RBAC: Permission check performance improvements for the new search (#60729)

* Add checker and update the resource filter function for new search

* Add tests for checker

* small fixes

* handle location for panels correctly

* clean up checker code and extend the tests for it

* more fixes, but tests don't quite work yet

* a small change to return error

* cleanup

* more simplification

* fix tests

* correct wrong argument ordering & use constant

* Apply suggestions from code review

Co-authored-by: Artur Wierzbicki <artur.wierzbicki@grafana.com>

* import

* check general folder from permission checker function

* handle root folder aka general folder properly

* update tests

* clean up

* lint

* add fix from main

Co-authored-by: Karl Persson <kalle.persson@grafana.com>
Co-authored-by: Artur Wierzbicki <artur.wierzbicki@grafana.com>

pkg/services/accesscontrol/checker.go

@@ -0,0 +1,57 @@
+package accesscontrol
+
+import (
+	"github.com/grafana/grafana/pkg/services/user"
+)
+
+func Checker(user *user.SignedInUser, action string) func(scopes ...string) bool {
+	if user.Permissions == nil || user.Permissions[user.OrgID] == nil {
+		return func(scopes ...string) bool { return false }
+	}
+
+	userScopes, ok := user.Permissions[user.OrgID][action]
+	if !ok {
+		return func(scopes ...string) bool { return false }
+	}
+
+	lookup := make(map[string]bool, len(userScopes))
+	for i := range userScopes {
+		lookup[userScopes[i]] = true
+	}
+
+	var checkedWildcards bool
+	var hasWildcard bool
+
+	return func(scopes ...string) bool {
+		if !checkedWildcards {
+			wildcards := wildcardsFromScopes(scopes...)
+			for _, w := range wildcards {
+				if _, ok := lookup[w]; ok {
+					hasWildcard = true
+					break
+				}
+			}
+			checkedWildcards = true
+		}
+
+		if hasWildcard {
+			return true
+		}
+
+		for _, s := range scopes {
+			if lookup[s] {
+				return true
+			}
+		}
+		return false
+	}
+}
+
+func wildcardsFromScopes(scopes ...string) Wildcards {
+	prefixes := make([]string, len(scopes))
+	for _, scope := range scopes {
+		prefixes = append(prefixes, ScopePrefix(scope))
+	}
+
+	return WildcardsFromPrefixes(prefixes)
+}

pkg/services/accesscontrol/checker_test.go

@@ -0,0 +1,111 @@
+package accesscontrol
+
+import (
+	"strconv"
+	"testing"
+
+	"github.com/grafana/grafana/pkg/services/user"
+	"github.com/stretchr/testify/assert"
+)
+
+type testData struct {
+	uid       string
+	folderUid string
+}
+
+func (d testData) Scopes() []string {
+	return []string{
+		"dashboards:uid:" + d.uid,
+		"folders:uid:" + d.folderUid,
+	}
+}
+
+func generateTestData() []testData {
+	var data []testData
+	for i := 1; i < 100; i++ {
+		data = append(data, testData{
+			uid:       strconv.Itoa(i),
+			folderUid: strconv.Itoa(i + 100),
+		})
+	}
+	return data
+}
+
+func Test_Checker(t *testing.T) {
+	data := generateTestData()
+	type testCase struct {
+		desc        string
+		user        *user.SignedInUser
+		expectedLen int
+	}
+	tests := []testCase{
+		{
+			desc: "should pass for every entity with dashboard wildcard scope",
+			user: &user.SignedInUser{
+				OrgID:       1,
+				Permissions: map[int64]map[string][]string{1: {"dashboards:read": {"dashboards:*"}}},
+			},
+			expectedLen: len(data),
+		},
+		{
+			desc: "should pass for every entity with folder wildcard scope",
+			user: &user.SignedInUser{
+				OrgID:       1,
+				Permissions: map[int64]map[string][]string{1: {"dashboards:read": {"folders:*"}}},
+			},
+			expectedLen: len(data),
+		},
+		{
+			desc: "should only pass for for 3 scopes",
+			user: &user.SignedInUser{
+				OrgID:       1,
+				Permissions: map[int64]map[string][]string{1: {"dashboards:read": {"dashboards:uid:4", "dashboards:uid:50", "dashboards:uid:99"}}},
+			},
+			expectedLen: 3,
+		},
+		{
+			desc: "should only pass 4 with secondary supported scope",
+			user: &user.SignedInUser{
+				OrgID:       1,
+				Permissions: map[int64]map[string][]string{1: {"dashboards:read": {"folders:uid:104", "folders:uid:150", "folders:uid:154", "folders:uid:199"}}},
+			},
+			expectedLen: 4,
+		},
+		{
+			desc: "should only pass 4 with some dashboard and some folder scopes",
+			user: &user.SignedInUser{
+				OrgID:       1,
+				Permissions: map[int64]map[string][]string{1: {"dashboards:read": {"dashboards:uid:1", "dashboards:uid:2", "folders:uid:154", "folders:uid:199"}}},
+			},
+			expectedLen: 4,
+		},
+		{
+			desc: "should only pass 2 with overlapping dashboard and folder scopes",
+			user: &user.SignedInUser{
+				OrgID:       1,
+				Permissions: map[int64]map[string][]string{1: {"dashboards:read": {"dashboards:uid:101", "dashboards:uid:2", "folders:uid:101", "folders:uid:102"}}},
+			},
+			expectedLen: 2,
+		},
+		{
+			desc: "should pass none for missing action",
+			user: &user.SignedInUser{
+				OrgID:       1,
+				Permissions: map[int64]map[string][]string{1: {}},
+			},
+			expectedLen: 0,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.desc, func(t *testing.T) {
+			check := Checker(tt.user, "dashboards:read")
+			numPasses := 0
+			for _, d := range data {
+				if ok := check(d.Scopes()...); ok {
+					numPasses++
+				}
+			}
+			assert.Equal(t, tt.expectedLen, numPasses)
+		})
+	}
+}

pkg/services/accesscontrol/scope.go

@@ -142,19 +142,26 @@ func (s scopeProviderImpl) GetResourceAllIDScope() string {
 	return GetResourceAllIDScope(s.root)
 }
 
-// WildcardsFromPrefix generates valid wildcards from prefix
-// datasource:uid: => "*", "datasource:*", "datasource:uid:*"
 func WildcardsFromPrefix(prefix string) Wildcards {
+	return WildcardsFromPrefixes([]string{prefix})
+}
+
+// WildcardsFromPrefixes generates valid wildcards from prefixes
+// datasource:uid: => "*", "datasource:*", "datasource:uid:*"
+func WildcardsFromPrefixes(prefixes []string) Wildcards {
 	var b strings.Builder
 	wildcards := Wildcards{"*"}
-	parts := strings.Split(prefix, ":")
-	for _, p := range parts {
-		if p == "" {
-			continue
+	for _, prefix := range prefixes {
+		parts := strings.Split(prefix, ":")
+		for _, p := range parts {
+			if p == "" {
+				continue
+			}
+			b.WriteString(p)
+			b.WriteRune(':')
+			wildcards = append(wildcards, b.String()+"*")
 		}
-		b.WriteString(p)
-		b.WriteRune(':')
-		wildcards = append(wildcards, b.String()+"*")
+		b.Reset()
 	}
 	return wildcards
 }

pkg/services/searchV2/auth.go

@@ -7,21 +7,20 @@ import (
 	"github.com/grafana/grafana/pkg/services/accesscontrol"
 	"github.com/grafana/grafana/pkg/services/dashboards"
 	"github.com/grafana/grafana/pkg/services/sqlstore/permissions"
-	"github.com/grafana/grafana/pkg/services/sqlstore/searchstore"
 	"github.com/grafana/grafana/pkg/services/user"
 )
 
 // ResourceFilter checks if a given a uid (resource identifier) check if we have the requested permission
-type ResourceFilter func(uid string) bool
+type ResourceFilter func(kind entityKind, uid, parentUID string) bool
 
 // FutureAuthService eventually implemented by the security service
 type FutureAuthService interface {
 	GetDashboardReadFilter(user *user.SignedInUser) (ResourceFilter, error)
 }
 
-var _ FutureAuthService = (*simpleSQLAuthService)(nil)
+var _ FutureAuthService = (*simpleAuthService)(nil)
 
-type simpleSQLAuthService struct {
+type simpleAuthService struct {
 	sql db.DB
 	ac  accesscontrol.Service
 }
@@ -30,22 +29,26 @@ type dashIdQueryResult struct {
 	UID string `xorm:"uid"`
 }
 
-func (a *simpleSQLAuthService) getDashboardTableAuthFilter(user *user.SignedInUser) searchstore.FilterWhere {
-	if a.ac.IsDisabled() {
-		return permissions.DashboardPermissionFilter{
-			OrgRole:         user.OrgRole,
-			OrgId:           user.OrgID,
-			Dialect:         a.sql.GetDialect(),
-			UserId:          user.UserID,
-			PermissionLevel: dashboards.PERMISSION_VIEW,
-		}
+func (a *simpleAuthService) GetDashboardReadFilter(user *user.SignedInUser) (ResourceFilter, error) {
+	if !a.ac.IsDisabled() {
+		canReadDashboard, canReadFolder := accesscontrol.Checker(user, dashboards.ActionDashboardsRead), accesscontrol.Checker(user, dashboards.ActionFoldersRead)
+		return func(kind entityKind, uid, parent string) bool {
+			if kind == entityKindFolder {
+				return canReadFolder(dashboards.ScopeFoldersProvider.GetResourceScopeUID(uid))
+			} else if kind == entityKindDashboard {
+				return canReadDashboard(dashboards.ScopeDashboardsProvider.GetResourceScopeUID(uid), dashboards.ScopeFoldersProvider.GetResourceScopeUID(parent))
+			}
+			return false
+		}, nil
 	}
 
-	return permissions.NewAccessControlDashboardPermissionFilter(user, dashboards.PERMISSION_VIEW, "")
-}
-
-func (a *simpleSQLAuthService) GetDashboardReadFilter(user *user.SignedInUser) (ResourceFilter, error) {
-	filter := a.getDashboardTableAuthFilter(user)
+	filter := permissions.DashboardPermissionFilter{
+		OrgRole:         user.OrgRole,
+		OrgId:           user.OrgID,
+		Dialect:         a.sql.GetDialect(),
+		UserId:          user.UserID,
+		PermissionLevel: dashboards.PERMISSION_VIEW,
+	}
 	rows := make([]*dashIdQueryResult, 0)
 
 	err := a.sql.WithDbSession(context.Background(), func(sess *db.Session) error {
@@ -72,7 +75,7 @@ func (a *simpleSQLAuthService) GetDashboardReadFilter(user *user.SignedInUser) (
 		uids[rows[i].UID] = true
 	}
 
-	return func(uid string) bool {
+	return func(_ entityKind, uid, _ string) bool {
 		return uids[uid]
 	}, err
 }

pkg/services/searchV2/bluge.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/slugify"
+	"github.com/grafana/grafana/pkg/services/folder"
 	"github.com/grafana/grafana/pkg/services/store/entity"
 )
 
@@ -70,6 +71,7 @@ func initOrgIndex(dashboards []dashboard, logger log.Logger, extendDoc ExtendDas
 
 	// First index the folders to construct folderIdLookup.
 	folderIdLookup := make(map[int64]string, 50)
+	folderIdLookup[0] = folder.GeneralFolderUID
 	for _, dash := range dashboards {
 		if !dash.isFolder {
 			continue
@@ -83,9 +85,6 @@ func initOrgIndex(dashboards []dashboard, logger log.Logger, extendDoc ExtendDas
 			return nil, err
 		}
 		uid := dash.uid
-		if uid == "" {
-			uid = "general"
-		}
 		folderIdLookup[dash.id] = uid
 	}
 

pkg/services/searchV2/filter.go

@@ -2,6 +2,7 @@ package searchV2
 
 import (
 	"regexp"
+	"strings"
 
 	"github.com/blugelabs/bluge"
 	"github.com/blugelabs/bluge/search"
@@ -36,7 +37,7 @@ func (r entityKind) supportsAuthzCheck() bool {
 }
 
 var (
-	permissionFilterFields                 = []string{documentFieldUID, documentFieldKind}
+	permissionFilterFields                 = []string{documentFieldUID, documentFieldKind, documentFieldLocation}
 	panelIdFieldRegex                      = regexp.MustCompile(`^(.*)#([0-9]{1,4})$`)
 	panelIdFieldDashboardUidSubmatchIndex  = 1
 	panelIdFieldPanelIdSubmatchIndex       = 2
@@ -65,7 +66,7 @@ func (q *PermissionFilter) logAccessDecision(decision bool, kind interface{}, id
 	}
 }
 
-func (q *PermissionFilter) canAccess(kind entityKind, id string) bool {
+func (q *PermissionFilter) canAccess(kind entityKind, id, location string) bool {
 	if !kind.supportsAuthzCheck() {
 		q.logAccessDecision(false, kind, id, "entityDoesNotSupportAuthz")
 		return false
@@ -74,29 +75,28 @@ func (q *PermissionFilter) canAccess(kind entityKind, id string) bool {
 	// TODO add `kind` to the `ResourceFilter` interface so that we can move the switch out of here
 	//
 	switch kind {
-	case entityKindFolder:
-		if id == "" {
-			q.logAccessDecision(true, kind, id, "generalFolder")
-			return true
-		}
-		fallthrough
-	case entityKindDashboard:
-		decision := q.filter(id)
+	case entityKindFolder, entityKindDashboard:
+		decision := q.filter(kind, id, location)
 		q.logAccessDecision(decision, kind, id, "resourceFilter")
 		return decision
 	case entityKindPanel:
 		matches := panelIdFieldRegex.FindStringSubmatch(id)
-
 		submatchCount := len(matches)
 		if submatchCount != panelIdFieldRegexExpectedSubmatchCount {
 			q.logAccessDecision(false, kind, id, "invalidPanelIdFieldRegexSubmatchCount", "submatchCount", submatchCount, "expectedSubmatchCount", panelIdFieldRegexExpectedSubmatchCount)
 			return false
 		}
-
 		dashboardUid := matches[panelIdFieldDashboardUidSubmatchIndex]
-		decision := q.filter(dashboardUid)
 
-		q.logAccessDecision(decision, kind, id, "resourceFilter", "dashboardUid", dashboardUid, "panelId", matches[panelIdFieldPanelIdSubmatchIndex])
+		// Location is <folder_uid>/<dashboard_uid>
+		if !strings.HasSuffix(location, "/"+dashboardUid) {
+			q.logAccessDecision(false, kind, id, "invalidLocation", "location", location, "dashboardUid", dashboardUid)
+			return false
+		}
+		folderUid := location[:len(location)-len(dashboardUid)-1]
+
+		decision := q.filter(entityKindDashboard, dashboardUid, folderUid)
+		q.logAccessDecision(decision, kind, id, "resourceFilter", "folderUid", folderUid, "dashboardUid", dashboardUid, "panelId", matches[panelIdFieldPanelIdSubmatchIndex])
 		return decision
 	default:
 		q.logAccessDecision(false, kind, id, "reason", "unknownKind")
@@ -111,13 +111,18 @@ func (q *PermissionFilter) Searcher(i search.Reader, options search.SearcherOpti
 	}
 
 	s, err := searcher.NewMatchAllSearcher(i, 1, similarity.ConstantScorer(1), options)
+	if err != nil {
+		return nil, err
+	}
 	return searcher.NewFilteringSearcher(s, func(d *search.DocumentMatch) bool {
-		var kind, id string
+		var kind, id, location string
 		err := dvReader.VisitDocumentValues(d.Number, func(field string, term []byte) {
 			if field == documentFieldKind {
 				kind = string(term)
 			} else if field == documentFieldUID {
 				id = string(term)
+			} else if field == documentFieldLocation {
+				location = string(term)
 			}
 		})
 		if err != nil {
@@ -131,6 +136,6 @@ func (q *PermissionFilter) Searcher(i search.Reader, options search.SearcherOpti
 			return false
 		}
 
-		return q.canAccess(e, id)
+		return q.canAccess(e, id, location)
 	}), err
 }

pkg/services/searchV2/index.go

@@ -20,6 +20,7 @@ import (
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/folder"
 	"github.com/grafana/grafana/pkg/services/store"
 	"github.com/grafana/grafana/pkg/services/store/entity"
 	kdash "github.com/grafana/grafana/pkg/services/store/kind/dashboard"
@@ -761,7 +762,7 @@ func (i *searchIndex) updateDashboard(ctx context.Context, orgID int64, index *o
 
 	var folderUID string
 	if dash.folderID == 0 {
-		folderUID = "general"
+		folderUID = folder.GeneralFolderUID
 	} else {
 		var err error
 		folderUID, err = i.folderIdLookup(ctx, dash.folderID)
@@ -900,23 +901,7 @@ func (l sqlDashboardLoader) LoadDashboards(ctx context.Context, orgID int64, das
 	limit := 1
 
 	if dashboardUID == "" {
-		limit = l.settings.DashboardLoadingBatchSize
-		dashboards = make([]dashboard, 0, limit+1)
-
-		// Add the root folder ID (does not exist in SQL).
-		dashboards = append(dashboards, dashboard{
-			id:       0,
-			uid:      "",
-			isFolder: true,
-			folderID: 0,
-			slug:     "",
-			created:  time.Now(),
-			updated:  time.Now(),
-			summary: &entity.EntitySummary{
-				//ID:    0,
-				Name: "General",
-			},
-		})
+		dashboards = make([]dashboard, 0, l.settings.DashboardLoadingBatchSize)
 	}
 
 	loadDatasourceCtx, loadDatasourceSpan := l.tracer.Start(ctx, "sqlDashboardLoader LoadDatasourceLookup")

pkg/services/searchV2/index_test.go

@@ -9,14 +9,13 @@ import (
 	"github.com/grafana/grafana-plugin-sdk-go/backend"
 	"github.com/grafana/grafana-plugin-sdk-go/data"
 
+	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/infra/tracing"
 	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/store"
 	"github.com/grafana/grafana/pkg/services/store/entity"
 	"github.com/grafana/grafana/pkg/setting"
 
-	"github.com/grafana/grafana/pkg/infra/log"
-	"github.com/grafana/grafana/pkg/services/store"
-
 	"github.com/blugelabs/bluge"
 	"github.com/grafana/grafana-plugin-sdk-go/experimental"
 	"github.com/stretchr/testify/require"
@@ -32,11 +31,11 @@ func (t *testDashboardLoader) LoadDashboards(_ context.Context, _ int64, _ strin
 
 var testLogger = log.New("index-test-logger")
 
-var testAllowAllFilter = func(uid string) bool {
+var testAllowAllFilter = func(kind entityKind, uid, parent string) bool {
 	return true
 }
 
-var testDisallowAllFilter = func(uid string) bool {
+var testDisallowAllFilter = func(kind entityKind, uid, parent string) bool {
 	return false
 }
 
@@ -430,8 +429,8 @@ var dashboardsWithFolders = []dashboard{
 		summary: &entity.EntitySummary{
 			Name: "Dashboard in folder 1",
 			Nested: []*entity.EntitySummary{
-				newNestedPanel(1, "Panel 1"),
-				newNestedPanel(2, "Panel 2"),
+				newNestedPanel(1, 2, "Panel 1"),
+				newNestedPanel(2, 2, "Panel 2"),
 			},
 		},
 	},
@@ -442,7 +441,7 @@ var dashboardsWithFolders = []dashboard{
 		summary: &entity.EntitySummary{
 			Name: "Dashboard in folder 2",
 			Nested: []*entity.EntitySummary{
-				newNestedPanel(3, "Panel 3"),
+				newNestedPanel(3, 3, "Panel 3"),
 			},
 		},
 	},
@@ -452,7 +451,7 @@ var dashboardsWithFolders = []dashboard{
 		summary: &entity.EntitySummary{
 			Name: "One more dash",
 			Nested: []*entity.EntitySummary{
-				newNestedPanel(4, "Panel 4"),
+				newNestedPanel(4, 4, "Panel 4"),
 			},
 		},
 	},
@@ -509,17 +508,17 @@ var dashboardsWithPanels = []dashboard{
 		summary: &entity.EntitySummary{
 			Name: "My Dash",
 			Nested: []*entity.EntitySummary{
-				newNestedPanel(1, "Panel 1"),
-				newNestedPanel(2, "Panel 2"),
+				newNestedPanel(1, 1, "Panel 1"),
+				newNestedPanel(2, 1, "Panel 2"),
 			},
 		},
 	},
 }
 
-func newNestedPanel(id int64, name string) *entity.EntitySummary {
+func newNestedPanel(id, dashId int64, name string) *entity.EntitySummary {
 	summary := &entity.EntitySummary{
 		Kind: "panel",
-		UID:  fmt.Sprintf("???#%d", id),
+		UID:  fmt.Sprintf("%d#%d", dashId, id),
 	}
 	summary.Name = name
 	return summary

pkg/services/searchV2/service.go

@@ -91,7 +91,7 @@ func ProvideService(cfg *setting.Cfg, sql db.DB, entityEventStore store.EntityEv
 		cfg: cfg,
 		sql: sql,
 		ac:  ac,
-		auth: &simpleSQLAuthService{
+		auth: &simpleAuthService{
 			sql: sql,
 			ac:  ac,
 		},

pkg/services/searchV2/testdata/basic-search.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:        | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 2              | boom           |                  | /pfix/d/2/     | null                     | []                      |                |
+//  | dashboard      | 2              | boom           |                  | /pfix/d/2/     | null                     | []                      | general        |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/folders-dashboard-removed-on-folder-removed.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:        | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 4              | One more dash  |                  | /pfix/d/4/     | null                     | []                      |                |
+//  | dashboard      | 4              | One more dash  |                  | /pfix/d/4/     | null                     | []                      | general        |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/multiple-tokens-beginning-lower.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:            | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string     | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 1              | Archer Data System |                  | /pfix/d/1/     | null                     | []                      |                |
+//  | dashboard      | 1              | Archer Data System |                  | /pfix/d/1/     | null                     | []                      | general        |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/multiple-tokens-beginning.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:            | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string     | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 1              | Archer Data System |                  | /pfix/d/1/     | null                     | []                      |                |
+//  | dashboard      | 1              | Archer Data System |                  | /pfix/d/1/     | null                     | []                      | general        |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/multiple-tokens-middle-lower.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:            | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string     | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 2              | Document Sync repo |                  | /pfix/d/2/     | null                     | []                      |                |
+//  | dashboard      | 2              | Document Sync repo |                  | /pfix/d/2/     | null                     | []                      | general        |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/multiple-tokens-middle.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:            | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string     | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 1              | Archer Data System |                  | /pfix/d/1/     | null                     | []                      |                |
+//  | dashboard      | 1              | Archer Data System |                  | /pfix/d/1/     | null                     | []                      | general        |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/ngram-camel-case-split.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:        | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 1              | heatTorkel     |                  | /pfix/d/1/     | null                     | []                      |                |
+//  | dashboard      | 1              | heatTorkel     |                  | /pfix/d/1/     | null                     | []                      | general        |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/ngram-punctuation-split.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:        | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 1              | heat-torkel    |                  | /pfix/d/1/     | null                     | []                      |                |
+//  | dashboard      | 1              | heat-torkel    |                  | /pfix/d/1/     | null                     | []                      | general        |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/ngram-simple.jsonc

@@ -13,8 +13,8 @@
 //  | Labels:        | Labels:        | Labels:          | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string   | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 1              | heat-torkel      |                  | /pfix/d/1/     | null                     | []                      |                |
-//  | dashboard      | 2              | topology heatmap |                  | /pfix/d/2/     | null                     | []                      |                |
+//  | dashboard      | 1              | heat-torkel      |                  | /pfix/d/1/     | null                     | []                      | general        |
+//  | dashboard      | 2              | topology heatmap |                  | /pfix/d/2/     | null                     | []                      | general        |
 //  +----------------+----------------+------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -130,8 +130,8 @@
             []
           ],
           [
-            "",
-            ""
+            "general",
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/prefix-search-beginning-lower.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:            | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string     | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 1              | Archer Data System |                  | /pfix/d/1/     | null                     | []                      |                |
+//  | dashboard      | 1              | Archer Data System |                  | /pfix/d/1/     | null                     | []                      | general        |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/prefix-search-beginning.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:            | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string     | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 1              | Archer Data System |                  | /pfix/d/1/     | null                     | []                      |                |
+//  | dashboard      | 1              | Archer Data System |                  | /pfix/d/1/     | null                     | []                      | general        |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/prefix-search-middle-lower.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:            | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string     | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 2              | Document Sync repo |                  | /pfix/d/2/     | null                     | []                      |                |
+//  | dashboard      | 2              | Document Sync repo |                  | /pfix/d/2/     | null                     | []                      | general        |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/prefix-search-middle.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:            | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string     | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 2              | Document Sync repo |                  | /pfix/d/2/     | null                     | []                      |                |
+//  | dashboard      | 2              | Document Sync repo |                  | /pfix/d/2/     | null                     | []                      | general        |
 //  +----------------+----------------+--------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/prefix-search-ngram-exceeded.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:                        | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string                 | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+--------------------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 1              | Eyjafjallajökull Eruption data |                  | /pfix/d/1/     | null                     | []                      |                |
+//  | dashboard      | 1              | Eyjafjallajökull Eruption data |                  | /pfix/d/1/     | null                     | []                      | general        |
 //  +----------------+----------------+--------------------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/scattered-tokens-match.jsonc

@@ -13,7 +13,7 @@
 //  | Labels:        | Labels:        | Labels:                                                              | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        |
 //  | Type: []string | Type: []string | Type: []string                                                       | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string |
 //  +----------------+----------------+----------------------------------------------------------------------+------------------+----------------+--------------------------+-------------------------+----------------+
-//  | dashboard      | 1              | Three can keep a secret, if two of them are dead (Benjamin Franklin) |                  | /pfix/d/1/     | null                     | []                      |                |
+//  | dashboard      | 1              | Three can keep a secret, if two of them are dead (Benjamin Franklin) |                  | /pfix/d/1/     | null                     | []                      | general        |
 //  +----------------+----------------+----------------------------------------------------------------------+------------------+----------------+--------------------------+-------------------------+----------------+
 //  
 //  
@@ -122,7 +122,7 @@
             []
           ],
           [
-            ""
+            "general"
           ]
         ]
       }

pkg/services/searchV2/testdata/sort-asc.jsonc

@@ -14,8 +14,8 @@
 //  | Labels:        | Labels:        | Labels:        | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        | Labels:         |
 //  | Type: []string | Type: []string | Type: []string | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string | Type: []float64 |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+-----------------+
-//  | dashboard      | 1              | a-test         |                  | /pfix/d/1/     | null                     | []                      |                | 0               |
-//  | dashboard      | 2              | z-test         |                  | /pfix/d/2/     | null                     | []                      |                | 1               |
+//  | dashboard      | 1              | a-test         |                  | /pfix/d/1/     | null                     | []                      | general        | 0               |
+//  | dashboard      | 2              | z-test         |                  | /pfix/d/2/     | null                     | []                      | general        | 1               |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+-----------------+
 //  
 //  
@@ -139,8 +139,8 @@
             []
           ],
           [
-            "",
-            ""
+            "general",
+            "general"
           ],
           [
             0,

pkg/services/searchV2/testdata/sort-desc.jsonc

@@ -14,8 +14,8 @@
 //  | Labels:        | Labels:        | Labels:        | Labels:          | Labels:        | Labels:                  | Labels:                 | Labels:        | Labels:         |
 //  | Type: []string | Type: []string | Type: []string | Type: []string   | Type: []string | Type: []*json.RawMessage | Type: []json.RawMessage | Type: []string | Type: []float64 |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+-----------------+
-//  | dashboard      | 2              | z-test         |                  | /pfix/d/2/     | null                     | []                      |                | 3               |
-//  | dashboard      | 1              | a-test         |                  | /pfix/d/1/     | null                     | []                      |                | 2               |
+//  | dashboard      | 2              | z-test         |                  | /pfix/d/2/     | null                     | []                      | general        | 3               |
+//  | dashboard      | 1              | a-test         |                  | /pfix/d/1/     | null                     | []                      | general        | 2               |
 //  +----------------+----------------+----------------+------------------+----------------+--------------------------+-------------------------+----------------+-----------------+
 //  
 //  
@@ -139,8 +139,8 @@
             []
           ],
           [
-            "",
-            ""
+            "general",
+            "general"
           ],
           [
             3,

pkg/services/store/entity_events.go

@@ -148,6 +148,10 @@ func (e *entityEventService) Run(ctx context.Context) error {
 type dummyEntityEventsService struct {
 }
 
+func NewDummyEntityEventsService() EntityEventsService {
+	return dummyEntityEventsService{}
+}
+
 func (d dummyEntityEventsService) Run(ctx context.Context) error {
 	return nil
 }