---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_privileges:
      body: "{\n  \"myapp\": {\n    \"user\": {\n      \"application\": \"myapp\"\
        ,\n      \"name\": \"user\",\n      \"actions\": [ \"action:login\", \"version:1.0.*\"\
        \ ]\n    },\n    \"read\": {\n      \"application\": \"myapp\",\n      \"\
        name\": \"read\",\n      \"actions\": [ \"data:read/*\" ]\n    },\n    \"\
        write\": {\n      \"application\": \"myapp\",\n      \"name\": \"write\",\n\
        \      \"actions\": [ \"data:write/*\" ]\n    }\n  },\n  \"yourapp-v1\" :\
        \ {\n    \"read\": {\n      \"actions\": [ \"data:read/*\" ]\n    }\n  },\n\
        \  \"yourapp-v2\" : {\n    \"read\": {\n      \"actions\": [ \"data:read/*\"\
        \ ]\n    }\n  }\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "myapp_engineering_read"
      body: "{\n  \"cluster\": [],\n  \"indices\": [\n    {\n      \"names\": \"engineering-*\"\
        ,\n      \"privileges\": [\"read\"]\n    }\n  ],\n  \"applications\": [\n\
        \    {\n      \"application\": \"myapp\",\n      \"privileges\": [\"user\"\
        ],\n      \"resources\": [\"*\"]\n    },\n    {\n      \"application\": \"\
        myapp\",\n      \"privileges\": [\"read\"],\n      \"resources\": [\"engineering/*\"\
        ]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "myapp_engineering_write"
      body: "{\n  \"cluster\": [],\n  \"indices\": [\n    {\n      \"names\": \"engineering-*\"\
        ,\n      \"privileges\": [\"read\"]\n    }\n  ],\n  \"applications\": [\n\
        \    {\n      \"application\": \"myapp\",\n      \"privileges\": [\"user\"\
        ],\n      \"resources\": [\"*\"]\n    },\n    {\n      \"application\": \"\
        myapp\",\n      \"privileges\": [\"read\", \"write\"],\n      \"resources\"\
        : [\"engineering/*\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "yourapp_read_config"
      body: "{\n  \"cluster\": [],\n  \"indices\": [],\n  \"applications\": [\n  \
        \  {\n      \"application\": \"yourapp-*\",\n      \"privileges\": [\"read\"\
        ],\n      \"resources\": [\"settings/*\"]\n    }\n  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_role:
      name: "role_containing_wildcard_app_name_and_plain_app_name"
      body: "{\n  \"cluster\": [],\n  \"indices\": [],\n  \"applications\": [\n  \
        \  {\n      \"application\": \"myapp\",\n      \"privileges\": [\"user\"],\n\
        \      \"resources\": [\"*\"]\n    },\n    {\n      \"application\": \"yourapp-*\"\
        ,\n      \"privileges\": [\"read\"],\n      \"resources\": [\"*\"]\n    }\n\
        \  ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "eng_read"
      body: "{\n  \"password\": \"s3cr3t-p@ssw0rd\",\n  \"roles\" : [ \"myapp_engineering_read\"\
        \ ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "eng_write"
      body: "{\n  \"password\": \"s3cr3t-p@ssw0rd\",\n  \"roles\" : [ \"myapp_engineering_write\"\
        \ ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "your_read"
      body: "{\n  \"password\": \"s3cr3t-p@ssw0rd\",\n  \"roles\" : [ \"yourapp_read_config\"\
        \ ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.put_user:
      username: "myapp_yourapp_wildard_role_user"
      body: "{\n  \"password\": \"s3cr3t-p@ssw0rd\",\n  \"roles\" : [ \"role_containing_wildcard_app_name_and_plain_app_name\"\
        \ ]\n}\n"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_privileges:
      application: "myapp"
      name: "user,read,write"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_privileges:
      application: "yourapp-v1"
      name: "read"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_privileges:
      application: "yourapp-v2"
      name: "read"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "eng_read"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "eng_write"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "your_read"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_user:
      username: "myapp_yourapp_wildard_role_user"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "myapp_engineering_read"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "myapp_engineering_write"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "yourapp_read_config"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_role:
      name: "role_containing_wildcard_app_name_and_plain_app_name"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test has_privileges with application-privileges:
- do:
    headers:
      Authorization: "Basic ZW5nX3JlYWQ6czNjcjN0LXBAc3N3MHJk"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"index\": [\n    {\n      \"names\" :[ \"engineering-logs\", \"\
        product-logs\" ],\n      \"privileges\" : [ \"read\", \"index\", \"write\"\
        \ ]\n    }\n  ],\n  \"application\": [\n    {\n      \"application\" : \"\
        myapp\",\n      \"resources\" : [ \"*\" ],\n      \"privileges\" : [ \"action:login\"\
        , \"version:1.0.3\" ]\n    },\n    {\n      \"application\" : \"myapp\",\n\
        \      \"resources\" : [ \"engineering/logs/*\", \"product/logs/*\" ],\n \
        \     \"privileges\" : [ \"data:read/log/raw\", \"data:write/log/raw\" ]\n\
        \    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "eng_read"
- match:
    has_all_requested: false
- match:
    index:
      engineering-logs:
        read: true
        index: false
        write: false
      product-logs:
        read: false
        index: false
        write: false
- match:
    application:
      myapp:
        '*':
          action:login: true
          version:1.0.3: true
        engineering/logs/*:
          data:read/log/raw: true
          data:write/log/raw: false
        product/logs/*:
          data:read/log/raw: false
          data:write/log/raw: false
- do:
    headers:
      Authorization: "Basic eW91cl9yZWFkOnMzY3IzdC1wQHNzdzByZA=="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"application\": [\n    {\n      \"application\" : \"yourapp-v1\"\
        ,\n      \"resources\" : [ \"settings/host\", \"settings/port\", \"system/key\"\
        \ ],\n      \"privileges\" : [ \"data:read/settings\", \"data:write/settings\"\
        , \"read\", \"write\" ]\n    },\n    {\n      \"application\" : \"yourapp-v2\"\
        ,\n      \"resources\" : [ \"settings/host\" ],\n      \"privileges\" : [\
        \ \"data:read/settings\", \"data:write/settings\" ]\n    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "your_read"
- match:
    has_all_requested: false
- match:
    application:
      yourapp-v1:
        settings/host:
          data:read/settings: true
          data:write/settings: false
          read: true
          write: false
        settings/port:
          data:read/settings: true
          data:write/settings: false
          read: true
          write: false
        system/key:
          data:read/settings: false
          data:write/settings: false
          read: false
          write: false
      yourapp-v2:
        settings/host:
          data:read/settings: true
          data:write/settings: false
- do:
    headers:
      Authorization: "Basic bXlhcHBfeW91cmFwcF93aWxkYXJkX3JvbGVfdXNlcjpzM2NyM3QtcEBzc3cwcmQ="
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.has_privileges:
      user: null
      body: "{\n  \"application\": [\n    {\n      \"application\" : \"myapp\",\n\
        \      \"resources\" : [ \"*\" ],\n      \"privileges\" : [ \"action:login\"\
        \ ]\n    },\n    {\n      \"application\" : \"yourapp-v1\",\n      \"resources\"\
        \ : [ \"*\" ],\n      \"privileges\" : [ \"read\" ]\n    },\n    {\n     \
        \ \"application\" : \"yourapp-v2\",\n      \"resources\" : [ \"*\" ],\n  \
        \    \"privileges\" : [ \"read\" ]\n    }\n  ]\n}\n"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "myapp_yourapp_wildard_role_user"
- match:
    has_all_requested: true
- match:
    application:
      myapp:
        '*':
          action:login: true
      yourapp-v1:
        '*':
          read: true
      yourapp-v2:
        '*':
          read: true
