improve the error message if unresolved user attrs are in DLS (#6305)

Signed-off-by: Ralph Ursprung <Ralph.Ursprung@avaloq.com>

Author: rursprung

src/integrationTest/java/org/opensearch/security/privileges/dlsfls/DocumentPrivilegesTest.java

@@ -67,6 +67,7 @@
 
 import static org.hamcrest.MatcherAssert.assertThat;
 import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.equalTo;
 import static org.opensearch.security.util.MockIndexMetadataBuilder.dataStreams;
 import static org.opensearch.security.util.MockIndexMetadataBuilder.indices;
 import static org.junit.Assert.assertEquals;
@@ -386,6 +387,10 @@ public void queryPatternTemplate() throws Exception {
                 if (index == index_a1) {
                     if (userSpec.roles.contains("dls_role_1") && userSpec.roles.contains("dls_role_2")) {
                         assertNotNull(exception);
+                        assertThat(
+                            exception.getMessage(),
+                            equalTo("DLS query references undefined user attributes: [attr.attr_a]. Available attributes are: [none]")
+                        );
                     }
                 }
             } else if (userSpec.roles.contains("non_dls_role") && dfmEmptyOverridesAll) {

src/main/java/org/opensearch/security/privileges/dlsfls/DocumentPrivileges.java

@@ -168,12 +168,17 @@ RenderedDlsQuery evaluate(PrivilegesEvaluationContext context) throws Privileges
                 if (UserAttributes.needsAttributeSubstitution(effectiveQueryString)) {
                     List<String> unresolved = UserAttributes.findUnresolvedAttributes(effectiveQueryString);
                     Set<String> available = context.getUser().getCustomAttributesMap().keySet();
-                    String availableStr = available.size() > MAX_ATTRIBUTES_IN_ERROR_MESSAGE
-                        ? available.stream().limit(MAX_ATTRIBUTES_IN_ERROR_MESSAGE).collect(Collectors.joining(", "))
+                    String availableStr;
+                    if (available.size() > MAX_ATTRIBUTES_IN_ERROR_MESSAGE) {
+                        availableStr = available.stream().limit(MAX_ATTRIBUTES_IN_ERROR_MESSAGE).collect(Collectors.joining(", "))
                             + " ... and "
                             + (available.size() - MAX_ATTRIBUTES_IN_ERROR_MESSAGE)
-                            + " more"
-                        : String.join(", ", available);
+                            + " more";
+                    } else if (!available.isEmpty()) {
+                        availableStr = String.join(", ", available);
+                    } else {
+                        availableStr = "[none]";
+                    }
                     throw new PrivilegesEvaluationException(
                         "DLS query references undefined user attributes: " + unresolved + ". Available attributes are: " + availableStr,
                         new OpenSearchSecurityException("User attribute substitution failed")