updated Sensitive with SecureSetting

Signed-off-by: Rishav9852Kumar <rishavkumaraug20005212@gmail.com>

Author: Rishav9852Kumar

src/main/java/org/opensearch/security/auditlog/impl/AbstractAuditLog.java

@@ -46,6 +46,7 @@
 import org.opensearch.cluster.metadata.IndexNameExpressionResolver;
 import org.opensearch.cluster.service.ClusterService;
 import org.opensearch.common.collect.Tuple;
+import org.opensearch.common.settings.SecureSetting;
 import org.opensearch.common.settings.Settings;
 import org.opensearch.common.xcontent.XContentHelper;
 import org.opensearch.common.xcontent.XContentType;
@@ -446,18 +447,18 @@ private List<Map<String, Object>> buildSettingsChanges(Settings newSettings, Set
         for (String key : newSettings.keySet()) {
             final String newValue = newSettings.get(key);
             final String oldValue = currentSettings.get(key);
-            final boolean isSensitive = isSensitiveSetting(key);
+            final boolean isSecure = isSecureSetting(key);
 
             final Map<String, Object> change = new HashMap<>();
             change.put("setting", key);
-            change.put("old_value", isSensitive && oldValue != null ? "***REDACTED***" : oldValue);
+            change.put("old_value", isSecure && oldValue != null ? "***REDACTED***" : oldValue);
             change.put("scope", scope);
 
             if (newValue == null) {
                 change.put("new_value", null);
                 change.put("operation", "removed");
             } else {
-                change.put("new_value", isSensitive ? "***REDACTED***" : newValue);
+                change.put("new_value", isSecure ? "***REDACTED***" : newValue);
                 change.put("operation", "set");
             }
 
@@ -468,18 +469,18 @@ private List<Map<String, Object>> buildSettingsChanges(Settings newSettings, Set
 
     /**
      * Checks if a setting should have its value redacted in audit logs.
-     * Uses ClusterSettings.isSensitiveSetting() to detect SecureSetting instances (e.g., keystore passwords,
-     * TLS keys). Falls back to pattern matching for plugin-specific settings
-     * that may not be registered in the cluster settings registry.
+     * Returns true for settings registered as SecureSetting (secrets stored
+     * in the keystore), or settings whose key contains common secret indicators
+     * (password, secret, token).
      */
-    private boolean isSensitiveSetting(String key) {
+    private boolean isSecureSetting(final String key) {
         try {
-            // Looks up the Setting object by key and checks setting.isSensitive(),
-            // which returns true for SecureSetting instances — the proper way to identify secrets
-            if (clusterService.getClusterSettings().isSensitiveSetting(key)) {
+            // Looks up the Setting object by key and checks if it is an instance of SecureSetting
+            // i.e. secrets stored in the opensearch-keystore that must be redacted
+            if (clusterService.getClusterSettings().get(key) instanceof SecureSetting) {
                 return true;
             }
-        } catch (Exception e) {
+        } catch (final Exception e) {
             // Setting not registered in cluster settings — fall through to pattern match
         }
         // Pattern fallback for settings not registered as SecureSetting (e.g., plugin SSL settings)

src/test/java/org/opensearch/security/auditlog/impl/SettingsChangeAuditTest.java

@@ -295,10 +295,10 @@ public void testEmptyClusterSettingsProducesNoMessage() throws Exception {
         assertThat(result, not(containsString("CLUSTER_SETTINGS_CHANGED")));
     }
 
-    // --- Sensitive setting redaction tests ---
+    // --- Secure setting redaction tests ---
 
     @Test
-    public void testSensitiveSettingRedactionByPasswordPattern() throws Exception {
+    public void testSecureSettingRedactionByPasswordPattern() throws Exception {
         final AbstractAuditLog auditLog = createAuditLog();
 
         final ClusterUpdateSettingsRequest request = new ClusterUpdateSettingsRequest();
@@ -313,7 +313,7 @@ public void testSensitiveSettingRedactionByPasswordPattern() throws Exception {
     }
 
     @Test
-    public void testSensitiveSettingRedactionBySecretPattern() throws Exception {
+    public void testSecureSettingRedactionBySecretPattern() throws Exception {
         final AbstractAuditLog auditLog = createAuditLog();
 
         final ClusterUpdateSettingsRequest request = new ClusterUpdateSettingsRequest();
@@ -328,7 +328,7 @@ public void testSensitiveSettingRedactionBySecretPattern() throws Exception {
     }
 
     @Test
-    public void testSensitiveSettingRedactionByTokenPattern() throws Exception {
+    public void testSecureSettingRedactionByTokenPattern() throws Exception {
         final AbstractAuditLog auditLog = createAuditLog();
 
         final ClusterUpdateSettingsRequest request = new ClusterUpdateSettingsRequest();
@@ -343,7 +343,7 @@ public void testSensitiveSettingRedactionByTokenPattern() throws Exception {
     }
 
     @Test
-    public void testNonSensitiveSettingNotRedacted() throws Exception {
+    public void testNonSecureSettingNotRedacted() throws Exception {
         final AbstractAuditLog auditLog = createAuditLog();
 
         final ClusterUpdateSettingsRequest request = new ClusterUpdateSettingsRequest();
@@ -358,7 +358,7 @@ public void testNonSensitiveSettingNotRedacted() throws Exception {
     }
 
     @Test
-    public void testSensitiveOldValueAlsoRedacted() throws Exception {
+    public void testSecureOldValueAlsoRedacted() throws Exception {
         // Mock current state with a sensitive setting already set
         final Metadata metadata = mock(Metadata.class);
         when(metadata.persistentSettings()).thenReturn(
@@ -508,12 +508,12 @@ public void testMultipleSettingsInOneClusterRequest() throws Exception {
     // --- ClusterSettings registry redaction test ---
 
     /**
-     * Verifies that isSensitiveSetting() pattern fallback works even when ClusterSettings
+     * Verifies that isSecureSetting() pattern fallback works even when ClusterSettings
      * registry is available but returns false (setting registered but not as SecureSetting).
      * The registry path returning true is covered by integration tests with a real cluster.
      */
     @Test
-    public void testSensitiveSettingRedactionWhenRegistryReturnsFalse() throws Exception {
+    public void testSecureSettingRedactionWhenRegistryReturnsFalse() throws Exception {
         // When getClusterSettings() is not mocked, it returns null → exception caught → pattern fallback runs.
         // This test verifies the pattern fallback catches "password" in the key name regardless.
         final AbstractAuditLog auditLog = createAuditLog();

src/test/java/org/opensearch/security/auditlog/integration/SettingsChangeAuditIntegrationTest.java

@@ -121,7 +121,7 @@ public void testSettingsChangeAudit() throws Exception {
         Assert.assertTrue(auditlogs.contains("test-wild-002"));
         validateMsgs(TestAuditlogImpl.messages);
 
-        // test sensitive setting redaction
+        // test secure setting redaction
         TestAuditlogImpl.clear();
         rh.executePutRequest(
             "_cluster/settings",