---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_privileges:
      application: "app"
      name: "p1,p2,p3"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_privileges:
      application: "app2"
      name: "p1"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_privileges:
      application: "app3"
      name: "p1,p2,p3,p4"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_privileges:
      application: "app4"
      name: "p1"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test put and get privileges:
- do:
    security.put_privileges:
      body: "{\n  \"app\": {\n    \"p1\": {\n      \"application\": \"app\",\n   \
        \   \"name\": \"p1\",\n      \"actions\": [ \"data:read/*\" , \"action:login\"\
        \ ],\n      \"metadata\": {\n        \"key1\" : \"val1a\",\n        \"key2\"\
        \ : \"val2a\"\n      }\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app.p1:
      created: true
- do:
    security.put_privileges:
      body: "{\n  \"app\": {\n    \"p2\": {\n      \"application\": \"app\",\n   \
        \   \"name\": \"p2\",\n      \"actions\": [ \"data:read/*\" , \"action:login\"\
        \ ],\n      \"metadata\": {\n        \"key1\" : \"val1b\",\n        \"key2\"\
        \ : \"val2b\"\n      }\n    },\n    \"p3\": {\n      \"application\": \"app\"\
        ,\n      \"name\": \"p3\",\n      \"actions\": [ \"data:write/*\" , \"action:login\"\
        \ ],\n      \"metadata\": {\n        \"key1\" : \"val1c\",\n        \"key2\"\
        \ : \"val2c\"\n      }\n    }\n  },\n  \"app2\" : {\n    \"p1\" : {\n    \
        \  \"application\": \"app2\",\n      \"name\": \"p1\",\n      \"actions\"\
        : [ \"*\" ]\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app.p2:
      created: true
- match:
    app.p3:
      created: true
- match:
    app2.p1:
      created: true
- do:
    security.put_privileges:
      body: "{\n  \"app\": {\n    \"p1\": {\n      \"actions\": [ \"data:read/*\"\
        \ , \"action:login\" ],\n      \"metadata\": {\n        \"key3\" : \"val3\"\
        \n      }\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app.p1:
      created: false
- do:
    security.get_privileges:
      application: "app"
      name: "p1"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app.p1:
      application: "app"
      name: "p1"
      actions:
      - "data:read/*"
      - "action:login"
      metadata:
        key3: "val3"
- do:
    security.get_privileges:
      application: "app"
      name: "p1,p2"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app.p1:
      application: "app"
      name: "p1"
      actions:
      - "data:read/*"
      - "action:login"
      metadata:
        key3: "val3"
- match:
    app.p2:
      application: "app"
      name: "p2"
      actions:
      - "data:read/*"
      - "action:login"
      metadata:
        key1: "val1b"
        key2: "val2b"
- do:
    security.get_privileges:
      application: "app"
      name: ""
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app.p1:
      application: "app"
      name: "p1"
      actions:
      - "data:read/*"
      - "action:login"
      metadata:
        key3: "val3"
- match:
    app.p2:
      application: "app"
      name: "p2"
      actions:
      - "data:read/*"
      - "action:login"
      metadata:
        key1: "val1b"
        key2: "val2b"
- match:
    app.p3:
      application: "app"
      name: "p3"
      actions:
      - "data:write/*"
      - "action:login"
      metadata:
        key1: "val1c"
        key2: "val2c"
- do:
    security.get_privileges:
      application: ""
      name: ""
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app.p1:
      application: "app"
      name: "p1"
      actions:
      - "data:read/*"
      - "action:login"
      metadata:
        key3: "val3"
- match:
    app.p2:
      application: "app"
      name: "p2"
      actions:
      - "data:read/*"
      - "action:login"
      metadata:
        key1: "val1b"
        key2: "val2b"
- match:
    app.p3:
      application: "app"
      name: "p3"
      actions:
      - "data:write/*"
      - "action:login"
      metadata:
        key1: "val1c"
        key2: "val2c"
- match:
    app2.p1:
      application: "app2"
      name: "p1"
      actions:
      - "*"
      metadata: {}
---
Test put and delete privileges:
- do:
    security.put_privileges:
      body: "{\n  \"app3\": {\n    \"p1\": {\n      \"application\": \"app3\",\n \
        \     \"name\": \"p1\",\n      \"actions\": [ \"data:read/*\" ]\n    },\n\
        \    \"p2\": {\n      \"application\": \"app3\",\n      \"name\": \"p2\",\n\
        \      \"actions\": [ \"data:write/*\" ]\n    },\n    \"p3\": {\n      \"\
        application\": \"app3\",\n      \"name\": \"p3\",\n      \"actions\": [ \"\
        data:write/*\", \"data:read/*\" ]\n    },\n    \"p4\": {\n      \"application\"\
        : \"app3\",\n      \"name\": \"p4\",\n      \"actions\": [ \"*\" ]\n    }\n\
        \  },\n  \"app4\": {\n    \"p1\": {\n      \"application\": \"app4\",\n  \
        \    \"name\": \"p1\",\n      \"actions\": [ \"*\" ]\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app3.p1:
      created: true
- match:
    app3.p2:
      created: true
- match:
    app3.p3:
      created: true
- match:
    app3.p4:
      created: true
- match:
    app4.p1:
      created: true
- do:
    security.delete_privileges:
      application: "app3"
      name: "p1"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app3.p1:
      found: true
- do:
    security.delete_privileges:
      application: "app3"
      name: "p1,p2,p3,p0"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app3.p1:
      found: false
- match:
    app3.p2:
      found: true
- match:
    app3.p3:
      found: true
- match:
    app3.p0:
      found: false
- do:
    catch: "missing"
    security.get_privileges:
      application: "app3"
      name: "p1,p2,p3"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.get_privileges:
      application: ""
      name: ""
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    app3.p4:
      application: "app3"
      name: "p4"
      actions:
      - "*"
      metadata: {}
- match:
    app4.p1:
      application: "app4"
      name: "p1"
      actions:
      - "*"
      metadata: {}
---
Test clear privileges cache:
- requires:
    cluster_features:
    - "gte_v7.9.0"
    reason: "application privileges cache is available since 7.9.0"
- do:
    security.clear_cached_privileges:
      application: "app"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
- do:
    security.clear_cached_privileges:
      application: "*"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
