Skip to content

Commit 1269378

Browse files
ywangdywangd
authored
User Profile - Rename access to labels for request, response and mappings (#85797)
It is agreed that the "access" field should be renamed to the more generic "labels". Data stored in this field are meant to be application specific (similar to "data" but searchable) and ES does not attempt to understand its content or purpose. Hence the more generic name is a better fit.
1 parent df5cb3d commit 1269378

File tree

16 files changed

+58
-52
lines changed

16 files changed

+58
-52
lines changed

‎x-pack/docs/en/rest-api/security/activate-user-profile.asciidoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ users with information that is extracted from the user's authentication object,
2727
including `username`, `full_name`, `roles`, and the authentication realm.
2828

2929
When updating a profile document, the API enables the document if it was
30-
disabled. Any updates do not change existing content for either the `access` or
30+
disabled. Any updates do not change existing content for either the `labels` or
3131
`data` fields.
3232

3333
This API is intended only for use by applications (such as {kib}) that need to
@@ -116,7 +116,7 @@ The API returns the following response:
116116
"email": "jacknich@example.com",
117117
"active": true
118118
},
119-
"access": {},
119+
"labels": {},
120120
"data": {},
121121
"_doc": {
122122
"_primary_term": 88,

‎x-pack/docs/en/rest-api/security/get-user-profile.asciidoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ The API returns the following response for a `uid` matching `u_kd2JMqwUQwSCCOxMv
7979
"email": "jacknich@example.com",
8080
"active": true
8181
},
82-
"access": {},
82+
"labels": {},
8383
"data": {}, <1>
8484
"_doc": {
8585
"_primary_term": 1,
@@ -120,7 +120,7 @@ GET /_security/profile/u_kd2JMqwUQwSCCOxMv7M1vw?data=app1.key1
120120
"email": "jacknich@example.com",
121121
"active": true
122122
},
123-
"access": {},
123+
"labels": {},
124124
"data": {
125125
"app1": {
126126
"key1": "value1"

‎x-pack/docs/en/rest-api/security/update-user-profile-data.asciidoc‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,12 @@ referenced in the request.
2727
[[security-api-update-user-profile-data-desc]]
2828
==== {api-description-title}
2929

30-
The update user profile API updates the `access` and `data` fields of an
30+
The update user profile API updates the `labels` and `data` fields of an
3131
existing user profile document with JSON objects. New keys and their values are
3232
added to the profile document, and conflicting keys are replaced by data that's
3333
included in the request.
3434

35-
For both `access` and `data`, content is namespaced by the top-level fields.
35+
For both `labels` and `data`, content is namespaced by the top-level fields.
3636
The `update_profile_data` global privilege grants privileges for updating only
3737
the allowed namespaces.
3838

@@ -57,10 +57,10 @@ include::{es-repo-dir}/rest-api/common-parms.asciidoc[tag=refresh]
5757
[[security-api-update-user-profile-data-request-body]]
5858
==== {api-request-body-title}
5959

60-
`access`::
60+
`labels`::
6161
(Required*, object)
6262
Searchable data that you want to associate with the user profile.
63-
This field supports a nested data structure. Within the `access` object,
63+
This field supports a nested data structure. Within the `labels` object,
6464
top-level keys cannot begin with an underscore (`_`) or contain a period (`.`).
6565

6666
`data`::
@@ -97,7 +97,7 @@ The following request updates a profile document for a `uid` matching
9797
----
9898
POST /_security/profile/u_kd2JMqwUQwSCCOxMv7M1vw/_data
9999
{
100-
"access": {
100+
"labels": {
101101
"app1": {
102102
"tag": "prod"
103103
}
@@ -117,7 +117,7 @@ You can update the profile data to replace some keys and add new keys:
117117
----
118118
POST /_security/profile/u_kd2JMqwUQwSCCOxMv7M1vw/_data
119119
{
120-
"access": {
120+
"labels": {
121121
"app1": {
122122
"tag": "dev"
123123
}
@@ -150,7 +150,7 @@ If you run the request again, the consolidated profile data is returned:
150150
"email": "jacknich@example.com",
151151
"active": true
152152
},
153-
"access": {
153+
"labels": {
154154
"app1": {
155155
"tag": "dev"
156156
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/profile/Profile.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ public record Profile(
2424
boolean enabled,
2525
long lastSynchronized,
2626
ProfileUser user,
27-
Map<String, Object> access,
27+
Map<String, Object> labels,
2828
Map<String, Object> applicationData,
2929
VersionControl versionControl
3030
) implements Writeable, ToXContentObject {
@@ -129,7 +129,7 @@ public void innerToXContent(XContentBuilder builder, Params params) throws IOExc
129129
builder.field("enabled", enabled);
130130
builder.field("last_synchronized", lastSynchronized);
131131
user.toXContent(builder, params);
132-
builder.field("access", access);
132+
builder.field("labels", labels);
133133
builder.field("data", applicationData);
134134
}
135135

@@ -139,7 +139,7 @@ public void writeTo(StreamOutput out) throws IOException {
139139
out.writeBoolean(enabled);
140140
out.writeLong(lastSynchronized);
141141
user.writeTo(out);
142-
out.writeGenericMap(access);
142+
out.writeGenericMap(labels);
143143
out.writeGenericMap(applicationData);
144144
versionControl.writeTo(out);
145145
}

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/profile/SuggestProfilesResponse.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ public XContentBuilder toXContent(XContentBuilder builder, Params params) throws
9797
{
9898
builder.field("uid", profile.uid());
9999
profile.user().toXContent(builder, params);
100-
builder.field("access", profile.access());
100+
builder.field("labels", profile.labels());
101101
builder.field("data", profile.applicationData());
102102
}
103103
builder.endObject();

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/profile/UpdateProfileDataRequest.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,22 +25,22 @@
2525
public class UpdateProfileDataRequest extends ActionRequest {
2626

2727
private final String uid;
28-
private final Map<String, Object> access;
28+
private final Map<String, Object> labels;
2929
private final Map<String, Object> data;
3030
private final long ifPrimaryTerm;
3131
private final long ifSeqNo;
3232
private final RefreshPolicy refreshPolicy;
3333

3434
public UpdateProfileDataRequest(
3535
String uid,
36-
Map<String, Object> access,
36+
Map<String, Object> labels,
3737
Map<String, Object> data,
3838
long ifPrimaryTerm,
3939
long ifSeqNo,
4040
RefreshPolicy refreshPolicy
4141
) {
4242
this.uid = Objects.requireNonNull(uid, "profile uid must not be null");
43-
this.access = access != null ? access : Map.of();
43+
this.labels = labels != null ? labels : Map.of();
4444
this.data = data != null ? data : Map.of();
4545
this.ifPrimaryTerm = ifPrimaryTerm;
4646
this.ifSeqNo = ifSeqNo;
@@ -50,7 +50,7 @@ public UpdateProfileDataRequest(
5050
public UpdateProfileDataRequest(StreamInput in) throws IOException {
5151
super(in);
5252
this.uid = in.readString();
53-
this.access = in.readMap();
53+
this.labels = in.readMap();
5454
this.data = in.readMap();
5555
this.ifPrimaryTerm = in.readLong();
5656
this.ifSeqNo = in.readLong();
@@ -61,8 +61,8 @@ public String getUid() {
6161
return uid;
6262
}
6363

64-
public Map<String, Object> getAccess() {
65-
return access;
64+
public Map<String, Object> getLabels() {
65+
return labels;
6666
}
6767

6868
public Map<String, Object> getData() {
@@ -82,7 +82,7 @@ public RefreshPolicy getRefreshPolicy() {
8282
}
8383

8484
public Set<String> getApplicationNames() {
85-
final Set<String> names = new HashSet<>(access.keySet());
85+
final Set<String> names = new HashSet<>(labels.keySet());
8686
names.addAll(data.keySet());
8787
return Set.copyOf(names);
8888
}

‎x-pack/plugin/security/qa/profile/src/javaRestTest/java/org/elasticsearch/xpack/security/profile/ProfileIT.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ public class ProfileIT extends ESRestTestCase {
6060
"active": true
6161
},
6262
"last_synchronized": %s,
63-
"access": {
63+
"labels": {
6464
},
6565
"application_data": {
6666
"app1": { "name": "app1" },
@@ -127,7 +127,7 @@ public void testUpdateProfileData() throws IOException {
127127
final Request updateProfileRequest1 = new Request(randomFrom("PUT", "POST"), "_security/profile/" + uid + "/_data");
128128
updateProfileRequest1.setJsonEntity("""
129129
{
130-
"access": {
130+
"labels": {
131131
"app1": { "tags": [ "prod", "east" ] }
132132
},
133133
"data": {
@@ -137,7 +137,7 @@ public void testUpdateProfileData() throws IOException {
137137
assertOK(adminClient().performRequest(updateProfileRequest1));
138138

139139
final Map<String, Object> profileMap1 = doGetProfile(uid, "app1");
140-
assertThat(castToMap(profileMap1.get("access")), equalTo(Map.of("app1", Map.of("tags", List.of("prod", "east")))));
140+
assertThat(castToMap(profileMap1.get("labels")), equalTo(Map.of("app1", Map.of("tags", List.of("prod", "east")))));
141141
assertThat(castToMap(profileMap1.get("data")), equalTo(Map.of("app1", Map.of("theme", "default"))));
142142
}
143143

‎x-pack/plugin/security/src/internalClusterTest/java/org/elasticsearch/xpack/security/profile/ProfileIntegTests.java‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ public void testProfileIndexAutoCreation() {
9494
"properties"
9595
);
9696

97-
assertThat(userProfileProperties.keySet(), hasItems("uid", "enabled", "last_synchronized", "user", "access", "application_data"));
97+
assertThat(userProfileProperties.keySet(), hasItems("uid", "enabled", "last_synchronized", "user", "labels", "application_data"));
9898
}
9999

100100
public void testActivateProfile() {
@@ -123,7 +123,7 @@ public void testActivateProfile() {
123123
assertThat(profile3.user().email(), equalTo(RAC_USER_NAME + "@example.com"));
124124
assertThat(profile3.user().fullName(), nullValue());
125125
assertThat(profile3.user().roles(), contains(RAC_ROLE));
126-
assertThat(profile3.access(), anEmptyMap());
126+
assertThat(profile3.labels(), anEmptyMap());
127127
// Get by ID immediately should get the same document and content as the response to activate
128128
assertThat(getProfile(profile3.uid(), Set.of()), equalTo(profile3));
129129

@@ -132,7 +132,7 @@ public void testActivateProfile() {
132132
.setDoc("""
133133
{
134134
"user_profile": {
135-
"access": {
135+
"labels": {
136136
"my_app": {
137137
"tag": "prod"
138138
}
@@ -151,7 +151,7 @@ public void testActivateProfile() {
151151
// Above manual update should be successful
152152
final Profile profile4 = getProfile(profile3.uid(), Set.of("my_app"));
153153
assertThat(profile4.uid(), equalTo(profile3.uid()));
154-
assertThat(profile4.access(), equalTo(Map.of("my_app", Map.of("tag", "prod"))));
154+
assertThat(profile4.labels(), equalTo(Map.of("my_app", Map.of("tag", "prod"))));
155155
assertThat(profile4.applicationData(), equalTo(Map.of("my_app", Map.of("theme", "default"))));
156156

157157
// Update native rac user
@@ -168,8 +168,8 @@ public void testActivateProfile() {
168168
assertThat(profile5.user().email(), nullValue());
169169
assertThat(profile5.user().fullName(), equalTo("Native RAC User"));
170170
assertThat(profile5.user().roles(), containsInAnyOrder(RAC_ROLE, "superuser"));
171-
// Re-activate should not change access
172-
assertThat(profile5.access(), equalTo(Map.of("my_app", Map.of("tag", "prod"))));
171+
// Re-activate should not change labels
172+
assertThat(profile5.labels(), equalTo(Map.of("my_app", Map.of("tag", "prod"))));
173173
// Get by ID immediately should get the same document and content as the response to activate
174174
assertThat(getProfile(profile5.uid(), Set.of()), equalTo(profile5));
175175
// Re-activate should not change application data
@@ -192,7 +192,7 @@ public void testUpdateProfileData() {
192192
final Profile profile2 = getProfile(profile1.uid(), Set.of("app1", "app2"));
193193

194194
assertThat(profile2.uid(), equalTo(profile1.uid()));
195-
assertThat(profile2.access(), equalTo(Map.of("app1", List.of("tab1", "tab2"))));
195+
assertThat(profile2.labels(), equalTo(Map.of("app1", List.of("tab1", "tab2"))));
196196
assertThat(profile2.applicationData(), equalTo(Map.of("app1", Map.of("name", "app1", "type", "app"))));
197197

198198
// Update again should be incremental
@@ -208,7 +208,7 @@ public void testUpdateProfileData() {
208208

209209
final Profile profile3 = getProfile(profile1.uid(), Set.of("app1", "app2"));
210210
assertThat(profile3.uid(), equalTo(profile1.uid()));
211-
assertThat(profile3.access(), equalTo(profile2.access()));
211+
assertThat(profile3.labels(), equalTo(profile2.labels()));
212212
assertThat(
213213
profile3.applicationData(),
214214
equalTo(Map.of("app1", Map.of("name", "app1_take2", "type", "app", "active", false), "app2", Map.of("name", "app2")))
@@ -217,7 +217,7 @@ public void testUpdateProfileData() {
217217
// Activate profile again should not affect the data section
218218
doActivateProfile(RAC_USER_NAME, TEST_PASSWORD_SECURE_STRING);
219219
final Profile profile4 = getProfile(profile1.uid(), Set.of("app1", "app2"));
220-
assertThat(profile4.access(), equalTo(profile3.access()));
220+
assertThat(profile4.labels(), equalTo(profile3.labels()));
221221
assertThat(profile4.applicationData(), equalTo(profile3.applicationData()));
222222

223223
// Update non-existent profile should throw error

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1403,7 +1403,7 @@ LogEntryBuilder withRequestBody(UpdateProfileDataRequest updateProfileDataReques
14031403
XContentBuilder builder = JsonXContent.contentBuilder().humanReadable(true);
14041404
builder.startObject()
14051405
.field("uid", updateProfileDataRequest.getUid())
1406-
.field("access", updateProfileDataRequest.getAccess())
1406+
.field("labels", updateProfileDataRequest.getLabels())
14071407
.field("data", updateProfileDataRequest.getData())
14081408
.endObject();
14091409
logEntry.with(PUT_CONFIG_FIELD_NAME, Strings.toString(builder));

‎x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/profile/ProfileDocument.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ public record ProfileDocument(
4040
boolean enabled,
4141
long lastSynchronized,
4242
ProfileDocumentUser user,
43-
Map<String, Object> access,
43+
Map<String, Object> labels,
4444
BytesReference applicationData
4545
) implements ToXContentObject {
4646

@@ -80,10 +80,10 @@ public XContentBuilder toXContent(XContentBuilder builder, Params params) throws
8080
builder.field("last_synchronized", lastSynchronized);
8181
user.toXContent(builder, params);
8282

83-
if (params.paramAsBoolean("include_access", true) && access != null) {
84-
builder.field("access", access);
83+
if (params.paramAsBoolean("include_labels", true) && labels != null) {
84+
builder.field("labels", labels);
8585
} else {
86-
builder.startObject("access").endObject();
86+
builder.startObject("labels").endObject();
8787
}
8888
if (params.paramAsBoolean("include_data", true) && applicationData != null) {
8989
builder.field("application_data", applicationData);
@@ -199,7 +199,7 @@ public static ProfileDocument fromXContent(XContentParser parser) {
199199
PROFILE_DOC_PARSER.declareBoolean(constructorArg(), new ParseField("enabled"));
200200
PROFILE_DOC_PARSER.declareLong(constructorArg(), new ParseField("last_synchronized"));
201201
PROFILE_DOC_PARSER.declareObject(constructorArg(), (p, c) -> PROFILE_DOC_USER_PARSER.parse(p, null), new ParseField("user"));
202-
PROFILE_DOC_PARSER.declareObject(constructorArg(), (p, c) -> p.map(), new ParseField("access"));
202+
PROFILE_DOC_PARSER.declareObject(constructorArg(), (p, c) -> p.map(), new ParseField("labels"));
203203
ObjectParserHelper.declareRawObject(PROFILE_DOC_PARSER, constructorArg(), new ParseField("application_data"));
204204

205205
PARSER.declareObject(constructorArg(), (p, c) -> PROFILE_DOC_PARSER.parse(p, null), new ParseField("user_profile"));

0 commit comments

Comments
 (0)