Module org.elasticsearch.xcore

Package org.elasticsearch.xpack.core.security.authz.accesscontrol

Class IndicesAccessControl.IndexAccessControl

java.lang.Object

org.elasticsearch.xpack.core.security.authz.accesscontrol.IndicesAccessControl.IndexAccessControl

All Implemented Interfaces:

CacheKey

Enclosing class:

IndicesAccessControl

public static class IndicesAccessControl.IndexAccessControl
extends Object
implements CacheKey

Encapsulates the field and document permissions for an index.

Field Summary

Fields

Modifier and Type	Field	Description
static final IndicesAccessControl.IndexAccessControl	ALLOW_ALL

Constructor Summary

Constructors

Constructor	Description
IndexAccessControl(FieldPermissions fieldPermissions, DocumentPermissions documentPermissions)
IndexAccessControl(FieldPermissions fieldPermissions, DocumentPermissions documentPermissions, boolean dlsFlsImplicit)

Method Summary

Modifier and Type	Method	Description
void	buildCacheKey(StreamOutput out, SecurityQueryTemplateEvaluator.DlsQueryEvaluationContext context)	Note: dlsFlsImplicit is deliberately excluded from the cache key.
boolean	equals(Object o)
DocumentPermissions	getDocumentPermissions()
FieldPermissions	getFieldPermissions()
int	hashCode()
boolean	isDlsFlsImplicit()	Whether the DLS/FLS on this index was contributed exclusively by implicit grants — for example, those derived from application privileges via an ImplicitPrivilegesProvider rather than by anything declared in the role definition.
IndicesAccessControl.IndexAccessControl	limitIndexAccessControl(IndicesAccessControl.IndexAccessControl limitedByIndexAccessControl)	Returns an instance of IndicesAccessControl.IndexAccessControl, where the privileges for this object are constrained by the privileges contained in the provided parameter. Allowed fields for this index permission would be an intersection of allowed fields. Allowed documents for this index permission would be an intersection of allowed documents. The result is marked implicit when every side that contributed DLS or FLS was already implicit; see the inline rationale.
String	toString()

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Details

ALLOW_ALL

public static final IndicesAccessControl.IndexAccessControl ALLOW_ALL

Constructor Details

IndexAccessControl

public IndexAccessControl(FieldPermissions fieldPermissions,
 DocumentPermissions documentPermissions)

IndexAccessControl

public IndexAccessControl(FieldPermissions fieldPermissions,
 DocumentPermissions documentPermissions,
 boolean dlsFlsImplicit)

Method Details

getFieldPermissions

public FieldPermissions getFieldPermissions()

Returns:

The allowed fields for this index permissions.

getDocumentPermissions

public DocumentPermissions getDocumentPermissions()

Returns:

The allowed documents expressed as a query for this index permission. If null is returned then this means that there are no document level restrictions

isDlsFlsImplicit

public boolean isDlsFlsImplicit()

Whether the DLS/FLS on this index was contributed exclusively by implicit grants — for example, those derived from application privileges via an ImplicitPrivilegesProvider rather than by anything declared in the role definition.

Used to gate license enforcement and feature-usage tracking for DLS/FLS. Returns true only when getFieldPermissions() or getDocumentPermissions() carry actual restrictions and every contributor of those restrictions was implicit; an index without any DLS or FLS therefore reports false. If any explicit DLS/FLS contributed to this index — even alongside implicit grants — the flag is false and the strictest semantics apply.

When two IndicesAccessControl.IndexAccessControl instances are composed via limitIndexAccessControl(org.elasticsearch.xpack.core.security.authz.accesscontrol.IndicesAccessControl.IndexAccessControl) (e.g. for API-key or run-as flows), the result is implicit when every side that contributed DLS/FLS was already implicit. A side with no DLS/FLS is neutral. See that method.

limitIndexAccessControl

public IndicesAccessControl.IndexAccessControl limitIndexAccessControl(IndicesAccessControl.IndexAccessControl limitedByIndexAccessControl)

Returns an instance of IndicesAccessControl.IndexAccessControl, where the privileges for this object are constrained by the privileges contained in the provided parameter.
Allowed fields for this index permission would be an intersection of allowed fields.
Allowed documents for this index permission would be an intersection of allowed documents.
The result is marked implicit when every side that contributed DLS or FLS was already implicit; see the inline rationale.

Parameters:

limitedByIndexAccessControl - IndicesAccessControl.IndexAccessControl

Returns:

IndicesAccessControl.IndexAccessControl

See Also:

• FieldPermissions.limitFieldPermissions(FieldPermissions)
• DocumentPermissions.limitDocumentPermissions(DocumentPermissions)

toString

public String toString()

Overrides:

toString in class Object

buildCacheKey

public void buildCacheKey(StreamOutput out,
 SecurityQueryTemplateEvaluator.DlsQueryEvaluationContext context)
                   throws IOException

Note: dlsFlsImplicit is deliberately excluded from the cache key. Two entries with the same DLS queries and FLS restrictions produce identical query results regardless of whether the restrictions were contributed implicitly (via application-privilege-derived grants) or explicitly (via a role definition), so the request cache should be shared across them.

Specified by:

buildCacheKey in interface CacheKey

Throws:

IOException

equals

public boolean equals(Object o)

Overrides:

equals in class Object

hashCode

public int hashCode()

Overrides:

hashCode in class Object