[Connectors Python] Drop unused space.permissions from content query on Confluence Data Center / Server - #4118
Merged
Jan-Kazlouski-elastic merged 4 commits intoJul 1, 2026
Conversation
…erver Follow-up to #4041. The content search query (CONTENT_QUERY, sent to /rest/api/content/search) still requested expand=...,space.permissions for every data source type. On Data Center / Server that field is never consumed: _page_blog_coro derives access control from restrictions plus the Extender SPACE_PERMISSION endpoint, and space.permissions is only read on the Confluence Cloud code path. Like the space query in #4041, sending space.permissions on DC/Server is dead weight and belongs to the expand=permissions defect family that returns HTTP 500 when the caller is not a Confluence admin (CONFSERVER-99908 and similar), forcing customers to over-grant site admin for space enumeration and content sync. Split CONTENT_QUERY into CONTENT_QUERY_CLOUD (unchanged) and CONTENT_QUERY_DATA_CENTER (without space.permissions); get_docs selects the DC/Server-safe query off Cloud, mirroring fetch_spaces and _remote_validation. Cloud behavior is unchanged. A parametrized test pins the query selection across all three data source types. Co-authored-by: Cursor <cursoragent@cursor.com>
Jan-Kazlouski-elastic
marked this pull request as ready for review
July 1, 2026 13:52
Condense the rationale comments on SPACE_QUERY_DATA_CENTER and CONTENT_QUERY_DATA_CENTER to a single line each. No behavior change. Co-authored-by: Cursor <cursoragent@cursor.com>
artem-shelkovnikov
approved these changes
Jul 1, 2026
Jan-Kazlouski-elastic
deleted the
jan-kazlouski/confluence-dc-content-query-permissions
branch
July 1, 2026 17:34
3 tasks
Jan-Kazlouski-elastic
added a commit
that referenced
this pull request
Jul 1, 2026
…t query on Confluence Data Center / Server (#4118) (#4120) Backports the following commits to 9.3: - [Connectors Python] Drop unused `space.permissions` from content query on Confluence Data Center / Server (#4118) Co-authored-by: Jan-Kazlouski-elastic <jan.kazlouski@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Jan-Kazlouski-elastic
added a commit
that referenced
this pull request
Jul 1, 2026
…t query on Confluence Data Center / Server (#4118) (#4121) Backports the following commits to 9.4: - [Connectors Python] Drop unused `space.permissions` from content query on Confluence Data Center / Server (#4118) Co-authored-by: Jan-Kazlouski-elastic <jan.kazlouski@elastic.co> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
Jan-Kazlouski-elastic
added a commit
that referenced
this pull request
Jul 2, 2026
… query on Confluence Data Center / Server (#4118) (#4122) Backport of #4118 to `8.19`. The automatic backport failed to cherry-pick because `8.19` still has the pre-refactor Confluence connector layout (single `connectors/sources/confluence.py`) rather than the `atlassian/confluence/` package on `main`. This PR applies the same functional change by hand. ## Related to elastic/sdh-search#1916 Follow-up to #4041 (already on `8.19` via #4103). `CONTENT_QUERY` — sent to `/rest/api/content/search` by `get_docs` → `_page_blog_coro` → `fetch_documents` for page/blog sync — was hard-coded to `limit=50&expand=...,space,space.permissions,restrictions...` for **every** data source type. The `space.permissions` expansion is only consumed on the Confluence **Cloud** code path: * On Data Center / Server, page/space access control comes from `restrictions` plus the separate `SPACE_PERMISSION` (Extender) endpoint — the `space.permissions` field embedded in content is never read (`_page_blog_coro` reads it only inside the `if data_source_type == CONFLUENCE_CLOUD` branch). Just like the space query fixed in #4041, sending `space.permissions` on DC/Server is dead weight and belongs to the wider `expand=permissions` defect family that returns **HTTP 500** when the calling user is not a Confluence administrator (CONFSERVER-99908 and related). This is the remaining piece of the DC/Server sync path that pushed customers to over-grant full site admin (see sdh-search#1916), even after #4041 fixed `/rest/api/space`. ## What this PR changes * Splits `CONTENT_QUERY` into `CONTENT_QUERY_CLOUD` (unchanged, keeps `space.permissions`) and `CONTENT_QUERY_DATA_CENTER` (drops `space.permissions`), with a comment explaining the rationale (CONFSERVER-99908). * `get_docs` now selects `CONTENT_QUERY_CLOUD` for `confluence_cloud` and `CONTENT_QUERY_DATA_CENTER` otherwise — following the existing `fetch_spaces` / `_remote_validation` idiom from #4041. * Cloud behavior is unchanged. Functionally identical to the change merged on `main` in #4118 (adapted to the single-module `confluence.py` layout on `8.19`). ## Tests A parametrized test (`test_get_docs_uses_correct_content_query_for_data_source_type`) pins the content-query selection across all three data source types (`confluence_cloud`, `confluence_data_center`, `confluence_server`) and asserts `space.permissions` is present only for Cloud. ``` PYTHONPATH=. python -m pytest tests/sources/test_confluence.py -q 71 passed ``` ## Release Note Fix the Confluence connector requesting the unused `space.permissions` expansion on Confluence Data Center / Server content queries, which could trigger HTTP 500 (CONFSERVER-99908) and forced over-privileged (site-admin) functional accounts. Combined with #4041, space enumeration and content sync on DC/Server no longer require Confluence admin. ## Test plan - [x] `pytest tests/sources/test_confluence.py` passes - [ ] Confluence Cloud sync unchanged (still sends `space.permissions`) - [ ] Confluence DC/Server sync succeeds with a non-admin functional user that has read/View on the target space(s) Made with [Cursor](https://cursor.com) Co-authored-by: Cursor <cursoragent@cursor.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to https://github.com/elastic/sdh-search/issues/1916
Follow-up to #4041.
CONTENT_QUERY— sent to/rest/api/content/searchbyget_docs→_page_blog_coro→fetch_documentsfor page/blog sync — was hard-coded tolimit=50&expand=...,space,space.permissions,restrictions...for every data source type. Thespace.permissionsexpansion is only consumed on the Confluence Cloud code path:restrictionsplus the separateSPACE_PERMISSION(Extender) endpoint — thespace.permissionsfield embedded in content is never read (_page_blog_cororeads it only inside theif data_source_type == CONFLUENCE_CLOUDbranch).Just like the space query fixed in #4041, sending
space.permissionson DC/Server is dead weight and belongs to the widerexpand=permissionsdefect family that returns HTTP 500 when the calling user is not a Confluence administrator (CONFSERVER-99908 and related). This is the remaining piece of the DC/Server sync path that pushed customers to over-grant full site admin (see sdh-search#1916), even after #4041 fixed/rest/api/space.What this PR changes
CONTENT_QUERYintoCONTENT_QUERY_CLOUD(unchanged, keepsspace.permissions) andCONTENT_QUERY_DATA_CENTER(dropsspace.permissions) inconstants.py, with a comment explaining the rationale (CONFSERVER-99908).get_docsnow selectsCONTENT_QUERY_CLOUDforconfluence_cloudandCONTENT_QUERY_DATA_CENTERotherwise — following the existingfetch_spaces/_remote_validationidiom from [Connectors Python] Drop unusedexpand=permissions,historyfrom space query on Confluence Data Center / Server #4041.Tests
A parametrized test (
test_get_docs_uses_correct_content_query_for_data_source_type) pins the content-query selection across all three data source types (confluence_cloud,confluence_data_center,confluence_server) and assertsspace.permissionsis present only for Cloud.Release Note
Fix the Confluence connector requesting the unused
space.permissionsexpansion on Confluence Data Center / Server content queries, which could trigger HTTP 500 (CONFSERVER-99908) and forced over-privileged (site-admin) functional accounts. Combined with #4041, space enumeration and content sync on DC/Server no longer require Confluence admin.Test plan
pytest tests/sources/test_confluence.pypassesspace.permissions)Made with Cursor