---
setup:
  - skip:
      features: headers

  - do:
      cluster.health:
          wait_for_status: yellow

  - do:
      security.put_role:
        name: "all_access"
        body:  >
            {
              "cluster": [ "all" ],
              "indices": [
                { "names": ["*"], "privileges": ["all"] }
              ]
            }

  - do:
      security.put_user:
        username: "test_user"
        body:  >
          {
            "password" : "x-pack-test-password",
            "roles" : [ "all_access" ],
            "full_name" : "user with all possible privileges (but not superuser)"
          }

---
teardown:
  - do:
      security.delete_user:
        username: "test_user"
        ignore: 404

  - do:
      security.delete_role:
        name: "all_access"
        ignore: 404

---
"Test get security tokens index metadata":

  - do:
      security.get_token:
        body:
          grant_type: "password"
          username: "test_user"
          password: "x-pack-test-password"

  - match: { type: "Bearer" }
  - is_true: access_token
  - set: { access_token: token }
  - match: { expires_in: 1200 }
  - is_false: scope

  - do:
      catch: forbidden
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      indices.get:
        index: ".security-tokens-7"

  - do:
      catch: forbidden
      headers:
        Authorization: Bearer ${token}
      indices.get:
        index: ".security-tokens-7"

  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      indices.get:
        index: ".secu*rity*tokens-7"
  - length: { $body: 0 }

  - do:
      headers:
        Authorization: Bearer ${token}
      indices.get:
        index: ".secu*rity*tokens-7"
  - length: { $body: 0 }

---
"Test get security document":

  - do:
      security.get_token:
        body:
          grant_type: "password"
          username: "test_user"
          password: "x-pack-test-password"

  - match: { type: "Bearer" }
  - is_true: access_token
  - set: { access_token: token }
  - match: { expires_in: 1200 }
  - is_false: scope

  - do:
      catch: forbidden
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      get:
        index: ".security-tokens-7"
        id: token_${token}

  - do:
      catch: forbidden
      headers:
        Authorization: Bearer ${token}
      get:
        index: ".security-tokens-7"
        id: token_${token}

---
"Test search security tokens index":

  - do:
      security.get_token:
        body:
          grant_type: "password"
          username: "test_user"
          password: "x-pack-test-password"

  - match: { type: "Bearer" }
  - is_true: access_token
  - set: { access_token: token }
  - match: { expires_in: 1200 }
  - is_false: scope

  - do:
      catch: forbidden
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      search:
        rest_total_hits_as_int: true
        index: ".security-tokens-7"

  - do:
      catch: forbidden
      headers:
        Authorization: Bearer ${token}
      search:
        rest_total_hits_as_int: true
        index: ".security-tokens-7"

  - do:
      headers: { Authorization: "Basic dGVzdF91c2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } # test_user
      search:
        rest_total_hits_as_int: true
        index: ".secu*rity*tokens-7"
  - match: { hits.total: 0 }

  - do:
      headers:
        Authorization: Bearer ${token}
      search:
        rest_total_hits_as_int: true
        index: ".secu*rity*tokens-7"
  - match: { hits.total: 0 }

