Security: remove put privilege API (#32879)

This commit removes the put privilege API in favor of having a single API to
create and update privileges. If we see the need to have an API like this in
the future we can always add it back.

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/action/privilege/PutPrivilegesRequestBuilder.java

@@ -20,7 +20,6 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 
@@ -35,32 +34,6 @@ public PutPrivilegesRequestBuilder(ElasticsearchClient client, PutPrivilegesActi
         super(client, action, new PutPrivilegesRequest());
     }
 
-    /**
-     * Populate the put privileges request using the given source, application name and privilege name
-     * The source must contain a single privilege object which matches the application and privilege names.
-     */
-    public PutPrivilegesRequestBuilder source(String applicationName, String expectedName,
-                                              BytesReference source, XContentType xContentType)
-        throws IOException {
-        Objects.requireNonNull(xContentType);
-        // EMPTY is ok here because we never call namedObject
-        try (InputStream stream = source.streamInput();
-             XContentParser parser = xContentType.xContent()
-                 .createParser(NamedXContentRegistry.EMPTY, LoggingDeprecationHandler.INSTANCE, stream)) {
-            XContentParser.Token token = parser.currentToken();
-            if (token == null) {
-                token = parser.nextToken();
-            }
-            if (token == XContentParser.Token.START_OBJECT) {
-                final ApplicationPrivilegeDescriptor privilege = parsePrivilege(parser, applicationName, expectedName);
-                this.request.setPrivileges(Collections.singleton(privilege));
-            } else {
-                throw new ElasticsearchParseException("expected an object but found {} instead", token);
-            }
-        }
-        return this;
-    }
-
     ApplicationPrivilegeDescriptor parsePrivilege(XContentParser parser, String applicationName, String privilegeName) throws IOException {
         ApplicationPrivilegeDescriptor privilege = ApplicationPrivilegeDescriptor.parse(parser, applicationName, privilegeName, false);
         checkPrivilegeName(privilege, applicationName, privilegeName);

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/client/SecurityClient.java

@@ -295,12 +295,6 @@ public GetPrivilegesRequestBuilder prepareGetPrivileges(String applicationName,
         return new GetPrivilegesRequestBuilder(client, GetPrivilegesAction.INSTANCE).application(applicationName).privileges(privileges);
     }
 
-    public PutPrivilegesRequestBuilder preparePutPrivilege(String applicationName, String privilegeName,
-                                                           BytesReference bytesReference, XContentType xContentType) throws IOException {
-        return new PutPrivilegesRequestBuilder(client, PutPrivilegesAction.INSTANCE)
-            .source(applicationName, privilegeName, bytesReference, xContentType);
-    }
-
     public PutPrivilegesRequestBuilder preparePutPrivileges(BytesReference bytesReference, XContentType xContentType) throws IOException {
         return new PutPrivilegesRequestBuilder(client, PutPrivilegesAction.INSTANCE).source(bytesReference, xContentType);
     }

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/Security.java

@@ -193,7 +193,6 @@
 import org.elasticsearch.xpack.security.rest.action.oauth2.RestInvalidateTokenAction;
 import org.elasticsearch.xpack.security.rest.action.privilege.RestDeletePrivilegesAction;
 import org.elasticsearch.xpack.security.rest.action.privilege.RestGetPrivilegesAction;
-import org.elasticsearch.xpack.security.rest.action.privilege.RestPutPrivilegeAction;
 import org.elasticsearch.xpack.security.rest.action.privilege.RestPutPrivilegesAction;
 import org.elasticsearch.xpack.security.rest.action.realm.RestClearRealmCacheAction;
 import org.elasticsearch.xpack.security.rest.action.role.RestClearRolesCacheAction;
@@ -788,7 +787,6 @@ public List<RestHandler> getRestHandlers(Settings settings, RestController restC
                 new RestSamlInvalidateSessionAction(settings, restController, getLicenseState()),
                 new RestGetPrivilegesAction(settings, restController, getLicenseState()),
                 new RestPutPrivilegesAction(settings, restController, getLicenseState()),
-                new RestPutPrivilegeAction(settings, restController, getLicenseState()),
                 new RestDeletePrivilegesAction(settings, restController, getLicenseState())
         );
     }

x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/rest/action/privilege/RestPutPrivilegesAction.java

@@ -29,6 +29,7 @@
 import java.util.Map;
 
 import static org.elasticsearch.rest.RestRequest.Method.POST;
+import static org.elasticsearch.rest.RestRequest.Method.PUT;
 
 /**
  * Rest endpoint to add one or more {@link ApplicationPrivilege} objects to the security index
@@ -37,6 +38,7 @@ public class RestPutPrivilegesAction extends SecurityBaseRestHandler {
 
     public RestPutPrivilegesAction(Settings settings, RestController controller, XPackLicenseState licenseState) {
         super(settings, licenseState);
+        controller.registerHandler(PUT, "/_xpack/security/privilege/", this);
         controller.registerHandler(POST, "/_xpack/security/privilege/", this);
     }
 

x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/core/security/action/privilege/PutPrivilegesRequestBuilderTests.java

@@ -52,36 +52,6 @@ private ApplicationPrivilegeDescriptor descriptor(String app, String name, Strin
         return new ApplicationPrivilegeDescriptor(app, name, Sets.newHashSet(actions), Collections.emptyMap());
     }
 
-    public void testBuildRequestFromJsonObject() throws Exception {
-        final PutPrivilegesRequestBuilder builder = new PutPrivilegesRequestBuilder(null, PutPrivilegesAction.INSTANCE);
-        builder.source("foo", "read", new BytesArray(
-                "{  \"application\":\"foo\", \"name\":\"read\", \"actions\":[ \"data:/read/*\", \"admin:/read/*\" ] }"
-        ), XContentType.JSON);
-        final List<ApplicationPrivilegeDescriptor> privileges = builder.request().getPrivileges();
-        assertThat(privileges, iterableWithSize(1));
-        assertThat(privileges, contains(descriptor("foo", "read", "data:/read/*", "admin:/read/*")));
-    }
-
-    public void testPrivilegeNameValidationOfSingleElement() throws Exception {
-        final PutPrivilegesRequestBuilder builder = new PutPrivilegesRequestBuilder(null, PutPrivilegesAction.INSTANCE);
-        final IllegalArgumentException exception = expectThrows(IllegalArgumentException.class, () ->
-                builder.source("foo", "write", new BytesArray(
-                        "{ \"application\":\"foo\", \"name\":\"read\", \"actions\":[ \"data:/read/*\", \"admin:/read/*\" ] }"
-                ), XContentType.JSON));
-        assertThat(exception.getMessage(), containsString("write"));
-        assertThat(exception.getMessage(), containsString("read"));
-    }
-
-    public void testApplicationNameValidationOfSingleElement() throws Exception {
-        final PutPrivilegesRequestBuilder builder = new PutPrivilegesRequestBuilder(null, PutPrivilegesAction.INSTANCE);
-        final IllegalArgumentException exception = expectThrows(IllegalArgumentException.class, () ->
-                builder.source("bar", "read", new BytesArray(
-                        "{ \"application\":\"foo\", \"name\":\"read\", \"actions\":[ \"data:/read/*\", \"admin:/read/*\" ] }"
-                ), XContentType.JSON));
-        assertThat(exception.getMessage(), containsString("foo"));
-        assertThat(exception.getMessage(), containsString("bar"));
-    }
-
     public void testPrivilegeNameValidationOfMultipleElement() throws Exception {
         final PutPrivilegesRequestBuilder builder = new PutPrivilegesRequestBuilder(null, PutPrivilegesAction.INSTANCE);
         final IllegalArgumentException exception = expectThrows(IllegalArgumentException.class, () ->

x-pack/plugin/src/test/resources/rest-api-spec/api/xpack.security.put_privileges.json

@@ -1,7 +1,7 @@
 {
   "xpack.security.put_privileges": {
     "documentation": "TODO",
-    "methods": [ "POST" ],
+    "methods": [ "PUT", "POST" ],
     "url": {
       "path": "/_xpack/security/privilege/",
       "paths": [

x-pack/plugin/src/test/resources/rest-api-spec/test/privileges/10_basic.yml

@@ -30,24 +30,26 @@ teardown:
         ignore: 404
 ---
 "Test put and get privileges":
-  # Single privilege, with names in URL
+  # Single privilege
   - do:
-      xpack.security.put_privilege:
-        application: app
-        name: p1
+      xpack.security.put_privileges:
         body:  >
             {
-              "application": "app",
-              "name": "p1",
-              "actions": [ "data:read/*" , "action:login" ],
-              "metadata": {
-                "key1" : "val1a",
-                "key2" : "val2a"
+              "app": {
+                "p1": {
+                  "application": "app",
+                  "name": "p1",
+                  "actions": [ "data:read/*" , "action:login" ],
+                  "metadata": {
+                    "key1" : "val1a",
+                    "key2" : "val2a"
+                  }
+                }
               }
             }
   - match: { "app.p1" : { created: true } }
 
-  # Multiple privileges, no names in URL
+  # Multiple privileges
   - do:
       xpack.security.put_privileges:
         body: >
@@ -84,18 +86,18 @@ teardown:
   - match: { "app.p3" : { created: true } }
   - match: { "app2.p1" : { created: true } }
 
-  # Update existing privilege, with names in URL
+  # Update existing privilege
   - do:
-      xpack.security.put_privilege:
-        application: app
-        name: p1
+      xpack.security.put_privileges:
         body:  >
             {
-              "application": "app",
-              "name": "p1",
-              "actions": [ "data:read/*" , "action:login" ],
-              "metadata": {
-                "key3" : "val3"
+              "app": {
+                "p1": {
+                  "actions": [ "data:read/*" , "action:login" ],
+                  "metadata": {
+                    "key3" : "val3"
+                  }
+                }
               }
             }
   - match: { "app.p1" : { created: false } }

x-pack/plugin/src/test/resources/rest-api-spec/test/security/authz/40_condtional_cluster_priv.yml

@@ -31,21 +31,25 @@ setup:
             }
 
   - do:
-      xpack.security.put_privilege:
-        application: app-allow
-        name: read
+      xpack.security.put_privileges:
         body:  >
             {
-              "actions": [ "data:read/*" ]
+              "app-allow": {
+                "read": {
+                  "actions": [ "data:read/*" ]
+                }
+              }
             }
 
   - do:
-      xpack.security.put_privilege:
-        application: app_deny
-        name: read
+      xpack.security.put_privileges:
         body:  >
             {
-              "actions": [ "data:read/*" ]
+              "app-deny": {
+                "read": {
+                  "actions": [ "data:read/*" ]
+                }
+              }
             }
 
 ---
@@ -82,12 +86,14 @@ teardown:
 
   - do:
       headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
-      xpack.security.put_privilege:
-        application: app
-        name: read
+      xpack.security.put_privileges:
         body:  >
             {
-              "actions": [ "data:read/*" ]
+              "app": {
+                "read": {
+                  "actions": [ "data:read/*" ]
+                }
+              }
             }
   - match: { "app.read" : { created: true } }
 
@@ -112,12 +118,14 @@ teardown:
 "Test put application privileges when not allowed":
   - do:
       headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
-      xpack.security.put_privilege:
-          application: app_deny
-          name: write
+      xpack.security.put_privileges:
           body:  >
               {
-                "actions": [ "data:write/*" ]
+                "app_deny": {
+                  "write": {
+                    "actions": [ "data:write/*" ]
+                  }
+                }
               }
       catch: forbidden