[DRAFT] [Feature] Introduces resource sharing and access-control

.gitignore

@@ -43,7 +43,3 @@ out/
 build/
 gradle-build/
 .gradle/
-
-# nodejs
-node_modules/
-package-lock.json

src/main/java/org/opensearch/security/OpenSearchSecurityPlugin.java

@@ -38,16 +38,7 @@
 import java.security.PrivilegedAction;
 import java.security.Provider;
 import java.security.Security;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Optional;
-import java.util.Set;
+import java.util.*;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.BiFunction;
 import java.util.function.Function;
@@ -68,6 +59,10 @@
 import org.opensearch.OpenSearchSecurityException;
 import org.opensearch.SpecialPermission;
 import org.opensearch.Version;
+import org.opensearch.accesscontrol.resources.EntityType;
+import org.opensearch.accesscontrol.resources.ResourceService;
+import org.opensearch.accesscontrol.resources.ResourceSharing;
+import org.opensearch.accesscontrol.resources.ShareWith;
 import org.opensearch.action.ActionRequest;
 import org.opensearch.action.search.PitService;
 import org.opensearch.action.search.SearchScrollAction;
@@ -120,6 +115,8 @@
 import org.opensearch.plugins.IdentityPlugin;
 import org.opensearch.plugins.MapperPlugin;
 import org.opensearch.plugins.Plugin;
+import org.opensearch.plugins.ResourceAccessControlPlugin;
+import org.opensearch.plugins.ResourcePlugin;
 import org.opensearch.plugins.SecureHttpTransportSettingsProvider;
 import org.opensearch.plugins.SecureSettingsFactory;
 import org.opensearch.plugins.SecureTransportSettingsProvider;
@@ -173,6 +170,10 @@
 import org.opensearch.security.privileges.RestLayerPrivilegesEvaluator;
 import org.opensearch.security.privileges.dlsfls.DlsFlsBaseContext;
 import org.opensearch.security.resolver.IndexResolverReplacer;
+import org.opensearch.security.resources.ResourceAccessHandler;
+import org.opensearch.security.resources.ResourceManagementRepository;
+import org.opensearch.security.resources.ResourceSharingIndexHandler;
+import org.opensearch.security.resources.ResourceSharingIndexListener;
 import org.opensearch.security.rest.DashboardsInfoAction;
 import org.opensearch.security.rest.SecurityConfigUpdateAction;
 import org.opensearch.security.rest.SecurityHealthAction;
@@ -230,9 +231,10 @@ public final class OpenSearchSecurityPlugin extends OpenSearchSecuritySSLPlugin
     implements
         ClusterPlugin,
         MapperPlugin,
+        IdentityPlugin,
+        ResourceAccessControlPlugin,
         // CS-SUPPRESS-SINGLE: RegexpSingleline get Extensions Settings
-        ExtensionAwarePlugin,
-        IdentityPlugin
+        ExtensionAwarePlugin
 // CS-ENFORCE-SINGLE
 
 {
@@ -268,6 +270,9 @@ public final class OpenSearchSecurityPlugin extends OpenSearchSecuritySSLPlugin
     private volatile OpensearchDynamicSetting<Boolean> transportPassiveAuthSetting;
     private volatile PasswordHasher passwordHasher;
     private volatile DlsFlsBaseContext dlsFlsBaseContext;
+    private ResourceManagementRepository rmr;
+    private ResourceAccessHandler resourceAccessHandler;
+    private final Set<String> indicesToListen = new HashSet<>();
 
     public static boolean isActionTraceEnabled() {
 
@@ -708,6 +713,13 @@ public void onIndexModule(IndexModule indexModule) {
                     dlsFlsBaseContext
                 )
             );
+
+            log.info("Indices to listen to: {}", this.indicesToListen);
+            if (this.indicesToListen.contains(indexModule.getIndex().getName())) {
+                indexModule.addIndexOperationListener(ResourceSharingIndexListener.getInstance());
+                log.warn("Security plugin started listening to operations on index {}", indexModule.getIndex().getName());
+            }
+
             indexModule.forceQueryCacheProvider((indexSettings, nodeCache) -> new QueryCache() {
 
                 @Override
@@ -1191,6 +1203,12 @@ public Collection<Object> createComponents(
             e.subscribeForChanges(dcf);
         }
 
+        final var resourceSharingIndex = ConfigConstants.OPENSEARCH_RESOURCE_SHARING_INDEX;
+        ResourceSharingIndexHandler rsIndexHandler = new ResourceSharingIndexHandler(resourceSharingIndex, localClient, threadPool);
+        resourceAccessHandler = new ResourceAccessHandler(threadPool, rsIndexHandler, adminDns);
+
+        rmr = ResourceManagementRepository.create(settings, threadPool, localClient, rsIndexHandler);
+
         components.add(adminDns);
         components.add(cr);
         components.add(xffResolver);
@@ -2065,6 +2083,18 @@ public void onNodeStarted(DiscoveryNode localNode) {
         if (!SSLConfig.isSslOnlyMode() && !client && !disabled && !useClusterStateToInitSecurityConfig(settings)) {
             cr.initOnNodeStart();
         }
+
+        // create resource sharing index if absent
+        rmr.createResourceSharingIndexIfAbsent();
+
+        log.info("Loading resource plugins");
+        for (ResourcePlugin resourcePlugin : OpenSearchSecurityPlugin.GuiceHolder.getResourceService().listResourcePlugins()) {
+            String resourceIndex = resourcePlugin.getResourceIndex();
+
+            this.indicesToListen.add(resourceIndex);
+            log.info("Loaded resource plugin: {}, index: {}", resourcePlugin, resourceIndex);
+        }
+
         final Set<ModuleInfo> securityModules = ReflectionHelper.getModulesLoaded();
         log.info("{} OpenSearch Security modules loaded so far: {}", securityModules.size(), securityModules);
     }
@@ -2166,12 +2196,43 @@ private void tryAddSecurityProvider() {
         });
     }
 
+    @Override
+    public List<String> listAccessibleResourcesInPlugin(String systemIndexName) {
+        return this.resourceAccessHandler.listAccessibleResourcesInPlugin(systemIndexName);
+    }
+
+    @Override
+    public boolean hasPermission(String resourceId, String systemIndexName, String scope) {
+        return this.resourceAccessHandler.hasPermission(resourceId, systemIndexName, scope);
+    }
+
+    @Override
+    public ResourceSharing shareWith(String resourceId, String systemIndexName, ShareWith shareWith) {
+        return this.resourceAccessHandler.shareWith(resourceId, systemIndexName, shareWith);
+    }
+
+    @Override
+    public ResourceSharing revokeAccess(String resourceId, String systemIndexName, Map<EntityType, List<String>> entities) {
+        return this.resourceAccessHandler.revokeAccess(resourceId, systemIndexName, entities);
+    }
+
+    @Override
+    public boolean deleteResourceSharingRecord(String resourceId, String systemIndexName) {
+        return this.resourceAccessHandler.deleteResourceSharingRecord(resourceId, systemIndexName);
+    }
+
+    @Override
+    public boolean deleteAllResourceSharingRecordsForCurrentUser() {
+        return this.resourceAccessHandler.deleteAllResourceSharingRecordsForCurrentUser();
+    }
+
     public static class GuiceHolder implements LifecycleComponent {
 
         private static RepositoriesService repositoriesService;
         private static RemoteClusterService remoteClusterService;
         private static IndicesService indicesService;
         private static PitService pitService;
+        private static ResourceService resourceService;
 
         // CS-SUPPRESS-SINGLE: RegexpSingleline Extensions manager used to allow/disallow TLS connections to extensions
         private static ExtensionsManager extensionsManager;
@@ -2182,13 +2243,15 @@ public GuiceHolder(
             final TransportService remoteClusterService,
             IndicesService indicesService,
             PitService pitService,
-            ExtensionsManager extensionsManager
+            ExtensionsManager extensionsManager,
+            ResourceService resourceService
         ) {
             GuiceHolder.repositoriesService = repositoriesService;
             GuiceHolder.remoteClusterService = remoteClusterService.getRemoteClusterService();
             GuiceHolder.indicesService = indicesService;
             GuiceHolder.pitService = pitService;
             GuiceHolder.extensionsManager = extensionsManager;
+            GuiceHolder.resourceService = resourceService;
         }
         // CS-ENFORCE-SINGLE
 
@@ -2214,6 +2277,10 @@ public static ExtensionsManager getExtensionsManager() {
         }
         // CS-ENFORCE-SINGLE
 
+        public static ResourceService getResourceService() {
+            return resourceService;
+        }
+
         @Override
         public void close() {}