Original comment by @javanna:

As a followup of LINK REDACTED, which effectively aligns indices resolution in security with the standard es behaviour, we should investigate sharing code around indices resolution with elasticsearch. The main thing about security is that _all is converted to all the indices that the current user is authorized for, same for wildcards expansion, but all the rest is the same. We should be able to add a public method to MetaData in es core that instead of relying internally on the cluster state, takes as an argument all the available indices. That way es core can call this method and provide the indices retrieved from the cluster state, while security can call it providing the filtered indices based on its own logic. After that, all of the matching logic should be the same. This would allow to remove quite some duplicated code from security. I also noticed that the restore api in es core duplicates the indices resolution code once again (in SnapshotUtils) for a very similar reason. Fixes that we applied to indices resolution in core didn't go to restore, which is quite bad. This change would allow to improve the restore api in core as well and remove code there too.

I meant to do this a while ago but I got trapped with all kinds of security bugs around indices resolution and never got to it. I am happy to work on this, I just have to find some time to do it.