fix cluster perm classification for msearch template (opensearch-proj…

…ect#2892) (opensearch-project#2914) * fix cluster perm classification for msearch template Signed-off-by: Derek Ho <[email protected]> * move test to unit test file Signed-off-by: Derek Ho <[email protected]> * fully revert integration test file Signed-off-by: Derek Ho <[email protected]> * Update src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java Signed-off-by: Stephen Crawford <[email protected]> * spotless Signed-off-by: Derek Ho <[email protected]> --------- Signed-off-by: Derek Ho <[email protected]> Signed-off-by: Stephen Crawford <[email protected]> Co-authored-by: Stephen Crawford <[email protected]> (cherry picked from commit 50ce79c) Co-authored-by: Derek Ho <[email protected]>
willyborankin · Jun 29, 2023 · 101f58c · 101f58c
1 parent b81522b
commit 101f58c
Show file tree

Hide file tree

Showing 2 changed files with 37 additions and 1 deletion.
diff --git a/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java b/src/main/java/org/opensearch/security/privileges/PrivilegesEvaluator.java
@@ -669,7 +669,7 @@ public static boolean isClusterPerm(String action0) {
             || action0.startsWith(SearchScrollAction.NAME)
             || (action0.equals(BulkAction.NAME))
             || (action0.equals(MultiGetAction.NAME))
-            || (action0.equals(MultiSearchAction.NAME))
+            || (action0.startsWith(MultiSearchAction.NAME))
             || (action0.equals(MultiTermVectorsAction.NAME))
             || (action0.equals(ReindexAction.NAME))
 

diff --git a/src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java b/src/test/java/org/opensearch/security/privileges/PrivilegesEvaluatorUnitTest.java
@@ -0,0 +1,36 @@
+/*
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * The OpenSearch Contributors require contributions made to
+ * this file be licensed under the Apache-2.0 license or a
+ * compatible open source license.
+ */
+
+package org.opensearch.security.privileges;
+
+import org.junit.Test;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.opensearch.security.privileges.PrivilegesEvaluator.isClusterPerm;
+
+public class PrivilegesEvaluatorUnitTest {
+
+    @Test
+    public void testClusterPerm() {
+        String multiSearchTemplate = "indices:data/read/msearch/template";
+        String monitorHealth = "cluster:monitor/health";
+        String writeIndex = "indices:data/write/reindex";
+        String adminClose = "indices:admin/close";
+        String monitorUpgrade = "indices:monitor/upgrade";
+
+        // Cluster Permissions
+        assertTrue(isClusterPerm(multiSearchTemplate));
+        assertTrue(isClusterPerm(writeIndex));
+        assertTrue(isClusterPerm(monitorHealth));
+
+        // Index Permissions
+        assertFalse(isClusterPerm(adminClose));
+        assertFalse(isClusterPerm(monitorUpgrade));
+    }
+}