From c33c67e1f61456ba03af9938cd4bb334a6d85dc1 Mon Sep 17 00:00:00 2001 From: Darshit Chanpura Date: Thu, 6 Aug 2026 20:41:30 +0000 Subject: [PATCH] Declare report-instance as child resource of report-definition Report instances never received resource-sharing records: the on-demand creation path indexes the instance doc under the plugin subject (via PluginClient) and scheduled runs execute under job-scheduler, so the security plugin's ResourceIndexListener finds no authenticated user and silently skips record creation. As a result instances are invisible to the resource-sharing APIs, even to their creator. Declaring parentType/parentIdField on the report-instance provider makes instances inherit access from the report definition they were generated from, which matches the intended semantics: whoever can access a definition can access its generated reports. The parent id is extracted from the flattened reportDefinitionDetails.id field, which is already indexed as keyword in report-instances-mapping.yml. Requires the companion security plugin change that creates parent-linked records when no user is present in the thread context. Signed-off-by: Darshit Chanpura --- .../reportsscheduler/ReportsSchedulerExtension.kt | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/main/kotlin/org/opensearch/reportsscheduler/ReportsSchedulerExtension.kt b/src/main/kotlin/org/opensearch/reportsscheduler/ReportsSchedulerExtension.kt index dcec59a5..ab666965 100644 --- a/src/main/kotlin/org/opensearch/reportsscheduler/ReportsSchedulerExtension.kt +++ b/src/main/kotlin/org/opensearch/reportsscheduler/ReportsSchedulerExtension.kt @@ -24,10 +24,25 @@ class ReportsSchedulerExtension : ResourceSharingExtension { object : ResourceProvider { override fun resourceType(): String = Utils.REPORT_INSTANCE_TYPE override fun resourceIndexName(): String = ReportInstancesIndex.REPORT_INSTANCES_INDEX_NAME + + // Report instances are child resources of the report definition + // they were generated from: access is inherited from the parent + // definition's sharing record. This also covers instances created + // without an authenticated user in context (on-demand runs under + // the plugin subject; scheduled runs under job-scheduler). + override fun parentType(): String = Utils.REPORT_DEFINITION_TYPE + override fun parentIdField(): String = PARENT_ID_FIELD } ) } + companion object { + // Flattened field in the report instance document that holds the id of + // the report definition it was generated from. Indexed as keyword in + // report-instances-mapping.yml. + private const val PARENT_ID_FIELD = "reportDefinitionDetails.id" + } + override fun assignResourceSharingClient(resourceSharingClient: ResourceSharingClient?) { ResourceSharingClientAccessor.getInstance() .setResourceSharingClient(resourceSharingClient)