[Workspace] add validation for data source in get and bulk_get methods #7596

raintygao · 2024-07-31T04:59:13Z

Description

Add validation for data source in get and bulk get

Screenshot

No UX updates

Testing the changes

In workspace, when getting a data source that doesn't belong to this workspace, this request will be forbidden. Before we didn't do this validation.

Changelog

fix: add validation for data source in get and bulk_get methods

Check List

All tests pass
- yarn test:jest
- yarn test:jest_integration
New functionality includes testing.
New functionality has been documented.
Update CHANGELOG.md
Commits are signed per the DCO using --signoff

Signed-off-by: tygao <[email protected]>

codecov · 2024-07-31T05:15:46Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 63.65%. Comparing base (61d5c49) to head (07fddb0).
Report is 229 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7596   +/-   ##
=======================================
  Coverage   63.64%   63.65%           
=======================================
  Files        3634     3634           
  Lines       80099    80112   +13     
  Branches    12682    12687    +5     
=======================================
+ Hits        50977    50992   +15     
+ Misses      26015    26014    -1     
+ Partials     3107     3106    -1

Flag	Coverage Δ
Linux_1	`30.57% <100.00%> (+0.01%)`	⬆️
Linux_2	`55.58% <ø> (ø)`
Linux_3	`40.58% <ø> (ø)`
Linux_4	`31.32% <ø> (ø)`
Windows_1	`30.59% <100.00%> (+0.01%)`	⬆️
Windows_2	`55.53% <ø> (ø)`
Windows_3	`40.58% <ø> (ø)`
Windows_4	`31.32% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

wanglam · 2024-07-31T06:05:50Z

src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts

+    request: OpenSearchDashboardsRequest
+  ) => {
+    const requestWorkspaceId = getWorkspaceState(request).requestWorkspaceId;
+    if (


Nit: Shall we rewrite to below code?

return !requestWorkspaceId || !!object.workspaces?.includes(requestWorkspaceId)

This looks more clearable to me.

Do you mean we use this code to replace requestWorkspaceId && !(object.workspaces && object.workspaces?.includes(requestWorkspaceId))? I suppose their effect would not be the same.

Not replace the if condition. We can replace the whole if statement.

if ( requestWorkspaceId && !(object.workspaces && object.workspaces?.includes(requestWorkspaceId)) ) { return false; } else { return true; }

can be refactor to

return !requestWorkspaceId || !!object.workspaces?.includes(requestWorkspaceId)

It has better readability to me. The method will return true when request workspace id is empty or object's workspaces attributes includes request workspace id.

!! is used for converting undefined to false, right? This looks more clear, thanks.

Not a big concern, but I do like your original implementation, it's more readable to me, when I read the code, I can easily get that we only disallow the access to data source when request with workspace but the data source is not associated with the workspace. ;D

Signed-off-by: tygao <[email protected]>

…enSearch-Dashboards into data-source-wrapper

ruanyl · 2024-07-31T08:27:51Z

src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts

@@ -179,6 +189,15 @@ export class WorkspaceSavedObjectsClientWrapper {
    return hasPermission;
  }

+  // Data source is a workspace level object, validate if data source has the permission to the given `workspaceIds`


validate if data source has the permission to the given `workspaceIds`

what do you mean by this? should it be

validate if the request has access to the data source within the requested workspace?

Yes, updated.

ruanyl · 2024-07-31T08:31:12Z

src/plugins/workspace/server/saved_objects/workspace_saved_objects_client_wrapper.ts

+    request: OpenSearchDashboardsRequest
+  ) => {
+    const requestWorkspaceId = getWorkspaceState(request).requestWorkspaceId;
+    return !requestWorkspaceId || !!object.workspaces?.includes(requestWorkspaceId);


!requestWorkspaceId this covers the case when outside of a workspace?

No, in WorkspaceState type, requestWorkspaceId could be undefined. Here just want to ensure that the workspaceId to be compared is existing.

The requestWorkspaceId should be exists if user in a workspace. In another words, user should be out of workspace if requestWorkspaceId is undefined right?

We don't need to care whether is in or out of workspace especially here.

Imaging user is in global(requestWorkspaceId is undefined) and try to get a datasource(without workspaces) by id, we should prevent user from getting the datasource detail.

I think the !requestWorkspaceId should be removed.

I think this may be a common case in OSD, this doesn't belong to the concept of workspace/assign/unassign, we should not do extra limitation.

Yeah, agreed. There may be some use cases that users may access data source detail in global.

But can we add a unit test to cover the case when requestWorkspaceId is empty?

Signed-off-by: tygao <[email protected]>

#7596) * add data source validation in get and bulk get Signed-off-by: tygao <[email protected]> * Changeset file for PR #7596 created/updated * update wrapper validate implementation Signed-off-by: tygao <[email protected]> * update comments Signed-off-by: tygao <[email protected]> * test: add cases when not in workspace Signed-off-by: tygao <[email protected]> --------- Signed-off-by: tygao <[email protected]> Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com> (cherry picked from commit 424e241) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

#7596) (#7649) * add data source validation in get and bulk get * Changeset file for PR #7596 created/updated * update wrapper validate implementation * update comments * test: add cases when not in workspace --------- (cherry picked from commit 424e241) Signed-off-by: tygao <[email protected]> Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: opensearch-changeset-bot[bot] <154024398+opensearch-changeset-bot[bot]@users.noreply.github.com>

add data source validation in get and bulk get

64cd0d6

Signed-off-by: tygao <[email protected]>

Merge branch 'main' into data-source-wrapper

949e697

github-actions bot added the all-star-contributor label Jul 31, 2024

Changeset file for PR opensearch-project#7596 created/updated

73f639f

wanglam approved these changes Jul 31, 2024

View reviewed changes

update wrapper validate implementation

8085cdf

Signed-off-by: tygao <[email protected]>

Merge branch 'data-source-wrapper' of https://github.com/raintygao/Op…

5ea63e6

…enSearch-Dashboards into data-source-wrapper

ruanyl reviewed Jul 31, 2024

View reviewed changes

update comments

b86bd63

Signed-off-by: tygao <[email protected]>

ruanyl added v2.17.0 workspace labels Jul 31, 2024

test: add cases when not in workspace

07fddb0

Signed-off-by: tygao <[email protected]>

SuZhou-Joe approved these changes Jul 31, 2024

View reviewed changes

ruanyl approved these changes Aug 1, 2024

View reviewed changes

SuZhou-Joe merged commit 424e241 into opensearch-project:main Aug 2, 2024
67 checks passed

SuZhou-Joe added the backport 2.x label Aug 8, 2024

opensearch-trigger-bot bot mentioned this pull request Aug 8, 2024

[Backport 2.x] [Workspace] add validation for data source in get and bulk_get methods #7649

Merged

AMoo-Miki added the in-next label Sep 27, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Workspace] add validation for data source in get and bulk_get methods #7596

[Workspace] add validation for data source in get and bulk_get methods #7596

raintygao commented Jul 31, 2024

codecov bot commented Jul 31, 2024 •

edited

Loading

wanglam Jul 31, 2024

raintygao Jul 31, 2024

wanglam Jul 31, 2024

raintygao Jul 31, 2024

ruanyl Jul 31, 2024

ruanyl Jul 31, 2024 •

edited

Loading

raintygao Jul 31, 2024

ruanyl Jul 31, 2024

raintygao Jul 31, 2024

wanglam Jul 31, 2024

raintygao Jul 31, 2024

SuZhou-Joe Jul 31, 2024 •

edited

Loading

raintygao Jul 31, 2024

SuZhou-Joe Jul 31, 2024

SuZhou-Joe Jul 31, 2024

[Workspace] add validation for data source in get and bulk_get methods #7596

[Workspace] add validation for data source in get and bulk_get methods #7596

Conversation

raintygao commented Jul 31, 2024

Description

Screenshot

Testing the changes

Changelog

Check List

codecov bot commented Jul 31, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ruanyl Jul 31, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

SuZhou-Joe Jul 31, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Jul 31, 2024 •

edited

Loading

ruanyl Jul 31, 2024 •

edited

Loading

SuZhou-Joe Jul 31, 2024 •

edited

Loading