diff --git a/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java b/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java index 7383c6b4b6..f41241d3ef 100644 --- a/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java +++ b/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java @@ -669,7 +669,7 @@ public static boolean isClusterPerm(String action0) { || action0.startsWith(SearchScrollAction.NAME) || (action0.equals(BulkAction.NAME)) || (action0.equals(MultiGetAction.NAME)) - || (action0.equals(MultiSearchAction.NAME)) + || (action0.startsWith(MultiSearchAction.NAME)) || (action0.equals(MultiTermVectorsAction.NAME)) || (action0.equals(ReindexAction.NAME)) diff --git a/src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java b/src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java new file mode 100644 index 0000000000..e7412f43b4 --- /dev/null +++ b/src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java @@ -0,0 +1,36 @@ +/* + * SPDX-License-Identifier: Apache-2.0 + * + * The OpenSearch Contributors require contributions made to + * this file be licensed under the Apache-2.0 license or a + * compatible open source license. + */ + +package org.opensearch.security.privileges; + +import org.junit.Test; + +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; +import static org.opensearch.security.privileges.PrivilegesEvaluator.isClusterPerm; + +public class PrivilegesEvaluatorUnitTest { + + @Test + public void testClusterPerm() { + String multiSearchTemplate = "indices:data/read/msearch/template"; + String monitorHealth = "cluster:monitor/health"; + String writeIndex = "indices:data/write/reindex"; + String adminClose = "indices:admin/close"; + String monitorUpgrade = "indices:monitor/upgrade"; + + // Cluster Permissions + assertTrue(isClusterPerm(multiSearchTemplate)); + assertTrue(isClusterPerm(writeIndex)); + assertTrue(isClusterPerm(monitorHealth)); + + // Index Permissions + assertFalse(isClusterPerm(adminClose)); + assertFalse(isClusterPerm(monitorUpgrade)); + } +}