-
Notifications
You must be signed in to change notification settings - Fork 2.3k
Create generic DocRequest to better categorize ActionRequests #18269
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #18269 +/- ##
============================================
+ Coverage 72.48% 72.55% +0.06%
- Complexity 67357 67393 +36
============================================
Files 5488 5488
Lines 311023 311024 +1
Branches 45217 45217
============================================
+ Hits 225444 225662 +218
+ Misses 67282 66965 -317
- Partials 18297 18397 +100 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Signed-off-by: Craig Perkins <[email protected]>
Signed-off-by: Craig Perkins <[email protected]>
|
❌ Gradle check result for 84a40fd: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
…arch-project#18269) Signed-off-by: Craig Perkins <[email protected]>
…arch-project#18269) Signed-off-by: Craig Perkins <[email protected]>
…arch-project#18269) Signed-off-by: Craig Perkins <[email protected]>Signed-off-by: TJ Neuenfeldt <[email protected]>
…arch-project#18269) Signed-off-by: Craig Perkins <[email protected]>
Description
Currently, ActionRequest has 233 inheritors in the OpenSearch core alone. This number gets much larger taking into account the ecosystem of plugins.
There is not a lot of hierarchy to ActionRequests, with one notable exception
DocWriteRequestwhich is an umbrella for IndexRequest, UpdateRequest and DeleteRequest all of which are types of requests that can be individual items in a_bulkrequest.I am raising this PR to create a generic
DocRequestwhich is a superset ofDocWriteRequestand updatesGetRequestto be a subclass.While this PR is not very interesting within the confines of the OpenSearch core repo, I would like to start using this to categorize requests within OpenSearch plugins...particularly if the request is around an individual document stored in a system index.
The security plugin is working on a new sharing model where resource owners can determine with whom and how their own resources are shared...think google docs model where I give read access to UserA, but read+comment access to UserB - something that is not currently possible in OpenSearch.
In order for the security plugin to provide this new fine-grained access control model for plugin resources, there needs to be some way of distinguishing types of requests pertinent to resources. A resource is assumed to be a single document in a system index. By categorizing requests into this new category of DocRequest, the security plugin will be able to use this when computing authz for the resource being acted upon.
Related Issues
Related to opensearch-project/security#4500
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.