---
setup:
  - skip:
      features: headers

  - do:
      cluster.health:
        wait_for_status: yellow
---
teardown:
  - do:
      security.delete_privileges:
        application: app
        name: "p1,p2,p3"
        ignore: 404
  - do:
      security.delete_privileges:
        application: app2
        name: "p1"
        ignore: 404
  - do:
      security.delete_privileges:
        application: app3
        name: "p1,p2,p3,p4"
        ignore: 404
  - do:
      security.delete_privileges:
        application: app4
        name: "p1"
        ignore: 404
---
"Test put and get privileges":
  # Single privilege
  - do:
      security.put_privileges:
        body:  >
            {
              "app": {
                "p1": {
                  "application": "app",
                  "name": "p1",
                  "actions": [ "data:read/*" , "action:login" ],
                  "metadata": {
                    "key1" : "val1a",
                    "key2" : "val2a"
                  }
                }
              }
            }
  - match: { "app.p1" : { created: true } }

  # Multiple privileges
  - do:
      security.put_privileges:
        body: >
          {
            "app": {
              "p2": {
                "application": "app",
                "name": "p2",
                "actions": [ "data:read/*" , "action:login" ],
                "metadata": {
                  "key1" : "val1b",
                  "key2" : "val2b"
                }
              },
              "p3": {
                "application": "app",
                "name": "p3",
                "actions": [ "data:write/*" , "action:login" ],
                "metadata": {
                  "key1" : "val1c",
                  "key2" : "val2c"
                }
              }
            },
            "app2" : {
              "p1" : {
                "application": "app2",
                "name": "p1",
                "actions": [ "*" ]
              }
            }
          }
  - match: { "app.p2" : { created: true } }
  - match: { "app.p3" : { created: true } }
  - match: { "app2.p1" : { created: true } }

  # Update existing privilege
  - do:
      security.put_privileges:
        body:  >
            {
              "app": {
                "p1": {
                  "actions": [ "data:read/*" , "action:login" ],
                  "metadata": {
                    "key3" : "val3"
                  }
                }
              }
            }
  - match: { "app.p1" : { created: false } }

  # Get the privilege back
  - do:
      security.get_privileges:
        application: app
        name: p1

  - match: {
      "app.p1" : {
        "application": "app",
        "name": "p1",
        "actions": [ "data:read/*" , "action:login" ],
        "metadata": {
          "key3" : "val3"
        }
      }
    }

  # Get 2 privileges back
  - do:
      security.get_privileges:
        application: app
        name: p1,p2

  - match: {
      "app.p1" : {
        "application": "app",
        "name": "p1",
        "actions": [ "data:read/*" , "action:login" ],
        "metadata": {
          "key3" : "val3"
        }
      }
    }
  - match: {
      "app.p2" : {
        "application": "app",
        "name": "p2",
        "actions": [ "data:read/*" , "action:login" ],
        "metadata": {
          "key1" : "val1b",
          "key2" : "val2b"
        }
      }
    }

 # Get all (3) privileges back for "app"
  - do:
      security.get_privileges:
        application: "app"
        name: ""

  - match: {
      "app.p1" : {
        "application": "app",
        "name": "p1",
        "actions": [ "data:read/*" , "action:login" ],
        "metadata": {
          "key3" : "val3"
        }
      }
    }
  - match: {
      "app.p2" : {
        "application": "app",
        "name": "p2",
        "actions": [ "data:read/*" , "action:login" ],
        "metadata": {
          "key1" : "val1b",
          "key2" : "val2b"
        }
      }
    }
  - match: {
      "app.p3" : {
        "application": "app",
        "name": "p3",
        "actions": [ "data:write/*" , "action:login" ],
        "metadata": {
          "key1" : "val1c",
          "key2" : "val2c"
        }
      }
    }

 # Get all (4) privileges back for all apps
  - do:
      security.get_privileges:
        application: ""
        name: ""

  - match: {
      "app.p1" : {
        "application": "app",
        "name": "p1",
        "actions": [ "data:read/*" , "action:login" ],
        "metadata": {
          "key3" : "val3"
        }
      }
    }
  - match: {
      "app.p2" : {
        "application": "app",
        "name": "p2",
        "actions": [ "data:read/*" , "action:login" ],
        "metadata": {
          "key1" : "val1b",
          "key2" : "val2b"
        }
      }
    }
  - match: {
      "app.p3" : {
        "application": "app",
        "name": "p3",
        "actions": [ "data:write/*" , "action:login" ],
        "metadata": {
          "key1" : "val1c",
          "key2" : "val2c"
        }
      }
    }
  - match: {
      "app2.p1" : {
        "application": "app2",
        "name": "p1",
        "actions": [ "*" ],
        "metadata": { }
      }
    }

---
"Test put and delete privileges":
  # Store some privileges
  - do:
      security.put_privileges:
        body:  >
          {
            "app3": {
              "p1": {
                "application": "app3",
                "name": "p1",
                "actions": [ "data:read/*" ]
              },
              "p2": {
                "application": "app3",
                "name": "p2",
                "actions": [ "data:write/*" ]
              },
              "p3": {
                "application": "app3",
                "name": "p3",
                "actions": [ "data:write/*", "data:read/*" ]
              },
              "p4": {
                "application": "app3",
                "name": "p4",
                "actions": [ "*" ]
              }
            },
            "app4": {
              "p1": {
                "application": "app4",
                "name": "p1",
                "actions": [ "*" ]
              }
            }
          }
  - match: { "app3.p1" : { created: true } }
  - match: { "app3.p2" : { created: true } }
  - match: { "app3.p3" : { created: true } }
  - match: { "app3.p4" : { created: true } }
  - match: { "app4.p1" : { created: true } }

  # Delete 1 privilege
  - do:
      security.delete_privileges:
        application: app3
        name: p1

  - match: { "app3.p1" : { "found" : true } }

  # Delete 2 more privileges (p2, p3)
  # and try to delete two that don't exist (p1, p0)
  - do:
      security.delete_privileges:
        application: app3
        name: p1,p2,p3,p0

  - match: { "app3.p1" : { "found" : false} }
  - match: { "app3.p2" : { "found" : true } }
  - match: { "app3.p3" : { "found" : true } }
  - match: { "app3.p0" : { "found" : false} }

  # Check the deleted privileges are gone
  - do:
      catch: missing
      security.get_privileges:
        application: app3
        name: p1,p2,p3

  # Check the non-deleted privileges are there
  - do:
      security.get_privileges:
        application: ""
        name: ""
  - match: {
      "app3.p4" : {
        "application": "app3",
        "name": "p4",
        "actions": [ "*" ],
        "metadata": { }
      }
    }
  - match: {
      "app4.p1" : {
        "application": "app4",
        "name": "p1",
        "actions": [ "*" ],
        "metadata": { }
      }
    }

---
"Test clear privileges cache":
  - requires:
      cluster_features: ["gte_v7.9.0"]
      reason:  "application privileges cache is available since 7.9.0"

  - do:
      security.clear_cached_privileges:
        application: "app"
  - match: { _nodes.failed: 0 }

  - do:
      security.clear_cached_privileges:
        application: "*"
  - match: { _nodes.failed: 0 }
