forked from elastic/elasticsearch
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge all file entitlements into a single files entitlement (elastic#…
…121864) This change replaces FileEntitlement with FilesEntitlement so that we can have exactly one entitlement class per module (or possibly future scope). This cleans up our policy files so that all files are located together to allow access, and this opens up the design for future optimizations.
- Loading branch information
Showing
11 changed files
with
217 additions
and
107 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
70 changes: 70 additions & 0 deletions
70
...main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the "Elastic License | ||
| * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side | ||
| * Public License v 1"; you may not use this file except in compliance with, at | ||
| * your election, the "Elastic License 2.0", the "GNU Affero General Public | ||
| * License v3.0 only", or the "Server Side Public License, v 1". | ||
| */ | ||
|
|
||
| package org.elasticsearch.entitlement.runtime.policy.entitlements; | ||
|
|
||
| import org.elasticsearch.entitlement.runtime.policy.ExternalEntitlement; | ||
| import org.elasticsearch.entitlement.runtime.policy.PolicyValidationException; | ||
|
|
||
| import java.util.ArrayList; | ||
| import java.util.HashMap; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| /** | ||
| * Describes a file entitlement with a path and mode. | ||
| */ | ||
| public record FilesEntitlement(List<FileData> filesData) implements Entitlement { | ||
|
|
||
| public static final FilesEntitlement EMPTY = new FilesEntitlement(List.of()); | ||
|
|
||
| public enum Mode { | ||
| READ, | ||
| READ_WRITE | ||
| } | ||
|
|
||
| public record FileData(String path, Mode mode) { | ||
|
|
||
| } | ||
|
|
||
| private static Mode parseMode(String mode) { | ||
| if (mode.equals("read")) { | ||
| return Mode.READ; | ||
| } else if (mode.equals("read_write")) { | ||
| return Mode.READ_WRITE; | ||
| } else { | ||
| throw new PolicyValidationException("invalid mode: " + mode + ", valid values: [read, read_write]"); | ||
| } | ||
| } | ||
|
|
||
| @ExternalEntitlement(parameterNames = { "paths" }, esModulesOnly = false) | ||
| @SuppressWarnings("unchecked") | ||
| public static FilesEntitlement build(List<Object> paths) { | ||
| if (paths == null || paths.isEmpty()) { | ||
| throw new PolicyValidationException("must specify at least one path"); | ||
| } | ||
| List<FileData> filesData = new ArrayList<>(); | ||
| for (Object object : paths) { | ||
| Map<String, String> file = new HashMap<>((Map<String, String>) object); | ||
| String path = file.remove("path"); | ||
| if (path == null) { | ||
| throw new PolicyValidationException("files entitlement must contain path for every listed file"); | ||
| } | ||
| String mode = file.remove("mode"); | ||
| if (mode == null) { | ||
| throw new PolicyValidationException("files entitlement must contain mode for every listed file"); | ||
| } | ||
| if (file.isEmpty() == false) { | ||
| throw new PolicyValidationException("unknown key(s) " + file + " in a listed file for files entitlement"); | ||
| } | ||
| filesData.add(new FileData(path, parseMode(mode))); | ||
| } | ||
| return new FilesEntitlement(filesData); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.