The evaluator gates a request using the id and type that the request itself reports (ResourceAccessEvaluator.java:83). When the resource governing access is not the one named in the request, the plugin has to perform the check by hand.
alerting's alert comments are the case: an update or delete carries the comment id, and the monitor that governs access is known only after reading the comment or the alert, so TransportIndexAlertingCommentAction calls verifyAccess(monitorId, "monitor", action) itself.
evaluateAsync is already asynchronous, so a provider-supplied resolver from request to (type, id) could perform that lookup inside the framework and produce the 403 before the transport action runs.
This relocates the lookup rather than eliminating it. The gain is a uniform deny path that plugins no longer own.
The evaluator gates a request using the id and type that the request itself reports (
ResourceAccessEvaluator.java:83). When the resource governing access is not the one named in the request, the plugin has to perform the check by hand.alerting's alert comments are the case: an update or delete carries the comment id, and the monitor that governs access is known only after reading the comment or the alert, so
TransportIndexAlertingCommentActioncallsverifyAccess(monitorId, "monitor", action)itself.evaluateAsyncis already asynchronous, so a provider-supplied resolver from request to (type, id) could perform that lookup inside the framework and produce the 403 before the transport action runs.This relocates the lookup rather than eliminating it. The gain is a uniform deny path that plugins no longer own.