Creating a security filter in elasticsearch - elasticsearch

Question

I'm attempting to create a security filter of sorts to exclude certain users from seeing certain documents in elasticsearch. As an example, if a document contains "ABC:123" and "ABC:XYZ", the user must have both of those in their profile to see the document. We are creating this on the fly using mustache templates. My first attempt was along these lines:
"bool": {
"filter": {
"bool": {
"minimum_should_match": 1,
"should": {
"bool": [{
"must_not": {
"prefix": {
"controlSet": "ABC:"
}
}
},{
"must": {
"terms": {
"controlSet": ["ABC:123","ABC:XYZ"]
}
}
}]
}
}
}
}
However, I quickly realized that this will allow a user with one control to view a document that has multiple. A document must have a subset of the controls that the user has to be matched. So if the user has "ABC:XYZ" only they should not be able to see a document that has "ABC:123" even if the document also contains "ABC:XYZ".
Is there a way to accomplish this that I am missing? Currently we enumerate ever control in the system and add them to a must_not but controls change periodically and I'd rather not maintain that listing manually.

Answer 1

Assuming your document looks like the following:
{
...
"controlSet": ["ABC:123", "ABC:XYZ"],
...
}
and controlSet is a keyword field, the following query should do the trick:
{
"bool": {
"filter": {
"terms": {
"controlSet": ["ABC:123", "ABC:XYZ"]
}
}
}
}
It will match documents with controlSet having at least ABC:123 and ABC:XYZ

Answer 2

I may have found a solution...
{
"bool": {
"must_not": {
"regexp": {
"value": "ABC:~(XYZ|123)",
"flags": "COMPLEMENT"
}
}
}
}
That should allow documents with either ABC:XYZ or ABC:123 (or both) while excluding documents with ABC:[anything else]
Of course I am worried about the speed of the regexp but I think the lack of wildcards will make it relatively fast.