[Workspace]Deny get or bulkGet for global data source

[wanglam]

Description

This PR is for adding permission validation in saved objects client's get or bulkGet methods. Currently, a user can call get / bulkGet with data source id for global data source (not assigned to any workspace). These two methods will throw error when operating on these global data sources.

Issues Resolved

#8044

Screenshot

No UI changes

Testing the changes

• Clone branch code and run yarn osd bootstrap --single-version ignore
• Add below configs in config/opensearch_dashboards.yml

savedObjects.permission.enabled: true
workspace.enabled: true
uiSettings:
  overrides:
    'home:useNewHomePage': true
opensearchDashboards.dashboardAdmin.users: ['admin']

• Run yarn start --no-base-path
• Login with admin user
• Create a data source and record the data source id
• Create a test-user with kibanauser backend roles
• Call curl with created data source use below commands, it should response error
• Test bulkGet

# Test with get
curl 'http://localhost:5601/api/saved_objects/data-source/<created_data_source_id>"' \
  -H 'Accept: */*' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Content-Type: application/json' \
  -H 'Origin: http://localhost:5601' \
  -H 'Pragma: no-cache' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-origin' \
  -H 'osd-version: 3.0.0' \
  -H 'osd-xsrf: osd-fetch' \
  -H 'authorization: Basic <TOKEN_TO_TEST_USER>'

# Test with bulk get
curl 'http://localhost:5601/api/saved_objects/_bulk_get' \
  -H 'Accept: */*' \
  -H 'Accept-Language: en-US,en;q=0.9' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Content-Type: application/json' \
  -H 'Origin: http://localhost:5601' \
  -H 'Pragma: no-cache' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Site: same-origin' \
  -H 'osd-version: 3.0.0' \
  -H 'osd-xsrf: osd-fetch' \
  -H 'authorization: Basic <TOKEN_TO_TEST_USER>' \
  --data-raw '[{"id":"<created_data_source_id>","type":"data-source"}]'

These two commands should response {"statusCode":403,"error":"Forbidden","message":"Invalid data source permission, please associate it to current workspace"}

Changelog

• feat: [Workspace]Deny get or bulkGet for global data source

Check List

• All tests pass
  • yarn test:jest
  • yarn test:jest_integration
• New functionality includes testing.
• New functionality has been documented.
• Update CHANGELOG.md
• Commits are signed per the DCO using --signoff

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 60.59%. Comparing base (d9c9aad) to head (e569c44).
Report is 79 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8043      +/-   ##
==========================================
- Coverage   60.60%   60.59%   -0.02%     
==========================================
  Files        3732     3732              
  Lines       88427    88431       +4     
  Branches    13701    13702       +1     
==========================================
- Hits        53589    53581       -8     
- Misses      31579    31591      +12     
  Partials     3259     3259              

Flag	Coverage Δ
Linux_1	28.76% <100.00%> (+<0.01%)	⬆️
Linux_2	56.26% <ø> (ø)
Linux_3	37.44% <ø> (ø)
Linux_4	29.64% <ø> (ø)
Windows_1	28.77% <100.00%> (-0.02%)	⬇️
Windows_2	56.21% <ø> (ø)
Windows_3	37.44% <ø> (ø)
Windows_4	29.64% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[opensearch-trigger-bot]

The backport to 2.17 failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-2.17 2.17
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-2.17
# Create a new branch
git switch --create backport/backport-8043-to-2.17
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 d22b68b3ea439fd97e0ed8363fb9fb79c1f89dd6
# Push it to GitHub
git push --set-upstream origin backport/backport-8043-to-2.17
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-2.17

Then, create a pull request where the base branch is 2.17 and the compare/head branch is backport/backport-8043-to-2.17.