feat(opensearch): restrict search view access based on user roles and permissions
Type of Change
- [x] Bugfix
- [ ] New feature
- [ ] Enhancement
- [ ] Refactoring
- [ ] Dependency updates
- [ ] Documentation
- [ ] CI/CD
Description
Fixes the issue raised here: https://github.com/juspay/hyperswitch-cloud/issues/6759
-
Currently, a profile level user is able to see the other profile payments list when using global-search, irrespective of whether he has permissions or not. But the user will not be able to view the details related to the payments upon clicking the particular payment.
-
This PR fixes this behaviour by restricting the profiles / merchants to be searched based on the user roles associated with the role_id and the permissions associated with the user role
-
Now, only if the use role has the necessary READ permissions to access the indexes, he would be able to search the payments related to that particular profile/merchant.
-
The
search_paramswill now be constructed with only those ProfileLevel / MerchantLevel / OrgLevel entities which will be searched through the opensearch query.
Additional Changes
- [ ] This PR modifies the API contract
- [ ] This PR modifies the database schema
- [ ] This PR modifies application configuration/environment variables
Motivation and Context
To preserve confidentiality of the payment details
How did you test it?
Try to search payments of a profile from another profile which doesn't have access to the profile where the payments are present. Results should not show up while using global search.
Checklist
- [x] I formatted the code
cargo +nightly fmt --all - [x] I addressed lints thrown by
cargo clippy - [x] I reviewed the submitted code
- [ ] I added unit tests for my changes where possible
Review changes with SemanticDiff.
Analyzed 3 of 4 files.
Overall, the semantic diff is 10% smaller than the GitHub diff.
| Filename | Status | |
|---|---|---|
| :heavy_check_mark: | crates/router/src/analytics.rs | 7.14% smaller |
| :heavy_check_mark: | crates/router/src/consts/opensearch.rs | 31.91% smaller |
| :heavy_check_mark: | crates/analytics/src/opensearch.rs | Analyzed |
| :grey_question: | config/dashboard.toml | Unsupported file format |