @@ package org.opensearch.commons.alerting.action
77

88
import org.opensearch.action.ActionRequest
99
import org.opensearch.action.ActionRequestValidationException
10+
import org.opensearch.action.DocRequest
11+
import org.opensearch.commons.alerting.model.ScheduledJob
1012
import org.opensearch.core.common.io.stream.StreamInput
1113
import org.opensearch.core.common.io.stream.StreamOutput
1214
import java.io.IOException
1315
import java.util.Collections
1416

1517
/** Request DTO for acknowledging chained alerts generated by workflow.*/
16-
class AcknowledgeChainedAlertRequest : ActionRequest {
18+
class AcknowledgeChainedAlertRequest : ActionRequest, DocRequest {
1719
val workflowId: String
1820
val alertIds: List<String>
1921

@@ -40,4 +42,12 @@ class AcknowledgeChainedAlertRequest : ActionRequest {
4042
out.writeString(workflowId)
4143
out.writeStringCollection(alertIds)
4244
}
45+
46+
override fun index(): String? {
47+
return ScheduledJob.SCHEDULED_JOBS_INDEX
48+
}
49+
50+
override fun id(): String? {
51+
return workflowId
52+
}
4353
}

‎src/main/kotlin/org/opensearch/commons/alerting/action/DeleteCommentRequest.kt‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,13 @@ package org.opensearch.commons.alerting.action
22

33
import org.opensearch.action.ActionRequest
44
import org.opensearch.action.ActionRequestValidationException
5+
import org.opensearch.action.DocRequest
6+
import org.opensearch.commons.alerting.util.AlertingConstants.Companion.ALL_COMMENTS_INDEX_PATTERN
57
import org.opensearch.core.common.io.stream.StreamInput
68
import org.opensearch.core.common.io.stream.StreamOutput
79
import java.io.IOException
810

9-
class DeleteCommentRequest : ActionRequest {
11+
class DeleteCommentRequest : ActionRequest, DocRequest {
1012
val commentId: String
1113

1214
constructor(commentId: String) : super() {
@@ -31,4 +33,12 @@ class DeleteCommentRequest : ActionRequest {
3133
override fun writeTo(out: StreamOutput) {
3234
out.writeString(commentId)
3335
}
36+
37+
override fun index(): String? {
38+
return ALL_COMMENTS_INDEX_PATTERN
39+
}
40+
41+
override fun id(): String? {
42+
return commentId
43+
}
3444
}

‎src/main/kotlin/org/opensearch/commons/alerting/action/DeleteMonitorRequest.kt‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,14 @@ package org.opensearch.commons.alerting.action
22

33
import org.opensearch.action.ActionRequest
44
import org.opensearch.action.ActionRequestValidationException
5+
import org.opensearch.action.DocRequest
56
import org.opensearch.action.support.WriteRequest
7+
import org.opensearch.commons.alerting.model.ScheduledJob
68
import org.opensearch.core.common.io.stream.StreamInput
79
import org.opensearch.core.common.io.stream.StreamOutput
810
import java.io.IOException
911

10-
class DeleteMonitorRequest : ActionRequest {
12+
class DeleteMonitorRequest : DocRequest, ActionRequest {
1113

1214
val monitorId: String
1315
val refreshPolicy: WriteRequest.RefreshPolicy
@@ -32,4 +34,12 @@ class DeleteMonitorRequest : ActionRequest {
3234
out.writeString(monitorId)
3335
refreshPolicy.writeTo(out)
3436
}
37+
38+
override fun index(): String? {
39+
return ScheduledJob.SCHEDULED_JOBS_INDEX
40+
}
41+
42+
override fun id(): String? {
43+
return monitorId
44+
}
3545
}

‎src/main/kotlin/org/opensearch/commons/alerting/action/DeleteWorkflowRequest.kt‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,13 @@ package org.opensearch.commons.alerting.action
22

33
import org.opensearch.action.ActionRequest
44
import org.opensearch.action.ActionRequestValidationException
5+
import org.opensearch.action.DocRequest
6+
import org.opensearch.commons.alerting.model.ScheduledJob
57
import org.opensearch.core.common.io.stream.StreamInput
68
import org.opensearch.core.common.io.stream.StreamOutput
79
import java.io.IOException
810

9-
class DeleteWorkflowRequest : ActionRequest {
11+
class DeleteWorkflowRequest : ActionRequest, DocRequest {
1012

1113
val workflowId: String
1214

@@ -36,4 +38,12 @@ class DeleteWorkflowRequest : ActionRequest {
3638
out.writeString(workflowId)
3739
out.writeOptionalBoolean(deleteDelegateMonitors)
3840
}
41+
42+
override fun index(): String? {
43+
return ScheduledJob.SCHEDULED_JOBS_INDEX
44+
}
45+
46+
override fun id(): String? {
47+
return workflowId
48+
}
3949
}

‎src/main/kotlin/org/opensearch/commons/alerting/action/DocLevelMonitorFanOutRequest.kt‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,11 @@ package org.opensearch.commons.alerting.action
77

88
import org.opensearch.action.ActionRequest
99
import org.opensearch.action.ActionRequestValidationException
10+
import org.opensearch.action.DocRequest
1011
import org.opensearch.commons.alerting.model.IndexExecutionContext
1112
import org.opensearch.commons.alerting.model.Monitor
1213
import org.opensearch.commons.alerting.model.MonitorMetadata
14+
import org.opensearch.commons.alerting.model.ScheduledJob
1315
import org.opensearch.commons.alerting.model.WorkflowRunContext
1416
import org.opensearch.core.common.io.stream.StreamInput
1517
import org.opensearch.core.common.io.stream.StreamOutput
@@ -19,7 +21,7 @@ import org.opensearch.core.xcontent.ToXContentObject
1921
import org.opensearch.core.xcontent.XContentBuilder
2022
import java.io.IOException
2123

22-
class DocLevelMonitorFanOutRequest : ActionRequest, ToXContentObject {
24+
class DocLevelMonitorFanOutRequest : ActionRequest, DocRequest, ToXContentObject {
2325
val monitor: Monitor
2426
val dryRun: Boolean
2527
val monitorMetadata: MonitorMetadata
@@ -98,4 +100,12 @@ class DocLevelMonitorFanOutRequest : ActionRequest, ToXContentObject {
98100
.field("workflow_run_context", workflowRunContext)
99101
return builder.endObject()
100102
}
103+
104+
override fun index(): String? {
105+
return ScheduledJob.SCHEDULED_JOBS_INDEX
106+
}
107+
108+
override fun id(): String? {
109+
return monitor.id
110+
}
101111
}

‎src/main/kotlin/org/opensearch/commons/alerting/action/GetAlertsRequest.kt‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,15 @@ package org.opensearch.commons.alerting.action
22

33
import org.opensearch.action.ActionRequest
44
import org.opensearch.action.ActionRequestValidationException
5+
import org.opensearch.action.DocRequest
6+
import org.opensearch.commons.alerting.model.ScheduledJob
57
import org.opensearch.commons.alerting.model.Table
68
import org.opensearch.core.common.io.stream.StreamInput
79
import org.opensearch.core.common.io.stream.StreamOutput
810
import org.opensearch.index.query.BoolQueryBuilder
911
import java.io.IOException
1012

11-
class GetAlertsRequest : ActionRequest {
13+
class GetAlertsRequest : ActionRequest, DocRequest {
1214
val table: Table
1315
val severityLevel: String
1416
val alertState: String
@@ -75,4 +77,14 @@ class GetAlertsRequest : ActionRequest {
7577
out.writeOptionalBoolean(false)
7678
}
7779
}
80+
81+
override fun index(): String? {
82+
return ScheduledJob.SCHEDULED_JOBS_INDEX
83+
}
84+
85+
override fun id(): String? {
86+
// Access is gated on the underlying monitor when a single monitorId is provided; otherwise let the security
87+
// plugin fall back to search-level DLS filtering.
88+
return monitorId ?: monitorIds?.singleOrNull()
89+
}
7890
}

‎src/main/kotlin/org/opensearch/commons/alerting/action/GetFindingsRequest.kt‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,15 @@ package org.opensearch.commons.alerting.action
22

33
import org.opensearch.action.ActionRequest
44
import org.opensearch.action.ActionRequestValidationException
5+
import org.opensearch.action.DocRequest
6+
import org.opensearch.commons.alerting.model.ScheduledJob
57
import org.opensearch.commons.alerting.model.Table
68
import org.opensearch.core.common.io.stream.StreamInput
79
import org.opensearch.core.common.io.stream.StreamOutput
810
import org.opensearch.index.query.BoolQueryBuilder
911
import java.io.IOException
1012

11-
class GetFindingsRequest : ActionRequest {
13+
class GetFindingsRequest : ActionRequest, DocRequest {
1214
val findingId: String?
1315
val table: Table
1416
val monitorId: String?
@@ -54,4 +56,14 @@ class GetFindingsRequest : ActionRequest {
5456
out.writeOptionalStringCollection(monitorIds)
5557
boolQueryBuilder?.writeTo(out)
5658
}
59+
60+
override fun index(): String? {
61+
return ScheduledJob.SCHEDULED_JOBS_INDEX
62+
}
63+
64+
override fun id(): String? {
65+
// Access is gated on the underlying monitor when a single monitorId is provided; otherwise fall back to
66+
// search-level DLS filtering.
67+
return monitorId ?: monitorIds?.singleOrNull()
68+
}
5769
}

‎src/main/kotlin/org/opensearch/commons/alerting/action/GetMonitorRequest.kt‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,13 +7,15 @@ package org.opensearch.commons.alerting.action
77

88
import org.opensearch.action.ActionRequest
99
import org.opensearch.action.ActionRequestValidationException
10+
import org.opensearch.action.DocRequest
11+
import org.opensearch.commons.alerting.model.ScheduledJob
1012
import org.opensearch.core.common.io.stream.StreamInput
1113
import org.opensearch.core.common.io.stream.StreamOutput
1214
import org.opensearch.rest.RestRequest
1315
import org.opensearch.search.fetch.subphase.FetchSourceContext
1416
import java.io.IOException
1517

16-
class GetMonitorRequest : ActionRequest {
18+
class GetMonitorRequest : ActionRequest, DocRequest {
1719
val monitorId: String
1820
val version: Long
1921
val method: RestRequest.Method
@@ -55,4 +57,12 @@ class GetMonitorRequest : ActionRequest {
5557
out.writeBoolean(srcContext != null)
5658
srcContext?.writeTo(out)
5759
}
60+
61+
override fun index(): String? {
62+
return ScheduledJob.SCHEDULED_JOBS_INDEX
63+
}
64+
65+
override fun id(): String? {
66+
return monitorId
67+
}
5868
}

‎src/main/kotlin/org/opensearch/commons/alerting/action/GetWorkflowAlertsRequest.kt‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,14 @@ package org.opensearch.commons.alerting.action
22

33
import org.opensearch.action.ActionRequest
44
import org.opensearch.action.ActionRequestValidationException
5+
import org.opensearch.action.DocRequest
6+
import org.opensearch.commons.alerting.model.ScheduledJob
57
import org.opensearch.commons.alerting.model.Table
68
import org.opensearch.core.common.io.stream.StreamInput
79
import org.opensearch.core.common.io.stream.StreamOutput
810
import java.io.IOException
911

10-
class GetWorkflowAlertsRequest : ActionRequest {
12+
class GetWorkflowAlertsRequest : ActionRequest, DocRequest {
1113
val table: Table
1214
val severityLevel: String
1315
val alertState: String
@@ -69,4 +71,13 @@ class GetWorkflowAlertsRequest : ActionRequest {
6971
out.writeOptionalStringCollection(alertIds)
7072
out.writeBoolean(getAssociatedAlerts)
7173
}
74+
75+
override fun index(): String? {
76+
return ScheduledJob.SCHEDULED_JOBS_INDEX
77+
}
78+
79+
override fun id(): String? {
80+
// Access is gated on the workflow when a single workflowId is provided; otherwise fall back to search-level DLS.
81+
return workflowIds?.singleOrNull()
82+
}
7283
}

0 commit comments

Comments
 (0)