---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "joe"
      body: "{\n  \"password\": \"s3krit-password\",\n  \"roles\" : [ \"remote_role\"\
        \ ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_user:
      username: "joe"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "remote_role"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test put remote role api:
- do:
    security.put_role:
      name: "remote_role"
      body: "{\n  \"remote_indices\":[\n    {\n      \"names\":[\n        \"logs*\"\
        \n      ],\n      \"privileges\":[\n        \"read\"\n      ],\n      \"allow_restricted_indices\"\
        :false,\n      \"clusters\":[\n        \"*\"\n      ]\n    }\n  ],\n  \"remote_cluster\"\
        :[\n    {\n      \"privileges\":[\n        \"monitor_enrich\"\n      ],\n\
        \      \"clusters\":[\n        \"my_remote*\", \"my_remote2*\"\n      ]\n\
        \    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    role:
      created: true
- do:
    security.get_role:
      name: "remote_role"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    remote_role.remote_indices.0.names.0: "logs*"
- match:
    remote_role.remote_indices.0.privileges.0: "read"
- match:
    remote_role.remote_indices.0.allow_restricted_indices: false
- match:
    remote_role.remote_indices.0.clusters.0: "*"
- match:
    remote_role.remote_cluster.0.privileges.0: "monitor_enrich"
- match:
    remote_role.remote_cluster.0.clusters.0: "my_remote*"
- match:
    remote_role.remote_cluster.0.clusters.1: "my_remote2*"
- do:
    security.query_role:
      body: "{\n  \"query\": {\n    \"bool\": {\n      \"must_not\": {\n        \"\
        term\": {\n          \"metadata._reserved\": true\n        }\n      }\n  \
        \  }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    total: 1
- match:
    count: 1
- match:
    roles.0.name: "remote_role"
- match:
    roles.0.remote_indices.0.names.0: "logs*"
- match:
    roles.0.remote_indices.0.privileges.0: "read"
- match:
    roles.0.remote_indices.0.allow_restricted_indices: false
- match:
    roles.0.remote_indices.0.clusters.0: "*"
- match:
    roles.0.remote_cluster.0.privileges.0: "monitor_enrich"
- match:
    roles.0.remote_cluster.0.clusters.0: "my_remote*"
- match:
    roles.0.remote_cluster.0.clusters.1: "my_remote2*"
- do:
    headers:
      Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.get_user_privileges: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    remote_indices.0.names.0: "logs*"
- match:
    remote_indices.0.privileges.0: "read"
- match:
    remote_indices.0.allow_restricted_indices: false
- match:
    remote_indices.0.clusters.0: "*"
- match:
    remote_cluster.0.privileges.0: "monitor_enrich"
- match:
    remote_cluster.0.clusters.0: "my_remote*"
- match:
    remote_cluster.0.clusters.1: "my_remote2*"
