Shrink operation privileges evaluation

[MaciejMierzwa]

Description

Bug fix. Shrink, or resize operations weren't properly evaluated. More in the task: #2141

Issues Resolved

#2141

Is this a backport? If so, please add backport PR # and/or commits #

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov]

Codecov Report

Merging #3716 (7a76d1d) into main (ee66199) will increase coverage by 1.32%.
Report is 1 commits behind head on main.
The diff coverage is 100.00%.

❗ Current head 7a76d1d differs from pull request most recent head 610ba7c. Consider uploading reports for the commit 610ba7c to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3716      +/-   ##
==========================================
+ Coverage   64.88%   66.21%   +1.32%     
==========================================
  Files         292      292              
  Lines       20776    20779       +3     
  Branches     3409     3410       +1     
==========================================
+ Hits        13481    13759     +278     
+ Misses       5606     5322     -284     
- Partials     1689     1698       +9     

Files	Coverage Δ
...earch/security/resolver/IndexResolverReplacer.java	69.35% <100.00%> (+0.79%)	⬆️

... and 34 files with indirect coverage changes

[MaciejMierzwa]

I cherry-picked changes made in this PR to not combine bug fix and test fix.

[stephen-crawford]

Hi @MaciejMierzwa, just one question but otherwise looks good.

Judging from this it looks like the issue was that the index replacer resolver was not filtering properly? Is that the change this implements which corrects the evaluation?

[MaciejMierzwa]

Hi @MaciejMierzwa, just one question but otherwise looks good.

Judging from this it looks like the issue was that the index replacer resolver was not filtering properly? Is that the change this implements which corrects the evaluation?

Exactly. It wasn't even analyzing incoming requests. After going through that part of the code, in PriviledgesEvaluator it assumes the most restrictive access control -> As a result only user with wildcard access could perform shrink operation.

[stephen-crawford]

Looks good

[cwperks]

Thank you @MaciejMierzwa . There was another case of this recently with SearchTemplateRequests too where a SearchTemplateRequest was falling through the cracks of IndexResolverReplacer and it required a user to have permissions to search all indices in order to use Search Template: opensearch-project/OpenSearch#9122