Merge pull request #47 from appbaseio/feat/source_filter

feat: add support for source_filtering

Author: lakhansamani

model/permission/permission.go

@@ -46,6 +46,8 @@ type Permission struct {
 	TTL         time.Duration       `json:"ttl"`
 	Limits      *Limits             `json:"limits"`
 	Description string              `json:"description"`
+	Includes    []string            `json:"include_fields"`
+	Excludes    []string            `json:"exclude_fields"`
 }
 
 // Limits defines the rate limits for each category.
@@ -159,6 +161,22 @@ func SetSources(sources []string) Options {
 	}
 }
 
+// SetIncludes sets the includes fields
+func SetIncludes(includes []string) Options {
+	return func(p *Permission) error {
+		p.Includes = includes
+		return nil
+	}
+}
+
+// SetExcludes sets the excludes fields
+func SetExcludes(excludes []string) Options {
+	return func(p *Permission) error {
+		p.Excludes = excludes
+		return nil
+	}
+}
+
 func validateSources(sources []string) error {
 	for _, source := range sources {
 		_, _, err := net.ParseCIDR(source)
@@ -557,6 +575,12 @@ func (p *Permission) GetPatch(rolePatched bool) (map[string]interface{}, error)
 	if p.Description != "" {
 		patch["description"] = p.Description
 	}
+	if p.Includes != nil {
+		patch["include_fields"] = p.Includes
+	}
+	if p.Excludes != nil {
+		patch["exclude_fields"] = p.Excludes
+	}
 
 	return patch, nil
 }

plugins/elasticsearch/middleware.go

@@ -1,9 +1,13 @@
 package elasticsearch
 
 import (
+	"bytes"
+	"encoding/json"
 	"fmt"
+	"io/ioutil"
 	"log"
 	"net/http"
+	"strings"
 
 	"github.com/appbaseio/arc/middleware"
 	"github.com/appbaseio/arc/middleware/classify"
@@ -13,6 +17,7 @@ import (
 	"github.com/appbaseio/arc/model/acl"
 	"github.com/appbaseio/arc/model/category"
 	"github.com/appbaseio/arc/model/op"
+	"github.com/appbaseio/arc/model/permission"
 	"github.com/appbaseio/arc/plugins/auth"
 	"github.com/appbaseio/arc/plugins/logs"
 	"github.com/appbaseio/arc/util"
@@ -126,7 +131,73 @@ func transformRequest(h http.HandlerFunc) http.HandlerFunc {
 		}
 		// transform POST request(search) to GET
 		if *reqACL == category.Search {
-			req.Method = http.MethodGet
+			isMsearch := strings.HasSuffix(req.URL.String(), "/_msearch")
+			// Apply source filters
+			reqPermission, err := permission.FromContext(ctx)
+			if err != nil {
+				log.Printf("%s: %v\n", logTag, err)
+				h(w, req)
+				return
+			}
+			sources := make(map[string]interface{})
+			var Includes, Excludes []string
+			Includes = reqPermission.Includes
+			Excludes = reqPermission.Excludes
+			if len(Includes) > 0 {
+				sources["includes"] = Includes
+			}
+			if len(Excludes) > 0 {
+				sources["excludes"] = Excludes
+			}
+			_, isExcludesPresent := sources["excludes"]
+			isDefaultInclude := len(Includes) > 0 && Includes[0] == "*"
+			shouldApplyFilters := !isDefaultInclude || isExcludesPresent
+			if shouldApplyFilters {
+				if isMsearch {
+					// Handle the _msearch requests
+					body, err := ioutil.ReadAll(req.Body)
+					if err != nil {
+						log.Printf("%s: %v\n", logTag, err)
+						util.WriteBackError(w, err.Error(), http.StatusInternalServerError)
+						return
+					}
+					var reqBodyString = string(body)
+					splitReq := strings.Split(reqBodyString, "\n")
+					var modifiedBodyString string
+					for index, element := range splitReq {
+						if index%2 == 1 { // even lines
+							var reqBody = make(map[string]interface{})
+							err := json.Unmarshal([]byte(element), &reqBody)
+							if err != nil {
+								log.Printf("%s: %v\n", logTag, err)
+								util.WriteBackError(w, err.Error(), http.StatusInternalServerError)
+								return
+							}
+							reqBody["_source"] = sources
+							raw, _ := json.Marshal(reqBody)
+							modifiedBodyString += string(raw)
+						} else {
+							modifiedBodyString += element
+						}
+						modifiedBodyString += "\n"
+					}
+					modifiedBody := []byte(modifiedBodyString)
+					req.Body = ioutil.NopCloser(bytes.NewReader(modifiedBody))
+				} else {
+					body, err := ioutil.ReadAll(req.Body)
+					if err != nil {
+						log.Printf("%s: %v\n", logTag, err)
+						util.WriteBackError(w, err.Error(), http.StatusInternalServerError)
+						return
+					}
+					d := json.NewDecoder(ioutil.NopCloser(bytes.NewReader(body)))
+					reqBody := make(map[string]interface{})
+					d.Decode(&reqBody)
+					reqBody["_source"] = sources
+					modifiedBody, _ := json.Marshal(reqBody)
+					req.Body = ioutil.NopCloser(bytes.NewReader(modifiedBody))
+				}
+			}
 		}
 		h(w, req)
 	}

plugins/permissions/handlers.go

@@ -78,6 +78,12 @@ func (p *permissions) postPermission(opts ...permission.Options) http.HandlerFun
 		if permissionBody.Referers != nil {
 			opts = append(opts, permission.SetReferers(permissionBody.Referers))
 		}
+		if permissionBody.Includes != nil {
+			opts = append(opts, permission.SetIncludes(permissionBody.Includes))
+		}
+		if permissionBody.Excludes != nil {
+			opts = append(opts, permission.SetExcludes(permissionBody.Excludes))
+		}
 		if permissionBody.Indices != nil {
 			opts = append(opts, permission.SetIndices(permissionBody.Indices))
 		}
@@ -270,7 +276,7 @@ func (p *permissions) getUserPermissions() http.HandlerFunc {
 }
 
 func (p *permissions) role() http.HandlerFunc {
-	return func (w http.ResponseWriter, req *http.Request) {
+	return func(w http.ResponseWriter, req *http.Request) {
 		vars := mux.Vars(req)
 		role := vars["name"]
 
@@ -290,7 +296,7 @@ func (p *permissions) role() http.HandlerFunc {
 				msg := fmt.Sprintf(`an error occurred while fetching permissions for role=%s`, role)
 				log.Printf("%s: %s: %v\n", logTag, msg, err)
 				util.WriteBackError(w, msg, http.StatusInternalServerError)
-				return			
+				return
 			}
 		}
 
@@ -301,10 +307,10 @@ func (p *permissions) role() http.HandlerFunc {
 			p.postPermission(permission.SetRole(role))(w, req)
 			return
 		case http.MethodPatch:
-			http.Redirect(w, req, "/_permission/" + perm.Username, 308)
+			http.Redirect(w, req, "/_permission/"+perm.Username, 308)
 			return
 		case http.MethodDelete:
-			http.Redirect(w, req, "/_permission/" + perm.Username, 308)
+			http.Redirect(w, req, "/_permission/"+perm.Username, 308)
 			return
 		}
 	}