Declare report-instance as child resource of report-definition - #1213
Open
DarshitChanpura wants to merge 1 commit into
Open
Declare report-instance as child resource of report-definition#1213DarshitChanpura wants to merge 1 commit into
DarshitChanpura wants to merge 1 commit into
Conversation
Report instances never received resource-sharing records: the on-demand creation path indexes the instance doc under the plugin subject (via PluginClient) and scheduled runs execute under job-scheduler, so the security plugin's ResourceIndexListener finds no authenticated user and silently skips record creation. As a result instances are invisible to the resource-sharing APIs, even to their creator. Declaring parentType/parentIdField on the report-instance provider makes instances inherit access from the report definition they were generated from, which matches the intended semantics: whoever can access a definition can access its generated reports. The parent id is extracted from the flattened reportDefinitionDetails.id field, which is already indexed as keyword in report-instances-mapping.yml. Requires the companion security plugin change that creates parent-linked records when no user is present in the thread context. Signed-off-by: Darshit Chanpura <dchanp@amazon.com>
DarshitChanpura
marked this pull request as ready for review
August 21, 2026 04:49
DarshitChanpura
requested review from
Swiddis,
YANG-DB,
anirudha,
dai-chen,
derek-ho,
joshuali925,
kavithacm,
mengweieric,
penghuo,
ps48 and
seankao-az
as code owners
August 21, 2026 04:49
Contributor
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
cwperks
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Declares
parentType/parentIdFieldon thereport-instanceresource provider so report instances inherit access from the report definition they were generated from — whoever can access a definition can access its generated reports. The parent id is extracted from the flattenedreportDefinitionDetails.idfield, already indexed as keyword inreport-instances-mapping.yml.Why this is needed:
Context: the resource-sharing onboarding (#1141, 2025-12-10) predates parent/child support in the SPI (security#5735, 2026-03-23), so this wiring could not be added at onboarding time and was never retrofitted.
Investigation note (correction)
An earlier version of this description claimed on-demand instances are indexed under the plugin subject and receive no sharing entries. That was traced to listener-attachment timing on a 3.8.0 snapshot instead (type added to
protected_typesdynamically after the instances index was already open — no listener until restart). On-demand writes do carry the user and receive entries once the listener is attached; the child declaration remains necessary for scheduled instances and for correct inheritance semantics.Depends on
opensearch-project/security#6373 (parent-linked entries for user-less writes; integration-tested there)
Category
Bug fix
Testing
compileKotlinpasses; field name verified against the index mappingBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.