Refactor: move workspace logic from repository to saved objects client wrapper

src/core/server/saved_objects/import/regenerate_ids.ts

@@ -68,7 +68,7 @@ export const regenerateIdsWithReference = async (props: {
       return acc;
     }
 
-    const filteredWorkspaces = SavedObjectsUtils.filterWorkspacesAccordingToBaseWorkspaces(
+    const filteredWorkspaces = SavedObjectsUtils.filterWorkspacesAccordingToSourceWorkspaces(
       workspaces,
       object.workspaces
     );

src/core/server/saved_objects/service/lib/repository.test.js

@@ -651,7 +651,6 @@ describe('SavedObjectsRepository', () => {
     };
 
     const bulkCreateSuccess = async (objects, options) => {
-      const originalObjects = JSON.parse(JSON.stringify(objects));
       const multiNamespaceObjects = objects.filter(
         ({ type, id }) => registry.isMultiNamespace(type) && id
       );
@@ -666,9 +665,7 @@ describe('SavedObjectsRepository', () => {
         opensearchClientMock.createSuccessTransportRequestPromise(response)
       );
       const result = await savedObjectsRepository.bulkCreate(objects, options);
-      expect(client.mget).toHaveBeenCalledTimes(
-        multiNamespaceObjects?.length || originalObjects?.some((item) => item.id) ? 1 : 0
-      );
+      expect(client.mget).toHaveBeenCalledTimes(multiNamespaceObjects?.length ? 1 : 0);
       return result;
     };
 
@@ -726,10 +723,7 @@ describe('SavedObjectsRepository', () => {
         await bulkCreateSuccess(objects);
         expect(client.bulk).toHaveBeenCalledTimes(1);
         expect(client.mget).toHaveBeenCalledTimes(1);
-        const docs = [
-          expect.objectContaining({ _id: `${obj1.type}:${obj1.id}` }),
-          expect.objectContaining({ _id: `${MULTI_NAMESPACE_TYPE}:${obj2.id}` }),
-        ];
+        const docs = [expect.objectContaining({ _id: `${MULTI_NAMESPACE_TYPE}:${obj2.id}` })];
         expect(client.mget.mock.calls[0][0].body).toEqual({ docs });
       });
 
@@ -1007,12 +1001,6 @@ describe('SavedObjectsRepository', () => {
         const response1 = {
           status: 200,
           docs: [
-            {
-              found: true,
-              _source: {
-                type: obj1.type,
-              },
-            },
             {
               found: true,
               _source: {
@@ -1036,11 +1024,7 @@ describe('SavedObjectsRepository', () => {
         expect(client.mget).toHaveBeenCalled();
 
         const body1 = {
-          docs: [
-            expect.objectContaining({ _id: `${obj1.type}:${obj1.id}` }),
-            expect.objectContaining({ _id: `${obj.type}:${obj.id}` }),
-            expect.objectContaining({ _id: `${obj2.type}:${obj2.id}` }),
-          ],
+          docs: [expect.objectContaining({ _id: `${obj.type}:${obj.id}` })],
         };
         expect(client.mget).toHaveBeenCalledWith(
           expect.objectContaining({ body: body1 }),
@@ -2050,17 +2034,9 @@ describe('SavedObjectsRepository', () => {
 
     const createSuccess = async (type, attributes, options) => {
       const result = await savedObjectsRepository.create(type, attributes, options);
-      let count = 0;
-      if (options?.overwrite && options?.id) {
-        /**
-         * workspace will call extra one to get latest status of current object
-         */
-        count++;
-      }
-      if (registry.isMultiNamespace(type) && options.overwrite) {
-        count++;
-      }
-      expect(client.get).toHaveBeenCalledTimes(count);
+      expect(client.get).toHaveBeenCalledTimes(
+        registry.isMultiNamespace(type) && options.overwrite ? 1 : 0
+      );
       return result;
     };
 

src/core/server/saved_objects/service/lib/repository.ts

@@ -287,26 +287,6 @@ export class SavedObjectsRepository {
       }
     }
 
-    let savedObjectWorkspaces = workspaces;
-
-    if (id && overwrite) {
-      try {
-        const currentItem = await this.get(type, id);
-        if (
-          SavedObjectsUtils.filterWorkspacesAccordingToBaseWorkspaces(
-            workspaces,
-            currentItem.workspaces
-          ).length
-        ) {
-          throw SavedObjectsErrorHelpers.createConflictError(type, id);
-        } else {
-          savedObjectWorkspaces = currentItem.workspaces;
-        }
-      } catch (e) {
-        // this.get will throw an error when no items can be found
-      }
-    }
-
     const migrated = this._migrator.migrateDocument({
       id,
       type,
@@ -317,7 +297,7 @@ export class SavedObjectsRepository {
       migrationVersion,
       updated_at: time,
       ...(Array.isArray(references) && { references }),
-      ...(Array.isArray(savedObjectWorkspaces) && { workspaces: savedObjectWorkspaces }),
+      ...(Array.isArray(workspaces) && { workspaces }),
       ...(permissions && { permissions }),
     });
 
@@ -385,28 +365,15 @@ export class SavedObjectsRepository {
 
       const method = object.id && overwrite ? 'index' : 'create';
       const requiresNamespacesCheck = object.id && this._registry.isMultiNamespace(object.type);
-      /**
-       * Only when importing an object to a target workspace should we check if the object is workspace-specific.
-       */
-      const requiresWorkspaceCheck = object.id;
 
       if (object.id == null) object.id = uuid.v1();
 
-      let opensearchRequestIndexPayload = {};
-
-      if (requiresNamespacesCheck || requiresWorkspaceCheck) {
-        opensearchRequestIndexPayload = {
-          opensearchRequestIndex: bulkGetRequestIndexCounter,
-        };
-        bulkGetRequestIndexCounter++;
-      }
-
       return {
         tag: 'Right' as 'Right',
         value: {
           method,
           object,
-          ...opensearchRequestIndexPayload,
+          ...(requiresNamespacesCheck && { opensearchRequestIndex: bulkGetRequestIndexCounter++ }),
         },
       };
     });
@@ -417,7 +384,7 @@ export class SavedObjectsRepository {
       .map(({ value: { object: { type, id } } }) => ({
         _id: this._serializer.generateRawId(namespace, type, id),
         _index: this.getIndexForType(type),
-        _source: ['type', 'namespaces', 'workspaces'],
+        _source: ['type', 'namespaces'],
       }));
     const bulkGetResponse = bulkGetDocs.length
       ? await this.client.mget(
@@ -495,36 +462,7 @@ export class SavedObjectsRepository {
       savedObjectWorkspaces = options.workspaces;
 
       if (expectedBulkGetResult.value.method !== 'create') {
-        const rawId = this._serializer.generateRawId(namespace, object.type, object.id);
-        const findObject =
-          bulkGetResponse?.statusCode !== 404
-            ? bulkGetResponse?.body.docs?.find((item) => item._id === rawId)
-            : null;
-        if (findObject && findObject.found) {
-          const transformedObject = this._serializer.rawToSavedObject(
-            findObject as SavedObjectsRawDoc
-          ) as SavedObject;
-          const filteredWorkspaces = SavedObjectsUtils.filterWorkspacesAccordingToBaseWorkspaces(
-            options.workspaces,
-            transformedObject.workspaces
-          );
-          if (filteredWorkspaces.length) {
-            const { id, type } = object;
-            return {
-              tag: 'Left' as 'Left',
-              error: {
-                id,
-                type,
-                error: {
-                  ...errorContent(SavedObjectsErrorHelpers.createConflictError(type, id)),
-                  metadata: { isNotOverwritable: true },
-                },
-              },
-            };
-          } else {
-            savedObjectWorkspaces = transformedObject.workspaces;
-          }
-        }
+        savedObjectWorkspaces = object.workspaces;
       }
 
       const expectedResult = {
@@ -541,7 +479,7 @@ export class SavedObjectsRepository {
             updated_at: time,
             references: object.references || [],
             originId: object.originId,
-            workspaces: savedObjectWorkspaces,
+            ...(savedObjectWorkspaces && { workspaces: savedObjectWorkspaces }),
           }) as SavedObjectSanitizedDoc
         ),
       };
@@ -639,7 +577,7 @@ export class SavedObjectsRepository {
     const bulkGetDocs = expectedBulkGetResults.filter(isRight).map(({ value: { type, id } }) => ({
       _id: this._serializer.generateRawId(namespace, type, id),
       _index: this.getIndexForType(type),
-      _source: ['type', 'namespaces', 'workspaces'],
+      _source: ['type', 'namespaces'],
     }));
     const bulkGetResponse = bulkGetDocs.length
       ? await this.client.mget(
@@ -662,24 +600,13 @@ export class SavedObjectsRepository {
       const { type, id, opensearchRequestIndex } = expectedResult.value;
       const doc = bulkGetResponse?.body.docs[opensearchRequestIndex];
       if (doc?.found) {
-        let workspaceConflict = false;
-        if (options.workspaces) {
-          const transformedObject = this._serializer.rawToSavedObject(doc as SavedObjectsRawDoc);
-          const filteredWorkspaces = SavedObjectsUtils.filterWorkspacesAccordingToBaseWorkspaces(
-            options.workspaces,
-            transformedObject.workspaces
-          );
-          if (filteredWorkspaces.length) {
-            workspaceConflict = true;
-          }
-        }
         errors.push({
           id,
           type,
           error: {
             ...errorContent(SavedObjectsErrorHelpers.createConflictError(type, id)),
             // @ts-expect-error MultiGetHit._source is optional
-            ...((!this.rawDocExistsInNamespace(doc!, namespace) || workspaceConflict) && {
+            ...(!this.rawDocExistsInNamespace(doc!, namespace) && {
               metadata: { isNotOverwritable: true },
             }),
           },

src/core/server/saved_objects/service/lib/utils.ts

@@ -81,7 +81,7 @@ export class SavedObjectsUtils {
     saved_objects: [],
   });
 
-  public static filterWorkspacesAccordingToBaseWorkspaces(
+  public static filterWorkspacesAccordingToSourceWorkspaces(
     targetWorkspaces?: string[],
     baseWorkspaces?: string[]
   ): string[] {

src/core/server/saved_objects/service/saved_objects_client.ts

@@ -71,6 +71,10 @@ export interface SavedObjectsCreateOptions extends SavedObjectsBaseOptions {
   initialNamespaces?: string[];
   /** permission control describe by ACL object */
   permissions?: Permissions;
+  /**
+   * workspaces the new created objects belong to
+   */
+  workspaces?: string[];
 }
 
 /**
@@ -94,6 +98,10 @@ export interface SavedObjectsBulkCreateObject<T = unknown> {
    * Note: this can only be used for multi-namespace object types.
    */
   initialNamespaces?: string[];
+  /**
+   * workspaces the objects belong to, will only be used when overwrite is enabled.
+   */
+  workspaces?: string[];
 }
 
 /**

src/plugins/workspace/common/constants.ts

@@ -19,3 +19,5 @@ export const PATHS = {
 export const WORKSPACE_OP_TYPE_CREATE = 'create';
 export const WORKSPACE_OP_TYPE_UPDATE = 'update';
 export const WORKSPACE_SAVED_OBJECTS_CLIENT_WRAPPER_ID = 'workspace';
+export const WORKSPACE_CONFLICT_CONTROL_SAVED_OBJECTS_CLIENT_WRAPPER_ID =
+  'workspace_conflict_control';

src/plugins/workspace/server/plugin.ts

@@ -16,20 +16,25 @@ import { IWorkspaceDBImpl } from './types';
 import { WorkspaceClientWithSavedObject } from './workspace_client';
 import { WorkspaceSavedObjectsClientWrapper } from './saved_objects';
 import { registerRoutes } from './routes';
-import { WORKSPACE_SAVED_OBJECTS_CLIENT_WRAPPER_ID } from '../common/constants';
+import {
+  WORKSPACE_SAVED_OBJECTS_CLIENT_WRAPPER_ID,
+  WORKSPACE_CONFLICT_CONTROL_SAVED_OBJECTS_CLIENT_WRAPPER_ID,
+} from '../common/constants';
 import {
   SavedObjectsPermissionControl,
   SavedObjectsPermissionControlContract,
 } from './permission_control/client';
 import { registerPermissionCheckRoutes } from './permission_control/routes';
 import { WorkspacePluginConfigType } from '../config';
 import { cleanWorkspaceId, getWorkspaceIdFromUrl } from '../../../core/server/utils';
+import { WorkspaceConflictSavedObjectsClientWrapper } from './saved_objects/saved_objects_wrapper_for_check_workspace_conflict';
 
 export class WorkspacePlugin implements Plugin<{}, {}> {
   private readonly logger: Logger;
   private client?: IWorkspaceDBImpl;
   private permissionControl?: SavedObjectsPermissionControlContract;
   private readonly config$: Observable<WorkspacePluginConfigType>;
+  private workspaceConflictControl?: WorkspaceConflictSavedObjectsClientWrapper;
 
   private proxyWorkspaceTrafficToRealHandler(setupDeps: CoreSetup) {
     /**
@@ -83,6 +88,13 @@ export class WorkspacePlugin implements Plugin<{}, {}> {
     }
 
     this.proxyWorkspaceTrafficToRealHandler(core);
+    this.workspaceConflictControl = new WorkspaceConflictSavedObjectsClientWrapper();
+
+    core.savedObjects.addClientWrapper(
+      -1,
+      WORKSPACE_CONFLICT_CONTROL_SAVED_OBJECTS_CLIENT_WRAPPER_ID,
+      this.workspaceConflictControl.wrapperFactory
+    );
 
     registerRoutes({
       http: core.http,
@@ -110,6 +122,7 @@ export class WorkspacePlugin implements Plugin<{}, {}> {
     this.logger.debug('Starting SavedObjects service');
     this.permissionControl?.setup(core.savedObjects.getScopedClient);
     this.client?.setSavedObjects(core.savedObjects);
+    this.workspaceConflictControl?.setSerializer(core.savedObjects.createSerializer());
 
     return {
       client: this.client as IWorkspaceDBImpl,