30_privileges_stack.yml

---
requires:
  stack: true
  serverless: false
---
teardown:
  - do:
      security.delete_privileges:
        application: app
        name: "p1,p2,p3"
        ignore: 404
  - do:
      security.delete_privileges:
        application: app2
        name: "p1"
        ignore: 404
---
'Security Privileges':
  # Single privilege
  - do:
      security.put_privileges:
        body:
          {
            "app": {
              "p1": {
                "application": "app",
                "name": "p1",
                "actions": ["data:read/*", "action:login"],
                "metadata": {
                  "key1" : "val1a",
                  "key2" : "val2a"
                }
              }
            }
          }
  - match: { "app.p1" : { created: true } }

  # Multiple privileges
  - do:
      security.put_privileges:
        body: >
          {
            "app": {
              "p2": {
                "application": "app",
                "name": "p2",
                "actions": ["data:read/*", "action:login"],
                "metadata": {
                  "key1" : "val1b",
                  "key2" : "val2b"
                }
              },
              "p3": {
                "application": "app",
                "name": "p3",
                "actions": ["data:write/*", "action:login"],
                "metadata": {
                  "key1" : "val1c",
                  "key2" : "val2c"
                }
              }
            },
            "app2" : {
              "p1" : {
                "application": "app2",
                "name": "p1",
                "actions": [ "*" ]
              }
            }
          }
  - match: { "app.p2" : { created: true } }
  - match: { "app.p3" : { created: true } }
  - match: { "app2.p1" : { created: true } }

  # Update existing privilege
  - do:
      security.put_privileges:
        body:  >
            {
              "app": {
                "p1": {
                  "actions": ["data:read/*", "action:login"],
                  "metadata": {
                    "key3" : "val3"
                  }
                }
              }
            }
  - match: { "app.p1" : { created: false } }

  # Get the privilege back
  - do:
      security.get_privileges:
        application: app
        name: p1
  - match: {
    "app.p1" : {
      "application": "app",
      "name": "p1",
      "actions": ["data:read/*", "action:login"],
      "metadata": {
        "key3" : "val3"
      }
    }
  }

  # Get 2 privileges back
  - do:
      security.get_privileges:
        application: app
        name: p1,p2

  - match: {
    "app.p1" : {
      "application": "app",
      "name": "p1",
      "actions": [ "data:read/*", "action:login" ],
      "metadata": {
        "key3" : "val3"
      }
    }
  }
  - match: {
    "app.p2" : {
      "application": "app",
      "name": "p2",
      "actions": [ "data:read/*", "action:login" ],
      "metadata": {
        "key1" : "val1b",
        "key2" : "val2b"
      }
    }
  }

  # Delete 1 privilege
  - do:
      security.delete_privileges:
        application: app2
        name: p1

  # Delete 2 more privileges (p2, p3)
  # and try to delete two that don't exist (p1, p0)
  - do:
      security.delete_privileges:
        application: app
        name: p1,p2,p3,p0
  - match: { "app.p0" : { "found" : false } }
  - match: { "app.p1" : { "found" : true } }
  - match: { "app.p2" : { "found" : true } }
  - match: { "app.p3" : { "found" : true } }

  # Check the deleted privileges are gone
  - do:
      catch: missing
      security.get_privileges:
        application: app3
        name: p1,p2,p3
  - do:
      security.clear_cached_privileges:
        application: "app"
  - match: { _nodes.failed: 0 }

  - do:
      security.clear_cached_privileges:
        application: "*"
  - match: { _nodes.failed: 0 }

  - do:
      security.get_builtin_privileges: {}
  # On the client side we don't really care what the values are, just that we've received a correct
  # response and parsed it:
  - is_true: cluster
  - is_true: index

  - do:
      security.get_user_privileges: {}
  - is_true: cluster
  - is_true: indices

  - do:
      security.has_privileges:
        body: { "index": [ { "names": "create", "privileges" : ["all"] } ] }
  - is_true: has_all_requested