---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    cluster.health:
      wait_for_status: "yellow"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
teardown:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- do:
    security.delete_service_token:
      namespace: "elastic"
      service: "fleet-server"
      name: "api-token-fleet"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_service_token:
      namespace: "elastic"
      service: "kibana"
      name: "api-token-kibana"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- do:
    security.delete_service_token:
      namespace: "elastic"
      service: "enterprise-search-server"
      name: "api-token-enterprise-search-server"
      ignore: 404
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
---
Test get service accounts:
- skip:
    awaits_fix: "Enterprise Search service account removed, invalidating the current\
      \ tests"
- do:
    security.get_service_accounts: {}
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    ? ""
    : 5
- is_true: "elastic/auto-ops"
- is_true: "elastic/enterprise-search-server"
- is_true: "elastic/fleet-server"
- is_true: "elastic/fleet-server-remote"
- is_true: "elastic/kibana"
- do:
    security.get_service_accounts:
      namespace: "elastic"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    ? ""
    : 5
- is_true: "elastic/auto-ops"
- is_true: "elastic/enterprise-search-server"
- is_true: "elastic/fleet-server"
- is_true: "elastic/fleet-server-remote"
- is_true: "elastic/kibana"
- do:
    security.get_service_accounts:
      namespace: "elastic"
      service: "fleet-server"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- length:
    ? ""
    : 1
- is_true: "elastic/fleet-server"
---
Test service account tokens:
- skip:
    features: "headers"
    awaits_fix: "Enterprise Search service account removed, invalidating the current\
      \ tests"
- do:
    security.create_service_token:
      namespace: "elastic"
      service: "fleet-server"
      name: "api-token-fleet"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- is_true: "created"
- match:
    token.name: "api-token-fleet"
- set:
    token.value: "service_token_fleet"
- do:
    security.create_service_token:
      namespace: "elastic"
      service: "kibana"
      name: "api-token-kibana"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- is_true: "created"
- match:
    token.name: "api-token-kibana"
- set:
    token.value: "service_token_kibana"
- do:
    security.create_service_token:
      namespace: "elastic"
      service: "enterprise-search-server"
      name: "api-token-enterprise-search-server"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- is_true: "created"
- match:
    token.name: "api-token-enterprise-search-server"
- set:
    token.value: "service_token_enterprise_search_server"
- do:
    headers:
      Authorization: "Bearer ${service_token_fleet}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.authenticate: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "elastic/fleet-server"
- match:
    roles: []
- match:
    full_name: "Service account - elastic/fleet-server"
- match:
    token.name: "api-token-fleet"
- do:
    catch: "forbidden"
    headers:
      Authorization: "Bearer ${service_token_fleet}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.delete_user:
      username: "foo"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    error.type: "security_exception"
- match:
    error.reason: "action [cluster:admin/xpack/security/user/delete] is unauthorized\
      \ for service account [elastic/fleet-server], this action is granted by the\
      \ cluster privileges [manage_security,all]"
- do:
    headers:
      Authorization: "Bearer ${service_token_kibana}"
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    security.authenticate: {}
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    username: "elastic/kibana"
- match:
    roles: []
- match:
    full_name: "Service account - elastic/kibana"
- match:
    token.name: "api-token-kibana"
- do:
    security.get_service_credentials:
      namespace: "elastic"
      service: "fleet-server"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    service_account: "elastic/fleet-server"
- match:
    count: 2
- match:
    tokens:
      api-token-fleet: {}
- match:
    nodes_credentials._nodes.failed: 0
- is_true: "nodes_credentials.file_tokens.token1"
- is_true: "nodes_credentials.file_tokens.token1.nodes"
- match:
    nodes_credentials.file_tokens.token1.nodes.0: "/yamlRestTest.*-0/"
- do:
    security.clear_cached_service_tokens:
      namespace: "elastic"
      service: "fleet-server"
      name: "api-token-fleet"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
- do:
    security.clear_cached_service_tokens:
      namespace: "elastic"
      service: "kibana"
      name: "api-token-kibana"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
- do:
    security.clear_cached_service_tokens:
      namespace: "elastic"
      service: "fleet-server"
      name:
      - "api-token-fleet"
      - "does-not-exist"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
- do:
    security.clear_cached_service_tokens:
      namespace: "elastic"
      service: "kibana"
      name:
      - "api-token-kibana"
      - "does-not-exist-either"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - ".*rollup functionality will be removed in Elasticsearch.*"
    - "Index \\[\\.profiling-.*\\] name begins with a dot.* and will not be allowed\
      \ in a future Elasticsearch version."
    - "Parameter \\[default_metric\\] is deprecated and will be removed in a future\
      \ version"
- match:
    _nodes.failed: 0
