Merge branch 'main' into move-grpc-out-exp

DarshitChanpura · web-flow · commit d409b683aefc · 2025-08-05T12:28:23.000-04:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -34,6 +34,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 * Fix config update with deprecated config types failing in mixed clusters ([#5456](https://github.com/opensearch-project/security/pull/5456))
 * Fix usage of jwt_clock_skew_tolerance_seconds in HTTPJwtAuthenticator ([#5506](https://github.com/opensearch-project/security/pull/5506))
 * Always install demo certs if configured with demo certs ([#5517](https://github.com/opensearch-project/security/pull/5517))
+* [Resource Sharing] Restores client accessor pattern to fix compilation issues when security plugin is not installed ([#5541](https://github.com/opensearch-project/security/pull/5541))
 
 ### Refactoring
 
diff --git a/sample-resource-plugin/build.gradle b/sample-resource-plugin/build.gradle
@@ -162,4 +162,6 @@ tasks.register('jacocoSamplePluginReport', JacocoReport) {
 tasks.named("integrationTest").configure {
     dependsOn rootProject.tasks.named("compileIntegrationTestJava")
     finalizedBy jacocoSamplePluginReport
+    maxParallelForks = 8
+    forkEvery = 1
 }
diff --git a/sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/SecurityDisabledTests.java b/sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/SecurityDisabledTests.java
@@ -51,7 +51,7 @@
 public class SecurityDisabledTests {
 
     @ClassRule
-    public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.SINGLENODE)
+    public static LocalCluster cluster = new LocalCluster.Builder().clusterManager(ClusterManager.DEFAULT)
         .plugin(
             new PluginInfo(
                 SampleResourcePlugin.class.getName(),
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResourceExtension.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResourceExtension.java
@@ -13,6 +13,7 @@
 
 import java.util.Set;
 
+import org.opensearch.sample.client.ResourceSharingClientAccessor;
 import org.opensearch.security.spi.resources.ResourceProvider;
 import org.opensearch.security.spi.resources.ResourceSharingExtension;
 import org.opensearch.security.spi.resources.client.ResourceSharingClient;
@@ -23,7 +24,6 @@
  * Responsible for parsing the XContent into a SampleResource object.
  */
 public class SampleResourceExtension implements ResourceSharingExtension {
-    private ResourceSharingClient client;
 
     @Override
     public Set<ResourceProvider> getResourceProviders() {
@@ -32,11 +32,6 @@ public Set<ResourceProvider> getResourceProviders() {
 
     @Override
     public void assignResourceSharingClient(ResourceSharingClient resourceSharingClient) {
-        this.client = resourceSharingClient;
-    }
-
-    @Override
-    public ResourceSharingClient getResourceSharingClient() {
-        return this.client;
+        ResourceSharingClientAccessor.getInstance().setResourceSharingClient(resourceSharingClient);
     }
 }
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/client/ResourceSharingClientAccessor.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/client/ResourceSharingClientAccessor.java
@@ -0,0 +1,44 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.sample.client;
+
+import org.opensearch.security.spi.resources.client.ResourceSharingClient;
+
+/**
+ * Accessor for resource sharing client supplied by the SPI.
+ */
+public class ResourceSharingClientAccessor {
+    private ResourceSharingClient CLIENT;
+
+    private static ResourceSharingClientAccessor resourceSharingClientAccessor;
+
+    private ResourceSharingClientAccessor() {}
+
+    public static ResourceSharingClientAccessor getInstance() {
+        if (resourceSharingClientAccessor == null) {
+            resourceSharingClientAccessor = new ResourceSharingClientAccessor();
+        }
+
+        return resourceSharingClientAccessor;
+    }
+
+    /**
+     * Set the resource sharing client
+     */
+    public void setResourceSharingClient(ResourceSharingClient client) {
+        resourceSharingClientAccessor.CLIENT = client;
+    }
+
+    /**
+     * Get the resource sharing client
+     */
+    public ResourceSharingClient getResourceSharingClient() {
+        return resourceSharingClientAccessor.CLIENT;
+    }
+}
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/transport/GetResourceTransportAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/transport/GetResourceTransportAction.java
@@ -31,7 +31,7 @@
 import org.opensearch.core.xcontent.XContentParser;
 import org.opensearch.index.query.QueryBuilders;
 import org.opensearch.sample.SampleResource;
-import org.opensearch.sample.SampleResourceExtension;
+import org.opensearch.sample.client.ResourceSharingClientAccessor;
 import org.opensearch.sample.resource.actions.rest.get.GetResourceAction;
 import org.opensearch.sample.resource.actions.rest.get.GetResourceRequest;
 import org.opensearch.sample.resource.actions.rest.get.GetResourceResponse;
@@ -51,24 +51,17 @@ public class GetResourceTransportAction extends HandledTransportAction<GetResour
 
     private final TransportService transportService;
     private final NodeClient nodeClient;
-    private final SampleResourceExtension sampleResourceExtension;
 
     @Inject
-    public GetResourceTransportAction(
-        TransportService transportService,
-        ActionFilters actionFilters,
-        NodeClient nodeClient,
-        SampleResourceExtension sampleResourceExtension
-    ) {
+    public GetResourceTransportAction(TransportService transportService, ActionFilters actionFilters, NodeClient nodeClient) {
         super(GetResourceAction.NAME, transportService, actionFilters, GetResourceRequest::new);
         this.transportService = transportService;
         this.nodeClient = nodeClient;
-        this.sampleResourceExtension = sampleResourceExtension;
     }
 
     @Override
     protected void doExecute(Task task, GetResourceRequest request, ActionListener<GetResourceResponse> listener) {
-        ResourceSharingClient client = sampleResourceExtension.getResourceSharingClient();
+        ResourceSharingClient client = ResourceSharingClientAccessor.getInstance().getResourceSharingClient();
         String resourceId = request.getResourceId();
 
         if (Strings.isNullOrEmpty(resourceId)) {
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/transport/RevokeResourceAccessTransportAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/transport/RevokeResourceAccessTransportAction.java
@@ -17,7 +17,7 @@
 import org.opensearch.common.inject.Inject;
 import org.opensearch.core.action.ActionListener;
 import org.opensearch.core.rest.RestStatus;
-import org.opensearch.sample.SampleResourceExtension;
+import org.opensearch.sample.client.ResourceSharingClientAccessor;
 import org.opensearch.sample.resource.actions.rest.revoke.RevokeResourceAccessAction;
 import org.opensearch.sample.resource.actions.rest.revoke.RevokeResourceAccessRequest;
 import org.opensearch.sample.resource.actions.rest.revoke.RevokeResourceAccessResponse;
@@ -37,13 +37,9 @@ public class RevokeResourceAccessTransportAction extends HandledTransportAction<
     private final ResourceSharingClient resourceSharingClient;
 
     @Inject
-    public RevokeResourceAccessTransportAction(
-        TransportService transportService,
-        ActionFilters actionFilters,
-        SampleResourceExtension sampleResourceExtension
-    ) {
+    public RevokeResourceAccessTransportAction(TransportService transportService, ActionFilters actionFilters) {
         super(RevokeResourceAccessAction.NAME, transportService, actionFilters, RevokeResourceAccessRequest::new);
-        this.resourceSharingClient = sampleResourceExtension.getResourceSharingClient();
+        this.resourceSharingClient = ResourceSharingClientAccessor.getInstance().getResourceSharingClient();
     }
 
     @Override
diff --git a/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/transport/ShareResourceTransportAction.java b/sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/transport/ShareResourceTransportAction.java
@@ -17,7 +17,7 @@
 import org.opensearch.common.inject.Inject;
 import org.opensearch.core.action.ActionListener;
 import org.opensearch.core.rest.RestStatus;
-import org.opensearch.sample.SampleResourceExtension;
+import org.opensearch.sample.client.ResourceSharingClientAccessor;
 import org.opensearch.sample.resource.actions.rest.share.ShareResourceAction;
 import org.opensearch.sample.resource.actions.rest.share.ShareResourceRequest;
 import org.opensearch.sample.resource.actions.rest.share.ShareResourceResponse;
@@ -36,13 +36,9 @@ public class ShareResourceTransportAction extends HandledTransportAction<ShareRe
     private final ResourceSharingClient resourceSharingClient;
 
     @Inject
-    public ShareResourceTransportAction(
-        TransportService transportService,
-        ActionFilters actionFilters,
-        SampleResourceExtension sampleResourceExtension
-    ) {
+    public ShareResourceTransportAction(TransportService transportService, ActionFilters actionFilters) {
         super(ShareResourceAction.NAME, transportService, actionFilters, ShareResourceRequest::new);
-        this.resourceSharingClient = sampleResourceExtension.getResourceSharingClient();
+        this.resourceSharingClient = ResourceSharingClientAccessor.getInstance().getResourceSharingClient();
     }
 
     @Override
diff --git a/spi/src/main/java/org/opensearch/security/spi/resources/ResourceSharingExtension.java b/spi/src/main/java/org/opensearch/security/spi/resources/ResourceSharingExtension.java
@@ -32,11 +32,4 @@ public interface ResourceSharingExtension {
      * @param client the ResourceSharingClient instance
      */
     void assignResourceSharingClient(ResourceSharingClient client);
-
-    /**
-     * Gets the resource sharing client to be used by the plugin
-     * @return the resource sharing client
-     */
-    ResourceSharingClient getResourceSharingClient();
-
 }
diff --git a/src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java b/src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java
@@ -1195,11 +1195,7 @@ public Collection<Object> createComponents(
                 extension.assignResourceSharingClient(resourceAccessControlClient);
             });
             components.add(resourcePluginInfo);
-            components.add(resourceAccessControlClient);
             components.add(resourceAccessHandler);
-            // we add extensions here to allow the plugins to use them to fetch the resource-sharing client
-            // example: SampleResourcePlugin -> GetResourceTransportAction
-            components.addAll(resourceSharingExtensions);
             // CS-ENFORCE-SINGLE
         }
 
diff --git a/src/main/java/org/opensearch/security/filter/SecurityFilter.java b/src/main/java/org/opensearch/security/filter/SecurityFilter.java
@@ -150,7 +150,7 @@ public SecurityFilter(
         );
         this.rolesInjector = new RolesInjector(auditLog);
         this.userInjector = new UserInjector(settings, threadPool, auditLog, xffResolver);
-        this.resourceAccessEvaluator = new ResourceAccessEvaluator(resourceIndices, threadPool, settings, resourceAccessHandler);
+        this.resourceAccessEvaluator = new ResourceAccessEvaluator(resourceIndices, settings, resourceAccessHandler);
         log.info("{} indices are made immutable.", immutableIndicesMatcher);
     }
 
diff --git a/src/main/java/org/opensearch/security/privileges/ResourceAccessEvaluator.java b/src/main/java/org/opensearch/security/privileges/ResourceAccessEvaluator.java
@@ -18,11 +18,9 @@
 import org.opensearch.action.ActionRequest;
 import org.opensearch.action.DocRequest;
 import org.opensearch.common.settings.Settings;
-import org.opensearch.common.util.concurrent.ThreadContext;
 import org.opensearch.core.action.ActionListener;
 import org.opensearch.security.resources.ResourceAccessHandler;
 import org.opensearch.security.support.ConfigConstants;
-import org.opensearch.threadpool.ThreadPool;
 
 /**
  * Evaluates access to resources. The resource plugins must register the indices which hold resource information.
@@ -41,18 +39,11 @@ public class ResourceAccessEvaluator {
     private static final Logger log = LogManager.getLogger(ResourceAccessEvaluator.class);
 
     private final Set<String> resourceIndices;
-    private final ThreadContext threadContext;
     private final Settings settings;
     private final ResourceAccessHandler resourceAccessHandler;
 
-    public ResourceAccessEvaluator(
-        Set<String> resourceIndices,
-        ThreadPool threadPool,
-        Settings settings,
-        ResourceAccessHandler resourceAccessHandler
-    ) {
+    public ResourceAccessEvaluator(Set<String> resourceIndices, Settings settings, ResourceAccessHandler resourceAccessHandler) {
         this.resourceIndices = resourceIndices;
-        this.threadContext = threadPool.getThreadContext();
         this.settings = settings;
         this.resourceAccessHandler = resourceAccessHandler;
     }
diff --git a/src/test/java/org/opensearch/security/privileges/ResourceAccessEvaluatorTest.java b/src/test/java/org/opensearch/security/privileges/ResourceAccessEvaluatorTest.java
@@ -19,7 +19,6 @@
 import org.opensearch.common.util.concurrent.ThreadContext;
 import org.opensearch.core.action.ActionListener;
 import org.opensearch.security.auth.UserSubjectImpl;
-import org.opensearch.security.privileges.actionlevel.RoleBasedActionPrivileges;
 import org.opensearch.security.resources.ResourceAccessHandler;
 import org.opensearch.security.support.ConfigConstants;
 import org.opensearch.threadpool.ThreadPool;
@@ -33,7 +32,6 @@
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.doAnswer;
-import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 
@@ -48,8 +46,6 @@ public class ResourceAccessEvaluatorTest {
 
     @Mock
     private PrivilegesEvaluationContext context;
-    @Mock
-    private RoleBasedActionPrivileges roleBasedActionPrivileges;
 
     private ThreadContext threadContext;
     private ResourceAccessEvaluator evaluator;
@@ -60,8 +56,7 @@ public class ResourceAccessEvaluatorTest {
     public void setup() {
         Settings settings = Settings.builder().put(ConfigConstants.OPENSEARCH_RESOURCE_SHARING_ENABLED, true).build();
         threadContext = new ThreadContext(Settings.EMPTY);
-        doReturn(threadContext).when(threadPool).getThreadContext();
-        evaluator = new ResourceAccessEvaluator(Collections.singleton(IDX), threadPool, settings, resourceAccessHandler);
+        evaluator = new ResourceAccessEvaluator(Collections.singleton(IDX), settings, resourceAccessHandler);
     }
 
     private void stubAuthenticatedUser() {

Original file line number	Diff line number	Diff line change
`@@ -162,4 +162,6 @@ tasks.register('jacocoSamplePluginReport', JacocoReport) {`
`162`	`162`	`tasks.named("integrationTest").configure {`
`163`	`163`	`dependsOn rootProject.tasks.named("compileIntegrationTestJava")`
`164`	`164`	`finalizedBy jacocoSamplePluginReport`
	`165`	`+ maxParallelForks = 8`
	`166`	`+ forkEvery = 1`
`165`	`167`	`}`