Unified policy for secure both registry records & Elasticsearch datasets

[t83714]

We currently have a dataset policy that secures dataset records only.

The policy was created for early trial of our access control model and only for purpose of securing dataset in elastic-search originally.

However, our main metadata store registry actually support a more generic record type which users can create other record types on top of it. e.g. distributions, organisations etc.

This ticket is about creating one single "unified story" to:

• secure the generic record model including different record types
• secure two storage engines: registry & elastic search & different use cases
• the solution should be expansible so users can add more policy to add custom logic for custom record type

Solution

• One policy entrypoint object/record/allow.rego to delegate auth decision to policy created specifically for a particular record type.
  • e.g. when a record is a dataset record (test by checking if a record has dcat-dataset-strings aspect), delegate the decision to object/dataset/allow.rego
• if it's an unknown record type, default access control logic applied.
  • i.e. Only users have matching permission with appropriate constraint can perform the operation.
  • e.g. if a user has object/record/update permission with owner constraint, only the record owner/creator can update the record.
• Existing policy object/dataset/allow.rego needs to be adjusted to match more generic registry API data structure.
• Policy enforcement at Search API / Elasticsearch can use extra logic to translate the data field reference that matches registry data structure to data field references matches Elasticsearch data structure.
• i.e. in policy we should access aspect data field with json patch input.object.dataset.[aspect name].[aspect field name].
• e.g. reference input.object.dataset.publishingState in previous policy should change to input.object.dataset. publishing.state as publishingState field is defined as state field in publishing aspect
• e.g. input.object.dataset.accessControl.ownerId reference should be input.object.dataset["access-control"].ownerId --- as ownerId field us defined in access-control aspect.
  • Please note: the new decision API default concise format response will convert the reference to input.object.dataset.access-control.ownerId for ease of processing

[t83714]

closed via #3257