---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "admin_role"
      body: "{\n  \"cluster\": [\"manage_security\"]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "admin_user"
      body: "{\n  \"password\" : \"x-pack-test-password\",\n  \"roles\" : [ \"admin_role\"\
        \ ],\n  \"full_name\" : \"Admin user\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_role:
      name: "admin_role"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "admin_user"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test create a cross-cluster API key:
- skip:
    features: "transform_and_set"
- do:
    headers:
      Authorization: "Basic YWRtaW5fdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_cross_cluster_api_key:
      body: "{\n  \"name\": \"my-cc-api-key\",\n  \"expiration\": \"1d\",\n  \"access\"\
        : {\n    \"search\": [\n      {\n        \"names\": [\"logs*\"]\n      }\n\
        \    ],\n    \"replication\": [\n      {\n        \"names\": [\"archive\"\
        ],\n        \"allow_restricted_indices\": false\n      }\n    ]\n  },\n  \"\
        metadata\": {\n    \"answer\": 42,\n    \"tag\": \"dev\"\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-cc-api-key"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    catch: "unauthorized"
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.authenticate: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    error.type: "security_exception"
- match:
    error.reason: "authentication expected API key type of [rest], but API key [${api_key_id}]\
      \ has type [cross_cluster]"
- do:
    headers:
      Authorization: "Basic YWRtaW5fdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id"
      with_limited_by: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.id: "$api_key_id"
- match:
    api_keys.0.name: "my-cc-api-key"
- match:
    api_keys.0.type: "cross_cluster"
- is_false: "api_keys.0.invalidated"
- match:
    api_keys.0.metadata:
      answer: 42
      tag: "dev"
- match:
    api_keys.0.role_descriptors:
      cross_cluster:
        cluster:
        - "cross_cluster_search"
        - "monitor_enrich"
        - "cross_cluster_replication"
        indices:
        - names:
          - "logs*"
          privileges:
          - "read"
          - "read_cross_cluster"
          - "view_index_metadata"
          allow_restricted_indices: false
        - names:
          - "archive"
          privileges:
          - "cross_cluster_replication"
          - "cross_cluster_replication_internal"
          allow_restricted_indices: false
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
- match:
    api_keys.0.access:
      search:
      - names:
        - "logs*"
        allow_restricted_indices: false
      replication:
      - names:
        - "archive"
        allow_restricted_indices: false
- is_false: "api_keys.0.limited_by"
---
Test update a cross-cluster API Key:
- do:
    headers:
      Authorization: "Basic YWRtaW5fdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_cross_cluster_api_key:
      body: "{\n  \"name\": \"my-cc-api-key\",\n  \"access\": {\n    \"search\": [\n\
        \      {\n        \"names\": [\"logs*\"]\n      }\n    ]\n  },\n  \"metadata\"\
        : { \"tag\": \"dev\" }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- is_true: "id"
- set:
    id: "api_key_id"
- do:
    headers:
      Authorization: "Basic YWRtaW5fdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.update_cross_cluster_api_key:
      id: "$api_key_id"
      body: "{\n  \"access\": {\n    \"replication\": [\n      {\n        \"names\"\
        : [\"archive\"]\n      }\n    ]\n  },\n  \"metadata\": { \"tag\": \"prod\"\
        \ }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    updated: true
- do:
    headers:
      Authorization: "Basic YWRtaW5fdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id"
      with_limited_by: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.id: "$api_key_id"
- match:
    api_keys.0.name: "my-cc-api-key"
- match:
    api_keys.0.type: "cross_cluster"
- is_false: "api_keys.0.invalidated"
- match:
    api_keys.0.metadata:
      tag: "prod"
- match:
    api_keys.0.role_descriptors:
      cross_cluster:
        cluster:
        - "cross_cluster_replication"
        indices:
        - names:
          - "archive"
          privileges:
          - "cross_cluster_replication"
          - "cross_cluster_replication_internal"
          allow_restricted_indices: false
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
- match:
    api_keys.0.access:
      replication:
      - names:
        - "archive"
        allow_restricted_indices: false
- is_false: "api_keys.0.limited_by"
- do:
    headers:
      Authorization: "Basic YWRtaW5fdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.update_cross_cluster_api_key:
      id: "$api_key_id"
      body: "{\n  \"access\": {\n    \"replication\": [\n      {\n        \"names\"\
        : [\"archive\"]\n      }\n    ]\n  },\n  \"metadata\": { \"tag\": \"prod\"\
        \ }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    updated: false
---
Test invalidate a cross-cluster API Key:
- do:
    headers:
      Authorization: "Basic YWRtaW5fdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_cross_cluster_api_key:
      body: "{\n  \"name\": \"my-cc-api-key\",\n  \"access\": {\n    \"search\": [\n\
        \      {\n        \"names\": [\"*\"],\n        \"allow_restricted_indices\"\
        : true\n      }\n    ]\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- is_true: "id"
- set:
    id: "api_key_id"
- do:
    headers:
      Authorization: "Basic YWRtaW5fdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.id: "$api_key_id"
- match:
    api_keys.0.name: "my-cc-api-key"
- match:
    api_keys.0.type: "cross_cluster"
- is_false: "api_keys.0.invalidated"
- match:
    api_keys.0.metadata: {}
- match:
    api_keys.0.role_descriptors:
      cross_cluster:
        cluster:
        - "cross_cluster_search"
        - "monitor_enrich"
        indices:
        - names:
          - "*"
          privileges:
          - "read"
          - "read_cross_cluster"
          - "view_index_metadata"
          allow_restricted_indices: true
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
- match:
    api_keys.0.access:
      search:
      - names:
        - "*"
        allow_restricted_indices: true
- is_false: "api_keys.0.limited_by"
- do:
    headers:
      Authorization: "Basic YWRtaW5fdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.invalidate_api_key:
      body: "{\n  \"ids\": [ \"${api_key_id}\" ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    invalidated_api_keys: 1
- match:
    invalidated_api_keys.0: "${api_key_id}"
- length:
    previously_invalidated_api_keys: 0
- match:
    error_count: 0
- do:
    headers:
      Authorization: "Basic YWRtaW5fdXNlcjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.id: "$api_key_id"
- is_true: "api_keys.0.invalidated"
