setup:
  - requires:
      cluster_features: ["gte_v8.1.0"]
      reason: _tsid support introduced in 8.1.0

  - do:
      indices.create:
          index: test
          body:
            settings:
              index:
                mode: time_series
                routing_path: [ metricset, k8s.pod.uid ]
                time_series:
                  start_time: 2021-04-28T00:00:00Z
                  end_time: 2021-04-29T00:00:00Z
            mappings:
              properties:
                "@timestamp":
                  type: date
                metricset:
                  type: keyword
                  time_series_dimension: true
                k8s:
                  properties:
                    pod:
                      properties:
                        uid:
                          type: keyword
                          time_series_dimension: true
                        name:
                          type: keyword
                        ip:
                          type: ip
                        network:
                          properties:
                            tx:
                              type: long
                            rx:
                              type: long
  - do:
      bulk:
        refresh: true
        index: test
        body:
          - '{"index": {}}'
          - '{"@timestamp": "2021-04-28T18:50:04.467Z", "metricset": "pod", "k8s": {"pod": {"name": "cat", "uid":"947e4ced-1786-4e53-9e0c-5c447e959507", "ip": "10.10.55.1", "network": {"tx": 2001818691, "rx": 802133794}}}}'
          - '{"index": {}}'
          - '{"@timestamp": "2021-04-28T18:50:24.467Z", "metricset": "pod", "k8s": {"pod": {"name": "cat", "uid":"947e4ced-1786-4e53-9e0c-5c447e959507", "ip": "10.10.55.1", "network": {"tx": 2005177954, "rx": 801479970}}}}'
          - '{"index": {}}'
          - '{"@timestamp": "2021-04-28T18:50:44.467Z", "metricset": "pod", "k8s": {"pod": {"name": "cat", "uid":"947e4ced-1786-4e53-9e0c-5c447e959507", "ip": "10.10.55.1", "network": {"tx": 2006223737, "rx": 802337279}}}}'
          - '{"index": {}}'
          - '{"@timestamp": "2021-04-28T18:51:04.467Z", "metricset": "pod", "k8s": {"pod": {"name": "cat", "uid":"947e4ced-1786-4e53-9e0c-5c447e959507", "ip": "10.10.55.2", "network": {"tx": 2012916202, "rx": 803685721}}}}'
          - '{"index": {}}'
          - '{"@timestamp": "2021-04-28T18:50:03.142Z", "metricset": "pod", "k8s": {"pod": {"name": "dog", "uid":"df3145b3-0563-4d3b-a0f7-897eb2876ea9", "ip": "10.10.55.3", "network": {"tx": 1434521831, "rx": 530575198}}}}'
          - '{"index": {}}'
          - '{"@timestamp": "2021-04-28T18:50:23.142Z", "metricset": "pod", "k8s": {"pod": {"name": "dog", "uid":"df3145b3-0563-4d3b-a0f7-897eb2876ea9", "ip": "10.10.55.3", "network": {"tx": 1434577921, "rx": 530600088}}}}'
          - '{"index": {}}'
          - '{"@timestamp": "2021-04-28T18:50:53.142Z", "metricset": "pod", "k8s": {"pod": {"name": "dog", "uid":"df3145b3-0563-4d3b-a0f7-897eb2876ea9", "ip": "10.10.55.3", "network": {"tx": 1434587694, "rx": 530604797}}}}'
          - '{"index": {}}'
          - '{"@timestamp": "2021-04-28T18:51:03.142Z", "metricset": "pod", "k8s": {"pod": {"name": "dog", "uid":"df3145b3-0563-4d3b-a0f7-897eb2876ea9", "ip": "10.10.55.3", "network": {"tx": 1434595272, "rx": 530605511}}}}'

---
document level security on tag:
  - requires:
      cluster_features: ["gte_v8.1.0"]
      reason: _tsid support introduced in 8.1.0
      test_runner_features: headers

  - do:
      security.put_role:
        name: "limitread"
        body:  >
            {
              "indices": [
                {
                  "names": ["*"],
                  "privileges": ["read"],
                  "query": {"match": {"k8s.pod.name": "cat"}}
                }
              ]
            }

  - do:
      security.put_user:
        username: "limited"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "limitread" ],
            "full_name" : "user who can read some data"
          }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      search:
        index: test
        size: 0
        body:
          aggs:
            tsids:
              terms:
                field: _tsid

  - match: {hits.total.value: 4}
  - length: {aggregations.tsids.buckets: 1}
  - match: {aggregations.tsids.buckets.0.key: "KCjEJ9R_BgO8TRX2QOd6dpR12oDh--qoyNZRQPy43y34Qdy2dpsyG0o"}
  - match: {aggregations.tsids.buckets.0.doc_count: 4}

---
document level security on dimension:
  - requires:
      cluster_features: ["gte_v8.12.0"]
      reason: _tsid support introduced in 8.1.0
      test_runner_features: headers

  - do:
      security.put_role:
        name: "limitread"
        body:  >
            {
              "indices": [
                {
                  "names": ["*"],
                  "privileges": ["read"],
                  "query": {"match": {"k8s.pod.uid": "947e4ced-1786-4e53-9e0c-5c447e959507"}}
                }
              ]
            }

  - do:
      security.put_user:
        username: "limited"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "limitread" ],
            "full_name" : "user who can read some data"
          }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      search:
        index: test
        size: 0
        body:
          aggs:
            tsids:
              terms:
                field: _tsid

  - match: { hits.total.value: 4 }
  - length: { aggregations.tsids.buckets: 1 }
  - match: {aggregations.tsids.buckets.0.key: "KCjEJ9R_BgO8TRX2QOd6dpR12oDh--qoyNZRQPy43y34Qdy2dpsyG0o"}
  - match: {aggregations.tsids.buckets.0.doc_count: 4}

---
document level security on tsid is not possible:
  - requires:
      cluster_features: ["gte_v8.1.0"]
      reason: _tsid support introduced in 8.1.0
      test_runner_features: headers

  # It'd be better if this failed immediately but security doesn't build the
  # query until you use it on an index.
  - do:
      security.put_role:
        name: "limitread"
        body:  >
            {
              "indices": [
                {
                  "names": ["*"],
                  "privileges": ["read"],
                  "query": {"match": {"_tsid": "doesn't work"}}
                }
              ]
            }

  - do:
      security.put_user:
        username: "limited"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "limitread" ],
            "full_name" : "user who's role is broken"
          }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      catch: /Field \[_tsid\] of type \[_tsid\] does not support match queries/
      search:
        index: test
        size: 0
        body:
          aggs:
            tsids:
              terms:
                field: _tsid

---
create_doc permission can create:
  - requires:
      cluster_features: ["gte_v8.1.0"]
      reason: _tsid support introduced in 8.1.0
      test_runner_features: headers

  - do:
      security.put_role:
        name: "createonly"
        body:  >
          {
            "indices": [
              {
                "names": ["*"],
                "privileges": ["create_doc"]
              }
            ]
          }

  - do:
      security.put_user:
        username: "limited"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "createonly" ],
            "full_name" : "user who can only create docs"
          }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      bulk:
        index: test
        body:
          - '{"create": {}}'
          - '{"@timestamp": "2021-04-28T22:50:04.467Z", "metricset": "pod", "k8s": {"pod": {"name": "cat", "uid":"947e4ced-1786-4e53-9e0c-5c447e959507", "ip": "10.10.55.1", "network": {"tx": 2001818691, "rx": 802133794}}}}'
  - match: { items.0.create._version: 1 }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      index:
        index: test
        body:
          "@timestamp": "2021-04-28T23:51:03.142Z"
          metricset: pod
          k8s:
            pod:
              name: dog
              uid: df3145b3-0563-4d3b-a0f7-897eb2876ea9
              ip: 10.10.55.3
              network:
                tx: 111434595272
                rx: 430605511
  - match: { _version: 1 }

  - do: # superuser
      indices.refresh:
        index: test
  - do:
      search:
        index: test
    # Original 8 docs ("setup") + 2 more (above)
  - match: { hits.total.value: 10 }
  - match: { hits.total.relation: "eq" }

---
create_doc permission can't overwrite:
  - requires:
      cluster_features: ["gte_v8.1.0"]
      reason: _tsid support introduced in 8.1.0
      test_runner_features: headers

  - do:
      security.put_role:
        name: "createonly"
        body:  >
          {
            "indices": [
              {
                "names": ["*"],
                "privileges": ["create_doc"]
              }
            ]
          }

  - do:
      security.put_user:
        username: "limited"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "createonly" ],
            "full_name" : "user who can only create docs"
          }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      bulk:
        index: test
        body:
          - '{"index": {}}'
          - '{"@timestamp": "2021-04-28T18:50:04.467Z", "metricset": "pod", "k8s": {"pod": {"name": "cat", "uid":"947e4ced-1786-4e53-9e0c-5c447e959507", "ip": "10.10.55.1", "network": {"tx": 2001818691, "rx": 802133794}}}}'
  - match: { items.0.index.error.reason: "/is\\ unauthorized\\ for\\ user\\ \\[limited\\]/" }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      catch: "/is\ unauthorized\ for\ user\ \\[limited\\]/"
      index:
        index: test
        op_type: index
        body:
          "@timestamp": "2021-04-28T18:51:03.142Z"
          metricset: pod
          k8s:
            pod:
              name: dog
              uid: df3145b3-0563-4d3b-a0f7-897eb2876ea9
              ip: 10.10.55.3
              network:
                tx: 111434595272
                rx: 430605511

  - do: # superuser
      indices.refresh:
        index: test
  - do:
      search:
        index: test
    # Original 8 docs ("setup") but no more (above)
  - match: { hits.total.value: 8 }
  - match: { hits.total.relation: "eq" }

---
index permission can create:
  - requires:
      cluster_features: ["gte_v8.1.0"]
      reason: _tsid support introduced in 8.1.0
      test_runner_features: headers

  - do:
      security.put_role:
        name: "indexonly"
        body:  >
          {
            "indices": [
              {
                "names": ["*"],
                "privileges": ["index"]
              }
            ]
          }

  - do:
      security.put_user:
        username: "limited"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "indexonly" ],
            "full_name" : "user who can only index docs"
          }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      bulk:
        index: test
        body:
          - '{"create": {}}'
          - '{"@timestamp": "2021-04-28T22:50:04.467Z", "metricset": "pod", "k8s": {"pod": {"name": "cat", "uid":"947e4ced-1786-4e53-9e0c-5c447e959507", "ip": "10.10.55.1", "network": {"tx": 2001818691, "rx": 802133794}}}}'
  - match: { items.0.create._version: 1 }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      index:
        index: test
        body:
          "@timestamp": "2021-04-28T23:51:03.142Z"
          metricset: pod
          k8s:
            pod:
              name: dog
              uid: df3145b3-0563-4d3b-a0f7-897eb2876ea9
              ip: 10.10.55.3
              network:
                tx: 111434595272
                rx: 430605511
  - match: { _version: 1 }

  - do: # superuser
      indices.refresh:
        index: test
  - do:
      search:
        index: test
    # Original 8 docs ("setup") + 2 more (above)
  - match: { hits.total.value: 10 }
  - match: { hits.total.relation: "eq" }

---
index permission can overwrite:
  - requires:
      cluster_features: ["gte_v8.1.0"]
      reason: _tsid support introduced in 8.1.0
      test_runner_features: headers

  - do:
      security.put_role:
        name: "indexonly"
        body:  >
          {
            "indices": [
              {
                "names": ["*"],
                "privileges": ["index"]
              }
            ]
          }

  - do:
      security.put_user:
        username: "limited"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "indexonly" ],
            "full_name" : "user who can only index docs"
          }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      bulk:
        index: test
        body:
          - '{"index": {}}'
          - '{"@timestamp": "2021-04-28T18:50:04.467Z", "metricset": "pod", "k8s": {"pod": {"name": "cat", "uid":"947e4ced-1786-4e53-9e0c-5c447e959507", "ip": "10.10.55.1", "network": {"tx": 2001818691, "rx": 802133794}}}}'
  - match: { items.0.index._version: 2 }

  - do:
      headers: { Authorization: "Basic bGltaXRlZDp4LXBhY2stdGVzdC1wYXNzd29yZA==" } # limited - user
      index:
        index: test
        op_type: index
        body:
          "@timestamp": "2021-04-28T18:51:03.142Z"
          metricset: pod
          k8s:
            pod:
              name: dog
              uid: df3145b3-0563-4d3b-a0f7-897eb2876ea9
              ip: 10.10.55.3
              network:
                tx: 111434595272
                rx: 430605511
  - match: { _version: 2 }

  - do: # superuser
      indices.refresh:
        index: test
  - do:
      search:
        index: test
    # Original 8 docs ("setup") even though 2 have been overwritten (above)
  - match: { hits.total.value: 8 }
  - match: { hits.total.relation: "eq" }
