Merge #2848

2848: v0.29.0: bring `stable` changes into `main` r=curquiza a=curquiza

Bring `stable` changes into `main`. These changes correspond to changes we made during the v0.29.0 pre-release

Co-authored-by: evpeople <hangcaihui@gmail.com>
Co-authored-by: Loïc Lecrenier <loic@meilisearch.com>
Co-authored-by: bors[bot] <26634292+bors[bot]@users.noreply.github.com>
Co-authored-by: ManyTheFish <many@meilisearch.com>
Co-authored-by: Many the fish <many@meilisearch.com>
Co-authored-by: Morgane Dubus <30866152+mdubus@users.noreply.github.com>
Co-authored-by: Clémentine Urquizar <clementine@meilisearch.com>
Co-authored-by: Kerollmops <clement@meilisearch.com>
Co-authored-by: Clémentine Urquizar - curqui <clementine@meilisearch.com>

Cargo.toml

@@ -10,7 +10,6 @@ members = [
 
 [profile.release]
 codegen-units = 1
-lto = "thin"
 
 [profile.dev.package.flate2]
 opt-level = 3

meilisearch-auth/src/lib.rs

@@ -110,10 +110,7 @@ impl AuthController {
             filters.search_rules = search_rules;
         }
 
-        filters.allow_index_creation = key
+        filters.allow_index_creation = self.is_key_authorized(uid, Action::IndexesAdd, None)?;
-            .actions
-            .iter()
-            .any(|&action| action == Action::IndexesAdd || action == Action::All);
 
         Ok(filters)
     }

meilisearch-http/Cargo.toml

@@ -111,5 +111,5 @@ japanese = ["meilisearch-lib/japanese"]
 thai = ["meilisearch-lib/thai"]
 
 [package.metadata.mini-dashboard]
-assets-url = "https://github.com/meilisearch/mini-dashboard/releases/download/v0.2.1/build.zip"
+assets-url = "https://github.com/meilisearch/mini-dashboard/releases/download/v0.2.2/build.zip"
-sha1 = "05a02ff13c3982091884a3f81d28bf53e72607b2"
+sha1 = "c69feffc6b590e38a46981a85c47f48905d4082a"

meilisearch-http/src/extractors/authentication/mod.rs

@@ -5,7 +5,7 @@ use std::ops::Deref;
 use std::pin::Pin;
 
 use actix_web::FromRequest;
-use error::AuthenticationError;
+pub use error::AuthenticationError;
 use futures::future::err;
 use futures::Future;
 use meilisearch_auth::{AuthController, AuthFilter};

meilisearch-http/src/routes/indexes/mod.rs

@@ -8,7 +8,7 @@ use serde_json::json;
 use time::OffsetDateTime;
 
 use crate::analytics::Analytics;
-use crate::extractors::authentication::{policies::*, GuardedData};
+use crate::extractors::authentication::{policies::*, AuthenticationError, GuardedData};
 use crate::extractors::sequential_extractor::SeqHandler;
 use crate::task::SummarizedTaskView;
 
@@ -74,6 +74,8 @@ pub async fn create_index(
         primary_key, uid, ..
     } = body.into_inner();
 
+    let allow_index_creation = meilisearch.filters().search_rules.is_index_authorized(&uid);
+    if allow_index_creation {
         analytics.publish(
             "Index Created".to_string(),
             json!({ "primary_key": primary_key }),
@@ -84,6 +86,9 @@ pub async fn create_index(
         let task: SummarizedTaskView = meilisearch.register_update(uid, update).await?.into();
 
         Ok(HttpResponse::Accepted().json(task))
+    } else {
+        Err(AuthenticationError::InvalidToken.into())
+    }
 }
 
 #[derive(Debug, Deserialize)]

meilisearch-http/tests/auth/authorization.rs

@@ -597,15 +597,28 @@ async fn error_creating_index_without_action() {
 #[actix_rt::test]
 async fn lazy_create_index() {
     let mut server = Server::new_auth().await;
-    server.use_api_key("MASTER_KEY");
 
     // create key with access on all indexes.
-    let content = json!({
+    let contents = vec![
+        json!({
             "indexes": ["*"],
             "actions": ["*"],
             "expiresAt": "2050-11-13T00:00:00Z"
-    });
+        }),
+        json!({
+            "indexes": ["*"],
+            "actions": ["indexes.*", "documents.*", "settings.*", "tasks.*"],
+            "expiresAt": "2050-11-13T00:00:00Z"
+        }),
+        json!({
+            "indexes": ["*"],
+            "actions": ["indexes.create", "documents.add", "settings.update", "tasks.get"],
+            "expiresAt": "2050-11-13T00:00:00Z"
+        }),
+    ];
 
+    for content in contents {
+        server.use_api_key("MASTER_KEY");
         let (response, code) = server.add_api_key(content).await;
         assert_eq!(201, code, "{:?}", &response);
         assert!(response["key"].is_string());
@@ -658,4 +671,54 @@ async fn lazy_create_index() {
         let (response, code) = index.get_task(task_id).await;
         assert_eq!(200, code, "{:?}", &response);
         assert_eq!(response["status"], "succeeded");
+    }
+}
+
+#[actix_rt::test]
+async fn error_creating_index_without_index() {
+    let mut server = Server::new_auth().await;
+    server.use_api_key("MASTER_KEY");
+
+    // create key with access on all indexes.
+    let content = json!({
+        "indexes": ["unexpected"],
+        "actions": ["*"],
+        "expiresAt": "2050-11-13T00:00:00Z"
+    });
+
+    let (response, code) = server.add_api_key(content).await;
+    assert_eq!(201, code, "{:?}", &response);
+    assert!(response["key"].is_string());
+
+    // use created key.
+    let key = response["key"].as_str().unwrap();
+    server.use_api_key(&key);
+
+    // try to create a index via add documents route
+    let index = server.index("test");
+    let documents = json!([
+        {
+            "id": 1,
+            "content": "foo",
+        }
+    ]);
+
+    let (response, code) = index.add_documents(documents, None).await;
+    assert_eq!(403, code, "{:?}", &response);
+
+    // try to create a index via add settings route
+    let index = server.index("test1");
+    let settings = json!({ "distinctAttribute": "test"});
+    let (response, code) = index.update_settings(settings).await;
+    assert_eq!(403, code, "{:?}", &response);
+
+    // try to create a index via add specialized settings route
+    let index = server.index("test2");
+    let (response, code) = index.update_distinct_attribute(json!("test")).await;
+    assert_eq!(403, code, "{:?}", &response);
+
+    // try to create a index via create index route
+    let index = server.index("test3");
+    let (response, code) = index.create(None).await;
+    assert_eq!(403, code, "{:?}", &response);
 }

meilisearch-lib/src/index/updates.rs

@@ -331,14 +331,10 @@ impl Index {
             builder = new_builder;
 
             let user_result = match user_result {
-                Ok(count) => {
+                Ok(count) => Ok(DocumentAdditionResult {
-                    let addition = DocumentAdditionResult {
                     indexed_documents: count,
                     number_of_documents: count,
-                    };
+                }),
-                    info!("document addition done: {:?}", addition);
-                    Ok(addition)
-                }
                 Err(e) => Err(IndexError::from(e)),
             };
 
@@ -346,8 +342,9 @@ impl Index {
         }
 
         if results.iter().any(Result::is_ok) {
-            let _addition = builder.execute()?;
+            let addition = builder.execute()?;
             txn.commit()?;
+            info!("document addition done: {:?}", addition);
         }
 
         Ok(results)