[BUG] Running a nested path query from a user with FLS Includes rules returns empty results

[cwperks]

What is the bug?

When using a nested query from a user with a role containing FLS Includes rules, the query result is empty but I expect the query results to not be empty.

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Create an index

Create test index

PUT /my-index
{
  "mappings": {
    "properties": {
      "outerNested": {
        "type": "nested",
        "properties": {
          "innerNested": {
            "type": "nested",
            "properties": {
              "name": {
                "type": "keyword"
              }
            }
          }
        }
      }
    }
  }
}

2. Create a role with FLS includes rules using either wildcard (nestedField*) or each field explicitly (nestedField.name). When listing fields explicitly, list nested fields as dot-separated starting from the root.

Create a role

PUT _plugins/_security/api/roles/test-role
{
  "cluster_permissions": [
    "cluster_all"
  ],
  "index_permissions": [{
    "index_patterns": [
      "*"
    ],
    "dls": "",
    "fls": ["outerNested*"],
    "masked_fields": [],
    "allowed_actions": [
      "indices_all"
    ]
  }]
}

3. Map the role to a user
4. Ingest a few documents

Create documents

POST my-index/_doc
{
  "outerNested": {
    "innerNested": {
      "name": "Craig"
    }
  }
}

POST my-index/_doc
{
  "outerNested": {
    "innerNested": {
      "name": "John"
    }
  }
}

POST my-index/_doc
{
  "outerNested": {
    "innerNested": {
      "name": "Jane"
    }
  }
}

5. Create a painless script

Create script

POST _scripts/name-eq
{
  "script": {
    "lang": "painless",
    "source": "if (doc[params['fieldName']].size() != 0) { doc[params['fieldName']].value == params['value'] }"
  }
}

6. Search using Nested Query and script

Search

GET my-index/_search
{
  "query": {
    "nested": {
      "path": "outerNested.innerNested",
      "query": {
        "bool": {
          "must": [
            {
              "script": {
                "script": {
                  "id": "name-eq",
                  "params": {
                    "fieldName": "outerNested.innerNested.name",
                    "value": "Craig"
                  }
                }
              }
            }
          ]
        }
      }
    }
  }
}

> Empty results

What is the expected behavior?

The search query should return the matching documents

Do you have any additional context?

FLS with Includes is evaluated different than FLS with Excludes.

Searching with a painless script will use a __nested_path metaField behind the scenes which is not currently being tracked as a meta field: https://github.com/opensearch-project/security/blob/main/src/main/java/org/opensearch/security/configuration/SecurityFlsDlsIndexSearcherWrapper.java#L41-L59

[derek-ho]

[Triage] @cwperks thanks for filing this issue. It looks like there is a clear reproduction steps here and the bug seems like a bad user experience. We would gladly accept a PR to address this bug.

[cwperks]

Associated PRs have been merged. Closing this issue.