WIP: 🕸️ Bug / Support AWS OpenSearch Auth

.gitignore

@@ -16,4 +16,5 @@ lerna-debug.log
 !.env.test
 !**/.env.schema
 
-/configs
+/configs
+/modules/graphql-router/src/admin/**

apps/search-server/package.json

@@ -21,9 +21,10 @@
 		"test": "tsx --test ./src/**/*.test.ts"
 	},
 	"dependencies": {
+		"@aws-sdk/credential-provider-node": "^3.972.60",
 		"@overture-stack/arranger-graphql-router": "file:../../modules/graphql-router",
-		"@overture-stack/sqon": "file:../../modules/sqon",
 		"@overture-stack/arranger-types": "file:../../modules/types",
+		"@overture-stack/sqon": "file:../../modules/sqon",
 		"cors": "^2.8.5",
 		"dotenv": "^16.0.3",
 		"express": "^4.18.2",

modules/graphql-router/src/router.ts

@@ -7,10 +7,9 @@ import enforceAccessControl, { getDefaultServerSideFilter } from '#accessControl
 import fallbackConfigs, { validateConfigs } from '#config/index.js';
 import downloadRoutes from '#download/index.js';
 import getGraphQLRoutes from '#graphqlRoutes.js';
-import { getIndexMapping } from '#searchClient/index.js';
 import { buildCatalogueIntrospectionBody } from '#introspection/buildCatalogueIntrospection.js';
 import resolveCatalogueFields from '#mapping/resolveCatalogueFields.js';
-import buildSearchClient, { type SearchClient } from '#searchClient/index.js';
+import buildSearchClient, { getIndexMapping, type SearchClient } from '#searchClient/index.js';
 import type { ArrangerBaseContext } from '#types.js';
 import { addContext } from '#utils/context.js';
 import { warnDeprecatedConfigsSource } from '#utils/noops.js';
@@ -76,7 +75,7 @@ const arrangerRouter = async <Context extends ArrangerBaseContext>({
 			}));
 
 		const mappingFromIndex = await getIndexMapping({
-			enableDebug,
+			enableDebug: !!enableDebug,
 			searchClient: esClient,
 			esIndex: configs[configRootProperties.ES_INDEX],
 		});

modules/graphql-router/src/searchClient/createOpenSearchClient.ts

@@ -5,7 +5,7 @@ import type { SearchClient, SearchConfig } from './types.js';
 
 export type OSClientOptions = Prettify<
 	SearchConfig & {
-		clientType: 'opensearch';
+		clientType: 'opensearch' | 'opensearch-aws';
 	}
 >;
 

modules/graphql-router/src/searchClient/index.ts

@@ -1,8 +1,15 @@
+import { defaultProvider } from '@aws-sdk/credential-provider-node';
+import { AwsSigv4Signer } from '@opensearch-project/opensearch/aws';
+
 import { createElasticSearchClient, type ESClientOptions } from './createElasticSearchClient.js';
 import { createOpenSearchClient, type OSClientOptions } from './createOpenSearchClient.js';
 import type { SearchClient, SearchConfig, SearchConfigWithClient, SupportedClientTypes } from './types.js';
 
-export const supportedClientValues = ['opensearch', 'elasticsearch'] as const satisfies SupportedClientTypes[];
+export const supportedClientValues = [
+	'opensearch',
+	'elasticsearch',
+	'opensearch-aws',
+] as const satisfies SupportedClientTypes[];
 
 const buildAuthHeaders = (auth: SearchConfig['auth']): Record<string, string> =>
 	auth
@@ -243,6 +250,28 @@ const createSearchClient = (clientConfig: SearchConfigWithClient): SearchClient
 			return createOpenSearchClient(options);
 		}
 
+		case 'opensearch-aws': {
+			const options: OSClientOptions = {
+				...clientConfig,
+				clientType,
+				...AwsSigv4Signer({
+					region: 'us-east-1',
+					service: 'es',
+					// Must return a Promise that resolve to an AWS.Credentials object.
+					// This function is used to acquire the credentials when the client start and
+					// when the credentials are expired.
+					// The Client will refresh the Credentials only when they are expired.
+					// With AWS SDK V2, Credentials.refreshPromise is used when available to refresh the credentials.
+					getCredentials: () => {
+						// Any other method to acquire a new Credentials object can be used.
+						const credentialsProvider = defaultProvider();
+						return credentialsProvider();
+					},
+				}),
+			};
+			return createOpenSearchClient(options);
+		}
+
 		case 'elasticsearch': {
 			const options: ESClientOptions = { ...clientConfig, clientType };
 			return createElasticSearchClient(options);

modules/graphql-router/src/searchClient/types.ts

@@ -1,7 +1,11 @@
 import type { Client as ElasticClient } from '@elastic/elasticsearch';
 import type { Client as OpenSearchClient } from '@opensearch-project/opensearch';
 
-export type SupportedClients = { elasticsearch: ElasticClient; opensearch: OpenSearchClient };
+export type SupportedClients = {
+	elasticsearch: ElasticClient;
+	opensearch: OpenSearchClient;
+	'opensearch-aws': OpenSearchClient;
+};
 export type SupportedClientTypes = keyof SupportedClients;
 export type SearchConfig = {
 	node: string;
@@ -40,8 +44,13 @@ export type SearchClientIndicesOpenParams = { index: string | string[] };
 export type SearchClientIndicesPutMappingsParams = { index: string; body: Record<string, any> };
 export type SearchClientIndicesPutSettingsParams = { body: Record<string, any> };
 export type SearchClientBulkParams = { body: Record<string, any>[] };
-export type SearchClientCreateParams = { id: string; index: string; body: Record<string, any> };
-export type SearchClientDeleteParams = { index: string; id: string };
+export type SearchClientCreateParams = {
+	id: string;
+	index: string;
+	body: Record<string, any>;
+	refresh?: boolean | 'false' | 'true' | 'wait_for';
+};
+export type SearchClientDeleteParams = { index: string; id: string; refresh?: boolean | 'false' | 'true' | 'wait_for' };
 export type SearchClientDeleteByQueryParams = { index: string; body: Record<string, any> };
 export type SearchClientIndexParams = { index: string; body: Record<string, any> };
 export type SearchClientUpdateParams = { id: string; index: string; body: Record<string, any> };
@@ -95,6 +104,8 @@ type SearchClientHitsResponse = SearchClientBaseResponse & {
 		hits: {
 			hits: {
 				_source: any;
+				_id: string;
+				_index: string;
 			}[];
 		};
 	};
@@ -108,8 +119,8 @@ type SearchClientAggregationsResponse = SearchClientBaseResponse & {
 export type SearchClientSearchBody = {
 	_shards: ShardData;
 	aggregations?: Record<string, any>;
-	hits?: {
-		hits: { _id: string; _index: string; _source?: any }[];
+	hits: {
+		hits: { _source?: any }[];
 	};
 	timed_out: boolean;
 	took: number;