Content security search

search-api/search-core/src/main/java/org/sunbird/search/dto/SearchDTO.java

@@ -16,6 +16,7 @@ public class SearchDTO {
     private int limit;
     private int offset;
     boolean fuzzySearch = false;
+    boolean secureSettings = false;
     private Map<String, Object> additionalProperties = new HashMap<String, Object>();
     private Map<String, Object> softConstraints = new HashMap<String, Object>();
     private List<Map<String, Object>> aggregations = new ArrayList<>();
@@ -72,6 +73,12 @@ public boolean isFuzzySearch() {
     public void setFuzzySearch(boolean fuzzySearch) {
         this.fuzzySearch = fuzzySearch;
     }
+    public boolean isSecureSettings() {
+        return secureSettings;
+    }
+    public void setSecureSettings(boolean secureSettings) {
+        this.secureSettings = secureSettings;
+    }
     public Map<String, Object> getAdditionalProperties() {
         return additionalProperties;
     }

search-api/search-core/src/main/java/org/sunbird/search/processor/SearchProcessor.java

@@ -5,6 +5,7 @@
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.lang.StringUtils;
+import org.apache.lucene.search.join.ScoreMode;
 import org.elasticsearch.action.search.SearchResponse;
 import org.elasticsearch.index.query.*;
 import org.elasticsearch.index.query.MultiMatchQueryBuilder.Type;
@@ -342,6 +343,9 @@ private QueryBuilder prepareSearchQuery(SearchDTO searchDTO) {
 	}
 
 	private void formQuery(List<Map> properties, QueryBuilder queryBuilder, BoolQueryBuilder boolQuery, String operation, Boolean fuzzy) {
+		boolean enableSecureSettings = Platform.config.hasPath("search.fields.enable.secureSettings") &&
+				Platform.config.getBoolean("search.fields.enable.secureSettings");
+
 		for (Map<String, Object> property : properties) {
 			String opertation = (String) property.get("operation");
 
@@ -359,7 +363,13 @@ private void formQuery(List<Map> properties, QueryBuilder queryBuilder, BoolQuer
 				relevanceSort = true;
 				propertyName = "all_fields";
 				queryBuilder = getAllFieldsPropertyQuery(values, fuzzy);
-				boolQuery.must(queryBuilder);
+				if (!enableSecureSettings) {
+					boolQuery.mustNot(getSecureSettingsSearchDefaultQuery());
+					boolQuery.must(queryBuilder);
+				} else {
+					boolQuery.must(getSecureSettingsSearchQuery("0134149030919618561"));
+					boolQuery.must(queryBuilder);
+				}
 				continue;
 			}
 
@@ -447,8 +457,15 @@ private void formQuery(List<Map> properties, QueryBuilder queryBuilder, BoolQuer
 			}
 			}
 			if (operation.equalsIgnoreCase(AND)) {
-				boolQuery.must(queryBuilder);
-			} else {
+				if (!enableSecureSettings) {
+					boolQuery.mustNot(getSecureSettingsSearchDefaultQuery());
+					boolQuery.must(queryBuilder);
+				} else {
+					boolQuery.must(getSecureSettingsSearchQuery("0134149030919618561"));
+					boolQuery.must(queryBuilder);
+				}
+			}
+			 else {
 				boolQuery.should(queryBuilder);
 			}
 
@@ -515,9 +532,25 @@ private QueryBuilder getAllFieldsPropertyQuery(List<Object> values, Boolean fuzz
 								.operator(Operator.AND).type(Type.CROSS_FIELDS).fuzzyTranspositions(false).lenient(true));
 			}
 		}
-
 		return queryBuilder;
 	}
+	private QueryBuilder getSecureSettingsSearchDefaultQuery() {
+
+		QueryBuilder firstNestedQuery =new NestedQueryBuilder("secureSettings",
+				QueryBuilders.boolQuery() .mustNot(new ExistsQueryBuilder("organisation")), org.apache.lucene.search.join.ScoreMode.None);
+		QueryBuilder secondNestedQuery= new NestedQueryBuilder("secureSettings", QueryBuilders.boolQuery()
+				            .filter(new RangeQueryBuilder("organisation" + ".length").lte(0)) , org.apache.lucene.search.join.ScoreMode.None);
+		QueryBuilder query = QueryBuilders.boolQuery() .should(firstNestedQuery).should (secondNestedQuery);
+
+		return query;
+	}
+	private QueryBuilder getSecureSettingsSearchQuery(String org_id) {
+
+		QueryBuilder query =new NestedQueryBuilder("secureSettings",
+				QueryBuilders.boolQuery() .must(new ExistsQueryBuilder("secureSettings.organisation")).must(QueryBuilders.termQuery("secureSettings.organisation",org_id)), org.apache.lucene.search.join.ScoreMode.None);
+
+		return query;
+	}
 
 	/**
 	 * @param softConstraints

search-api/search-service/conf/application.conf

@@ -315,4 +315,7 @@ content.tagging.property=["subject","medium"]
 search.payload.log_enable=true
 
 #Folling configuration would enable the fuzzy search when there are no matches found for given query.
-search.fields.enable.fuzzy.when.noresult=false
+search.fields.enable.fuzzy.when.noresult=false
+
+#Following configuration would enable the secureSettings search
+search.fields.enable.secureSettings=false