dashboard admin(groups/users) implementation and integrating with dynamic application config

config/opensearch_dashboards.yml

@@ -290,3 +290,8 @@
 
 # Set the value to true to enable workspace feature
 # workspace.enabled: false
+
+# Set the backend roles in groups or users, whoever has the backend roles or exactly match the user ids defined in this config will be regard as dashboard admin.
+# Dashboard admin will have the access to all the workspaces(workspace.enabled: true) and objects inside OpenSearch Dashboards.
+# opensearchDashboards.dashboardAdmin.groups: ["dashboard_admin"]
+# opensearchDashboards.dashboardAdmin.users: ["dashboard_admin"]

src/core/server/mocks.ts

@@ -80,6 +80,7 @@ export function pluginInitializerContextConfigMock<T>(config: T) {
       configIndex: '.opensearch_dashboards_config_tests',
       autocompleteTerminateAfter: duration(100000),
       autocompleteTimeout: duration(1000),
+      dashboardAdmin: { groups: [], users: [] },
     },
     opensearch: {
       shardTimeout: duration('30s'),

src/core/server/opensearch_dashboards_config.ts

@@ -91,6 +91,14 @@ export const config = {
         defaultValue: 'https://survey.opensearch.org',
       }),
     }),
+    dashboardAdmin: schema.object({
+      groups: schema.arrayOf(schema.string(), {
+        defaultValue: [],
+      }),
+      users: schema.arrayOf(schema.string(), {
+        defaultValue: [],
+      }),
+    }),
   }),
   deprecations,
 };

src/core/server/plugins/plugin_context.test.ts

@@ -101,6 +101,7 @@ describe('createPluginInitializerContext', () => {
         configIndex: '.opensearch_dashboards_config',
         autocompleteTerminateAfter: duration(100000),
         autocompleteTimeout: duration(1000),
+        dashboardAdmin: { groups: [], users: [] },
       },
       opensearch: {
         shardTimeout: duration(30, 's'),

src/core/server/plugins/types.ts

@@ -292,6 +292,7 @@ export const SharedGlobalConfigKeys = {
     'configIndex',
     'autocompleteTerminateAfter',
     'autocompleteTimeout',
+    'dashboardAdmin',
   ] as const,
   opensearch: ['shardTimeout', 'requestTimeout', 'pingTimeout'] as const,
   path: ['data'] as const,

src/core/server/utils/workspace.test.ts

@@ -11,9 +11,11 @@ describe('updateWorkspaceState', () => {
     const requestMock = httpServerMock.createOpenSearchDashboardsRequest();
     updateWorkspaceState(requestMock, {
       requestWorkspaceId: 'foo',
+      isDashboardAdmin: true,
     });
     expect(getWorkspaceState(requestMock)).toEqual({
       requestWorkspaceId: 'foo',
+      isDashboardAdmin: true,
     });
   });
 });

src/core/server/utils/workspace.ts

@@ -7,6 +7,7 @@ import { OpenSearchDashboardsRequest, ensureRawRequest } from '../http/router';
 
 export interface WorkspaceState {
   requestWorkspaceId?: string;
+  isDashboardAdmin?: boolean;
 }
 
 /**
@@ -29,8 +30,9 @@ export const updateWorkspaceState = (
 };
 
 export const getWorkspaceState = (request: OpenSearchDashboardsRequest): WorkspaceState => {
-  const { requestWorkspaceId } = ensureRawRequest(request).app as WorkspaceState;
+  const { requestWorkspaceId, isDashboardAdmin } = ensureRawRequest(request).app as WorkspaceState;
   return {
     requestWorkspaceId,
+    isDashboardAdmin,
   };
 };

src/legacy/server/config/schema.js

@@ -251,6 +251,10 @@ export default () =>
       survey: Joi.object({
         url: Joi.any().default('/'),
       }),
+      dashboardAdmin: Joi.object({
+        groups: Joi.array().items(Joi.string()).default([]),
+        users: Joi.array().items(Joi.string()).default([]),
+      }),
     }).default(),
 
     savedObjects: HANDLED_IN_NEW_PLATFORM,

src/plugins/workspace/opensearch_dashboards.json

@@ -6,6 +6,6 @@
   "requiredPlugins": [
     "savedObjects"
   ],
-  "optionalPlugins": ["savedObjectsManagement"],
+  "optionalPlugins": ["savedObjectsManagement", "applicationConfig"],
   "requiredBundles": ["opensearchDashboardsReact"]
 }

src/plugins/workspace/server/plugin.test.ts

@@ -6,9 +6,17 @@
 import { OnPreRoutingHandler } from 'src/core/server';
 import { coreMock, httpServerMock } from '../../../core/server/mocks';
 import { WorkspacePlugin } from './plugin';
+import { AppPluginSetupDependencies } from './types';
 import { getWorkspaceState } from '../../../core/server/utils';
 
 describe('Workspace server plugin', () => {
+  const mockApplicationConfig = {
+    getConfigurationClient: jest.fn().mockResolvedValue({}),
+    registerConfigurationClient: jest.fn().mockResolvedValue({}),
+  };
+  const mockDependencies: AppPluginSetupDependencies = {
+    applicationConfig: mockApplicationConfig,
+  };
   it('#setup', async () => {
     let value;
     const setupMock = coreMock.createSetup();
@@ -17,7 +25,7 @@ describe('Workspace server plugin', () => {
     });
     setupMock.capabilities.registerProvider.mockImplementationOnce((fn) => (value = fn()));
     const workspacePlugin = new WorkspacePlugin(initializerContextConfigMock);
-    await workspacePlugin.setup(setupMock);
+    await workspacePlugin.setup(setupMock, mockDependencies);
     expect(value).toMatchInlineSnapshot(`
       Object {
         "workspaces": Object {
@@ -43,7 +51,7 @@ describe('Workspace server plugin', () => {
       return fn;
     });
     const workspacePlugin = new WorkspacePlugin(initializerContextConfigMock);
-    await workspacePlugin.setup(setupMock);
+    await workspacePlugin.setup(setupMock, mockDependencies);
     const toolKitMock = httpServerMock.createToolkit();
 
     const requestWithWorkspaceInUrl = httpServerMock.createOpenSearchDashboardsRequest({
@@ -78,7 +86,7 @@ describe('Workspace server plugin', () => {
     });
 
     const workspacePlugin = new WorkspacePlugin(initializerContextConfigMock);
-    await workspacePlugin.setup(setupMock);
+    await workspacePlugin.setup(setupMock, mockDependencies);
     await workspacePlugin.start(startMock);
     expect(startMock.savedObjects.createSerializer).toBeCalledTimes(1);
   });

src/plugins/workspace/server/plugin.ts

@@ -18,7 +18,12 @@ import {
   WORKSPACE_CONFLICT_CONTROL_SAVED_OBJECTS_CLIENT_WRAPPER_ID,
   WORKSPACE_ID_CONSUMER_WRAPPER_ID,
 } from '../common/constants';
-import { IWorkspaceClientImpl, WorkspacePluginSetup, WorkspacePluginStart } from './types';
+import {
+  IWorkspaceClientImpl,
+  WorkspacePluginSetup,
+  WorkspacePluginStart,
+  AppPluginSetupDependencies,
+} from './types';
 import { WorkspaceClient } from './workspace_client';
 import { registerRoutes } from './routes';
 import { WorkspaceSavedObjectsClientWrapper } from './saved_objects';
@@ -32,6 +37,11 @@ import {
   SavedObjectsPermissionControl,
   SavedObjectsPermissionControlContract,
 } from './permission_control/client';
+import {
+  getApplicationOSDAdminConfig,
+  getOSDAdminConfig,
+  updateDashboardAdminStateForRequest,
+} from './utils';
 import { WorkspaceIdConsumerWrapper } from './saved_objects/workspace_id_consumer_wrapper';
 
 export class WorkspacePlugin implements Plugin<WorkspacePluginSetup, WorkspacePluginStart> {
@@ -64,12 +74,51 @@ export class WorkspacePlugin implements Plugin<WorkspacePluginSetup, WorkspacePl
     });
   }
 
+  private setupPermission(core: CoreSetup, { applicationConfig }: AppPluginSetupDependencies) {
+    this.permissionControl = new SavedObjectsPermissionControl(this.logger);
+
+    core.http.registerOnPostAuth(async (request, response, toolkit) => {
+      let groups: string[];
+      let users: string[];
+      let configGroups: string[];
+      let configUsers: string[];
+
+      // There may be calls to saved objects client before user get authenticated, need to add a try catch here as `getPrincipalsFromRequest` will throw error when user is not authenticated.
+      try {
+        ({ groups = [], users = [] } = this.permissionControl!.getPrincipalsFromRequest(request));
+      } catch (e) {
+        return toolkit.next();
+      }
+
+      if (!!applicationConfig) {
+        [configGroups, configUsers] = await getApplicationOSDAdminConfig(
+          { applicationConfig },
+          request
+        );
+      } else {
+        [configGroups, configUsers] = await getOSDAdminConfig(this.globalConfig$);
+      }
+      updateDashboardAdminStateForRequest(request, groups, users, configGroups, configUsers);
+      return toolkit.next();
+    });
+
+    this.workspaceSavedObjectsClientWrapper = new WorkspaceSavedObjectsClientWrapper(
+      this.permissionControl
+    );
+
+    core.savedObjects.addClientWrapper(
+      0,
+      WORKSPACE_SAVED_OBJECTS_CLIENT_WRAPPER_ID,
+      this.workspaceSavedObjectsClientWrapper.wrapperFactory
+    );
+  }
+
   constructor(initializerContext: PluginInitializerContext) {
     this.logger = initializerContext.logger.get('plugins', 'workspace');
     this.globalConfig$ = initializerContext.config.legacy.globalConfig$;
   }
 
-  public async setup(core: CoreSetup) {
+  public async setup(core: CoreSetup, { applicationConfig }: AppPluginSetupDependencies) {
     this.logger.debug('Setting up Workspaces service');
     const globalConfig = await this.globalConfig$.pipe(first()).toPromise();
     const isPermissionControlEnabled = globalConfig.savedObjects.permission.enabled === true;
@@ -94,19 +143,7 @@ export class WorkspacePlugin implements Plugin<WorkspacePluginSetup, WorkspacePl
     );
 
     this.logger.info('Workspace permission control enabled:' + isPermissionControlEnabled);
-    if (isPermissionControlEnabled) {
-      this.permissionControl = new SavedObjectsPermissionControl(this.logger);
-
-      this.workspaceSavedObjectsClientWrapper = new WorkspaceSavedObjectsClientWrapper(
-        this.permissionControl
-      );
-
-      core.savedObjects.addClientWrapper(
-        0,
-        WORKSPACE_SAVED_OBJECTS_CLIENT_WRAPPER_ID,
-        this.workspaceSavedObjectsClientWrapper.wrapperFactory
-      );
-    }
+    if (isPermissionControlEnabled) this.setupPermission(core, { applicationConfig });
 
     registerRoutes({
       http: core.http,