---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "admin_role"
      body: "{\n  \"cluster\": [\"manage_api_key\"],\n  \"indices\": [\n    {\n  \
        \    \"names\": \"*\",\n      \"privileges\": [\"all\"]\n    }\n  ],\n  \"\
        applications\": [\n    {\n      \"application\": \"kibana-.kibana\",\n   \
        \   \"privileges\": [\"*\"],\n      \"resources\": [\"*\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "api_key_user"
      body: "{\n  \"password\" : \"x-pack-test-password\",\n  \"roles\" : [ \"admin_role\"\
        \ ],\n  \"full_name\" : \"API key user\"\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_privileges:
      body: "{\n  \"kibana-.kibana\": {\n    \"read\": {\n      \"application\": \"\
        kibana-.kibana\",\n      \"name\": \"read\",\n      \"actions\": [ \"data:read/*\"\
        \ ]\n    },\n    \"write\": {\n      \"application\": \"kibana-.kibana\",\n\
        \      \"name\": \"write\",\n      \"actions\": [ \"data:write/*\" ]\n   \
        \ }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_role:
      name: "admin_role"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "api_key_user"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_privileges:
      application: "kibana-.kibana"
      name: "read,write"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test create api key:
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"my-api-key\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {\n    \"role-a\": {\n      \"cluster\": [\"all\"],\n      \"index\": [\n\
        \        {\n          \"names\": [\"index-a\"],\n          \"privileges\"\
        : [\"read\"]\n        }\n      ]\n    },\n    \"role-b\": {\n      \"cluster\"\
        : [\"manage\"],\n      \"index\": [\n        {\n          \"names\": [\"index-b\"\
        ],\n          \"privileges\": [\"all\"]\n        }\n      ]\n    }\n  }\n\
        }\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.authenticate: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "api_key_user"
- length:
    roles: 0
- match:
    authentication_realm.name: "_es_api_key"
- match:
    authentication_realm.type: "_es_api_key"
- match:
    api_key.id: "${api_key_id}"
- match:
    api_key.name: "my-api-key"
- do:
    security.clear_api_key_cache:
      ids: "${api_key_id}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
---
Test get api key:
- skip:
    features: "transform_and_set"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"my-api-key\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {\n    \"role-a\": {\n      \"cluster\": [\"all\"],\n      \"index\": [\n\
        \        {\n          \"names\": [\"index-a\"],\n          \"privileges\"\
        : [\"read\"]\n        }\n      ]\n    },\n    \"role-b\": {\n      \"cluster\"\
        : [\"manage\"],\n      \"index\": [\n        {\n          \"names\": [\"index-b\"\
        ],\n          \"privileges\": [\"all\"]\n        }\n      ]\n    }\n  }\n\
        }\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id"
- set:
    name: "api_key_name"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      id: "$api_key_id"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    api_keys.0.id: "$api_key_id"
- match:
    api_keys.0.name: "$api_key_name"
- match:
    api_keys.0.username: "api_key_user"
- match:
    api_keys.0.invalidated: false
- is_true: "api_keys.0.creation"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_api_key:
      owner: true
      active_only: true
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    api_keys: 1
- match:
    api_keys.0.username: "api_key_user"
- match:
    api_keys.0.invalidated: false
- is_true: "api_keys.0.creation"
- do:
    security.clear_api_key_cache:
      ids: "*"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
---
Test invalidate api keys:
- skip:
    features: "transform_and_set"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"my-api-key-1\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key-1"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id_1"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"my-api-key-2\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key-2"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id_2"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"my-api-key-3\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key-3"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- set:
    id: "api_key_id_3"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.invalidate_api_key:
      body: "{\n  \"ids\": [ \"${api_key_id_1}\", \"${api_key_id_2}\", \"${api_key_id_3}\"\
        \ ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    invalidated_api_keys: 3
- match:
    invalidated_api_keys.0: "/^(${api_key_id_1}|${api_key_id_2}|${api_key_id_3})$/"
- match:
    invalidated_api_keys.1: "/^(${api_key_id_1}|${api_key_id_2}|${api_key_id_3})$/"
- match:
    invalidated_api_keys.2: "/^(${api_key_id_1}|${api_key_id_2}|${api_key_id_3})$/"
- length:
    previously_invalidated_api_keys: 0
- match:
    error_count: 0
---
Test has privileges API for api key:
- skip:
    features: "transform_and_set"
- do:
    headers:
      Authorization: "Basic YXBpX2tleV91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.create_api_key:
      body: "{\n  \"name\": \"my-api-key\",\n  \"expiration\": \"1d\",\n  \"role_descriptors\"\
        : {\n    \"role-a\": {\n      \"cluster\": [\"all\"],\n      \"index\": [\n\
        \        {\n          \"names\": [\"index-a\"],\n          \"privileges\"\
        : [\"read\"]\n        }\n      ],\n      \"applications\": [\n        {\n\
        \          \"application\": \"kibana-.kibana\",\n          \"privileges\"\
        : [\"read\"],\n          \"resources\": [\"*\"]\n        }\n      ]\n    },\n\
        \    \"role-b\": {\n      \"cluster\": [\"manage\"],\n      \"index\": [\n\
        \        {\n          \"names\": [\"index-b\"],\n          \"privileges\"\
        : [\"all\"]\n        }\n      ]\n    }\n  }\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "my-api-key"
- is_true: "id"
- is_true: "api_key"
- is_true: "expiration"
- transform_and_set:
    login_creds: "#base64EncodeCredentials(id,api_key)"
- match:
    encoded: "$login_creds"
- do:
    headers:
      Authorization: "ApiKey ${login_creds}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"index\": [\n    {\n      \"names\" :[ \"*\", \"index-a\" ],\n\
        \      \"privileges\" : [ \"read\", \"index\", \"write\" ]\n    },\n    {\n\
        \      \"names\" :[ \"index-a\", \"index-b\" ],\n      \"privileges\" : [\
        \ \"read\", \"write\" ]\n    }\n  ],\n  \"application\": [\n    {\n      \"\
        application\" : \"kibana-.kibana\",\n      \"resources\" : [ \"*\", \"some-other-res\"\
        \ ],\n      \"privileges\" : [ \"data:read/me\", \"data:write/me\" ]\n   \
        \ }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "api_key_user"
- match:
    has_all_requested: false
- match:
    index:
      '*':
        read: false
        index: false
        write: false
      index-a:
        read: true
        index: false
        write: false
      index-b:
        read: true
        write: true
- match:
    application:
      kibana-.kibana:
        '*':
          data:read/me: true
          data:write/me: false
        some-other-res:
          data:read/me: true
          data:write/me: false
