---
setup:
  - skip:
      features: headers

  - do:
      cluster.health:
          wait_for_status: yellow

  - do:
      security.put_role:
        name: "mixed_role"
        body:  >
            {
              "indices": [
                { "names": ["only_read"], "privileges": ["read"] },
                { "names": ["only_index"], "privileges": ["index"] },
                { "names": ["only_delete"], "privileges": ["delete"] },
                { "names": ["everything"], "privileges": ["all"] }
              ]
            }

  - do:
      security.put_user:
        username: "test_user"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "mixed_role" ],
            "full_name" : "user with mixed privileges to multiple indices"
          }

  - do:
      indices.create:
        index: only_read
        body:
          settings:
            index:
              number_of_shards:   1
              number_of_replicas: 1
          mappings:
            properties:
              name:
                type: "keyword"

  - do:
      indices.create:
        index: only_index
        body:
          settings:
            index:
              number_of_shards:   1
              number_of_replicas: 1
          mappings:
            properties:
              name:
                type: "keyword"
  - do:
      indices.create:
        index: only_delete
        body:
          settings:
            index:
              number_of_shards:   1
              number_of_replicas: 1
          mappings:
            properties:
              name:
                type: "keyword"

  - do:
      indices.create:
        index: everything
        body:
          settings:
            index:
              number_of_shards:   1
              number_of_replicas: 1
          mappings:
            properties:
              name:
                type: "keyword"

  - do:
      bulk:
        refresh: true
        body:
            - '{"index": {"_index": "only_read", "_id": "1"}}'
            - '{"name": "doc1"}'
            - '{"index": {"_index": "only_index", "_id": "2"}}'
            - '{"name": "doc2"}'
            - '{"index": {"_index": "only_delete", "_id": "3"}}'
            - '{"name": "doc3"}'
            - '{"index": {"_index": "only_delete", "_id": "4"}}'
            - '{"name": "doc4"}'
            - '{"index": {"_index": "only_delete", "_id": "5"}}'
            - '{"name": "doc5"}'
            - '{"index": {"_index": "only_delete", "_id": "6"}}'
            - '{"name": "doc6"}'
            - '{"index": {"_index": "only_delete", "_id": "7"}}'
            - '{"name": "doc7"}'
            - '{"index": {"_index": "everything", "_id": "8"}}'
            - '{"name": "doc8"}'
            - '{"index": {"_index": "everything", "_id": "9"}}'
            - '{"name": "doc9"}'
            - '{"index": {"_index": "everything", "_id": "10"}}'
            - '{"name": "doc10"}'

---
teardown:
  - do:
      security.delete_user:
        username: "test_user"
        ignore: 404

  - do:
      security.delete_role:
        name: "mixed_role"
        ignore: 404

---
"Test deleting a document when allowed":

  - do: # superuser
      search:
        rest_total_hits_as_int: true
        index: only_delete
        body: { "query": { "terms": { "_id":  [ "3", "4", "5" ] } } }
  - match: { hits.total: 3 }

  - do: # superuser
      search:
        rest_total_hits_as_int: true
        index: everything
        body: { "query": { "terms": { "_id":  [ "8", "9", "10" ] } } }
  - match: { hits.total: 3 }

  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      delete:
        index: only_delete
        id: "3"

  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      delete:
        refresh: true
        index: everything
        id: "8"

  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      bulk:
        body:
            - '{"delete": {"_index": "only_delete", "_id": "4"}}'
            - '{"delete": {"_index": "everything" , "_id": "9"}}'

  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      bulk:
        body: # The rest test won't send streaming content unless it has multiple bodies, so we send the same delete twice
            - '{"delete": {"_index": "only_delete", "_id": "5"}}'
            - '{"delete": {"_index": "only_delete", "_id": "5"}}'

  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      bulk:
        refresh: true
        body: # The rest test won't send streaming content unless it has multiple bodies, so we send the same delete twice
          - delete:
              _index: everything
              _id: "10"
          - delete:
              _index: everything
              _id: "10"

  - do: # superuser
      indices.refresh:
        index: only_delete

  - do: # superuser
      search:
        rest_total_hits_as_int: true
        index: only_delete
        body: { "query": { "terms": { "_id":  [ "3", "4", "5" ] } } }
  - match: { hits.total: 0 }

  - do: # superuser
      search:
        rest_total_hits_as_int: true
        index: everything
        body: { "query": { "terms": { "_id":  [ "8", "9", "10" ] } } }
  - match: { hits.total: 0 }

---
"Test deleting a document when not allowed":
  - do:
      catch: forbidden
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      delete:
        index: only_read
        id: "1"

  - do:
      catch: forbidden
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      delete:
        index: only_index
        id: "2"

  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      bulk:
        body:
            - '{"delete": {"_index": "only_read" , "_id": "1"}}'
            - '{"delete": {"_index": "only_index", "_id": "2"}}'

  - match: { errors: true }
  - match: { items.0.delete.status: 403 }
  - match: { items.0.delete.error.type: "security_exception" }
  - match: { items.1.delete.status: 403 }
  - match: { items.1.delete.error.type: "security_exception" }

  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      bulk:
        body: # The rest test won't send streaming content unless it has multiple bodies, so we send the same delete twice
            - '{"delete": {"_index": "only_read" , "_id": "1"}}'
            - '{"delete": {"_index": "only_read" , "_id": "1"}}'

  - match: { errors: true }
  - match: { items.0.delete.status: 403 }
  - match: { items.0.delete.error.type: "security_exception" }
  - match: { items.1.delete.status: 403 }
  - match: { items.1.delete.error.type: "security_exception" }

  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      bulk:
        body: # The rest test won't send streaming content unless it has multiple bodies, so we send the same delete twice
            - '{"delete": {"_index": "only_index", "_id": "2"}}'
            - '{"delete": {"_index": "only_index", "_id": "2"}}'

  - match: { errors: true }
  - match: { items.0.delete.status: 403 }
  - match: { items.0.delete.error.type: "security_exception" }
  - match: { items.1.delete.status: 403 }
  - match: { items.1.delete.error.type: "security_exception" }

  - do: # superuser
      indices.refresh:
        index: only_read,only_index

  - do: # superuser
      search:
        rest_total_hits_as_int: true
        index: only_read

  - match: { hits.total: 1 }

  - do: # superuser
      search:
        rest_total_hits_as_int: true
        index: only_index

  - match: { hits.total: 1 }

---
"Test bulk delete documents when only some are allowed":
  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      bulk:
        body:
            - '{"delete": {"_index": "only_read"  , "_id": "1"}}'
            - '{"delete": {"_index": "only_delete", "_id": "6"}}'
  - match: { errors: true }
  - match: { items.0.delete.status: 403 }
  - match: { items.0.delete.error.type: "security_exception" }
  - match: { items.1.delete.status: 200 }

  - do: # superuser
      indices.refresh:
        index: only_read,only_delete

  - do: # superuser
      search:
        rest_total_hits_as_int: true
        index: only_read
        body: { "query": { "term": { "_id": "1" } } }
  - match: { hits.total: 1 }

  - do: # superuser
      search:
        rest_total_hits_as_int: true
        index: only_delete
        body: { "query": { "term": { "_id": "6" } } }
  - match: { hits.total: 0 }

---
"Test bulk delete and index documents when only some are allowed":
  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      bulk:
        body:
            - '{"index" : {"_index": "only_delete", "_id": "11"}}'
            - '{"name"  : "doc11"}'
            - '{"delete": {"_index": "only_delete", "_id": "7"}}'
            - '{"index" : {"_index": "only_index", "_id": "12"}}'
            - '{"name"  : "doc12"}'
            - '{"delete": {"_index": "only_index", "_id": "2"}}'
  - match: { errors: true }
  - match: { items.0.index.status: 403 }
  - match: { items.0.index.error.type: "security_exception" }
  - match: { items.1.delete.status: 200 }
  - match: { items.2.index.status: 201 }
  - match: { items.3.delete.status: 403 }
  - match: { items.3.delete.error.type: "security_exception" }

  - do: # superuser
      indices.refresh:
        index: only_delete,only_index

  - do: # superuser
      search:
        rest_total_hits_as_int: true
        index: only_delete
        body: { "query": { "terms": { "_id":  [ "11", "7" ] } } }
        # 11 wasn't created, 7 was deleted
  - match: { hits.total: 0 }

  - do: # superuser
      search:
        rest_total_hits_as_int: true
        index: only_index
        body: { "query": { "terms": { "_id":  [ "12", "2" ] } } }
        # 12 was created, 2 wasn't deleted
  - match: { hits.total: 2 }
