---
setup:
  - skip:
      features: headers

  - do:
      cluster.health:
          wait_for_status: yellow

  - do:
      security.put_role:
        name: "admin_role"
        body:  >
            {
              "cluster": ["manage_api_key"]
            }

  - do:
      security.put_role:
        name: "user_role"
        body:  >
            {
              "cluster": ["manage_own_api_key"]
            }

  - do:
      security.put_user:
        username: "api_key_manager"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "admin_role" ],
            "full_name" : "API key manager"
          }

  - do:
      security.put_user:
        username: "api_key_user_1"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "user_role" ],
            "full_name" : "API key user"
          }

---
teardown:
  - do:
      security.delete_role:
        name: "admin_role"
        ignore: 404

  - do:
      security.delete_role:
        name: "use_role"
        ignore: 404

  - do:
      security.delete_user:
        username: "api_key_user_1"
        ignore: 404

  - do:
      security.delete_user:
        username: "api_key_manager"
        ignore: 404

---
"Test invalidate api key by username":

  # every user first gets its own API key
  - do:
      headers:
        Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" # api_key_manager
      security.create_api_key:
        body:  >
            {
              "name": "manager-api-key",
              "expiration": "1d",
              "role_descriptors": {
              }
            }
  - match: { name: "manager-api-key" }
  - is_true: id
  - is_true: api_key
  - is_true: expiration
  - set: { id: manager_key_id }

  - do:
      headers:
        Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" # api_key_user_1
      security.create_api_key:
        body:  >
            {
              "name": "user1-api-key",
              "expiration": "1d",
              "role_descriptors": {
              }
            }
  - match: { name: "user1-api-key" }
  - is_true: id
  - is_true: api_key
  - is_true: expiration
  - set: { id: user1_key_id }

  - do:
      headers:
        Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" # api_key_manager
      security.invalidate_api_key:
        body:  >
            {
              "username": "api_key_user_1"
            }
  - length: { "invalidated_api_keys" : 1 }
  - match: { "invalidated_api_keys.0" : "${user1_key_id}" }
  - length: { "previously_invalidated_api_keys" : 0 }
  - match: { "error_count" : 0 }

  - do:
      catch: forbidden
      headers:
        Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" # api_key_user_1
      security.invalidate_api_key:
        body:  >
            {
              "username": "api_key_manager"
            }
  - match: { "error.type": "security_exception" }
  - match:
      "error.reason": "action [cluster:admin/xpack/security/api_key/invalidate] is unauthorized for user [api_key_user_1] with effective roles [user_role], this action is granted by the cluster privileges [manage_api_key,manage_security,all]"

  - do:
      headers:
        Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" # api_key_manager
      security.invalidate_api_key:
        body:  >
            {
              "username": "api_key_manager"
            }
  - length: { "invalidated_api_keys" : 1 }
  - match: { "invalidated_api_keys.0" : "${manager_key_id}" }
  - length: { "previously_invalidated_api_keys" : 0 }
  - match: { "error_count" : 0 }

---
"Test invalidate api key by realm name":

  # every user first gets its own API key
  - do:
      headers:
        Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" # api_key_manager
      security.create_api_key:
        body:  >
            {
              "name": "manager-api-key",
              "expiration": "1d",
              "role_descriptors": {
              }
            }
  - match: { name: "manager-api-key" }
  - is_true: id
  - is_true: api_key
  - is_true: expiration
  - set: { id: manager_key_id }

  - do:
      headers:
        Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" # api_key_user_1
      security.create_api_key:
        body:  >
            {
              "name": "user1-api-key",
              "expiration": "1d",
              "role_descriptors": {
              }
            }
  - match: { name: "user1-api-key" }
  - is_true: id
  - is_true: api_key
  - is_true: expiration
  - set: { id: user1_key_id }

  - do:
      catch: forbidden
      headers:
        Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" # api_key_user_1
      security.invalidate_api_key:
        body:  >
            {
              "realm_name": "default_native"
            }
  - match: { "error.type": "security_exception" }
  - match:
      "error.reason": "action [cluster:admin/xpack/security/api_key/invalidate] is unauthorized for user [api_key_user_1] with effective roles [user_role], this action is granted by the cluster privileges [manage_api_key,manage_security,all]"

  - do:
      headers:
        Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" # api_key_manager
      security.invalidate_api_key:
        body:  >
            {
              "realm_name": "default_native"
            }
  - length: { "invalidated_api_keys" : 2 }
  - length: { "previously_invalidated_api_keys" : 0 }
  - match: { "error_count" : 0 }
