Integrate dynamic config to disable global settings updates for non-admin users

changelogs/fragments/10959.yml

@@ -0,0 +1,2 @@
+feat:
+- Integrate dynamic config to disable global settings updates for non-admin users ([#10959](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/10959))

src/core/server/server.ts

@@ -202,6 +202,7 @@ export class Server {
     const uiSettingsSetup = await this.uiSettings.setup({
       http: httpSetup,
       savedObjects: savedObjectsSetup,
+      dynamicConfig: dynamicConfigServiceSetup,
     });
     const workspaceSetup = await this.workspace.setup();
 

src/core/server/ui_settings/saved_objects/dynamic_config_controlled_ui_settings_wrapper.test.ts

@@ -0,0 +1,164 @@
+/*
+ * Copyright OpenSearch Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { coreMock, httpServerMock, savedObjectsClientMock } from '../../../server/mocks';
+import { DynamicConfigControlledUiSettingsWrapper } from './dynamic_config_controlled_ui_settings_wrapper';
+import { SavedObjectsErrorHelpers } from '../../../server';
+import { dynamicConfigServiceMock } from '../../config/dynamic_config_service.mock';
+
+jest.mock('opensearch-dashboards/server/utils', () => ({
+  getWorkspaceState: jest.fn().mockImplementation((request) => ({
+    isDashboardAdmin: request.isDashboardAdmin,
+  })),
+  pkg: {
+    build: {
+      distributable: true,
+      release: true,
+    },
+  },
+}));
+
+describe('DynamicConfigControlledUiSettingsWrapper', () => {
+  const requestHandlerContext = coreMock.createRequestHandlerContext();
+  const mockedClient = savedObjectsClientMock.create();
+  const requestMock = httpServerMock.createOpenSearchDashboardsRequest();
+  const dynamicConfigService = dynamicConfigServiceMock.createInternalSetupContract();
+
+  // Helper to build wrapper instance
+  const buildWrapperInstance = (isDashboardAdmin = true, globalScopeEditable = true) => {
+    const getConfigMock = jest.fn().mockResolvedValue({
+      globalScopeEditable: {
+        enabled: globalScopeEditable,
+      },
+    });
+    jest.spyOn(dynamicConfigService, 'getStartService').mockResolvedValue({
+      ...dynamicConfigService.getStartService(),
+      getAsyncLocalStore: jest.fn(),
+      getClient: () => ({
+        getConfig: getConfigMock,
+        bulkGetConfigs: jest.fn(),
+        listConfigs: jest.fn(),
+      }),
+    });
+
+    const wrapperInstance = new DynamicConfigControlledUiSettingsWrapper(dynamicConfigService);
+
+    // Set isDashboardAdmin property on request
+    (requestMock as any).isDashboardAdmin = isDashboardAdmin;
+
+    const wrapperClient = wrapperInstance.wrapperFactory({
+      client: mockedClient,
+      typeRegistry: requestHandlerContext.savedObjects.typeRegistry,
+      request: requestMock,
+    });
+    return wrapperClient;
+  };
+
+  describe('#create', () => {
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('should pass through non-config type requests', async () => {
+      const wrapperClient = buildWrapperInstance();
+      await wrapperClient.get('dashboard', 'test-id');
+      expect(mockedClient.get).toBeCalledWith('dashboard', 'test-id');
+    });
+
+    it('should handle regular config requests', async () => {
+      const wrapperClient = buildWrapperInstance();
+      const mockResponse = {
+        id: '3.0.0',
+        type: 'config',
+        attributes: { 'csv:quoteValues': 'true' },
+        references: [],
+      };
+      mockedClient.get.mockResolvedValue(mockResponse);
+
+      const result = await wrapperClient.get('config', '3.0.0');
+
+      expect(mockedClient.get).toBeCalledWith('config', '3.0.0');
+      expect(result).toEqual(mockResponse);
+    });
+  });
+
+  describe('#update', () => {
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('should pass through non-config type requests', async () => {
+      const wrapperClient = buildWrapperInstance();
+      const attributes = { 'csv:quoteValues': 'true' };
+      await wrapperClient.update('dashboard', 'test-id', attributes);
+      expect(mockedClient.update).toBeCalledWith('dashboard', 'test-id', attributes, {});
+    });
+
+    it('should pass through regular config requests when globalScopeEditable is enabled', async () => {
+      const wrapperClient = buildWrapperInstance();
+      const attributes = { 'csv:quoteValues': 'true' };
+      await wrapperClient.update('config', '3.0.0', attributes);
+      expect(mockedClient.update).toBeCalledWith('config', '3.0.0', attributes, {});
+    });
+    it('should only consider global ui settings updates', async () => {
+      const wrapperClient = buildWrapperInstance(false, false);
+      const attributes = { 'csv:quoteValues': 'true' };
+      await wrapperClient.update('config', '<current_user>_3.0.0', attributes);
+      expect(mockedClient.update).toBeCalledWith('config', '<current_user>_3.0.0', attributes, {});
+    });
+
+    it('should update global settings when user is dashboard admin even globalScopeEditable is disabled', async () => {
+      const wrapperClient = buildWrapperInstance(true, false);
+      const attributes = { 'csv:quoteValues': 'true' };
+      const mockResponse = {
+        id: '3.0.0',
+        type: 'config',
+        attributes,
+        references: [],
+      };
+
+      mockedClient.update.mockResolvedValue(mockResponse);
+
+      await wrapperClient.update('config', '3.0.0', attributes);
+
+      expect(mockedClient.update).toBeCalledWith('config', '3.0.0', attributes, {});
+    });
+
+    it('should throw error when user is not dashboard admin and globalScopeEditable is disabled', async () => {
+      const wrapperClient = buildWrapperInstance(false, false);
+      const attributes = { permissionControlledSetting: true };
+
+      mockedClient.update.mockImplementation(() => {
+        throw SavedObjectsErrorHelpers.createGenericNotFoundError('config', '3.0.0');
+      });
+
+      await expect(wrapperClient.update('config', '3.0.0', attributes)).rejects.toThrow(
+        'No permission for UI settings operations'
+      );
+    });
+  });
+
+  describe('#bulkUpdate', () => {
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it('should pass through bulk update requests', async () => {
+      const attributes = { 'csv:quoteValues': 'true' };
+      const wrapperClient = buildWrapperInstance();
+      const objects = [
+        {
+          type: 'config',
+          id: '3.0.0',
+          attributes,
+        },
+      ];
+
+      await wrapperClient.bulkUpdate(objects);
+
+      expect(mockedClient.bulkUpdate).toBeCalledWith(objects);
+    });
+  });
+});

src/core/server/ui_settings/saved_objects/dynamic_config_controlled_ui_settings_wrapper.ts

@@ -0,0 +1,95 @@
+/*
+ * Copyright OpenSearch Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { i18n } from '@osd/i18n';
+import {
+  SavedObjectsClientWrapperFactory,
+  SavedObjectsClientWrapperOptions,
+  SavedObjectsErrorHelpers,
+  SavedObjectsUpdateOptions,
+  SavedObjectsUpdateResponse,
+} from '../../../server';
+import { getWorkspaceState } from '../../../server/utils';
+import { isGlobalScope } from '../utils';
+import { InternalDynamicConfigServiceSetup } from '../../config';
+
+/**
+ * Wrapper for reading dynamic feature flag to decide if global UI settings
+ * are editable or not for non-admin users
+ * @param dynamicConfig
+ */
+export class DynamicConfigControlledUiSettingsWrapper {
+  constructor(private readonly dynamicConfig: InternalDynamicConfigServiceSetup) {}
+
+  public wrapperFactory: SavedObjectsClientWrapperFactory = (wrapperOptions) => {
+    const updateUiSettingsWithPermission = async <T = unknown>(
+      type: string,
+      id: string,
+      attributes: Partial<T>,
+      options: SavedObjectsUpdateOptions = {}
+    ): Promise<SavedObjectsUpdateResponse<T>> => {
+      if (type === 'config' && isGlobalScope(id)) {
+        const hasPermission = await this.checkPermission(wrapperOptions);
+        if (!hasPermission) throw this.generatePermissionError();
+      }
+
+      return wrapperOptions.client.update<T>(type, id, attributes, options);
+    };
+
+    return {
+      ...wrapperOptions.client,
+      create: wrapperOptions.client.create,
+      bulkCreate: wrapperOptions.client.bulkCreate,
+      delete: wrapperOptions.client.delete,
+      update: updateUiSettingsWithPermission,
+      bulkUpdate: wrapperOptions.client.bulkUpdate,
+      get: wrapperOptions.client.get,
+      checkConflicts: wrapperOptions.client.checkConflicts,
+      errors: wrapperOptions.client.errors,
+      addToNamespaces: wrapperOptions.client.addToNamespaces,
+      deleteFromNamespaces: wrapperOptions.client.deleteFromNamespaces,
+      find: wrapperOptions.client.find,
+      bulkGet: wrapperOptions.client.bulkGet,
+      deleteByWorkspace: wrapperOptions.client.deleteByWorkspace,
+    };
+  };
+
+  private async checkPermission(
+    wrapperOptions: SavedObjectsClientWrapperOptions
+  ): Promise<boolean> {
+    //  If saved object permission is disabled, getWorkspaceState will return undefined,everyone should be treated as admin here
+    if (getWorkspaceState(wrapperOptions.request).isDashboardAdmin !== false) return true;
+
+    try {
+      const dynamicConfigServiceStart = await this.dynamicConfig.getStartService();
+      const store = dynamicConfigServiceStart.getAsyncLocalStore();
+      const client = dynamicConfigServiceStart.getClient();
+
+      const dynamicConfig = await client.getConfig(
+        { pluginConfigPath: 'uiSettings' },
+        { asyncLocalStorageContext: store! }
+      );
+
+      // 1. when globalScopeEditable is false, only dashboard admin can edit global settings
+      // 2. when globalScopeEditable is true(default), both dashboard admin and non-admin users can edit global settings
+      return dynamicConfig.globalScopeEditable.enabled;
+    } catch (e) {
+      throw new Error(
+        i18n.translate('core.dynamic.config.controlled.ui.settings.read.invalidate', {
+          defaultMessage: 'Unable to read dynamic config',
+        })
+      );
+    }
+  }
+
+  private generatePermissionError = () =>
+    SavedObjectsErrorHelpers.decorateForbiddenError(
+      new Error(
+        i18n.translate('core.dynamic.config.controlled.ui.settings.permission.invalidate', {
+          defaultMessage: 'No permission for UI settings operations',
+        })
+      )
+    );
+}

src/core/server/ui_settings/ui_settings_config.ts

@@ -65,6 +65,9 @@ const configSchema = schema.object({
       })
     ),
   }),
+  globalScopeEditable: schema.object({
+    enabled: schema.boolean({ defaultValue: true }),
+  }),
 });
 
 export type UiSettingsConfigType = TypeOf<typeof configSchema>;

src/core/server/ui_settings/ui_settings_service.test.ts

@@ -41,6 +41,7 @@ import { savedObjectsClientMock } from '../mocks';
 import { savedObjectsServiceMock } from '../saved_objects/saved_objects_service.mock';
 import { mockCoreContext } from '../core_context.mock';
 import { uiSettingsType } from './saved_objects';
+import { dynamicConfigServiceMock } from '../config/dynamic_config_service.mock';
 
 const overrides = {
   overrideBaz: 'baz',
@@ -82,7 +83,12 @@ describe('uiSettings', () => {
     );
     const httpSetup = httpServiceMock.createInternalSetupContract();
     const savedObjectsSetup = savedObjectsServiceMock.createInternalSetupContract();
-    setupDeps = { http: httpSetup, savedObjects: savedObjectsSetup };
+    const dynamicConfigService = dynamicConfigServiceMock.createInternalSetupContract();
+    setupDeps = {
+      http: httpSetup,
+      savedObjects: savedObjectsSetup,
+      dynamicConfig: dynamicConfigService,
+    };
     savedObjectsClient = savedObjectsClientMock.create();
     service = new UiSettingsService(coreContext);
     jest.spyOn(service as any, 'register');
@@ -103,7 +109,7 @@ describe('uiSettings', () => {
     it('register adminUiSettings', async () => {
       const setup = await service.setup(setupDeps);
       setup.register(adminUiSettings);
-      expect(setupDeps.savedObjects.addClientWrapper).toHaveBeenCalledTimes(1);
+      expect(setupDeps.savedObjects.addClientWrapper).toHaveBeenCalledTimes(2);
 
       expect((service as any).register).toHaveBeenCalledWith(adminUiSettings);
     });

src/core/server/ui_settings/ui_settings_service.ts

@@ -31,7 +31,6 @@
 import { combineLatest, Observable } from 'rxjs';
 import { map } from 'rxjs/operators';
 import { firstValueFrom, mapToObject } from '@osd/std';
-
 import { CoreService } from '../../types';
 import { CoreContext } from '../core_context';
 import { Logger } from '../logging';
@@ -56,12 +55,17 @@ import {
 import {
   PERMISSION_CONTROLLED_UI_SETTINGS_WRAPPER_ID,
   PERMISSION_CONTROLLED_UI_SETTINGS_WRAPPER_PRIORITY,
+  DYNAMIC_CONFIG_CONTROLLEDUI_SETTINGS_WRAPPER_ID,
+  DYNAMIC_CONFIG_CONTROLLEDUI_SETTINGS_WRAPPER_PRIORITY,
 } from './utils';
 import { getAIFeaturesSetting } from './settings/ai_features';
+import { InternalDynamicConfigServiceSetup } from '../config';
+import { DynamicConfigControlledUiSettingsWrapper } from './saved_objects/dynamic_config_controlled_ui_settings_wrapper';
 
 export interface SetupDeps {
   http: InternalHttpServiceSetup;
   savedObjects: InternalSavedObjectsServiceSetup;
+  dynamicConfig: InternalDynamicConfigServiceSetup;
 }
 
 /** @internal */
@@ -81,7 +85,11 @@ export class UiSettingsService
     ]);
   }
 
-  public async setup({ http, savedObjects }: SetupDeps): Promise<InternalUiSettingsServiceSetup> {
+  public async setup({
+    http,
+    savedObjects,
+    dynamicConfig,
+  }: SetupDeps): Promise<InternalUiSettingsServiceSetup> {
     this.log.debug('Setting up ui settings service');
 
     savedObjects.registerType(uiSettingsType);
@@ -105,12 +113,22 @@ export class UiSettingsService
       config.savedObjectsConfig.permission.enabled
     );
 
+    const dynamicConfigControlledUiSettingsWrapper = new DynamicConfigControlledUiSettingsWrapper(
+      dynamicConfig
+    );
+
     savedObjects.addClientWrapper(
       PERMISSION_CONTROLLED_UI_SETTINGS_WRAPPER_PRIORITY,
       PERMISSION_CONTROLLED_UI_SETTINGS_WRAPPER_ID,
       permissionControlledUiSettingsWrapper.wrapperFactory
     );
 
+    savedObjects.addClientWrapper(
+      DYNAMIC_CONFIG_CONTROLLEDUI_SETTINGS_WRAPPER_PRIORITY,
+      DYNAMIC_CONFIG_CONTROLLEDUI_SETTINGS_WRAPPER_ID,
+      dynamicConfigControlledUiSettingsWrapper.wrapperFactory
+    );
+
     this.register(getAIFeaturesSetting());
 
     return {

src/core/server/ui_settings/utils.ts

@@ -15,6 +15,9 @@ export const PERMISSION_CONTROLLED_UI_SETTINGS_WRAPPER_ID = 'permission-control-
 // other wrappers, therefore the priorty can be any number and the priority of 100 is trival
 export const PERMISSION_CONTROLLED_UI_SETTINGS_WRAPPER_PRIORITY = 100;
 
+export const DYNAMIC_CONFIG_CONTROLLEDUI_SETTINGS_WRAPPER_ID = 'dynamic-config-control-ui-settings';
+export const DYNAMIC_CONFIG_CONTROLLEDUI_SETTINGS_WRAPPER_PRIORITY = 101;
+
 export const buildDocIdWithScope = (id: string, scope?: UiSettingScope) => {
   if (scope === UiSettingScope.USER) {
     return `${CURRENT_USER_PLACEHOLDER}_${id}`;
@@ -27,3 +30,11 @@ export const buildDocIdWithScope = (id: string, scope?: UiSettingScope) => {
   }
   return id;
 };
+
+export const isGlobalScope = (docId: string | undefined) => {
+  return (
+    docId !== DASHBOARD_ADMIN_SETTINGS_ID &&
+    !docId?.startsWith(CURRENT_WORKSPACE_PLACEHOLDER) &&
+    !docId?.startsWith(CURRENT_USER_PLACEHOLDER)
+  );
+};