---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "admin_role"
      body: "{\n  \"cluster\": [\"manage_api_key\"],\n  \"indices\": [\n    {\n  \
        \    \"names\": \"*\",\n      \"privileges\": [\"all\"]\n    }\n  ],\n  \"\
        applications\": [\n    {\n      \"application\": \"apm\",\n      \"privileges\"\
        : [\"*\"],\n      \"resources\": [\"*\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "api_key_admin"
      body: "{\n  \"password\" : \"x-pack-test-password\",\n  \"roles\" : [ \"admin_role\"\
        \ ],\n  \"full_name\" : \"API key admin\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "user_role"
      body: "{\n  \"cluster\": [\"manage_own_api_key\"]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "api_key_user"
      body: "{\n  \"password\" : \"x-pack-test-password\",\n  \"roles\" : [ \"user_role\"\
        \ ],\n  \"full_name\" : \"API key user\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_role:
      name: "admin_role"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "api_key_admin"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "user_role"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "api_key_user"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test API key role descriptors in Get and Query responses:
- skip:
    features: "transform_and_set"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9hZG1pbjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"key-0-with-implicit-inherit\"\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "key-0-with-implicit-inherit"
- is_true: "id"
- set:
    id: "api_key_id_0"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9hZG1pbjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id_0"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    api_keys.0.id: "$api_key_id_0"
- match:
    api_keys.0.role_descriptors: {}
- is_false: "api_keys.0.access"
- is_false: "api_keys.0.limited_by"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9hZG1pbjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"key-1-with-explicit-inherit\",\n  \"role_descriptors\"\
        : {}\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "key-1-with-explicit-inherit"
- is_true: "id"
- set:
    id: "api_key_id_1"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9hZG1pbjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id_1"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    api_keys.0.id: "$api_key_id_1"
- match:
    api_keys.0.role_descriptors: {}
- is_false: "api_keys.0.access"
- is_false: "api_keys.0.limited_by"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9hZG1pbjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"key-2-with-single-assigned-role-descriptor\",\n  \"\
        role_descriptors\": {\n    \"role-a\": {\n      \"cluster\": [\"all\"],\n\
        \      \"index\": [\n        {\n          \"names\": [\"index-a\"],\n    \
        \      \"privileges\": [\"read\"]\n        }\n      ]\n    }\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "key-2-with-single-assigned-role-descriptor"
- is_true: "id"
- set:
    id: "api_key_id_2"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9hZG1pbjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id_2"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    api_keys.0.id: "$api_key_id_2"
- match:
    api_keys.0.role_descriptors:
      role-a:
        cluster:
        - "all"
        indices:
        - names:
          - "index-a"
          privileges:
          - "read"
          allow_restricted_indices: false
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
- is_false: "api_keys.0.access"
- is_false: "api_keys.0.limited_by"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9hZG1pbjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"key-3-with-multiple-assigned-role-descriptors\",\n \
        \ \"expiration\": \"1d\",\n  \"role_descriptors\": {\n    \"role-a\": {\n\
        \      \"cluster\": [\"all\"],\n      \"index\": [\n        {\n          \"\
        names\": [\"index-a\"],\n          \"privileges\": [\"read\"]\n        }\n\
        \      ]\n    },\n    \"role-b\": {\n      \"cluster\": [\"manage\"],\n  \
        \    \"index\": [\n        {\n          \"names\": [\"index-b\"],\n      \
        \    \"privileges\": [\"all\"]\n        }\n      ]\n    }\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "key-3-with-multiple-assigned-role-descriptors"
- is_true: "id"
- set:
    id: "api_key_id_3"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9hZG1pbjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id_3"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    api_keys.0.id: "$api_key_id_3"
- match:
    api_keys.0.role_descriptors:
      role-a:
        cluster:
        - "all"
        indices:
        - names:
          - "index-a"
          privileges:
          - "read"
          allow_restricted_indices: false
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
      role-b:
        cluster:
        - "manage"
        indices:
        - names:
          - "index-b"
          privileges:
          - "all"
          allow_restricted_indices: false
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
- is_false: "api_keys.0.access"
- is_false: "api_keys.0.limited_by"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9hZG1pbjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.query_api_keys:
      body: "{\n  \"sort\": [ \"name\" ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    total: 4
- match:
    count: 4
- match:
    api_keys.0.name: "key-0-with-implicit-inherit"
- match:
    api_keys.0.role_descriptors: {}
- is_false: "api_keys.0.access"
- is_false: "api_keys.0.limited_by"
- match:
    api_keys.1.name: "key-1-with-explicit-inherit"
- match:
    api_keys.1.role_descriptors: {}
- is_false: "api_keys.1.limited_by"
- match:
    api_keys.2.name: "key-2-with-single-assigned-role-descriptor"
- match:
    api_keys.2.role_descriptors:
      role-a:
        cluster:
        - "all"
        indices:
        - names:
          - "index-a"
          privileges:
          - "read"
          allow_restricted_indices: false
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
- is_false: "api_keys.2.limited_by"
- match:
    api_keys.3.name: "key-3-with-multiple-assigned-role-descriptors"
- match:
    api_keys.3.role_descriptors:
      role-a:
        cluster:
        - "all"
        indices:
        - names:
          - "index-a"
          privileges:
          - "read"
          allow_restricted_indices: false
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
      role-b:
        cluster:
        - "manage"
        indices:
        - names:
          - "index-b"
          privileges:
          - "all"
          allow_restricted_indices: false
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
- is_false: "api_keys.3.limited_by"
---
Test API key limited-by role descriptors in Get and Query responses:
- skip:
    features: "transform_and_set"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"key-0-limited-by-api-key-user\"\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "key-0-limited-by-api-key-user"
- is_true: "id"
- set:
    id: "api_key_id_0"
- set:
    encoded: "login_creds_0"
- do:
    catch: "forbidden"
    headers:
      Authorization: "ApiKey ${login_creds_0}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id_0"
      with_limited_by: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id_0"
      owner: true
      with_limited_by: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    api_keys.0.id: "$api_key_id_0"
- is_true: "api_keys.0.role_descriptors"
- is_false: "api_keys.0.access"
- length:
    api_keys.0.limited_by: 1
- match:
    api_keys.0.limited_by.0:
      user_role:
        cluster:
        - "manage_own_api_key"
        indices: []
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.query_api_keys:
      with_limited_by: true
      body: "{\n  \"query\": { \"term\": { \"name\": \"key-0-limited-by-api-key-user\"\
        \ }}\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    total: 1
- match:
    count: 1
- match:
    api_keys.0.name: "key-0-limited-by-api-key-user"
- match:
    api_keys.0.id: "$api_key_id_0"
- is_true: "api_keys.0.role_descriptors"
- is_false: "api_keys.0.access"
- length:
    api_keys.0.limited_by: 1
- match:
    api_keys.0.limited_by.0:
      user_role:
        cluster:
        - "manage_own_api_key"
        indices: []
        applications: []
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
- do:
    headers:
      Authorization: "Basic YXBpX2tleV9hZG1pbjp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"key-1-limited-by-api-key-admin\"\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "key-1-limited-by-api-key-admin"
- is_true: "id"
- set:
    id: "api_key_id_1"
- set:
    encoded: "login_creds_1"
- do:
    headers:
      Authorization: "ApiKey ${login_creds_1}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id_1"
      with_limited_by: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    api_keys.0.id: "$api_key_id_1"
- is_true: "api_keys.0.role_descriptors"
- is_false: "api_keys.0.access"
- length:
    api_keys.0.limited_by: 1
- match:
    api_keys.0.limited_by.0:
      admin_role:
        cluster:
        - "manage_api_key"
        indices:
        - names:
          - "*"
          privileges:
          - "all"
          allow_restricted_indices: false
        applications:
        - application: "apm"
          privileges:
          - "*"
          resources:
          - "*"
        run_as: []
        metadata: {}
        transient_metadata:
          enabled: true
