feat: Only allow workspace CRUD APIs to modify workspace metadata.

Signed-off-by: SuZhou-Joe <[email protected]>
SuZhou-Joe · Oct 27, 2023 · 86871a5 · 86871a5
1 parent 87e8f71
commit 86871a5
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/src/plugins/workspace/server/saved_objects/workspace.ts b/src/plugins/workspace/server/saved_objects/workspace.ts
@@ -8,7 +8,10 @@ import { SavedObjectsType, WORKSPACE_TYPE } from '../../../../core/server';
 export const workspace: SavedObjectsType = {
   name: WORKSPACE_TYPE,
   namespaceType: 'agnostic',
-  hidden: false,
+  /**
+   * Disable operation by using saved objects APIs on workspace metadata
+   */
+  hidden: true,
   /**
    * workspace won't appear in management page.
    */

diff --git a/src/plugins/workspace/server/workspace_client.ts b/src/plugins/workspace/server/workspace_client.ts
@@ -36,13 +36,16 @@ export class WorkspaceClient implements IWorkspaceClientImpl {
   ): SavedObjectsClientContract | undefined {
     return this.savedObjects?.getScopedClient(requestDetail.request, {
       excludedWrappers: [WORKSPACE_SAVED_OBJECTS_CLIENT_WRAPPER_ID],
+      includedHiddenTypes: [WORKSPACE_TYPE],
     });
   }
 
   private getSavedObjectClientsFromRequestDetail(
     requestDetail: IRequestDetail
   ): SavedObjectsClientContract {
-    return requestDetail.context.core.savedObjects.client;
+    return this.savedObjects?.getScopedClient(requestDetail.request, {
+      includedHiddenTypes: [WORKSPACE_TYPE],
+    }) as SavedObjectsClientContract;
   }
   private getFlattenedResultWithSavedObject(
     savedObject: SavedObject<WorkspaceAttribute>