Fixing a test; adding a caching mechanism to avoid calling

findPrivilegesThatGrant each time.
BigPandaToo · Feb 1, 2021 · 7faa52f · 7faa52f
1 parent 93103ae
commit 7faa52f
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 3 deletions.
diff --git a/...urity/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java b/...urity/src/main/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrail.java
@@ -100,6 +100,7 @@
 import java.util.Optional;
 import java.util.Set;
 import java.util.TreeMap;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.function.Supplier;
@@ -1376,6 +1377,9 @@ private static final class EventFilterPolicy {
         private final Predicate<String> ignoreIndexPrivilegesPredicate;
         private final Predicate<String> ignoreClusterPrivilegesPredicate;
 
+        private final ConcurrentHashMap<String, Collection<String>> indexActions = new ConcurrentHashMap<>();
+        private final ConcurrentHashMap<String, Collection<String>> clusterActions = new ConcurrentHashMap<>();
+
         EventFilterPolicy(String name, Settings settings) {
             this(name, parsePredicate(FILTER_POLICY_IGNORE_PRINCIPALS.getConcreteSettingForNamespace(name).get(settings)),
                     parsePredicate(FILTER_POLICY_IGNORE_REALMS.getConcreteSettingForNamespace(name).get(settings)),
@@ -1461,13 +1465,21 @@ private static List<String> emptyStringBuildsEmptyAutomaton(List<String> l) {
 
         private boolean ignoreIndexPrivilegesPredicateTest(String action) {
             if (ignoreIndexPrivilegesPredicate.test(action)) return true;
-            Collection<String> privileges = IndexPrivilege.findPrivilegesThatGrant(action);
+            Collection<String> privileges = indexActions.get(action);
+            if (privileges == null) {
+                privileges = IndexPrivilege.findPrivilegesThatGrant(action);
+                indexActions.put(action, privileges);
+            }
             return privileges != null && privileges.stream().anyMatch((s) -> ignoreIndexPrivilegesPredicate.test(s));
         }
 
         private boolean ignoreClusterPrivilegesPredicateTest(String action) {
             if (ignoreClusterPrivilegesPredicate.test(action)) return true;
-            Collection<String> privileges = ClusterPrivilegeResolver.findPrivilegesThatGrant(action);
+            Collection<String> privileges = clusterActions.get(action);
+            if (privileges == null) {
+                privileges = ClusterPrivilegeResolver.findPrivilegesThatGrant(action);
+                clusterActions.put(action, privileges);
+            }
             return privileges != null && privileges.stream().anyMatch((s) -> ignoreClusterPrivilegesPredicate.test(s));
         }
 

diff --git a/...est/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrailFilterTests.java b/...est/java/org/elasticsearch/xpack/security/audit/logfile/LoggingAuditTrailFilterTests.java
@@ -2032,7 +2032,7 @@ private List<String> randomNonEmptyListOfFilteredPrivileges(List<String> listOfA
         for (int i = 0; i < listOfActions.size(); i++) {
             Collection<String> privileges = AuthorizationService.isIndexAction(listOfActions.get(i)) ?
                 IndexPrivilege.findPrivilegesThatGrant(listOfActions.get(i)) :
-                ClusterPrivilegeResolver.findPrivilegesThatGrant(listOfActions.get(i), null, null);
+                ClusterPrivilegeResolver.findPrivilegesThatGrant(listOfActions.get(i));
             assertNotNull(privileges);
             filtered.addAll(privileges);
         }