Workspace aware sharing records

sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/FeatureFlagSettingTests.java

@@ -258,7 +258,7 @@ public void testBehaviorAfterEnabling() throws Exception {
             migrateResponse.assertStatusCode(HttpStatus.SC_OK);
             assertThat(
                 migrateResponse.bodyAsMap().get("summary"),
-                equalTo("Migration complete. migrated 1; skippedNoType 0; skippedExisting 0; failed 0")
+                equalTo("Migration complete. migrated 1; backfilledExisting 0; skippedNoType 0; skippedExisting 0; failed 0")
             );
         }
 

sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/feature/ProtectedTypesSettingTests.java

@@ -260,7 +260,7 @@ public void testResourceProtected() throws Exception {
             migrateResponse.assertStatusCode(HttpStatus.SC_OK);
             assertThat(
                 migrateResponse.bodyAsMap().get("summary"),
-                equalTo("Migration complete. migrated 1; skippedNoType 0; skippedExisting 0; failed 0")
+                equalTo("Migration complete. migrated 1; backfilledExisting 0; skippedNoType 0; skippedExisting 0; failed 0")
             );
         }
 

sample-resource-plugin/src/integrationTest/java/org/opensearch/sample/resource/securityapis/MigrateApiTests.java

@@ -180,7 +180,7 @@ public void testMigrateAPIWithRestAdmin_valid() {
             migrateResponse.assertStatusCode(HttpStatus.SC_OK);
             assertThat(
                 migrateResponse.bodyAsMap().get("summary"),
-                equalTo("Migration complete. migrated 2; skippedNoType 0; skippedExisting 0; failed 0")
+                equalTo("Migration complete. migrated 2; backfilledExisting 0; skippedNoType 0; skippedExisting 0; failed 0")
             );
             assertThat(migrateResponse.bodyAsMap().get("resourcesWithDefaultOwner"), equalTo(List.of(resourceIdNoUser)));
         }
@@ -215,7 +215,7 @@ public void testMigrateAPIWithSuperAdmin_valid() {
             migrateResponse.assertStatusCode(HttpStatus.SC_OK);
             assertThat(
                 migrateResponse.bodyAsMap().get("summary"),
-                equalTo("Migration complete. migrated 2; skippedNoType 0; skippedExisting 0; failed 0")
+                equalTo("Migration complete. migrated 2; backfilledExisting 0; skippedNoType 0; skippedExisting 0; failed 0")
             );
             assertThat(migrateResponse.bodyAsMap().get("resourcesWithDefaultOwner"), equalTo(List.of(resourceIdNoUser)));
 
@@ -247,7 +247,7 @@ public void testMigrateTwice_shouldSkipSecondTime() {
             migrateResponse.assertStatusCode(HttpStatus.SC_OK);
             assertThat(
                 migrateResponse.bodyAsMap().get("summary"),
-                equalTo("Migration complete. migrated 2; skippedNoType 0; skippedExisting 0; failed 0")
+                equalTo("Migration complete. migrated 2; backfilledExisting 0; skippedNoType 0; skippedExisting 0; failed 0")
             );
             assertThat(migrateResponse.bodyAsMap().get("resourcesWithDefaultOwner"), equalTo(List.of(resourceIdNoUser)));
 
@@ -273,7 +273,7 @@ public void testMigrateTwice_shouldSkipSecondTime() {
             migrateResponse.assertStatusCode(HttpStatus.SC_OK);
             assertThat(
                 migrateResponse.bodyAsMap().get("summary"),
-                equalTo("Migration complete. migrated 0; skippedNoType 0; skippedExisting 2; failed 0")
+                equalTo("Migration complete. migrated 0; backfilledExisting 0; skippedNoType 0; skippedExisting 2; failed 0")
             );
             assertThat(migrateResponse.bodyAsMap().get("resourcesWithDefaultOwner"), equalTo(List.of(resourceIdNoUser)));
 
@@ -294,6 +294,91 @@ public void testMigrateTwice_shouldSkipSecondTime() {
         }
     }
 
+    @Test
+    public void testLiveIndexingStampsWorkspacesOnSharingRecord() {
+        // Steady-state: creating a resource with a workspaces field must trigger ResourceIndexListener to
+        // extract the (multi-valued) workspaces from the parsed doc via extractMultiValuedFieldFromIndexOp and
+        // store them on the sharing record (used by the write-path access-level fan-out). Workspace membership is
+        // NOT projected into all_shared_principals; read-path visibility filters the resource's own `workspaces`
+        // field in DLS. Also confirms the Lucene getFields() materialization works for the sample plugin's mapping.
+        String resourceId = createSampleResourceWithWorkspaces("ws-a", "ws-b");
+
+        try (TestRestClient client = cluster.getRestClient(cluster.getAdminCertificate())) {
+            // The sharing record carries the workspaces field (for the write-path fan-out).
+            TestRestClient.HttpResponse sharingDoc = client.get(RESOURCE_SHARING_INDEX + "/_doc/" + resourceId);
+            sharingDoc.assertStatusCode(HttpStatus.SC_OK);
+            ArrayNode ws = (ArrayNode) sharingDoc.bodyAsJsonNode().get("_source").get("workspaces");
+            List<String> workspaceIds = new ArrayList<>();
+            ws.forEach(n -> workspaceIds.add(n.asString()));
+            assertThat(workspaceIds, containsInAnyOrder("ws-a", "ws-b"));
+
+            // all_shared_principals stays usernames/roles only -- no workspace:<id> denormalization.
+            TestRestClient.HttpResponse resourceDoc = client.get(RESOURCE_INDEX_NAME + "/_doc/" + resourceId);
+            resourceDoc.assertStatusCode(HttpStatus.SC_OK);
+            ArrayNode principals = (ArrayNode) resourceDoc.bodyAsJsonNode().get("_source").get("all_shared_principals");
+            List<String> principalList = new ArrayList<>();
+            principals.forEach(n -> principalList.add(n.asString()));
+            assertThat(principalList, containsInAnyOrder("user:" + MIGRATION_USER.getName()));
+
+            // The resource doc keeps its own `workspaces` field -- this is what DLS filters on for read visibility.
+            ArrayNode docWs = (ArrayNode) resourceDoc.bodyAsJsonNode().get("_source").get("workspaces");
+            List<String> docWorkspaceIds = new ArrayList<>();
+            docWs.forEach(n -> docWorkspaceIds.add(n.asString()));
+            assertThat(docWorkspaceIds, containsInAnyOrder("ws-a", "ws-b"));
+        }
+    }
+
+    @Test
+    public void testMigrateBackfillsWorkspacesOntoExistingRecord() {
+        // A resource whose sharing record already exists (created at resource-creation time) but which has
+        // since gained workspace membership on its source doc. Migration should not re-create the record; it
+        // should backfill the workspaces field and refresh all_shared_principals.
+        String resourceId = createSampleResource();
+
+        try (TestRestClient client = cluster.getRestClient(cluster.getAdminCertificate())) {
+            // Add workspace membership to the resource's source doc (an _update, so no new sharing record is
+            // created). The existing sharing record stays workspace-blind until migration backfills it.
+            TestRestClient.HttpResponse update = client.postJson(
+                RESOURCE_INDEX_NAME + "/_update/" + resourceId + "?refresh=true",
+                "{ \"doc\": { \"workspaces\": [\"ws-a\", \"ws-b\"] } }"
+            );
+            update.assertStatusCode(HttpStatus.SC_OK);
+
+            // Migrate without clearing: the record exists, so create is skipped; the source doc now has
+            // workspaces, so it is backfilled rather than skipped.
+            TestRestClient.HttpResponse migrateResponse = client.postJson(RESOURCE_SHARING_MIGRATION_ENDPOINT, migrationPayload_valid());
+            migrateResponse.assertStatusCode(HttpStatus.SC_OK);
+            assertThat(
+                migrateResponse.bodyAsMap().get("summary"),
+                equalTo("Migration complete. migrated 0; backfilledExisting 1; skippedNoType 0; skippedExisting 0; failed 0")
+            );
+
+            // The sharing record now carries the workspaces field.
+            TestRestClient.HttpResponse sharingDoc = client.get(RESOURCE_SHARING_INDEX + "/_doc/" + resourceId);
+            sharingDoc.assertStatusCode(HttpStatus.SC_OK);
+            ArrayNode ws = (ArrayNode) sharingDoc.bodyAsJsonNode().get("_source").get("workspaces");
+            List<String> workspaceIds = new ArrayList<>();
+            ws.forEach(n -> workspaceIds.add(n.asString()));
+            assertThat(workspaceIds, containsInAnyOrder("ws-a", "ws-b"));
+
+            // all_shared_principals stays usernames/roles only -- workspace membership is not denormalized here.
+            TestRestClient.HttpResponse resourceDoc = client.get(RESOURCE_INDEX_NAME + "/_doc/" + resourceId);
+            resourceDoc.assertStatusCode(HttpStatus.SC_OK);
+            ArrayNode principals = (ArrayNode) resourceDoc.bodyAsJsonNode().get("_source").get("all_shared_principals");
+            List<String> principalList = new ArrayList<>();
+            principals.forEach(n -> principalList.add(n.asString()));
+            assertThat(principalList, containsInAnyOrder("user:" + MIGRATION_USER.getName()));
+
+            // Idempotency: a second migrate with the same workspaces adds nothing new (skipped, not backfilled).
+            TestRestClient.HttpResponse secondMigrate = client.postJson(RESOURCE_SHARING_MIGRATION_ENDPOINT, migrationPayload_valid());
+            secondMigrate.assertStatusCode(HttpStatus.SC_OK);
+            assertThat(
+                secondMigrate.bodyAsMap().get("summary"),
+                equalTo("Migration complete. migrated 0; backfilledExisting 0; skippedNoType 0; skippedExisting 1; failed 0")
+            );
+        }
+    }
+
     @Test
     public void testMigrateAPIWithSuperAdmin_valid_withSpecifiedAccessLevel() {
         String resourceId = createSampleResource();
@@ -308,7 +393,7 @@ public void testMigrateAPIWithSuperAdmin_valid_withSpecifiedAccessLevel() {
             migrateResponse.assertStatusCode(HttpStatus.SC_OK);
             assertThat(
                 migrateResponse.bodyAsMap().get("summary"),
-                equalTo("Migration complete. migrated 2; skippedNoType 0; skippedExisting 0; failed 0")
+                equalTo("Migration complete. migrated 2; backfilledExisting 0; skippedNoType 0; skippedExisting 0; failed 0")
             );
             assertThat(migrateResponse.bodyAsMap().get("resourcesWithDefaultOwner"), equalTo(List.of(resourceIdNoUser)));
 
@@ -395,7 +480,7 @@ public void testMigrateAPIWithSuperAdmin_noDefaultAccessLevel_usesRegisteredDefa
             migrateResponse.assertStatusCode(HttpStatus.SC_OK);
             assertThat(
                 migrateResponse.bodyAsMap().get("summary"),
-                equalTo("Migration complete. migrated 2; skippedNoType 0; skippedExisting 0; failed 0")
+                equalTo("Migration complete. migrated 2; backfilledExisting 0; skippedNoType 0; skippedExisting 0; failed 0")
             );
 
             TestRestClient.HttpResponse sharingResponse = client.get(RESOURCE_SHARING_INDEX + "/_search");
@@ -645,7 +730,7 @@ public void testMigrateAPI_withGarbageParentId() {
             migrateResponse.assertStatusCode(HttpStatus.SC_OK);
             assertThat(
                 migrateResponse.bodyAsMap().get("summary"),
-                equalTo("Migration complete. migrated 1; skippedNoType 0; skippedExisting 0; failed 0")
+                equalTo("Migration complete. migrated 1; backfilledExisting 0; skippedNoType 0; skippedExisting 0; failed 0")
             );
 
             // The sharing record should be created with the garbage parent_id stored as-is
@@ -681,7 +766,7 @@ public void testMigrateAPI_withParentHierarchy() {
             migrateResponse.assertStatusCode(HttpStatus.SC_OK);
             assertThat(
                 migrateResponse.bodyAsMap().get("summary"),
-                equalTo("Migration complete. migrated 2; skippedNoType 0; skippedExisting 0; failed 0")
+                equalTo("Migration complete. migrated 2; backfilledExisting 0; skippedNoType 0; skippedExisting 0; failed 0")
             );
 
             // Verify the sharing record for the resource has parent_type and parent_id set
@@ -762,6 +847,26 @@ private String createSampleResource() {
         }
     }
 
+    private String createSampleResourceWithWorkspaces(String... workspaceIds) {
+        try (TestRestClient client = cluster.getRestClient(MIGRATION_USER)) {
+            StringBuilder wsArray = new StringBuilder("[");
+            for (int i = 0; i < workspaceIds.length; i++) {
+                if (i > 0) wsArray.append(",");
+                wsArray.append("\"").append(workspaceIds[i]).append("\"");
+            }
+            wsArray.append("]");
+            String sampleResource = ("{\"name\":\"sample_ws\",\"store_user\":true,\"workspaces\":" + wsArray + "}");
+
+            TestRestClient.HttpResponse response = client.putJson(SAMPLE_RESOURCE_CREATE_ENDPOINT, sampleResource);
+            response.assertStatusCode(HttpStatus.SC_OK);
+            String resourceId = response.getTextFromJsonBody("/message").split(":")[1].trim();
+            Awaitility.await()
+                .alias("Wait until resource with workspaces is populated")
+                .until(() -> client.get(SAMPLE_RESOURCE_GET_ENDPOINT + "/" + resourceId).getStatusCode(), equalTo(200));
+            return resourceId;
+        }
+    }
+
     private String createSampleResourceNoUser() {
         try (TestRestClient client = cluster.getRestClient(MIGRATION_USER)) {
             String sampleResource = """

sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResource.java

@@ -12,7 +12,10 @@
 package org.opensearch.sample;
 
 import java.io.IOException;
+import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
+import java.util.Set;
 
 import org.opensearch.commons.authuser.User;
 import org.opensearch.core.ParseField;
@@ -40,6 +43,9 @@ public class SampleResource implements NamedWriteable, ToXContentObject {
     private Map<String, String> attributes;
     // NOTE: following field is added to specifically test migrate API, for newer resources this field must not be defined
     private User user;
+    // Workspace membership; optional, models the multi-valued "workspaces" field a real workspace-aware resource
+    // would declare so ResourceIndexListener can project workspace:<id> into all_shared_principals.
+    private Set<String> workspaces;
 
     public SampleResource() throws IOException {
         super();
@@ -51,6 +57,8 @@ public SampleResource(StreamInput in) throws IOException {
         this.groupId = in.readOptionalString();
         this.attributes = in.readMap(StreamInput::readString, StreamInput::readString);
         this.user = new User(in);
+        List<String> ws = in.readOptionalStringList();
+        this.workspaces = ws == null ? null : new HashSet<>(ws);
     }
 
     private static final ConstructingObjectParser<SampleResource, Void> PARSER = new ConstructingObjectParser<>(RESOURCE_TYPE, true, a -> {
@@ -67,6 +75,10 @@ public SampleResource(StreamInput in) throws IOException {
         // ignore a[3] as we know the type
         s.setAttributes((Map<String, String>) a[4]);
         s.setUser((User) a[5]);
+        List<String> ws = (List<String>) a[6];
+        if (ws != null) {
+            s.setWorkspaces(new HashSet<>(ws));
+        }
         return s;
     });
 
@@ -77,21 +89,27 @@ public SampleResource(StreamInput in) throws IOException {
         PARSER.declareStringOrNull(optionalConstructorArg(), new ParseField("resource_type"));
         PARSER.declareObjectOrNull(optionalConstructorArg(), (p, c) -> p.mapStrings(), null, new ParseField("attributes"));
         PARSER.declareObjectOrNull(optionalConstructorArg(), (p, c) -> User.parse(p), null, new ParseField("user"));
+        PARSER.declareStringArray(optionalConstructorArg(), new ParseField("workspaces"));
     }
 
     public static SampleResource fromXContent(XContentParser parser) throws IOException {
         return PARSER.parse(parser, null);
     }
 
     public XContentBuilder toXContent(XContentBuilder builder, ToXContent.Params params) throws IOException {
-        return builder.startObject()
+        builder.startObject()
             .field("name", name)
             .field("description", description)
             .field("group_id", groupId)
             .field("resource_type", RESOURCE_TYPE)
             .field("attributes", attributes)
-            .field("user", user)
-            .endObject();
+            .field("user", user);
+        // Emit workspaces only when non-empty so pre-existing docs stay byte-identical (BWC for callers/tests
+        // that don't touch this field).
+        if (workspaces != null && !workspaces.isEmpty()) {
+            builder.field("workspaces", workspaces);
+        }
+        return builder.endObject();
     }
 
     public void writeTo(StreamOutput out) throws IOException {
@@ -100,6 +118,8 @@ public void writeTo(StreamOutput out) throws IOException {
         out.writeOptionalString(groupId);
         out.writeMap(attributes, StreamOutput::writeString, StreamOutput::writeString);
         user.writeTo(out);
+        // Symmetric with the StreamInput ctor. Passing null when unset keeps mixed-caller compatibility.
+        out.writeOptionalStringCollection(workspaces);
     }
 
     public void setName(String name) {
@@ -122,6 +142,14 @@ public void setUser(User user) {
         this.user = user;
     }
 
+    public void setWorkspaces(Set<String> workspaces) {
+        this.workspaces = workspaces;
+    }
+
+    public Set<String> getWorkspaces() {
+        return workspaces;
+    }
+
     public String getName() {
         return name;
     }

sample-resource-plugin/src/main/java/org/opensearch/sample/SampleResourceExtension.java

@@ -11,6 +11,8 @@
 
 package org.opensearch.sample;
 
+import java.util.Collections;
+import java.util.HashSet;
 import java.util.Set;
 
 import org.opensearch.sample.client.ResourceSharingClientAccessor;
@@ -54,11 +56,36 @@ public String parentType() {
             public String parentIdField() {
                 return "group_id";
             }
+
+            @Override
+            public String workspacesField() {
+                return "workspaces";
+            }
         });
     }
 
     @Override
     public void assignResourceSharingClient(ResourceSharingClient resourceSharingClient) {
         ResourceSharingClientAccessor.getInstance().setResourceSharingClient(resourceSharingClient);
     }
+
+    /**
+     * Test-only workspace-membership resolver. Maps a user's <em>security roles</em> to a deterministic workspace ID
+     * ({@code ws-<role>}), simulating a trusted server-set source. Roles are resolved by the security plugin at
+     * authc time, so they are not user-assertable — matching the SPI contract.
+     *
+     * <p>A real workspace-owning plugin would replace this with a lookup against its own authoritative store
+     * (populated at authc time or cached in memory), never with values derived from user-influenceable inputs.
+     */
+    @Override
+    public Set<String> resolveWorkspacesForUser(String username, Set<String> securityRoles, Set<String> backendRoles) {
+        if (securityRoles == null || securityRoles.isEmpty()) {
+            return Collections.emptySet();
+        }
+        Set<String> workspaces = new HashSet<>();
+        for (String role : securityRoles) {
+            workspaces.add("ws-" + role);
+        }
+        return workspaces;
+    }
 }