1616import static org .opensearch .ad .settings .AnomalyDetectorSettings .AD_FILTER_BY_BACKEND_ROLES ;
1717import static org .opensearch .timeseries .util .ParseUtils .checkFilterByBackendRoles ;
1818import static org .opensearch .timeseries .util .ParseUtils .getConfig ;
19+ import static org .opensearch .timeseries .util .ParseUtils .verifyResourceAccessAndProcessRequest ;
1920import static org .opensearch .timeseries .util .RestHandlerUtils .wrapRestActionListener ;
2021
2122import java .util .List ;
2728import org .opensearch .action .support .ActionFilters ;
2829import org .opensearch .action .support .HandledTransportAction ;
2930import org .opensearch .action .support .WriteRequest ;
31+ import org .opensearch .ad .constant .ADResourceScope ;
3032import org .opensearch .ad .constant .ConfigConstants ;
3133import org .opensearch .ad .indices .ADIndexManagement ;
3234import org .opensearch .ad .model .AnomalyDetector ;
5254import org .opensearch .timeseries .util .SecurityClientUtil ;
5355import org .opensearch .transport .TransportService ;
5456import org .opensearch .transport .client .Client ;
57+ import org .opensearch .transport .client .node .NodeClient ;
5558
5659public class IndexAnomalyDetectorTransportAction extends HandledTransportAction <IndexAnomalyDetectorRequest , IndexAnomalyDetectorResponse > {
5760 private static final Logger LOG = LogManager .getLogger (IndexAnomalyDetectorTransportAction .class );
@@ -66,6 +69,7 @@ public class IndexAnomalyDetectorTransportAction extends HandledTransportAction<
6669 private final SearchFeatureDao searchFeatureDao ;
6770 private final Settings settings ;
6871 private final boolean resourceSharingEnabled ;
72+ private final NodeClient nodeClient ;
6973
7074 @ Inject
7175 public IndexAnomalyDetectorTransportAction (
@@ -78,7 +82,8 @@ public IndexAnomalyDetectorTransportAction(
7882 ADIndexManagement anomalyDetectionIndices ,
7983 NamedXContentRegistry xContentRegistry ,
8084 ADTaskManager adTaskManager ,
81- SearchFeatureDao searchFeatureDao
85+ SearchFeatureDao searchFeatureDao ,
86+ NodeClient nodeClient
8287 ) {
8388 super (IndexAnomalyDetectorAction .NAME , transportService , actionFilters , IndexAnomalyDetectorRequest ::new );
8489 this .client = client ;
@@ -94,6 +99,7 @@ public IndexAnomalyDetectorTransportAction(
9499 this .settings = settings ;
95100 this .resourceSharingEnabled = settings
96101 .getAsBoolean (ConfigConstants .OPENSEARCH_RESOURCE_SHARING_ENABLED , ConfigConstants .OPENSEARCH_RESOURCE_SHARING_ENABLED_DEFAULT );
102+ this .nodeClient = nodeClient ;
97103 }
98104
99105 @ Override
@@ -103,7 +109,29 @@ protected void doExecute(Task task, IndexAnomalyDetectorRequest request, ActionL
103109 RestRequest .Method method = request .getMethod ();
104110 String errorMessage = method == RestRequest .Method .PUT ? FAIL_TO_UPDATE_DETECTOR : FAIL_TO_CREATE_DETECTOR ;
105111 ActionListener <IndexAnomalyDetectorResponse > listener = wrapRestActionListener (actionListener , errorMessage );
112+
106113 try (ThreadContext .StoredContext context = client .threadPool ().getThreadContext ().stashContext ()) {
114+ if (resourceSharingEnabled ) {
115+ // Call verifyResourceAccessAndProcessRequest before proceeding
116+ verifyResourceAccessAndProcessRequest (
117+ user ,
118+ detectorId ,
119+ ADResourceScope .AD_FULL_ACCESS .value (),
120+ nodeClient ,
121+ settings ,
122+ listener ,
123+ args -> indexDetector (
124+ user ,
125+ detectorId ,
126+ method ,
127+ listener ,
128+ detector -> adExecute (request , user , detector , context , listener )
129+ ) // Execute only if access is granted
130+ );
131+ return ;
132+ }
133+
134+ // Proceed with normal execution if resource sharing is not enabled
107135 resolveUserAndExecute (user , detectorId , method , listener , (detector ) -> adExecute (request , user , detector , context , listener ));
108136 } catch (Exception e ) {
109137 LOG .error (e );
@@ -119,44 +147,51 @@ private void resolveUserAndExecute(
119147 Consumer <AnomalyDetector > function
120148 ) {
121149 try {
122- // If resource sharing flag is enabled then access evaluation will be performed at DLS level
123- if (!resourceSharingEnabled && filterByEnabled ) {
124- // Check if user has backend roles
125- // When filter by is enabled, block users creating/updating detectors who do not have backend roles.
150+ if (filterByEnabled ) {
126151 String error = checkFilterByBackendRoles (requestedUser );
127152 if (error != null ) {
128153 listener .onFailure (new TimeSeriesException (error ));
129154 return ;
130155 }
131156 }
132- if (method == RestRequest .Method .PUT ) {
133- // requestedUser == null means security is disabled or user is superadmin. In this case we don't need to
134- // check if request user have access to the detector or not. But we still need to get current detector for
135- // this case, so we can keep current detector's user data.
136- boolean filterByBackendRole = requestedUser == null ? false : filterByEnabled ;
137- // Update detector request, check if user has permissions to update the detector
138- // Get detector and verify backend roles
139- getConfig (
140- requestedUser ,
141- detectorId ,
142- listener ,
143- function ,
144- client ,
145- clusterService ,
146- xContentRegistry ,
147- filterByBackendRole ,
148- AnomalyDetector .class ,
149- resourceSharingEnabled
150- );
151- } else {
152- // Create Detector. No need to get current detector.
153- function .accept (null );
154- }
157+
158+ indexDetector (requestedUser , detectorId , method , listener , function );
155159 } catch (Exception e ) {
156160 listener .onFailure (e );
157161 }
158162 }
159163
164+ private void indexDetector (
165+ User requestedUser ,
166+ String detectorId ,
167+ RestRequest .Method method ,
168+ ActionListener <IndexAnomalyDetectorResponse > listener ,
169+ Consumer <AnomalyDetector > function
170+ ) {
171+ if (method == RestRequest .Method .PUT ) {
172+ // requestedUser == null means security is disabled or user is superadmin. In this case we don't need to
173+ // check if request user have access to the detector or not. But we still need to get current detector for
174+ // this case, so we can keep current detector's user data.
175+ boolean filterByBackendRole = requestedUser == null ? false : filterByEnabled ;
176+ // Update detector request, check if user has permissions to update the detector
177+ // Get detector and verify backend roles
178+ getConfig (
179+ requestedUser ,
180+ detectorId ,
181+ listener ,
182+ function ,
183+ client ,
184+ clusterService ,
185+ xContentRegistry ,
186+ filterByBackendRole ,
187+ AnomalyDetector .class
188+ );
189+ } else {
190+ // Create Detector. No need to get current detector.
191+ function .accept (null );
192+ }
193+ }
194+
160195 protected void adExecute (
161196 IndexAnomalyDetectorRequest request ,
162197 User user ,
0 commit comments