---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "readall"
      body: "{\n  \"indices\": [\n    {\n      \"names\": [\"*\"],\n      \"privileges\"\
        : [\"read\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "limitread"
      body: "{\n  \"indices\": [\n    {\n      \"names\": [\"*\"],\n      \"privileges\"\
        : [\"read\"],\n      \"query\": {\"match\": {\"marker\": \"test_1\"}}\n  \
        \  }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "full"
      body: "{\n  \"password\" : \"x-pack-test-password\",\n  \"roles\" : [ \"readall\"\
        \ ],\n  \"full_name\" : \"user who can read all data\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "limited"
      body: "{\n  \"password\" : \"x-pack-test-password\",\n  \"roles\" : [ \"limitread\"\
        \ ],\n  \"full_name\" : \"user who can read some data\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_user:
      username: "full"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "limited"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "readall"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "limitread"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test doc level security against alias with different users:
- do:
    indices.create:
      index: "test_index"
      body:
        aliases:
          the_alias: {}
        mappings:
          properties:
            location:
              properties:
                city:
                  type: "keyword"
        settings:
          index:
            number_of_shards: 1
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      refresh: true
      body:
      - "{\"index\": {\"_index\": \"test_index\"}}"
      - "{\"marker\": \"test_1\", \"location.city\": \"bos\"}"
      - "{\"index\": {\"_index\": \"test_index\"}}"
      - "{\"marker\": \"test_2\", \"location.city\": \"ams\"}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic ZnVsbDp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      index: "the_alias"
      size: 0
      from: 0
      body:
        aggs:
          cities:
            terms:
              field: "location.city"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _shards.total: 1
- match:
    hits.total: 2
- length:
    aggregations.cities.buckets: 2
- match:
    aggregations.cities.buckets.0.key: "ams"
- match:
    aggregations.cities.buckets.0.doc_count: 1
- match:
    aggregations.cities.buckets.1.key: "bos"
- match:
    aggregations.cities.buckets.1.doc_count: 1
- do:
    headers:
      Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      index: "the_alias"
      size: 0
      from: 0
      body:
        aggs:
          cities:
            terms:
              field: "location.city"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _shards.total: 1
- match:
    hits.total: 1
- length:
    aggregations.cities.buckets: 1
- match:
    aggregations.cities.buckets.0.key: "bos"
- match:
    aggregations.cities.buckets.0.doc_count: 1
- do:
    headers:
      Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      index: "the_*"
      size: 0
      from: 0
      body:
        aggs:
          cities:
            terms:
              field: "location.city"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _shards.total: 1
- match:
    hits.total: 1
- length:
    aggregations.cities.buckets: 1
- match:
    aggregations.cities.buckets.0.key: "bos"
- match:
    aggregations.cities.buckets.0.doc_count: 1
- do:
    headers:
      Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      index: "test_*"
      size: 0
      from: 0
      body:
        aggs:
          cities:
            terms:
              field: "location.city"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _shards.total: 1
- match:
    hits.total: 1
- length:
    aggregations.cities.buckets: 1
- match:
    aggregations.cities.buckets.0.key: "bos"
- match:
    aggregations.cities.buckets.0.doc_count: 1
