[Resource Sharing] Use custom action prefixes for sample resource plugin

CHANGELOG.md

@@ -16,6 +16,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Optimize getFieldFilter to only return a predicate when index has FLS restrictions for user ([#5777](https://github.com/opensearch-project/security/pull/5777))
 - Performance optimizations for building internal authorization data structures upon config updates ([#5988](https://github.com/opensearch-project/security/pull/5988))
 - Make encryption_key optional for obo token authenticator ([#6017](https://github.com/opensearch-project/security/pull/6017)
+- [Resource Sharing] Using custom action prefixes for sample resource plugin ([#6020](https://github.com/opensearch-project/security/pull/6020)
 - Enable basic authentication for gRPC transport ([#6005](https://github.com/opensearch-project/security/pull/6005))
 - Allow specifying parentType and parentIdField in ResourceProvider ([#5735](https://github.com/opensearch-project/security/pull/5735))
 - [Resource Sharing] Allow specifying default access level in resource access levels yml file ([#6018](https://github.com/opensearch-project/security/pull/6018))

sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/TestUtils.java

@@ -65,10 +65,9 @@ public final class TestUtils {
         "resource_sharing_test_user_Limited_Perms"
     ).roles(
         new TestSecurityConfig.Role("shared_role_limited_perms").clusterPermissions(
-            "cluster:admin/sample-resource-plugin/get",
-            "cluster:admin/sample-resource-plugin/search",
-            "cluster:admin/sample-resource-plugin/create",
-            "cluster:admin/security/resource/share",
+            "sampleresource:get",
+            "sampleresource:search",
+            "sampleresource:create",
             "cluster:admin/security/resource/share"
         ).indexPermissions("indices:data/read*").on(RESOURCE_INDEX_NAME)
     );

sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/enabled/DryRunAccessTests.java

@@ -100,12 +100,12 @@ public void testDryRunAccess() throws Exception {
             HttpResponse resp = client.putJson(SAMPLE_RESOURCE_CREATE_ENDPOINT + "?perform_permission_check=true", sample);
             resp.assertStatusCode(HttpStatus.SC_OK);
             assertThat(resp.bodyAsMap().get("accessAllowed"), equalTo(false));
-            assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("cluster:admin/sample-resource-plugin/create")));
+            assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("sampleresource:create")));
 
             resp = client.get(SAMPLE_RESOURCE_GET_ENDPOINT + "/" + adminResId + "?perform_permission_check=true");
             resp.assertStatusCode(HttpStatus.SC_OK);
             assertThat(resp.bodyAsMap().get("accessAllowed"), equalTo(false));
-            assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("cluster:admin/sample-resource-plugin/get")));
+            assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("sampleresource:get")));
         }
 
         // share resource at readonly level with no_access_user
@@ -123,7 +123,7 @@ public void testDryRunAccess() throws Exception {
             resp = client.postJson(SAMPLE_RESOURCE_UPDATE_ENDPOINT + "/" + adminResId + "?perform_permission_check=true", updatePayload);
             resp.assertStatusCode(HttpStatus.SC_OK);
             assertThat(resp.bodyAsMap().get("accessAllowed"), equalTo(false));
-            assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("cluster:admin/sample-resource-plugin/update")));
+            assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("sampleresource:update")));
 
             // cannot share resource
             resp = client.putJson(
@@ -148,7 +148,7 @@ public void testDryRunAccess() throws Exception {
             resp = client.delete(SAMPLE_RESOURCE_DELETE_ENDPOINT + "/" + adminResId + "?perform_permission_check=true");
             resp.assertStatusCode(HttpStatus.SC_OK);
             assertThat(resp.bodyAsMap().get("accessAllowed"), equalTo(false));
-            assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("cluster:admin/sample-resource-plugin/delete")));
+            assertThat(resp.bodyAsMap().get("missingPrivileges"), equalTo(List.of("sampleresource:delete")));
         }
 
         // share resource at full-access level with no_access_user

sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/create/CreateResourceAction.java

@@ -21,7 +21,7 @@ public class CreateResourceAction extends ActionType<CreateResourceResponse> {
     /**
      * Create sample resource action name
      */
-    public static final String NAME = "cluster:admin/sample-resource-plugin/create";
+    public static final String NAME = "sampleresource:create";
 
     private CreateResourceAction() {
         super(NAME, CreateResourceResponse::new);

sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/create/UpdateResourceAction.java

@@ -21,7 +21,7 @@ public class UpdateResourceAction extends ActionType<CreateResourceResponse> {
     /**
      * Update sample resource action name
      */
-    public static final String NAME = "cluster:admin/sample-resource-plugin/update";
+    public static final String NAME = "sampleresource:update";
 
     private UpdateResourceAction() {
         super(NAME, CreateResourceResponse::new);

sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/delete/DeleteResourceAction.java

@@ -21,7 +21,7 @@ public class DeleteResourceAction extends ActionType<DeleteResourceResponse> {
     /**
      * Delete sample resource action name
      */
-    public static final String NAME = "cluster:admin/sample-resource-plugin/delete";
+    public static final String NAME = "sampleresource:delete";
 
     private DeleteResourceAction() {
         super(NAME, DeleteResourceResponse::new);

sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/get/GetResourceAction.java

@@ -21,7 +21,7 @@ public class GetResourceAction extends ActionType<GetResourceResponse> {
     /**
      * Get sample resource action name
      */
-    public static final String NAME = "cluster:admin/sample-resource-plugin/get";
+    public static final String NAME = "sampleresource:get";
 
     private GetResourceAction() {
         super(NAME, GetResourceResponse::new);

sample-resource-plugin/src/main/java/org/opensearch/sample/resource/actions/rest/search/SearchResourceAction.java

@@ -18,7 +18,7 @@ public class SearchResourceAction extends ActionType<SearchResponse> {
 
     public static final SearchResourceAction INSTANCE = new SearchResourceAction();
 
-    public static final String NAME = "cluster:admin/sample-resource-plugin/search";
+    public static final String NAME = "sampleresource:search";
 
     private SearchResourceAction() {
         super(NAME, SearchResponse::new);

sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/create/CreateResourceGroupAction.java

@@ -21,7 +21,7 @@ public class CreateResourceGroupAction extends ActionType<CreateResourceGroupRes
     /**
      * Create sample resource group action name
      */
-    public static final String NAME = "cluster:admin/sample-resource-plugin/group/create";
+    public static final String NAME = "sampleresourcegroup:create";
 
     private CreateResourceGroupAction() {
         super(NAME, CreateResourceGroupResponse::new);

sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/create/UpdateResourceGroupAction.java

@@ -21,7 +21,7 @@ public class UpdateResourceGroupAction extends ActionType<CreateResourceGroupRes
     /**
      * Update sample resource group action name
      */
-    public static final String NAME = "cluster:admin/sample-resource-plugin/group/update";
+    public static final String NAME = "sampleresourcegroup:update";
 
     private UpdateResourceGroupAction() {
         super(NAME, CreateResourceGroupResponse::new);

sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/delete/DeleteResourceGroupAction.java

@@ -21,7 +21,7 @@ public class DeleteResourceGroupAction extends ActionType<DeleteResourceGroupRes
     /**
      * Delete sample resource group action name
      */
-    public static final String NAME = "cluster:admin/sample-resource-plugin/group/delete";
+    public static final String NAME = "sampleresourcegroup:delete";
 
     private DeleteResourceGroupAction() {
         super(NAME, DeleteResourceGroupResponse::new);

sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/get/GetResourceGroupAction.java

@@ -21,7 +21,7 @@ public class GetResourceGroupAction extends ActionType<GetResourceGroupResponse>
     /**
      * Get sample resource group action name
      */
-    public static final String NAME = "cluster:admin/sample-resource-plugin/group/get";
+    public static final String NAME = "sampleresourcegroup:get";
 
     private GetResourceGroupAction() {
         super(NAME, GetResourceGroupResponse::new);

sample-resource-plugin/src/main/java/org/opensearch/sample/resourcegroup/actions/rest/search/SearchResourceGroupAction.java

@@ -18,7 +18,7 @@ public class SearchResourceGroupAction extends ActionType<SearchResponse> {
 
     public static final SearchResourceGroupAction INSTANCE = new SearchResourceGroupAction();
 
-    public static final String NAME = "cluster:admin/sample-resource-plugin/group/search";
+    public static final String NAME = "sampleresourcegroup:search";
 
     private SearchResourceGroupAction() {
         super(NAME, SearchResponse::new);

sample-resource-plugin/src/main/resources/resource-access-levels.yml

@@ -3,32 +3,37 @@ resource_types:
       sample_read_only:
         default: true
         allowed_actions:
-          - "cluster:admin/sample-resource-plugin/get"
+          - "sampleresource:get"
 
       sample_read_write:
         allowed_actions:
-          - "cluster:admin/sample-resource-plugin/*"
+          - "sampleresource:*"
 
       sample_full_access:
         allowed_actions:
-          - "cluster:admin/sample-resource-plugin/*"
+          - "sampleresource:*"
           - "cluster:admin/security/resource/share"
   sample-resource-group:
     sample_group_read_only:
       default: true
       allowed_actions:
-        - "cluster:admin/sample-resource-plugin/group/get"
         # TODO: can sample-resource access levels be referenced here? i.e. sample_read_only
-        - "cluster:admin/sample-resource-plugin/get"
+        - "sampleresourcegroup:get"
+        # group read-only also grants read on child resources
+        - "sampleresource:get"
+        - "sampleresource:search"
 
     sample_group_read_write:
       allowed_actions:
-        - "cluster:admin/sample-resource-plugin/group/*"
-        - "cluster:admin/sample-resource-plugin/*"
+        - "sampleresourcegroup:*"
+        # group read-write also grants read/write on child resources
+        - "sampleresource:get"
+        - "sampleresource:search"
+        - "sampleresource:update"
 
     sample_group_full_access:
       allowed_actions:
-        - "cluster:admin/sample-resource-plugin/group/*"
-        - "cluster:admin/sample-resource-plugin/*"
-        - "cluster:admin/security/resource/group/share"
+        - "sampleresourcegroup:*"
+        # group full-access grants full access on child resources
+        - "sampleresource:*"
         - "cluster:admin/security/resource/share"

src/main/java/org/opensearch/security/privileges/PrivilegesEvaluatorImpl.java

@@ -599,7 +599,8 @@ public static boolean isClusterPerm(String action0) {
             || (action0.startsWith(MultiSearchAction.NAME))
             || (action0.equals(MultiTermVectorsAction.NAME))
             || (action0.equals(ReindexAction.NAME))
-            || (action0.equals(RenderSearchTemplateAction.NAME)));
+            || (action0.equals(RenderSearchTemplateAction.NAME))
+            || !action0.startsWith("indices:"));
     }
 
     private boolean checkFilteredAliases(Resolved requestedResolved, String action, boolean isDebugEnabled) {