[Resource Sharing] Allow multiple sharable resource types in single resource index

RESOURCE_SHARING_AND_ACCESS_CONTROL.md

@@ -610,6 +610,7 @@ Read documents from a plugin’s index and migrate ownership and backend role-ba
 | `source_index`         | string  | yes      | Name of the plugin index containing the existing resource documents                                                                                  |
 | `username_path`        | string  | yes      | JSON Pointer to the username field inside each document                                                                                              |
 | `backend_roles_path`   | string  | yes      | JSON Pointer to the backend_roles field (must point to a JSON array)                                                                                 |
+| `type_path`            | string  | no       | JSON Pointer to the resource type field inside each document (required if multiple resource types in same resource index)                            |
 | `default_access_level` | string  | yes      | Default access level to assign migrated backend_roles. Must be one from the available action-groups for this type. See `resource-action-groups.yml`. |
 
 **Example Request**
@@ -619,7 +620,8 @@ Read documents from a plugin’s index and migrate ownership and backend role-ba
 {
   "source_index": ".sample_resource",
   "username_path": "/owner",
-  "backend_roles_path": "/access/backend_roles",
+  "backend_roles_path": "/backend_roles",
+  "type_path": "/type",
   "default_access_level": "read_only"
 }
 ```

sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/TestUtils.java

@@ -39,6 +39,7 @@
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.Matchers.equalTo;
 import static org.hamcrest.Matchers.is;
+import static org.opensearch.sample.utils.Constants.RESOURCE_GROUP_TYPE;
 import static org.opensearch.sample.utils.Constants.RESOURCE_INDEX_NAME;
 import static org.opensearch.sample.utils.Constants.RESOURCE_TYPE;
 import static org.opensearch.sample.utils.Constants.SAMPLE_RESOURCE_PLUGIN_PREFIX;
@@ -79,19 +80,29 @@ public final class TestUtils {
     public static final String SAMPLE_READ_WRITE = "sample_read_write";
     public static final String SAMPLE_FULL_ACCESS = "sample_full_access";
 
+    public static final String SAMPLE_GROUP_READ_ONLY = "sample_group_read_only";
+    public static final String SAMPLE_GROUP_READ_WRITE = "sample_group_read_write";
+    public static final String SAMPLE_GROUP_FULL_ACCESS = "sample_group_full_access";
+
     public static final String SAMPLE_RESOURCE_CREATE_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/create";
     public static final String SAMPLE_RESOURCE_GET_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/get";
     public static final String SAMPLE_RESOURCE_UPDATE_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/update";
     public static final String SAMPLE_RESOURCE_DELETE_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/delete";
     public static final String SAMPLE_RESOURCE_SEARCH_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/search";
 
+    public static final String SAMPLE_RESOURCE_GROUP_CREATE_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/group/create";
+    public static final String SAMPLE_RESOURCE_GROUP_GET_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/group/get";
+    public static final String SAMPLE_RESOURCE_GROUP_UPDATE_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/group/update";
+    public static final String SAMPLE_RESOURCE_GROUP_DELETE_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/group/delete";
+    public static final String SAMPLE_RESOURCE_GROUP_SEARCH_ENDPOINT = SAMPLE_RESOURCE_PLUGIN_PREFIX + "/group/search";
+
     public static final String RESOURCE_SHARING_MIGRATION_ENDPOINT = "_plugins/_security/api/resources/migrate";
     public static final String SECURITY_SHARE_ENDPOINT = "_plugins/_security/api/resource/share";
     public static final String SECURITY_TYPES_ENDPOINT = "_plugins/_security/api/resource/types";
     public static final String SECURITY_LIST_ENDPOINT = "_plugins/_security/api/resource/list";
 
     public static LocalCluster newCluster(boolean featureEnabled, boolean systemIndexEnabled) {
-        return newCluster(featureEnabled, systemIndexEnabled, List.of(RESOURCE_TYPE));
+        return newCluster(featureEnabled, systemIndexEnabled, List.of(RESOURCE_TYPE, RESOURCE_GROUP_TYPE));
     }
 
     public static LocalCluster newCluster(boolean featureEnabled, boolean systemIndexEnabled, List<String> protectedResourceTypes) {
@@ -144,31 +155,37 @@ public static String directSharePayload(String resourceId, String creator, Strin
     public static String migrationPayload_valid() {
         return """
             {
-            "source_index": "%s",
-            "username_path": "%s",
-            "backend_roles_path": "%s",
-            "default_access_level": "%s"
+              "source_index": "%s",
+              "username_path": "%s",
+              "backend_roles_path": "%s",
+              "default_access_level": {
+                "sample-resource": "%s"
+              }
             }
             """.formatted(RESOURCE_INDEX_NAME, "user/name", "user/backend_roles", "sample_read_only");
     }
 
     public static String migrationPayload_valid_withSpecifiedAccessLevel(String accessLevel) {
         return """
             {
-            "source_index": "%s",
-            "username_path": "%s",
-            "backend_roles_path": "%s",
-            "default_access_level": "%s"
+             "source_index": "%s",
+             "username_path": "%s",
+             "backend_roles_path": "%s",
+             "default_access_level": {
+                 "sample-resource": "%s"
+              }
             }
-            """.formatted(RESOURCE_INDEX_NAME, "user/name", "user/backend_roles", accessLevel);
+             """.formatted(RESOURCE_INDEX_NAME, "user/name", "user/backend_roles", accessLevel);
     }
 
     public static String migrationPayload_missingSourceIndex() {
         return """
             {
             "username_path": "%s",
             "backend_roles_path": "%s",
-            "default_access_level": "%s"
+            "default_access_level": {
+              "sample-resource": "%s"
+             }
             }
             """.formatted("user/name", "user/backend_roles", "sample_read_only");
     }
@@ -178,7 +195,9 @@ public static String migrationPayload_missingUserName() {
             {
             "source_index": "%s",
             "backend_roles_path": "%s",
-            "default_access_level": "%s"
+            "default_access_level": {
+              "sample-resource": "%s"
+             }
             }
             """.formatted(RESOURCE_INDEX_NAME, "user/backend_roles", "sample_read_only");
     }
@@ -188,7 +207,9 @@ public static String migrationPayload_missingBackendRoles() {
             {
             "source_index": "%s",
             "username_path": "%s",
-            "default_access_level": "%s"
+            "default_access_level": {
+              "sample-resource": "%s"
+             }
             }
             """.formatted(RESOURCE_INDEX_NAME, "user/name", "sample_read_only");
     }
@@ -330,6 +351,15 @@ public String createSampleResourceAs(TestSecurityConfig.User user, Header... hea
             }
         }
 
+        public String createSampleResourceGroupAs(TestSecurityConfig.User user, Header... headers) {
+            try (TestRestClient client = cluster.getRestClient(user)) {
+                String sample = "{\"name\":\"samplegroup\"}";
+                TestRestClient.HttpResponse resp = client.putJson(SAMPLE_RESOURCE_GROUP_CREATE_ENDPOINT, sample, headers);
+                resp.assertStatusCode(HttpStatus.SC_OK);
+                return resp.getTextFromJsonBody("/message").split(":")[1].trim();
+            }
+        }
+
         public String createRawResourceAs(CertificateData adminCert) {
             try (TestRestClient client = cluster.getRestClient(adminCert)) {
                 String sample = "{\"name\":\"sample\"}";
@@ -353,6 +383,12 @@ public TestRestClient.HttpResponse getResource(String resourceId, TestSecurityCo
             }
         }
 
+        public TestRestClient.HttpResponse getResourceGroup(String resourceGroupId, TestSecurityConfig.User user) {
+            try (TestRestClient client = cluster.getRestClient(user)) {
+                return client.get(SAMPLE_RESOURCE_GROUP_GET_ENDPOINT + "/" + resourceGroupId);
+            }
+        }
+
         private void assertGet(String endpoint, TestSecurityConfig.User user, int status, String expectedString) {
             try (TestRestClient client = cluster.getRestClient(user)) {
                 TestRestClient.HttpResponse response = client.get(endpoint);
@@ -484,6 +520,13 @@ public TestRestClient.HttpResponse updateResource(String resourceId, TestSecurit
             }
         }
 
+        public TestRestClient.HttpResponse updateResourceGroup(String resourceGroupId, TestSecurityConfig.User user, String newName) {
+            try (TestRestClient client = cluster.getRestClient(user)) {
+                String updatePayload = "{" + "\"name\": \"" + newName + "\"}";
+                return client.postJson(SAMPLE_RESOURCE_GROUP_UPDATE_ENDPOINT + "/" + resourceGroupId, updatePayload);
+            }
+        }
+
         public void assertDirectUpdate(String resourceId, TestSecurityConfig.User user, String newName, int status) {
             assertUpdate(RESOURCE_INDEX_NAME + "/_doc/" + resourceId + "?refresh=true", newName, user, status);
         }
@@ -526,6 +569,20 @@ public TestRestClient.HttpResponse shareResource(
             }
         }
 
+        public TestRestClient.HttpResponse shareResourceGroup(
+            String resourceId,
+            TestSecurityConfig.User user,
+            TestSecurityConfig.User target,
+            String accessLevel
+        ) {
+            try (TestRestClient client = cluster.getRestClient(user)) {
+                return client.putJson(
+                    SECURITY_SHARE_ENDPOINT,
+                    putSharingInfoPayload(resourceId, RESOURCE_GROUP_TYPE, accessLevel, Recipient.USERS, target.getName())
+                );
+            }
+        }
+
         public TestRestClient.HttpResponse shareResourceByRole(
             String resourceId,
             TestSecurityConfig.User user,
@@ -540,6 +597,20 @@ public TestRestClient.HttpResponse shareResourceByRole(
             }
         }
 
+        public TestRestClient.HttpResponse shareResourceGroupByRole(
+            String resourceId,
+            TestSecurityConfig.User user,
+            String targetRole,
+            String accessLevel
+        ) {
+            try (TestRestClient client = cluster.getRestClient(user)) {
+                return client.putJson(
+                    SECURITY_SHARE_ENDPOINT,
+                    putSharingInfoPayload(resourceId, RESOURCE_GROUP_TYPE, accessLevel, Recipient.ROLES, targetRole)
+                );
+            }
+        }
+
         public TestRestClient.HttpResponse revokeResource(
             String resourceId,
             TestSecurityConfig.User user,
@@ -555,6 +626,21 @@ public TestRestClient.HttpResponse revokeResource(
             }
         }
 
+        public TestRestClient.HttpResponse revokeResourceGroup(
+            String resourceId,
+            TestSecurityConfig.User user,
+            TestSecurityConfig.User target,
+            String accessLevel
+        ) {
+            PatchSharingInfoPayloadBuilder patchBuilder = new PatchSharingInfoPayloadBuilder();
+            patchBuilder.resourceType(RESOURCE_GROUP_TYPE);
+            patchBuilder.resourceId(resourceId);
+            patchBuilder.revoke(new Recipients(Map.of(Recipient.USERS, Set.of(target.getName()))), accessLevel);
+            try (TestRestClient client = cluster.getRestClient(user)) {
+                return client.patch(TestUtils.SECURITY_SHARE_ENDPOINT, patchBuilder.build());
+            }
+        }
+
         public void assertDirectDelete(String resourceId, TestSecurityConfig.User user, int status) {
             assertDelete(RESOURCE_INDEX_NAME + "/_doc/" + resourceId, user, status);
         }
@@ -569,6 +655,12 @@ public TestRestClient.HttpResponse deleteResource(String resourceId, TestSecurit
             }
         }
 
+        public TestRestClient.HttpResponse deleteResourceGroup(String resourceGroupId, TestSecurityConfig.User user) {
+            try (TestRestClient client = cluster.getRestClient(user)) {
+                return client.delete(SAMPLE_RESOURCE_GROUP_DELETE_ENDPOINT + "/" + resourceGroupId);
+            }
+        }
+
         private void assertDelete(String endpoint, TestSecurityConfig.User user, int status) {
             try (TestRestClient client = cluster.getRestClient(user)) {
                 TestRestClient.HttpResponse response = client.delete(endpoint);

sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/securityapis/ShareableResourceTypesInfoApiTests.java

@@ -22,6 +22,7 @@
 import org.opensearch.test.framework.cluster.TestRestClient;
 
 import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsInAnyOrder;
 import static org.hamcrest.Matchers.equalTo;
 import static org.opensearch.sample.resource.TestUtils.NO_ACCESS_USER;
 import static org.opensearch.sample.resource.TestUtils.RESOURCE_SHARING_INDEX;
@@ -54,10 +55,19 @@ public void testTypesApi_mustListSampleResourceAsAType() {
             TestRestClient.HttpResponse response = client.get(SECURITY_TYPES_ENDPOINT);
             response.assertStatusCode(HttpStatus.SC_OK);
             List<Object> types = (List<Object>) response.bodyAsMap().get("types");
-            assertThat(types.size(), equalTo(1));
-            Map<String, Object> responseBody = (Map<String, Object>) types.getFirst();
-            assertThat(responseBody.get("type"), equalTo("sample-resource"));
-            assertThat(responseBody.get("action_groups"), equalTo(List.of("sample_read_only", "sample_read_write", "sample_full_access")));
+            assertThat(types.size(), equalTo(2));
+            Map<String, Object> firstType = (Map<String, Object>) types.get(0);
+            assertThat(firstType.get("type"), equalTo("sample-resource"));
+            assertThat(
+                (List<String>) firstType.get("action_groups"),
+                containsInAnyOrder("sample_read_only", "sample_read_write", "sample_full_access")
+            );
+            Map<String, Object> secondType = (Map<String, Object>) types.get(1);
+            assertThat(secondType.get("type"), equalTo("sample-resource-group"));
+            assertThat(
+                (List<String>) secondType.get("action_groups"),
+                containsInAnyOrder("sample_group_read_only", "sample_group_read_write", "sample_group_full_access")
+            );
         }
 
     }