chore(search): allow explicit index true#2144
Conversation
WalkthroughThe OpenSearch domain configuration in the infrastructure stack was modified to enable explicit index handling in multi-action requests. Specifically, the Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@infra/stacks/opensearch/index.ts`:
- Around line 148-151: The global advancedOptions entry
'rest.action.multi.allow_explicit_index': 'true' should be gated behind a
stack/config toggle instead of enabled for every client; add a boolean config
flag (e.g., allowExplicitIndex or enable_multi_explicit_index) defaulting to
false and use that flag when building the advancedOptions object in this file so
the key is only added when true, and update the slow-log helper
(configure_slow_logs.ts) or the stack deployment invocation to read/enable this
flag so the slow-log script runs with the explicit-index permission only when
the stack opt-in is set.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: c1785626-9f55-432a-ae56-f02340762b13
📒 Files selected for processing (1)
infra/stacks/opensearch/index.ts
| advancedOptions: { | ||
| // when set to false, bulk operations requires more specific index targeting for safety, preventing accidental operations across multiple indices. | ||
| 'rest.action.multi.allow_explicit_index': 'false', | ||
| 'rest.action.multi.allow_explicit_index': 'true', | ||
| }, |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== OpenSearch wildcard/multi-action usage =="
rg -n -C2 -g '!**/node_modules/**' -g '!**/dist/**' \
'\b_all\b|/_all\b|_bulk\b|_msearch\b|_delete_by_query\b|_update_by_query\b|allow_explicit_index'
echo
echo "== Pulumi stack config related to this setting =="
fd '^Pulumi\..*\.ya?ml$' -t f -x sh -c '
echo "-- {} --"
rg -n "opensearch-allow-explicit-index|allow_explicit_index" "{}" || true
'Repository: macro-inc/macro
Length of output: 50371
🏁 Script executed:
cat -n infra/stacks/opensearch/index.ts | head -200Repository: macro-inc/macro
Length of output: 7768
🏁 Script executed:
# Search for actual OpenSearch operations, not DB bulk operations
rg -n "opensearch|OpenSearch" infra/stacks/opensearch/index.ts -A 5 -B 5Repository: macro-inc/macro
Length of output: 5035
🏁 Script executed:
# Look for scripts or operations that might use _all
rg -n "slowlog|slow.log|script|maintenance" infra/stacks/opensearch/index.tsRepository: macro-inc/macro
Length of output: 486
🏁 Script executed:
# Check if config infrastructure exists for stack-specific settings
fd -t f "\.ts$" infra/ | xargs rg -l "getBoolean|config.*stack" | head -20Repository: macro-inc/macro
Length of output: 860
🏁 Script executed:
# Look for OpenSearch client library usage
rg -n "opensearch|OpenSearch" rust/ --type rust -l | head -20Repository: macro-inc/macro
Length of output: 1314
🏁 Script executed:
# Check how config.getBoolean is used elsewhere
rg -n "config\.getBoolean|config\.get\(" infra/stacks/ -A 1 | head -40Repository: macro-inc/macro
Length of output: 2100
🏁 Script executed:
# Search for actual client operations with _all or bulk operations
rg -n "_all|_bulk|_msearch" --type ts --type js infra/ rust/Repository: macro-inc/macro
Length of output: 547
🏁 Script executed:
cat -n infra/stacks/opensearch/helpers/scripts/configure_slow_logs.tsRepository: macro-inc/macro
Length of output: 2653
🏁 Script executed:
# Check how this script is invoked
rg -n "configure_slow_logs" infra/ -B 3 -A 3Repository: macro-inc/macro
Length of output: 41
Gate this setting via config instead of enabling globally for all clients.
The 'rest.action.multi.allow_explicit_index': 'true' setting is required only by the slow-log configuration script at infra/stacks/opensearch/helpers/scripts/configure_slow_logs.ts. Rather than enabling _all operations for every client, make this an explicit stack-aware toggle so production defaults to restrictive behavior.
Suggested hardening diff
+const allowExplicitIndex =
+ config.getBoolean('opensearch-allow-explicit-index') ??
+ (stack !== 'prod');
+
...
advancedOptions: {
// when set to false, bulk operations requires more specific index targeting for safety, preventing accidental operations across multiple indices.
- 'rest.action.multi.allow_explicit_index': 'true',
+ 'rest.action.multi.allow_explicit_index': allowExplicitIndex ? 'true' : 'false',
},🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@infra/stacks/opensearch/index.ts` around lines 148 - 151, The global
advancedOptions entry 'rest.action.multi.allow_explicit_index': 'true' should be
gated behind a stack/config toggle instead of enabled for every client; add a
boolean config flag (e.g., allowExplicitIndex or enable_multi_explicit_index)
defaulting to false and use that flag when building the advancedOptions object
in this file so the key is only added when true, and update the slow-log helper
(configure_slow_logs.ts) or the stack deployment invocation to read/enable this
flag so the slow-log script runs with the explicit-index permission only when
the stack opt-in is set.
1 participant
the configure slow logs scripts uses _all so we need this setting back to its default. we don't really require this extra safety layer atm