---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "index_fls1"
      body:
        mappings:
          properties:
            name:
              type: "keyword"
            secret:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    indices.create:
      index: "index_fls2"
      body:
        mappings:
          properties:
            name:
              type: "keyword"
            object:
              type: "object"
              properties:
                secret:
                  type: "keyword"
                public:
                  type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Retrieve documents with FLS:
- do:
    bulk:
      refresh: true
      body:
      - "{\"index\": {\"_index\": \"index_fls1\", \"_id\": \"1a\" }}"
      - "{\"name\": \"i1_doc\", \"secret\":\"squirrel\"}"
      - "{\"index\": {\"_index\": \"index_fls2\", \"_id\": \"2a\"}}"
      - "{\"name\": \"i2_doc\", \"object\":{ \"secret\":\"mission\", \"public\":\"\
        interest\" }}"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    errors: false
- do:
    security.create_api_key:
      body:
        name: "test-fls"
        expiration: "1d"
        role_descriptors:
          index_access:
            indices:
            - names:
              - "index_fls1"
              privileges:
              - "read"
              field_security:
                grant:
                - "name"
            - names:
              - "index_fls2"
              privileges:
              - "read"
              - "monitor"
              field_security:
                grant:
                - "*"
                except:
                - "object.secret"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    name: "test-fls"
- is_true: "id"
- set:
    id: "api_key_id"
    encoded: "credentials"
- do:
    search:
      index: "index_fls1"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total.value: 1
- match:
    hits.total.relation: "eq"
- match:
    hits.hits.0._source.name: "i1_doc"
- is_true: "hits.hits.0._source.secret"
- match:
    hits.hits.0._source.secret: "squirrel"
- do:
    headers:
      Authorization: "ApiKey ${credentials}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    search:
      index: "index_fls1"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    hits.total.value: 1
- match:
    hits.total.relation: "eq"
- match:
    hits.hits.0._source.name: "i1_doc"
- is_false: "hits.hits.0._source.secret"
- do:
    get:
      index: "index_fls2"
      id: "2a"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _source.name: "i2_doc"
- match:
    _source.object.secret: "mission"
- match:
    _source.object.public: "interest"
- is_true: "_source.object.secret"
- do:
    headers:
      Authorization: "ApiKey ${credentials}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    get:
      index: "index_fls2"
      id: "2a"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _source.name: "i2_doc"
- match:
    _source.object.public: "interest"
- is_false: "_source.object.secret"
