[DataSource] Restrict to manage data source on the DSM UI #7214

yubonluo · 2024-07-10T06:22:26Z

Description

Restrict to edit data source on the DSM UI.
manageableBy:

in workspace:
	anyone can not manage data source on the DSM
out of workspace:
	none: anyone can not manage data source on the DSM
	dashboard_admin: only OSD admin can manage source on the DSM
	all: anyone can manage data source on the DSM
in the saved object management page:
         all: anyone can delete/import data source
	dashboard_admin: only OSD admin can delete/import source
	none: anyone can not delete data source

Issues Resolved

#6889

Screenshot

manageableBy="all" or
manageableBy="dashboard_admin" and user is OSD admin

manageableBy="none" or
manageableBy="dashboard_admin" and user is not OSD admin or
user in a workspace

Testing the changes

Clone the latest osd/security-dashboard plugin code and run yarn osd bootstrap
Modify config/opensearch_dashboards.yml

opensearchDashboards.dashboardAdmin.groups: ["dashboard_admin"]
opensearchDashboards.dashboardAdmin.users: ["username"]
workspace.enabled: true 
opensearch.username: "username"
opensearch.password: "password" 
opensearch.ssl.verificationMode: none
savedObjects.permission.enabled: true
data_source.enabled: true
data_source.manageableBy: "all|dashboard_admin|none"

Run yarn start --no-base-path
Operate data source.

Changelog

feat: [DataSource] Restrict to edit data source on the DSM UI.

Check List

All tests pass
- yarn test:jest
- yarn test:jest_integration
New functionality includes testing.
New functionality has been documented.
Update CHANGELOG.md
Commits are signed per the DCO using --signoff

Signed-off-by: yubonluo <[email protected]>

codecov · 2024-07-10T06:37:18Z

Codecov Report

Attention: Patch coverage is 80.00000% with 2 lines in your changes missing coverage. Please review.

Project coverage is 67.30%. Comparing base (d67d6ba) to head (c86002d).

Files	Patch %	Lines
.../data_source_home_panel/data_source_home_panel.tsx	66.66%	0 Missing and 1 partial ⚠️
...rce/components/edit_form/edit_data_source_form.tsx	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7214      +/-   ##
==========================================
- Coverage   67.32%   67.30%   -0.02%     
==========================================
  Files        3500     3500              
  Lines       69225    69232       +7     
  Branches    11276    11282       +6     
==========================================
- Hits        46604    46598       -6     
- Misses      19895    19906      +11     
- Partials     2726     2728       +2

Flag	Coverage Δ
Linux_1	`33.25% <ø> (-0.01%)`	⬇️
Linux_2	`55.30% <ø> (ø)`
Linux_3	`45.28% <80.00%> (+<0.01%)`	⬆️
Windows_1	`?`
Windows_2	`55.25% <ø> (ø)`
Windows_3	`45.29% <80.00%> (+0.01%)`	⬆️
Windows_4	`34.70% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

src/plugins/data_source/server/plugin.ts

config/opensearch_dashboards.yml

Signed-off-by: yubonluo <[email protected]>

…oards into 2.16-restrict-data-source

…earch-Dashboards into 2.16-restrict-data-source

Signed-off-by: yubonluo <[email protected]>

…oards into 2.16-restrict-data-source

Signed-off-by: yubonluo <[email protected]>

SuZhou-Joe · 2024-07-17T06:13:10Z

src/plugins/data_source/server/plugin.ts

+    core.capabilities.registerSwitcher((request) => {
+      const { requestWorkspaceId, isDashboardAdmin } = getWorkspaceState(request);
+      // User can not manage data source in the workspace.
+      const canManage =
+        (manageableBy === ManageableBy.All && !requestWorkspaceId) ||
+        (manageableBy === ManageableBy.DashboardAdmin &&
+          isDashboardAdmin !== false &&
+          !requestWorkspaceId);
+
+      return { dataSource: { canManage } };
+    });


Should we move this switcher to workspace?

SuZhou-Joe · 2024-07-17T06:17:51Z

...ugins/data_source_management/public/components/edit_data_source/components/header/header.tsx

+          {canManageDataSource ? (
+            <EuiFlexItem grow={false}>{renderDefaultIcon()}</EuiFlexItem>
+          ) : null}


Should we restrict user from setting default data source? @ruanyl

opensearch-trigger-bot · 2024-07-17T14:32:34Z

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-2.x
# Create a new branch
git switch --create backport/backport-7214-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 41900a0b3eff6b52c250b76d4ca316c141206a6c
# Push it to GitHub
git push --set-upstream origin backport/backport-7214-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-7214-to-2.x.

opensearch-trigger-bot · 2024-07-18T05:43:14Z

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-2.x
# Create a new branch
git switch --create backport/backport-7214-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 41900a0b3eff6b52c250b76d4ca316c141206a6c
# Push it to GitHub
git push --set-upstream origin backport/backport-7214-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-7214-to-2.x.

restrict to edit data source on the UI

b4e8b5a

Signed-off-by: yubonluo <[email protected]>

yubonluo requested review from ananzh, kavilla, AMoo-Miki, ashwin-pc, joshuarrrr, abbyhu2000, zengyan-amazon, zhongnansu, manasvinibs, ZilongX, Flyingliuhub, curq, bandinib-amzn, SuZhou-Joe, ruanyl, BionIT, xinruiba, zhyuanqi, mengweieric, LDrago27 and virajsanghvi as code owners July 10, 2024 06:22

github-actions bot added the valued-contributor label Jul 10, 2024

Changeset file for PR opensearch-project#7214 created/updated

05e384c

ruanyl reviewed Jul 10, 2024

View reviewed changes

src/plugins/data_source/server/plugin.ts Outdated Show resolved Hide resolved

wanglam reviewed Jul 12, 2024

View reviewed changes

config/opensearch_dashboards.yml Outdated Show resolved Hide resolved

SuZhou-Joe mentioned this pull request Jul 16, 2024

Add datasource readonly feature flag and disable certain routes #7256

Closed

7 tasks

yubonluo added 2 commits July 16, 2024 16:21

restrict user to edit data source in management page

932d68f

Signed-off-by: yubonluo <[email protected]>

Merge branch 'main' of github.com:opensearch-project/OpenSearch-Dashb…

d90cfc9

…oards into 2.16-restrict-data-source

yubonluo added 3 commits July 16, 2024 16:22

Merge branch '2.16-restrict-data-source' of github.com:yubonluo/OpenS…

51e72b3

…earch-Dashboards into 2.16-restrict-data-source

optimize the code

7dc11b8

Signed-off-by: yubonluo <[email protected]>

Merge branch 'main' of github.com:opensearch-project/OpenSearch-Dashb…

014820f

…oards into 2.16-restrict-data-source

yubonluo changed the title ~~[DataSource] Restrict to edit data source on the DSM UI~~ [DataSource] Restrict to manage data source on the DSM UI Jul 17, 2024

optimize the code

4b30816

Signed-off-by: yubonluo <[email protected]>

ruanyl previously approved these changes Jul 17, 2024

View reviewed changes

optimize the code

3e3c892

Signed-off-by: yubonluo <[email protected]>

yubonluo dismissed ruanyl’s stale review via 3e3c892 July 17, 2024 05:55

SuZhou-Joe reviewed Jul 17, 2024

View reviewed changes

Merge branch 'main' into 2.16-restrict-data-source

c86002d

SuZhou-Joe added backport 2.x workspace v2.16.0 labels Jul 17, 2024

SuZhou-Joe approved these changes Jul 17, 2024

View reviewed changes

ruanyl approved these changes Jul 17, 2024

View reviewed changes

SuZhou-Joe merged commit 41900a0 into opensearch-project:main Jul 17, 2024
71 of 73 checks passed

opensearch-trigger-bot bot added the failed backport label Jul 17, 2024

SuZhou-Joe added backport 2.x and removed backport 2.x labels Jul 18, 2024

raintygao mentioned this pull request Jul 18, 2024

[Workspace] Recover data source management in workspace #7296

Merged

7 tasks

This was referenced Jul 18, 2024

[Manual Backport][2.x][Data Source] Restrict to manage data source on the DSM UI #7303

Merged

[Manual Backport][2.x][Data Source] Restrict to manage data source on the DSM UI #7395

Merged

AMoo-Miki removed the failed backport label Aug 22, 2024

yubonluo mentioned this pull request Sep 5, 2024

Add data source permission wrapper and dataSourceAdmin role #8009

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[DataSource] Restrict to manage data source on the DSM UI #7214

[DataSource] Restrict to manage data source on the DSM UI #7214

yubonluo commented Jul 10, 2024 •

edited

Loading

codecov bot commented Jul 10, 2024 •

edited

Loading

SuZhou-Joe Jul 17, 2024

SuZhou-Joe Jul 17, 2024 •

edited

Loading

opensearch-trigger-bot bot commented Jul 17, 2024

opensearch-trigger-bot bot commented Jul 18, 2024

[DataSource] Restrict to manage data source on the DSM UI #7214

[DataSource] Restrict to manage data source on the DSM UI #7214

Conversation

yubonluo commented Jul 10, 2024 • edited Loading

Description

Issues Resolved

Screenshot

Testing the changes

Changelog

Check List

codecov bot commented Jul 10, 2024 • edited Loading

Codecov Report

SuZhou-Joe Jul 17, 2024

Choose a reason for hiding this comment

SuZhou-Joe Jul 17, 2024 • edited Loading

Choose a reason for hiding this comment

opensearch-trigger-bot bot commented Jul 17, 2024

opensearch-trigger-bot bot commented Jul 18, 2024

yubonluo commented Jul 10, 2024 •

edited

Loading

codecov bot commented Jul 10, 2024 •

edited

Loading

SuZhou-Joe Jul 17, 2024 •

edited

Loading