---
setup:
  - skip:
      features: [headers, catch_unauthorized]
  - do:
      cluster.health:
        wait_for_status: yellow

  - do:
      security.put_user:
        username: "joe"
        body:  >
            {
              "password": "s3krit-password",
              "roles" : [ "superuser" ]
            }

---
teardown:
  - do:
      security.delete_user:
        username: "joe"
        ignore: 404

---
"Test disable then enable user":
  - do:
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      cluster.health: {}
  - match: { timed_out: false }

# disable the user
  - do:
      security.disable_user:
        username: "joe"

# validate user cannot login
  - do:
      catch: unauthorized
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      cluster.health: {}

# enable the user
  - do:
      security.enable_user:
        username: "joe"

# validate that the user can login again
  - do:
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      cluster.health: {}
  - match: { timed_out: false }

---
"Test enabling already enabled user":
# check that the user works
  - do:
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      cluster.health: {}
  - match: { timed_out: false }

# enable the user
  - do:
      security.enable_user:
        username: "joe"

# validate that the user still works
  - do:
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      cluster.health: {}
  - match: { timed_out: false }

---
"Test disabling already disabled user":
# check that the user works
  - do:
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      cluster.health: {}
  - match: { timed_out: false }

# disable the user
  - do:
      security.disable_user:
        username: "joe"

# validate user cannot login
  - do:
      catch: unauthorized
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      cluster.health: {}

# disable again
  - do:
      security.disable_user:
        username: "joe"

  - do:
      security.enable_user:
        username: "joe"

---
"Test disabling yourself":
# check that the user works
  - do:
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      cluster.health: {}
  - match: { timed_out: false }

# try to disable yourself
  - do:
      catch: '/users may not update the enabled status of their own account/'
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      security.disable_user:
        username: "joe"
