Permissions in ElasticSearch - arrays

Question

Given a set of documents similar to the following:
{
"value": "Some random string here",
"permissions": ["job.view", "special.permission"]
}
We want to be able to create a search that'll allow us to pass an array of permissions to match against, for example, we might want to pass in
["job.view", "foo.bar", "pineapple.eat"]
as the permissions.
The document should only return in the search if all the permissions listed in the document exist in the set passed in as part of the query.
Not fussed whether we have to change the document layout, or the query, but, we're currently restricted to not being able to use the Scripting API (due to AWS).

Answer 1

There is a convoluted way to do this which requires you also index the number of permissions in the document, i.e. if the document contains two values in the permissions array (like in your example) then you'd also include the field permissions_count: 2.
Then your query would contain as many bool/should queries as there are permissions permutations in your search array. For instance, in your search array you have 3 permissions ["job.view", "foo.bar", "pineapple.eat"], then you need to check the following conditions:
permissions contains all three permissions and permissions_count: 3
or permissions contains two of the three permissions (three combinations) and permissions_count: 2
or permissions contains only one of the three permissions (three possibilities) and permissions_count: 1
So when checking for 1 permission, you'll have 1 query in your bool/should. For 2 permissions, you'll have 3, for 3 permissions you have 7, etc..
The full query is shown below:
{
"query": {
"bool": {
"should": [
{
"bool": {
"must": [
{
"terms": {
"permissions": ["job.view", "special.permission", "pineapple.eat"]
}
},
{
"term": {
"permissions_count": 3
}
}
]
}
},
{
"bool": {
"must": [
{
"terms": {
"permissions": ["special.permission", "pineapple.eat"]
}
},
{
"term": {
"permissions_count": 2
}
}
]
}
},
{
"bool": {
"must": [
{
"terms": {
"permissions": ["job.view", "pineapple.eat"]
}
},
{
"term": {
"permissions_count": 2
}
}
]
}
},
{
"bool": {
"must": [
{
"terms": {
"permissions": ["special.permission", "job.view"]
}
},
{
"term": {
"permissions_count": 2
}
}
]
}
},
{
"bool": {
"must": [
{
"term": {
"permissions": "special.permission"
}
},
{
"term": {
"permissions_count": 1
}
}
]
}
},
{
"bool": {
"must": [
{
"term": {
"permissions": "job.view"
}
},
{
"term": {
"permissions_count": 1
}
}
]
}
},
{
"bool": {
"must": [
{
"term": {
"permissions": "pineapple.eat"
}
},
{
"term": {
"permissions_count": 1
}
}
]
}
}
],
"minimum_number_should_match": 1
}
}
}
As you can see it's a bit convoluted only to check for three permissions...
I would maybe approach this problem from a different perspective and come up with another field (or set of fields) that would contain a bitset of permissions or cleverly chosen integers for each permissions, but I haven't fully thought-out this one yet.
Another solution would be to leverage Shield and document-access control instead of storing the permissions within the documents themselves.