[Workspace]Restrict saved objects finding when workspace enabled #7125

wanglam · 2024-06-28T09:43:57Z

Description

This PR is for restricting saved objects finding when workspace enabled. Non dashboard admin should only have access to saved objects in workspaces. This PR will overwrite passed arguments.

In options.workspaces, not permitted workspaces will be filtered out.
In options.ACLSearchParams, principals will be replaced to requested user.
Use permitted workspaces or default ACLSearchParams if no options.workspaces and options.ACLSearchParams provided.

Issues Resolved

#7127

Screenshot

No ui changes

Testing the changes

See the integration test file:
src/plugins/workspace/server/saved_objects/integration_tests/workspace_saved_objects_client_wrapper.test.ts

Changelog

fix: [Workspace]Restrict saved objects finding when workspace enabled

Check List

All tests pass
- yarn test:jest
- yarn test:jest_integration
New functionality includes testing.
New functionality has been documented.
Update CHANGELOG.md
Commits are signed per the DCO using --signoff

…bled Signed-off-by: Lin Wang <wonglam@amazon.com>

codecov · 2024-06-28T09:57:57Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 67.55%. Comparing base (e0945af) to head (185423f).
Report is 349 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7125      +/-   ##
==========================================
- Coverage   67.56%   67.55%   -0.01%     
==========================================
  Files        3469     3469              
  Lines       68508    68497      -11     
  Branches    11141    11138       -3     
==========================================
- Hits        46289    46276      -13     
- Misses      19514    19515       +1     
- Partials     2705     2706       +1

Flag	Coverage Δ
Linux_1	`33.15% <61.11%> (-0.02%)`	⬇️
Linux_2	`55.25% <100.00%> (+<0.01%)`	⬆️
Linux_3	`45.31% <0.00%> (-0.01%)`	⬇️
Linux_4	`34.73% <0.00%> (-0.01%)`	⬇️
Windows_1	`33.17% <61.11%> (-0.02%)`	⬇️
Windows_2	`55.21% <100.00%> (+<0.01%)`	⬆️
Windows_3	`45.32% <0.00%> (-0.01%)`	⬇️
Windows_4	`34.73% <0.00%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Signed-off-by: Lin Wang <wonglam@amazon.com>

…enabled

ruanyl · 2024-07-02T08:26:05Z

...plugins/workspace/server/saved_objects/saved_objects_wrapper_for_check_workspace_conflict.ts

-        // TODO: The `formatFindParams` is a workaround for 2.14 to always list global data sources,
-        //       should remove this workaround in the upcoming release once readonly share is available.
-        wrapperOptions.client.find(this.formatFindParams(options)),
+      find: wrapperOptions.client.find,


Can we remove formatFindParams since it's no longer used?

src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts

…enabled

src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts

…ects_client_wrapper.ts Co-authored-by: SuZhou-Joe <suzhou@amazon.com> Signed-off-by: Lin Wang <wonglam@amazon.com>

…ects_client_wrapper.ts Co-authored-by: Yulong Ruan <ruanyu1@gmail.com> Signed-off-by: Lin Wang <wonglam@amazon.com>

Signed-off-by: Lin Wang <wonglam@amazon.com>

…enabled

Signed-off-by: Lin Wang <wonglam@amazon.com>

…enabled

Signed-off-by: Lin Wang <wonglam@amazon.com>

* Limit data source saved objects finding and access when workspace enabled Signed-off-by: Lin Wang <wonglam@amazon.com> * Remove options.workspaces drop behavior in conflict client wrapper Signed-off-by: Lin Wang <wonglam@amazon.com> * Changeset file for PR #7125 created/updated * Update src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts Co-authored-by: SuZhou-Joe <suzhou@amazon.com> Signed-off-by: Lin Wang <wonglam@amazon.com> * Update src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts Co-authored-by: Yulong Ruan <ruanyu1@gmail.com> Signed-off-by: Lin Wang <wonglam@amazon.com> * Remove formatFindParams Signed-off-by: Lin Wang <wonglam@amazon.com> * Fix code format Signed-off-by: Lin Wang <wonglam@amazon.com> * Fix ACLSearchParams and empty workspaces Signed-off-by: Lin Wang <wonglam@amazon.com> * Refactor workspace client wrapper find Signed-off-by: Lin Wang <wonglam@amazon.com> * Remove global saved objects validation logic Signed-off-by: Lin Wang <wonglam@amazon.com> * Update uts and its Signed-off-by: Lin Wang <wonglam@amazon.com> * Changeset file for PR #7125 created/updated * Remove no need changes and refactor Signed-off-by: Lin Wang <wonglam@amazon.com> * Fix global saved objects not found Signed-off-by: Lin Wang <wonglam@amazon.com> * Change saved object get to assert Signed-off-by: Lin Wang <wonglam@amazon.com> --------- Signed-off-by: Lin Wang <wonglam@amazon.com> Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com> Co-authored-by: Yulong Ruan <ruanyl@amazon.com> Co-authored-by: SuZhou-Joe <suzhou@amazon.com> Co-authored-by: Yulong Ruan <ruanyu1@gmail.com> (cherry picked from commit 1cb5956) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

…) (#7182) * Limit data source saved objects finding and access when workspace enabled * Remove options.workspaces drop behavior in conflict client wrapper * Changeset file for PR #7125 created/updated * Update src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts * Update src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts * Remove formatFindParams * Fix code format * Fix ACLSearchParams and empty workspaces * Refactor workspace client wrapper find * Remove global saved objects validation logic * Update uts and its * Changeset file for PR #7125 created/updated * Remove no need changes and refactor * Fix global saved objects not found * Change saved object get to assert --------- (cherry picked from commit 1cb5956) Signed-off-by: Lin Wang <wonglam@amazon.com> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com> Co-authored-by: Yulong Ruan <ruanyl@amazon.com> Co-authored-by: SuZhou-Joe <suzhou@amazon.com> Co-authored-by: Yulong Ruan <ruanyu1@gmail.com>

Limit data source saved objects finding and access when workspace ena…

30fab0d

…bled Signed-off-by: Lin Wang <wonglam@amazon.com>

github-actions bot added the valued-contributor label Jun 28, 2024

opensearch-changeset-bot bot added a commit to wanglam/OpenSearch-Dashboards that referenced this pull request Jun 28, 2024

Changeset file for PR opensearch-project#7125 created/updated

42923d3

Remove options.workspaces drop behavior in conflict client wrapper

17b36b6

Signed-off-by: Lin Wang <wonglam@amazon.com>

wanglam force-pushed the limit-data-source-permission-when-workspace-enabled branch from 42923d3 to 17b36b6 Compare June 28, 2024 10:22

wanglam marked this pull request as ready for review June 28, 2024 11:27

wanglam requested review from ananzh, kavilla, AMoo-Miki, ashwin-pc, joshuarrrr, abbyhu2000, zengyan-amazon, zhongnansu, manasvinibs, ZilongX, Flyingliuhub, curq, bandinib-amzn, SuZhou-Joe, ruanyl, BionIT, xinruiba, zhyuanqi, mengweieric and LDrago27 as code owners June 28, 2024 11:27

wanglam changed the title ~~[Workspace]Limit data source permission when workspace enabled~~ [Workspace]Restrict data source permission when workspace enabled Jun 28, 2024

opensearch-changeset-bot bot and others added 2 commits June 28, 2024 15:51

Changeset file for PR opensearch-project#7125 created/updated

dadd9b7

Merge branch 'main' into limit-data-source-permission-when-workspace-…

1d08d8c

…enabled

ruanyl reviewed Jul 2, 2024

View reviewed changes

ruanyl added the workspace label Jul 2, 2024

Merge branch 'main' into limit-data-source-permission-when-workspace-…

c996790

…enabled

SuZhou-Joe added backport 2.x v2.16.0 labels Jul 2, 2024

SuZhou-Joe reviewed Jul 2, 2024

View reviewed changes

src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts Outdated Show resolved Hide resolved

wanglam and others added 9 commits July 2, 2024 22:00

Update src/plugins/workspace/server/saved_objects/workspace_saved_obj…

b54291c

…ects_client_wrapper.ts Co-authored-by: SuZhou-Joe <suzhou@amazon.com> Signed-off-by: Lin Wang <wonglam@amazon.com>

Update src/plugins/workspace/server/saved_objects/workspace_saved_obj…

899341c

…ects_client_wrapper.ts Co-authored-by: Yulong Ruan <ruanyu1@gmail.com> Signed-off-by: Lin Wang <wonglam@amazon.com>

Remove formatFindParams

a197688

Signed-off-by: Lin Wang <wonglam@amazon.com>

Fix code format

7b491fd

Signed-off-by: Lin Wang <wonglam@amazon.com>

Merge branch 'main' into limit-data-source-permission-when-workspace-…

ca51d01

…enabled

Fix ACLSearchParams and empty workspaces

a2e6c27

Signed-off-by: Lin Wang <wonglam@amazon.com>

Refactor workspace client wrapper find

9bbb6a3

Signed-off-by: Lin Wang <wonglam@amazon.com>

Remove global saved objects validation logic

15e131e

Signed-off-by: Lin Wang <wonglam@amazon.com>

Update uts and its

eb8bc9c

Signed-off-by: Lin Wang <wonglam@amazon.com>

wanglam changed the title ~~[Workspace]Restrict data source permission when workspace enabled~~ [Workspace]Restrict saved objects finding when workspace enabled Jul 5, 2024

opensearch-changeset-bot bot and others added 5 commits July 5, 2024 03:00

Changeset file for PR opensearch-project#7125 created/updated

8cb4cb3

Remove no need changes and refactor

97dcde0

Signed-off-by: Lin Wang <wonglam@amazon.com>

Merge branch 'main' into limit-data-source-permission-when-workspace-…

12cfce7

…enabled

Fix global saved objects not found

2b1c28b

Signed-off-by: Lin Wang <wonglam@amazon.com>

Change saved object get to assert

185423f

Signed-off-by: Lin Wang <wonglam@amazon.com>

ruanyl approved these changes Jul 5, 2024

View reviewed changes

SuZhou-Joe approved these changes Jul 5, 2024

View reviewed changes

SuZhou-Joe merged commit 1cb5956 into opensearch-project:main Jul 5, 2024
67 checks passed

opensearch-trigger-bot bot mentioned this pull request Jul 5, 2024

[Backport 2.x] [Workspace]Restrict saved objects finding when workspace enabled #7182

Merged

wanglam mentioned this pull request Jul 8, 2024

[Workspace] Restrict saved objects finding for non dashboard admin #7127

Closed

AMoo-Miki added the in-next label Sep 27, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Workspace]Restrict saved objects finding when workspace enabled #7125

[Workspace]Restrict saved objects finding when workspace enabled #7125

wanglam commented Jun 28, 2024 •

edited

Loading

codecov bot commented Jun 28, 2024 •

edited

Loading

ruanyl Jul 2, 2024

[Workspace]Restrict saved objects finding when workspace enabled #7125

[Workspace]Restrict saved objects finding when workspace enabled #7125

Conversation

wanglam commented Jun 28, 2024 • edited Loading

Description

Issues Resolved

Screenshot

Testing the changes

Changelog

Check List

codecov bot commented Jun 28, 2024 • edited Loading

Codecov Report

ruanyl Jul 2, 2024

Choose a reason for hiding this comment

wanglam commented Jun 28, 2024 •

edited

Loading

codecov bot commented Jun 28, 2024 •

edited

Loading