Add restriction to RoleDescriptor (#3142)

elastic · Nov 19, 2024 · 496e0b8 · 496e0b8
1 parent 60466c7
commit 496e0b8
Show file tree

Hide file tree

Showing 6 changed files with 203 additions and 7 deletions.
diff --git a/output/openapi/elasticsearch-openapi.json b/output/openapi/elasticsearch-openapi.json
diff --git a/output/openapi/elasticsearch-serverless-openapi.json b/output/openapi/elasticsearch-serverless-openapi.json
diff --git a/output/schema/schema-serverless.json b/output/schema/schema-serverless.json
diff --git a/output/schema/schema.json b/output/schema/schema.json
diff --git a/output/typescript/types.ts b/output/typescript/types.ts
diff --git a/specification/security/_types/RoleDescriptor.ts b/specification/security/_types/RoleDescriptor.ts
@@ -40,19 +40,16 @@ export class RoleDescriptor {
    * @aliases index
    */
   indices?: IndicesPrivileges[]
-
   /**
    * A list of indices permissions for remote clusters.
    * @availability stack since=8.14.0
    */
   remote_indices?: RemoteIndicesPrivileges[]
-
   /**
    * A list of cluster permissions for remote clusters. Note - this is limited a subset of the cluster permissions.
    * @availability stack since=8.15.0
    */
   remote_cluster?: RemoteClusterPrivileges[]
-
   /**
    * An object defining global privileges. A global privilege is a form of cluster privilege that is request-aware. Support for global privileges is currently limited to the management of application privileges.
    * @availability stack
@@ -75,6 +72,10 @@ export class RoleDescriptor {
    * Optional description of the role descriptor
    */
   description?: string
+  /**
+   * Restriction for when the role descriptor is allowed to be effective.
+   */
+  restriction?: Restriction
   transient_metadata?: Dictionary<string, UserDefinedValue>
 }
 
@@ -93,7 +94,6 @@ export class RoleDescriptorRead implements OverloadOf<RoleDescriptor> {
    * @availability stack since=8.14.0
    */
   remote_indices?: RemoteIndicesPrivileges[]
-
   /**
    * A list of cluster permissions for remote clusters. Note - this is limited a subset of the cluster permissions.
    * @availability stack since=8.15.0
@@ -120,5 +120,18 @@ export class RoleDescriptorRead implements OverloadOf<RoleDescriptor> {
    * Optional description of the role descriptor
    */
   description?: string
+  /**
+   * Restriction for when the role descriptor is allowed to be effective.
+   */
+  restriction?: Restriction
   transient_metadata?: Dictionary<string, UserDefinedValue>
 }
+
+export class Restriction {
+  workflows: RestrictionWorkflow[]
+}
+
+/** @non_exhaustive */
+export enum RestrictionWorkflow {
+  search_application_query
+}