---
setup:
- skip:
    features:
    - "headers"
    - "transform_and_set"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "user_role"
      body: "{\n  \"cluster\": [\"manage_own_api_key\"],\n  \"indices\": [\n    {\n\
        \      \"names\": \"*\",\n      \"privileges\": [\"all\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "api_key_user_1"
      body: "{\n  \"password\" : \"x-pack-test-password\",\n  \"roles\" : [ \"user_role\"\
        \ ],\n  \"full_name\" : \"API key user\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_role:
      name: "user_role"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "api_key_user_1"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test update api key:
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"user1-api-key\",\n  \"role_descriptors\": {\n    \"\
        role-a\": {\n      \"cluster\": [\"none\"],\n      \"index\": [\n        {\n\
        \          \"names\": [\"index-a\"],\n          \"privileges\": [\"read\"\
        ]\n        }\n      ]\n    }\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "user1-api-key"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "user1_key_id"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"manage_own_api_key\"],\n  \"index\": [\n    {\n\
        \      \"names\": [\"index-a\"],\n      \"privileges\": [\"write\"]\n    },\n\
        \    {\n      \"names\": [\"index-b\"],\n      \"privileges\": [\"read\"]\n\
        \    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: false
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.update_api_key:
      id: "$user1_key_id"
      body: "{\n  \"role_descriptors\": {\n    \"role-a\": {\n      \"cluster\": [\"\
        all\"],\n      \"index\": [\n        {\n          \"names\": [\"index-a\"\
        ],\n          \"privileges\": [\"write\"]\n        },\n        {\n       \
        \   \"names\": [\"index-b\"],\n          \"privileges\": [\"read\"]\n    \
        \    }\n      ]\n    }\n  },\n  \"metadata\": {\n     \"letter\": \"a\",\n\
        \     \"number\": 42\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    updated: true
- do:
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"manage_own_api_key\"],\n  \"index\": [\n    {\n\
        \      \"names\": [\"index-a\"],\n      \"privileges\": [\"write\"]\n    },\n\
        \    {\n      \"names\": [\"index-b\"],\n      \"privileges\": [\"read\"]\n\
        \    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: true
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$user1_key_id"
      owner: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.metadata:
      letter: "a"
      number: 42
---
Test update api key without explicit field updates:
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"user1-api-key\",\n  \"metadata\": {\n    \"letter\"\
        : \"a\",\n    \"number\": 42\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "user1-api-key"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "user1_key_id"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    security.put_role:
      name: "user_role"
      body: "{\n  \"cluster\": [\"all\"],\n  \"indices\": [\n    {\n      \"names\"\
        : \"index-a\",\n      \"privileges\": [\"all\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.update_api_key:
      id: "$user1_key_id"
      body: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    updated: true
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.update_api_key:
      id: "$user1_key_id"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    updated: false
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$user1_key_id"
      owner: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.metadata:
      letter: "a"
      number: 42
- do:
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"all\"],\n  \"index\": [\n    {\n      \"names\"\
        : [\"index-a\"],\n      \"privileges\": [\"read\"]\n    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: true
---
Test update api key with empty request fields:
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"user1-api-key\",\n  \"role_descriptors\": {\n    \"\
        role-a\": {\n      \"cluster\": [\"none\"],\n      \"index\": [\n        {\n\
        \          \"names\": [\"index-a\"],\n          \"privileges\": [\"none\"\
        ]\n        }\n      ]\n    }\n  },\n  \"metadata\": {\n    \"letter\": \"\
        a\",\n    \"number\": 42\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "user1-api-key"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "user1_key_id"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    security.put_role:
      name: "user_role"
      body: "{\n  \"cluster\": [\"all\"],\n  \"indices\": [\n    {\n      \"names\"\
        : \"index-a\",\n      \"privileges\": [\"all\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.update_api_key:
      id: "$user1_key_id"
      body: "{\n  \"role_descriptors\": {},\n  \"metadata\": {}\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    updated: true
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$user1_key_id"
      owner: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.metadata: {}
- do:
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"all\"],\n  \"index\": [\n    {\n      \"names\"\
        : [\"index-a\"],\n      \"privileges\": [\"read\"]\n    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: true
---
Test bulk update api keys:
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-1\",\n  \"role_descriptors\": {\n    \"role-a\"\
        : {\n      \"cluster\": [\"none\"],\n      \"index\": [\n        {\n     \
        \     \"names\": [\"index-a\"],\n          \"privileges\": [\"read\"]\n  \
        \      }\n      ]\n    }\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-1"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "key_id_1"
- transform_and_set:
    login_creds_1: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds_1"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-2\",\n  \"role_descriptors\": {\n    \"role-a\"\
        : {\n      \"cluster\": [\"monitor\"]\n    }\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-2"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "key_id_2"
- transform_and_set:
    login_creds_2: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds_2"
- do:
    headers:
      Authorization: "ApiKey ${login_creds_1}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"manage_own_api_key\"],\n  \"index\": [\n    {\n\
        \      \"names\": [\"index-a\"],\n      \"privileges\": [\"write\"]\n    },\n\
        \    {\n      \"names\": [\"index-b\"],\n      \"privileges\": [\"read\"]\n\
        \    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: false
- do:
    headers:
      Authorization: "ApiKey ${login_creds_2}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"manage_own_api_key\"],\n  \"index\": [\n    {\n\
        \      \"names\": [\"index-a\"],\n      \"privileges\": [\"write\"]\n    },\n\
        \    {\n      \"names\": [\"index-b\"],\n      \"privileges\": [\"read\"]\n\
        \    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: false
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.bulk_update_api_keys:
      body: "{\n  \"ids\": [\"$key_id_1\", \"$key_id_2\"],\n  \"role_descriptors\"\
        : {\n    \"role-a\": {\n      \"cluster\": [\"all\"],\n      \"index\": [\n\
        \        {\n          \"names\": [\"index-a\"],\n          \"privileges\"\
        : [\"write\"]\n        },\n        {\n          \"names\": [\"index-b\"],\n\
        \          \"privileges\": [\"read\"]\n        }\n      ]\n    }\n  },\n \
        \ \"metadata\": {\n     \"letter\": \"a\",\n     \"number\": 42\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    noops: 0
- length:
    updated: 2
- match:
    updated.0: "$key_id_1"
- match:
    updated.1: "$key_id_2"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.bulk_update_api_keys:
      body: "{\n  \"ids\": [\"$key_id_1\", \"$key_id_2\"]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- is_false: "errors"
- length:
    updated: 0
- length:
    noops: 2
- match:
    noops.0: "$key_id_1"
- match:
    noops.1: "$key_id_2"
- do:
    headers:
      Authorization: "ApiKey ${login_creds_1}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"manage_own_api_key\"],\n  \"index\": [\n    {\n\
        \      \"names\": [\"index-a\"],\n      \"privileges\": [\"write\"]\n    },\n\
        \    {\n      \"names\": [\"index-b\"],\n      \"privileges\": [\"read\"]\n\
        \    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: true
- do:
    headers:
      Authorization: "ApiKey ${login_creds_2}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"manage_own_api_key\"],\n  \"index\": [\n    {\n\
        \      \"names\": [\"index-a\"],\n      \"privileges\": [\"write\"]\n    },\n\
        \    {\n      \"names\": [\"index-b\"],\n      \"privileges\": [\"read\"]\n\
        \    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: true
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      owner: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 2
- match:
    api_keys.0.metadata:
      letter: "a"
      number: 42
- match:
    api_keys.1.metadata:
      letter: "a"
      number: 42
---
Test bulk update api key without explicit field updates:
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-1\",\n  \"metadata\": {\n    \"letter\": \"\
        a\",\n    \"number\": 42\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-1"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "key_id_1"
- transform_and_set:
    login_creds_1: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds_1"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-2\",\n  \"metadata\": {\n    \"letter\": \"\
        b\",\n    \"number\": 43\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-2"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "key_id_2"
- transform_and_set:
    login_creds_2: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds_2"
- do:
    security.put_role:
      name: "user_role"
      body: "{\n  \"cluster\": [\"all\"],\n  \"indices\": [\n    {\n      \"names\"\
        : \"index-a\",\n      \"privileges\": [\"all\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.bulk_update_api_keys:
      body: "{\n  \"ids\": [\"$key_id_1\", \"$key_id_2\"]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- is_false: "errors"
- length:
    noops: 0
- length:
    updated: 2
- match:
    updated.0: "$key_id_1"
- match:
    updated.1: "$key_id_2"
- do:
    headers:
      Authorization: "ApiKey ${login_creds_1}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"all\"],\n  \"index\": [\n    {\n      \"names\"\
        : [\"index-a\"],\n      \"privileges\": [\"read\"]\n    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: true
- do:
    headers:
      Authorization: "ApiKey ${login_creds_2}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"all\"],\n  \"index\": [\n    {\n      \"names\"\
        : [\"index-a\"],\n      \"privileges\": [\"read\"]\n    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: true
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$key_id_1"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.metadata:
      letter: "a"
      number: 42
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$key_id_2"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.metadata:
      letter: "b"
      number: 43
---
Test bulk update api key with empty request fields:
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-1\",\n  \"role_descriptors\": {\n    \"role-a\"\
        : {\n      \"cluster\": [\"none\"],\n      \"index\": [\n        {\n     \
        \     \"names\": [\"index-a\"],\n          \"privileges\": [\"none\"]\n  \
        \      }\n      ]\n    }\n  },\n  \"metadata\": {\n    \"letter\": \"a\",\n\
        \    \"number\": 42\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-1"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "key_id_1"
- transform_and_set:
    login_creds_1: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds_1"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"api-key-2\",\n  \"role_descriptors\": {\n    \"role-a\"\
        : {\n      \"cluster\": [\"monitor\"]\n    }\n  },\n  \"metadata\": {\n  \
        \  \"letter\": \"b\",\n    \"number\": 43\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "api-key-2"
- is_true: "id"
- is_true: "api_key"
- set:
    id: "key_id_2"
- transform_and_set:
    login_creds_2: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds_2"
- do:
    security.put_role:
      name: "user_role"
      body: "{\n  \"cluster\": [\"all\"],\n  \"indices\": [\n    {\n      \"names\"\
        : \"index-a\",\n      \"privileges\": [\"all\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.bulk_update_api_keys:
      body: "{\n  \"ids\": [\"$key_id_1\", \"$key_id_2\"],\n  \"role_descriptors\"\
        : {},\n  \"metadata\": {}\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- is_false: "errors"
- length:
    noops: 0
- length:
    updated: 2
- match:
    updated.0: "$key_id_1"
- match:
    updated.1: "$key_id_2"
- do:
    headers:
      Authorization: "ApiKey ${login_creds_1}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"all\"],\n  \"index\": [\n    {\n      \"names\"\
        : [\"index-a\"],\n      \"privileges\": [\"read\"]\n    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: true
- do:
    headers:
      Authorization: "ApiKey ${login_creds_2}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [\"all\"],\n  \"index\": [\n    {\n      \"names\"\
        : [\"index-a\"],\n      \"privileges\": [\"read\"]\n    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    has_all_requested: true
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      owner: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 2
- match:
    api_keys.0.metadata: {}
- match:
    api_keys.1.metadata: {}
