---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "mixed_role"
      body: "{\n  \"indices\": [\n    { \"names\": [\"only_read\"], \"privileges\"\
        : [\"read\"] },\n    { \"names\": [\"only_index\"], \"privileges\": [\"index\"\
        ] },\n    { \"names\": [\"only_delete\"], \"privileges\": [\"delete\"] },\n\
        \    { \"names\": [\"read_write\"], \"privileges\": [\"read\", \"write\"]\
        \ },\n    { \"names\": [\"everything\"], \"privileges\": [\"all\"] }\n  ]\n\
        }\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "test_user"
      body: "{\n  \"password\" : \"x-pack-test-password\",\n  \"roles\" : [ \"mixed_role\"\
        \ ],\n  \"full_name\" : \"user with mixed privileges to multiple indices\"\
        \n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "only_read"
      body:
        settings:
          index:
            number_of_shards: 1
            number_of_replicas: 1
        mappings:
          properties:
            name:
              type: "keyword"
            tag:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "only_index"
      body:
        settings:
          index:
            number_of_shards: 1
            number_of_replicas: 1
        mappings:
          properties:
            name:
              type: "keyword"
            tag:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "only_delete"
      body:
        settings:
          index:
            number_of_shards: 1
            number_of_replicas: 1
        mappings:
          properties:
            name:
              type: "keyword"
            tag:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "read_write"
      body:
        settings:
          index:
            number_of_shards: 1
            number_of_replicas: 1
        mappings:
          properties:
            name:
              type: "keyword"
            tag:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "everything"
      body:
        settings:
          index:
            number_of_shards: 1
            number_of_replicas: 1
        mappings:
          properties:
            name:
              type: "keyword"
            tag:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    bulk:
      refresh: true
      body:
      - "{\"index\": {\"_index\": \"only_read\", \"_id\": \"1\"}}"
      - "{\"name\": \"doc1\", \"tag\": [ \"can-read\", \"tag-a\" ] }"
      - "{\"index\": {\"_index\": \"only_read\", \"_id\": \"2\"}}"
      - "{\"name\": \"doc2\", \"tag\": [ \"can-read\", \"tag-b\"] }"
      - "{\"index\": {\"_index\": \"only_index\", \"_id\": \"3\"}}"
      - "{\"name\": \"doc3\", \"tag\": [ \"no-read\", \"tag-a\"] }"
      - "{\"index\": {\"_index\": \"only_index\", \"_id\": \"4\"}}"
      - "{\"name\": \"doc4\", \"tag\": [ \"no-read\", \"tag-b\"] }"
      - "{\"index\": {\"_index\": \"only_delete\", \"_id\": \"5\"}}"
      - "{\"name\": \"doc5\", \"tag\": [ \"no-read\", \"tag-a\"] }"
      - "{\"index\": {\"_index\": \"only_delete\", \"_id\": \"6\"}}"
      - "{\"name\": \"doc6\", \"tag\": [ \"no-read\", \"tag-b\"] }"
      - "{\"index\": {\"_index\": \"read_write\", \"_id\": \"7\"}}"
      - "{\"name\": \"doc7\", \"tag\": [ \"can-read\", \"tag-a\" ] }"
      - "{\"index\": {\"_index\": \"read_write\", \"_id\": \"8\"}}"
      - "{\"name\": \"doc8\", \"tag\": [ \"can-read\", \"tag-b\"] }"
      - "{\"index\": {\"_index\": \"everything\", \"_id\": \"9\"}}"
      - "{\"name\": \"doc9\", \"tag\": [ \"can-read\", \"tag-a\" ] }"
      - "{\"index\": {\"_index\": \"everything\", \"_id\": \"10\"}}"
      - "{\"name\": \"doc10\", \"tag\": [ \"can-read\", \"tag-b\"] }"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_user:
      username: "test_user"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "mixed_role"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test search for document when authorized:
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      index: "only_read"
      body: null
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 2
- match:
    hits.hits.0._index: "only_read"
- match:
    hits.hits.1._index: "only_read"
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      index: "read_write"
      body: null
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 2
- match:
    hits.hits.0._index: "read_write"
- match:
    hits.hits.1._index: "read_write"
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      index: "everything"
      body: null
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 2
- match:
    hits.hits.0._index: "everything"
- match:
    hits.hits.1._index: "everything"
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      body:
        query:
          term:
            tag: "can-read"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 6
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    msearch:
      rest_total_hits_as_int: true
      body:
      - {}
      - query:
          term:
            tag: "can-read"
      - index: "only_read"
      - query:
          term:
            tag: "tag-a"
      - index: "read_write"
      - {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    responses.0.hits.total: 6
- match:
    responses.1.hits.total: 1
- match:
    responses.2.hits.total: 2
---
Test search for documents when not allowed:
- do:
    catch: "forbidden"
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      index: "only_index"
      body: null
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    catch: "forbidden"
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      index: "only_delete"
      body: null
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      body:
        query:
          term:
            tag: "no-read"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 0
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      body:
        query:
          term:
            _index: "only_index"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 0
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    msearch:
      rest_total_hits_as_int: true
      body:
      - {}
      - query:
          term:
            tag: "no-read"
      - {}
      - query:
          term:
            _index: "only_index"
      - index: "only_delete"
      - {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    responses.0.hits.total: 0
- match:
    responses.1.hits.total: 0
- match:
    responses.2.error.type: "security_exception"
---
Test search documents when only some are allowed:
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      body:
        query:
          term:
            tag: "tag-a"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 3
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    msearch:
      rest_total_hits_as_int: true
      body:
      - {}
      - query:
          term:
            tag: "tag-a"
      - {}
      - query:
          term:
            tag: "can-read"
      - {}
      - query:
          term:
            tag: "no-read"
      - index: "only_read"
      - query:
          term:
            tag: "tag-a"
      - index: "only_delete"
      - query:
          term:
            tag: "tag-a"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    responses.0.hits.total: 3
- match:
    responses.1.hits.total: 6
- match:
    responses.2.hits.total: 0
- match:
    responses.3.hits.total: 1
- match:
    responses.4.error.type: "security_exception"
---
'filters agg match_all doesn''t count invisible docs: match_all':
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      size: 0
      body:
        aggs:
          f:
            filters:
              filters:
              - match_all: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 6
- match:
    aggregations.f.buckets.0.doc_count: 6
---
'filters agg exists doesn''t count invisible docs: exists':
- do:
    headers:
      Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      rest_total_hits_as_int: true
      size: 0
      body:
        aggs:
          f:
            filters:
              filters:
              - exists:
                  field: "name"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total: 6
- match:
    aggregations.f.buckets.0.doc_count: 6
