Record Class PolicyManager.ModuleEntitlements

java.lang.Object
java.lang.Record
org.elasticsearch.entitlement.runtime.policy.PolicyManager.ModuleEntitlements
Record Components:
componentName - the plugin name or else one of the special component names like "(server)".
Enclosing class:
PolicyManager

protected static record PolicyManager.ModuleEntitlements(String componentName, String moduleName, Map<Class<? extends Entitlement>,List<Entitlement>> entitlementsByType, FileAccessTree fileAccess) extends Record
This class contains all the entitlements by type, plus the FileAccessTree for the special case of filesystem entitlements.

We use layers when computing PolicyManager.ModuleEntitlements; first, we check whether the module we are building it for is in the server layer (PolicyManager.SERVER_LAYER_MODULES) (*). If it is, we use the server policy, using the same caller class module name as the scope, and read the entitlements for that scope. Otherwise, we use the PluginResolver to identify the correct plugin layer and find the policy for it (if any). If the plugin is modular, we again use the same caller class module name as the scope, and read the entitlements for that scope. If it's not, we use the single ALL-UNNAMED scope – in this case there is one scope and all entitlements apply to all the plugin code.

(*) implementation detail: this is currently done in an indirect way: we know the module is not in the system layer (otherwise the check would have been already trivially allowed), so we just check that the module is named, and it belongs to the boot ModuleLayer. We might want to change this in the future to make it more consistent/easier to maintain.

  • Constructor Details

    • ModuleEntitlements

      public ModuleEntitlements(String componentName, String moduleName, Map<Class<? extends Entitlement>,List<Entitlement>> entitlementsByType, FileAccessTree fileAccess)
      Creates an instance of a ModuleEntitlements record class.
      Parameters:
      componentName - the value for the componentName record component
      moduleName - the value for the moduleName record component
      entitlementsByType - the value for the entitlementsByType record component
      fileAccess - the value for the fileAccess record component
  • Method Details

    • hasEntitlement

      public boolean hasEntitlement(Class<? extends Entitlement> entitlementClass)
    • getEntitlements

      public <E extends Entitlement> Stream<E> getEntitlements(Class<E> entitlementClass)
    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object
    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object
    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. All components in this record class are compared with Objects::equals(Object,Object).
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.
    • componentName

      public String componentName()
      Returns the value of the componentName record component.
      Returns:
      the value of the componentName record component
    • moduleName

      public String moduleName()
      Returns the value of the moduleName record component.
      Returns:
      the value of the moduleName record component
    • entitlementsByType

      public Map<Class<? extends Entitlement>,List<Entitlement>> entitlementsByType()
      Returns the value of the entitlementsByType record component.
      Returns:
      the value of the entitlementsByType record component
    • fileAccess

      public FileAccessTree fileAccess()
      Returns the value of the fileAccess record component.
      Returns:
      the value of the fileAccess record component