Pass resourceType instead of resourceIndex to resourceSharingClient

[cwperks]

Description

This PR is related to the changes in opensearch-project/security#5713 to support multiple resource types in the same index. There's a small change in all ResourceSharingClient methods to accept type in the place of index.

resource type <-> resource index is a many-to-one relationship (think dashboards saved objects where multiple saved object types are in the same index).

On another note, ResourceSharingClient is used in instances where a mechanism doesn't currently exist as in parent<->child relationships (like a detector and results where all results are associated with a detector). Security is working on a mechanism to support this natively to obviate the need for ResourceSharingClient and instead abstract all the logic behind-the-scenes to the security plugin.

Check List

• New functionality includes testing.
• New functionality has been documented.
• API changes companion pull request created.
• Commits are signed per the DCO using --signoff.
• Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[mingshl]

CI failed not related to code changes

Tests with failures:
 - org.opensearch.ml.action.models.SearchModelTransportActionTests.test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds

> Task :opensearch-ml-plugin:test FAILED

[mingshl]

@cwperks can you look at this test and try reproduce locally?

REPRODUCE WITH: ./gradlew ':opensearch-ml-plugin:test' --tests 'org.opensearch.ml.action.models.SearchModelTransportActionTests.test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds' -Dtests.seed=83E68BE5CBA8AF9D -Dtests.security.manager=false -Dtests.locale=en-AE -Dtests.timezone=America/Argentina/Mendoza -Druntime.java=21

SearchModelTransportActionTests > test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds FAILED
    Argument(s) are different! Wanted:
    resourceSharingClient.getAccessibleResourceIds(
        ".plugins-ml-model-group",
        <any>
    );
    -> at org.opensearch.ml.action.models.SearchModelTransportActionTests.test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds(SearchModelTransportActionTests.java:388)
    Actual invocations have different arguments at position [0]:
    resourceSharingClient.isFeatureEnabledForType(
        "ml-model-group"
    );
    -> at org.opensearch.ml.helper.ModelAccessControlHelper.shouldUseResourceAuthz(ModelAccessControlHelper.java:298)
    resourceSharingClient.getAccessibleResourceIds(
        "ml-model-group",
        org.opensearch.core.action.ActionListener$1@5a3247ce
    );
    -> at org.opensearch.ml.action.handler.MLSearchHandler.search(MLSearchHandler.java:158)
        at __randomizedtesting.SeedInfo.seed([83E68BE5CBA8AF9D:447841CA93562BD9]:0)

[cwperks]

@cwperks can you look at this test and try reproduce locally?

REPRODUCE WITH: ./gradlew ':opensearch-ml-plugin:test' --tests 'org.opensearch.ml.action.models.SearchModelTransportActionTests.test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds' -Dtests.seed=83E68BE5CBA8AF9D -Dtests.security.manager=false -Dtests.locale=en-AE -Dtests.timezone=America/Argentina/Mendoza -Druntime.java=21

SearchModelTransportActionTests > test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds FAILED
    Argument(s) are different! Wanted:
    resourceSharingClient.getAccessibleResourceIds(
        ".plugins-ml-model-group",
        <any>
    );
    -> at org.opensearch.ml.action.models.SearchModelTransportActionTests.test_RSC_featureEnabled_typeEnabled_callsGetAccessibleIds(SearchModelTransportActionTests.java:388)
    Actual invocations have different arguments at position [0]:
    resourceSharingClient.isFeatureEnabledForType(
        "ml-model-group"
    );
    -> at org.opensearch.ml.helper.ModelAccessControlHelper.shouldUseResourceAuthz(ModelAccessControlHelper.java:298)
    resourceSharingClient.getAccessibleResourceIds(
        "ml-model-group",
        org.opensearch.core.action.ActionListener$1@5a3247ce
    );
    -> at org.opensearch.ml.action.handler.MLSearchHandler.search(MLSearchHandler.java:158)
        at __randomizedtesting.SeedInfo.seed([83E68BE5CBA8AF9D:447841CA93562BD9]:0)

looking, a few min

[cwperks]

@mingshl pushed a commit to fix that test suite..my bad. I missed 2 instances to update.

[dhrubo-os]

@peterzhuamazon can we override and merge? Couple integ test suites have passed already. This is blocking development.

[cwperks]

@peterzhuamazon can we override and merge? Couple integ test suites have passed already. This is blocking development.

Merged.

[dhrubo-os]

@cwperks I think we should backport this branch, otherwise it is failng:

* What went wrong:
Execution failed for task ':opensearch-ml-plugin:compileJava'.
> Compilation failed; see the compiler output below.
  /Volumes/workplace/ml-commons/plugin/src/main/java/org/opensearch/ml/resources/MLResourceSharingExtension.java:22: error: constructor ResourceProvider in record ResourceProvider cannot be applied to given types;
          return Set.of(new ResourceProvider() {
                        ^
    required: String,String
    found:    no arguments
    reason: actual and formal argument lists differ in length
  Note: Recompile with -Xlint:deprecation for details.
  /Volumes/workplace/ml-commons/plugin/src/main/java/org/opensearch/ml/resources/MLResourceSharingExtension.java:22: error: cannot inherit from final ResourceProvider
          return Set.of(new ResourceProvider() {
                            ^
  Note: Recompile with -Xlint:unchecked for details.
  Note: Some input files use or override a deprecated API.
  Note: Some input files use unchecked or unsafe operations.
  2 errors

* Try:
> Check your code and dependencies to fix the compilation error(s)
> Run with --scan to get full insights.

Deprecated Gradle features were used in this build, making it incompatible with Gradle 9.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

For more on this, please refer to https://docs.gradle.org/8.14.3/userguide/command_line_interface.html#sec:command_line_warnings in the Gradle documentation.

BUILD FAILED in 1m 40s

What do you think?