Blocking reprovision requests with substitution params

Signed-off-by: Joshua Palis <[email protected]>
opensearch-project · Aug 15, 2024 · d6a95bc · d6a95bc
1 parent ca6b183
commit d6a95bc
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 0 deletions.
diff --git a/src/main/java/org/opensearch/flowframework/rest/RestCreateWorkflowAction.java b/src/main/java/org/opensearch/flowframework/rest/RestCreateWorkflowAction.java
@@ -138,6 +138,13 @@ protected RestChannelConsumer prepareRequest(RestRequest request, NodeClient cli
             );
             return processError(ffe, params, request);
         }
+        if (reprovision && !params.isEmpty()) {
+            FlowFrameworkException ffe = new FlowFrameworkException(
+                "Only the parameters " + request.consumedParams() + " are permitted unless the provision parameter is set to true.",
+                RestStatus.BAD_REQUEST
+            );
+            return processError(ffe, params, request);
+        }
         try {
             Template template;
             Map<String, String> useCaseDefaultsMap = Collections.emptyMap();

diff --git a/src/test/java/org/opensearch/flowframework/rest/RestCreateWorkflowActionTests.java b/src/test/java/org/opensearch/flowframework/rest/RestCreateWorkflowActionTests.java
@@ -178,6 +178,20 @@ public void testCreateWorkflowRequestWithCreateAndReprovision() throws Exception
         );
     }
 
+    public void testCreateWorkflowRequestWithReprovisionAndSubstitutionParams() throws Exception {
+        RestRequest request = new FakeRestRequest.Builder(xContentRegistry()).withMethod(RestRequest.Method.POST)
+            .withPath(this.createWorkflowPath)
+            .withParams(Map.ofEntries(Map.entry(REPROVISION_WORKFLOW, "true"), Map.entry("open_ai_key", "1234")))
+            .withContent(new BytesArray(validTemplate), MediaTypeRegistry.JSON)
+            .build();
+        FakeRestChannel channel = new FakeRestChannel(request, false, 1);
+        createWorkflowRestAction.handleRequest(request, channel, nodeClient);
+        assertEquals(RestStatus.BAD_REQUEST, channel.capturedResponse().status());
+        assertTrue(
+            channel.capturedResponse().content().utf8ToString().contains("are permitted unless the provision parameter is set to true.")
+        );
+    }
+
     public void testCreateWorkflowRequestWithUpdateAndParams() throws Exception {
         RestRequest request = new FakeRestRequest.Builder(xContentRegistry()).withMethod(RestRequest.Method.POST)
             .withPath(this.createWorkflowPath)