---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_privileges:
      body: "{\n  \"test-app\": {\n    \"user\": {\n      \"actions\": [ \"action:login\"\
        , \"version:1.0.*\" ]\n    },\n    \"read\": {\n      \"actions\": [ \"data:read/*\"\
        \ ]\n    },\n    \"write\": {\n      \"actions\": [ \"data:write/*\" ]\n \
        \   }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "test-role-1"
      body: "{\n  \"cluster\": [ \"monitor\" ],\n  \"global\": {\n    \"application\"\
        : {\n      \"manage\": {\n        \"applications\": [ \"test-*\" ]\n     \
        \ }\n    }\n  },\n  \"indices\": [\n    {\n      \"names\": [\"test-1-*\"\
        ],\n      \"privileges\": [\"read\" ]\n    },\n    {\n      \"names\": [\"\
        test-2-*\"],\n      \"privileges\": [\"read\"],\n      \"field_security\"\
        : {\n        \"grant\" : [\"*\"],\n        \"except\" : [ \"secret-*\", \"\
        private-*\" ]\n      },\n      \"query\" : { \"term\" : { \"test\": true }\
        \ }\n    },\n    {\n      \"names\": [\"test-3-*\", \"test-4-*\", \"test-5-*\"\
        \ ],\n      \"privileges\": [\"read\"],\n      \"field_security\": {\n   \
        \     \"grant\" : [\"test-*\"]\n      }\n    },\n    {\n      \"names\": [\"\
        test-6-*\", \"test-7-*\" ],\n      \"privileges\": [\"read\"],\n      \"query\"\
        \ : { \"term\" : { \"test\": true } }\n    }\n  ],\n  \"applications\": [\n\
        \    {\n      \"application\": \"test-app\",\n      \"privileges\": [\"user\"\
        ],\n      \"resources\": [\"*\"]\n    },\n    {\n      \"application\": \"\
        test-app\",\n      \"privileges\": [\"read\"],\n      \"resources\": [\"object/1\"\
        ]\n    }\n  ],\n  \"run_as\": [ \"test-*\" ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "test-role-2"
      body: "{\n  \"cluster\": [ \"manage\", \"manage_security\" ],\n  \"global\"\
        : {\n    \"application\": {\n      \"manage\": {\n        \"applications\"\
        : [ \"apps-*\" ]\n      }\n    }\n  },\n  \"indices\": [\n    {\n      \"\
        names\": [ \"test-1-*\", \"test-9-*\" ],\n      \"privileges\": [\"all\" ]\n\
        \    },\n    {\n      \"names\": [\"test-2-*\"],\n      \"privileges\": [\"\
        read\"],\n      \"field_security\": {\n        \"grant\" : [\"apps-*\"]\n\
        \      },\n      \"query\" : { \"term\" : { \"apps\": true } }\n    },\n \
        \   {\n      \"names\": [\"test-3-*\", \"test-6-*\" ],\n      \"privileges\"\
        : [\"read\", \"write\" ]\n    },\n    {\n      \"names\": [\"test-4-*\"],\n\
        \      \"privileges\": [\"read\" ],\n      \"field_security\": {\n       \
        \ \"grant\" : [\"*\"],\n        \"except\" : [ \"private-*\" ]\n      }\n\
        \    }\n  ],\n  \"applications\": [\n    {\n      \"application\": \"app-dne\"\
        ,\n      \"privileges\": [\"all\"],\n      \"resources\": [\"*\"]\n    },\n\
        \    {\n      \"application\": \"test-app\",\n      \"privileges\": [\"dne\"\
        ],\n      \"resources\": [\"*\"]\n    },\n    {\n      \"application\": \"\
        test-app\",\n      \"privileges\": [\"read\"],\n      \"resources\": [\"object/2\"\
        ]\n    }\n  ],\n  \"run_as\": [ \"app-*\" ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "test-1"
      body: "{\n  \"password\": \"test-user-password\",\n  \"roles\" : [ \"test-role-1\"\
        \ ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "test-2"
      body: "{\n  \"password\": \"test-user-password\",\n  \"roles\" : [ \"test-role-2\"\
        \ ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "test-3"
      body: "{\n  \"password\": \"test-user-password\",\n  \"roles\" : [ \"test-role-1\"\
        , \"test-role-2\" ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_privileges:
      application: "test-app"
      name: "user,read,write"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "test-1"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "test-2"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "test-3"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "test-role-1"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "test-role-2"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test get_user_privileges for single role:
- skip:
    reason: "contains is a newly added assertion"
    features: "contains"
- do:
    headers:
      Authorization: "Basic dGVzdC0xOnRlc3QtdXNlci1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_user_privileges: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    cluster:
    - "monitor"
- length:
    global: 1
- match:
    global.0.application.manage.applications:
    - "test-*"
- length:
    indices: 4
- contains:
    indices:
      names:
      - "test-1-*"
      privileges:
      - "read"
- contains:
    indices:
      names:
      - "test-2-*"
      privileges:
      - "read"
      field_security:
      - grant:
        - "*"
        except:
        - "secret-*"
        - "private-*"
      query:
      - "{\"term\":{\"test\":true}}"
- contains:
    indices:
      names:
      - "test-3-*"
      - "test-4-*"
      - "test-5-*"
      privileges:
      - "read"
      field_security:
      - grant:
        - "test-*"
- contains:
    indices:
      names:
      - "test-6-*"
      - "test-7-*"
      privileges:
      - "read"
      query:
      - "{\"term\":{\"test\":true}}"
- length:
    applications: 2
- contains:
    applications:
      application: "test-app"
      privileges:
      - "user"
      resources:
      - "*"
- contains:
    applications:
      application: "test-app"
      privileges:
      - "read"
      resources:
      - "object/1"
- match:
    run_as:
    - "test-*"
- do:
    headers:
      Authorization: "Basic dGVzdC0yOnRlc3QtdXNlci1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_user_privileges:
      username: null
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    cluster:
    - "manage"
    - "manage_security"
- length:
    global: 1
- match:
    global.0.application.manage.applications:
    - "apps-*"
- length:
    indices: 4
- contains:
    indices:
      names:
      - "test-1-*"
      - "test-9-*"
      privileges:
      - "all"
- contains:
    indices:
      names:
      - "test-2-*"
      privileges:
      - "read"
      field_security:
      - grant:
        - "apps-*"
      query:
      - "{\"term\":{\"apps\":true}}"
- contains:
    indices:
      names:
      - "test-3-*"
      - "test-6-*"
      privileges:
      - "read"
      - "write"
- contains:
    indices:
      names:
      - "test-4-*"
      privileges:
      - "read"
      field_security:
      - grant:
        - "*"
        except:
        - "private-*"
- length:
    applications: 3
- contains:
    applications:
      application: "app-dne"
      privileges:
      - "all"
      resources:
      - "*"
- contains:
    applications:
      application: "test-app"
      privileges:
      - "read"
      resources:
      - "object/2"
- contains:
    applications:
      application: "test-app"
      privileges:
      - "dne"
      resources:
      - "*"
- match:
    run_as:
    - "app-*"
---
Test get_user_privileges for merged roles:
- skip:
    reason: "contains is a newly added assertion"
    features: "contains"
- do:
    headers:
      Authorization: "Basic dGVzdC0zOnRlc3QtdXNlci1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_user_privileges: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    cluster:
    - "manage"
    - "manage_security"
    - "monitor"
- length:
    global: 2
- contains:
    global:
      application:
        manage:
          applications:
          - "test-*"
- contains:
    global:
      application:
        manage:
          applications:
          - "apps-*"
- length:
    indices: 7
- contains:
    indices:
      names:
      - "test-1-*"
      privileges:
      - "read"
- contains:
    indices:
      names:
      - "test-2-*"
      privileges:
      - "read"
      field_security:
      - grant:
        - "*"
        except:
        - "secret-*"
        - "private-*"
      - grant:
        - "apps-*"
      query:
      - "{\"term\":{\"test\":true}}"
      - "{\"term\":{\"apps\":true}}"
- contains:
    indices:
      names:
      - "test-3-*"
      - "test-4-*"
      - "test-5-*"
      privileges:
      - "read"
      field_security:
      - grant:
        - "test-*"
- contains:
    indices:
      names:
      - "test-6-*"
      - "test-7-*"
      privileges:
      - "read"
      query:
      - "{\"term\":{\"test\":true}}"
- contains:
    indices:
      names:
      - "test-1-*"
      - "test-9-*"
      privileges:
      - "all"
- contains:
    indices:
      names:
      - "test-3-*"
      - "test-6-*"
      privileges:
      - "read"
      - "write"
- contains:
    indices:
      names:
      - "test-4-*"
      privileges:
      - "read"
      field_security:
      - grant:
        - "*"
        except:
        - "private-*"
- length:
    applications: 3
- contains:
    applications:
      application: "app-dne"
      privileges:
      - "all"
      resources:
      - "*"
- contains:
    applications:
      application: "test-app"
      privileges:
      - "dne"
      - "user"
      resources:
      - "*"
- contains:
    applications:
      application: "test-app"
      privileges:
      - "read"
      resources:
      - "object/1"
      - "object/2"
- match:
    run_as:
    - "app-*"
    - "test-*"
