---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_privileges:
      body: "{\n  \"app01\": {\n    \"user\": {\n      \"application\": \"app01\"\
        ,\n      \"name\": \"user\",\n      \"actions\": [ \"action:login\" ]\n  \
        \  },\n    \"read\": {\n      \"application\": \"app01\",\n      \"name\"\
        : \"read\",\n      \"actions\": [ \"data:read/*\" ]\n    },\n    \"write\"\
        : {\n      \"application\": \"app01\",\n      \"name\": \"write\",\n     \
        \ \"actions\": [ \"data:write/*\" ]\n    }\n  },\n  \"app02\": {\n    \"user\"\
        : {\n      \"application\": \"app02\",\n      \"name\": \"user\",\n      \"\
        actions\": [ \"action:login\" ]\n    },\n    \"read\": {\n      \"application\"\
        : \"app02\",\n      \"name\": \"read\",\n      \"actions\": [ \"data:read/*\"\
        \ ]\n    },\n    \"write\": {\n      \"application\": \"app02\",\n      \"\
        name\": \"write\",\n      \"actions\": [ \"data:write/*\" ]\n    }\n  }\n\
        }\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "my_admin"
      body: "{\n  \"password\": \"admin01-password\",\n  \"roles\" : [ \"superuser\"\
        \ ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "eng_write"
      body: "{\n  \"password\": \"s3cr3t-p@ssw0rd\",\n  \"roles\" : [ \"myapp_engineering_write\"\
        \ ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_privileges:
      application: "app01"
      name: "user,read,write"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_privileges:
      application: "app02"
      name: "user,read,write"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "my_admin"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test superuser has all application-privileges:
- do:
    headers:
      Authorization: "Basic bXlfYWRtaW46YWRtaW4wMS1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"cluster\": [ \"manage\" ],\n  \"index\": [\n    {\n      \"names\"\
        \ :[ \"*\"  ],\n      \"privileges\" : [ \"read\", \"index\", \"write\" ]\n\
        \    }\n  ],\n  \"application\": [\n    {\n      \"application\" : \"app01\"\
        ,\n      \"resources\" : [ \"*\" ],\n      \"privileges\" : [ \"action:login\"\
        , \"data:read/secrets\" ]\n    },\n    {\n      \"application\" : \"app02\"\
        ,\n      \"resources\" : [ \"thing/1\" ],\n      \"privileges\" : [ \"data:write/thing\"\
        \ ]\n    },\n    {\n      \"application\" : \"app01\",\n      \"resources\"\
        \ : [ \"foo\" ],\n      \"privileges\" : [ \"dne\", \"data:dne\" ]\n    },\n\
        \    {\n      \"application\" : \"app-dne\",\n      \"resources\" : [ \"bar\"\
        \ ],\n      \"privileges\" : [ \"anything\", \"action:anything\" ]\n    }\n\
        \  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "my_admin"
- match:
    has_all_requested: true
- match:
    application:
      app01:
        '*':
          action:login: true
          data:read/secrets: true
        foo:
          dne: true
          data:dne: true
      app02:
        thing/1:
          data:write/thing: true
      app-dne:
        bar:
          anything: true
          action:anything: true
