setup:
  - skip:
      features: headers
---
"Reindex as same user works":

  - do:
      index:
        index:   source
        id:      "1"
        body:    { "text": "test" }
  - do:
      indices.refresh: {}

  - do:
      reindex:
        body:
          source:
            index: source
          dest:
            index: dest
  - match: {created: 1}

---
"Reindex with runas user works":

  - do:
      index:
        index:   source
        id:      "1"
        body:    { "text": "test" }
  - do:
      indices.refresh: {}

  - do:
      headers: {es-security-runas-user: powerful_user}
      reindex:
        refresh: true
        body:
          source:
            index: source
          dest:
            index: dest
  - match: {created: 1}

  - do:
      search:
        rest_total_hits_as_int: true
        index: dest
        body:
          query:
            match:
              text: test
  - match: { hits.total: 1 }

---
"Reindex with runas user with minimal privileges works":

  - do:
      index:
        index:   source
        id:      "1"
        body:    { "text": "test" }
  - do:
      indices.refresh: {}

  - do:
      headers: {es-security-runas-user: minimal_user}
      reindex:
        refresh: true
        body:
          source:
            index: source
          dest:
            index: dest
  - match: {created: 1}

  - do:
      search:
        rest_total_hits_as_int: true
        index: dest
        body:
          query:
            match:
              text: test
  - match: { hits.total: 1 }

---
"Reindex as readonly user is forbidden":

  - do:
      index:
        index:   source
        id:      "1"
        body:    { "text": "test" }
  - do:
      indices.refresh: {}

  - do:
      headers: {es-security-runas-user: readonly_user}
      catch: forbidden
      reindex:
        body:
          source:
            index: source
          dest:
            index: dest

---
"Reindex as user that can't read from the source is forbidden":

  - do:
      index:
        index:   source
        id:      "1"
        body:    { "text": "test" }
  - do:
      indices.refresh: {}

  - do:
      headers: {es-security-runas-user: dest_only_user}
      catch: forbidden
      reindex:
        body:
          source:
            index: source
          dest:
            index: dest

---
"Using a script to write to an index to which you don't have access is forbidden":
  - do:
      index:
        index:        source
        id:           "1"
        body:         { "user": "kimchy" }
  - do:
      index:
        index:        source
        id:           "2"
        body:         { "user": "another" }
  - do:
      indices.refresh: {}

  - do:
      headers: {es-security-runas-user: minimal_user}
      catch: forbidden
      reindex:
        body:
          source:
            index: source
          dest:
            index: dest
          script:
            source: if (ctx._source.user == "kimchy") {ctx._index = 'other_dest'}

  - do:
      indices.refresh: {}

  # The index to which the user tried the unauthorized write didn't even get created
  - do:
      catch: missing
      search:
        rest_total_hits_as_int: true
        index: other_dest

  - do:
      search:
        rest_total_hits_as_int: true
        index: dest
  - length:   { hits.hits: 1  }
  - match: { hits.hits.0._index: dest }

---
"Reindex misses hidden docs":

  - do:
      index:
        index:   source
        id:      "1"
        body:    { "text": "test" }
  - do:
      index:
        index:   source
        id:      "2"
        body:    { "text": "test", "hidden": true }
  - do:
      indices.refresh: {}

  - do:
      headers: {es-security-runas-user: can_not_see_hidden_docs_user}
      reindex:
        refresh: true
        body:
          source:
            index: source
          dest:
            index: dest
  - match: {created: 1}

  # We copied just one doc, presumably the one without the hidden field
  - do:
      search:
        rest_total_hits_as_int: true
        index: dest
        body:
          query:
            match:
              text: test
  - match: { hits.total: 1 }

  # We didn't copy the doc with the hidden field
  - do:
      search:
        rest_total_hits_as_int: true
        index: dest
        body:
          query:
            match:
              hidden: true
  - match: { hits.total: 0 }

---
"Reindex misses hidden fields":

  - do:
      index:
        index:   source
        id:      "1"
        body:    { "text": "test", "foo": "z", "bar": "z" }
  - do:
      indices.refresh: {}

  - do:
      headers: {es-security-runas-user: can_not_see_hidden_fields_user}
      reindex:
        refresh: true
        body:
          source:
            index: source
          dest:
            index: dest
  - match: {created: 1}

  - do:
      search:
        rest_total_hits_as_int: true
        index: dest
        body:
          query:
            match:
              foo: z
  - match: { hits.total: 1 }

  - do:
      search:
        rest_total_hits_as_int: true
        index: dest
        body:
          query:
            match:
              bar: z
  - match: { hits.total: 1 }

  - do:
      search:
        rest_total_hits_as_int: true
        index: dest
        body:
          query:
            match:
              text: test
  - match: { hits.total: 0 }

---
"Reindex to index with document level security is forbidden":

  - do:
      index:
        index:   dest
        id:      "1"
        body:    { "text": "test" }
  - do:
      indices.refresh: {}

  - do:
      headers: {es-security-runas-user: can_not_see_hidden_docs_user}
      reindex:
        body:
          source:
            index: dest
          dest:
            index: source

---
"Reindex to index with field level security is forbidden":

  - do:
      index:
        index:   dest
        id:      "1"
        body:    { "text": "test" }
  - do:
      indices.refresh: {}

  - do:
      headers: {es-security-runas-user: can_not_see_hidden_fields_user}
      reindex:
        body:
          source:
            index: dest
          dest:
            index: source

---
"Reindex wait_for_completion=false as minimal with task API":

  - do:
      index:
        index:   source
        id:      "1"
        body:    { "text": "test" }
  - do:
      indices.refresh: {}

  - do:
      headers: {es-security-runas-user: minimal_with_task_user}
      reindex:
        refresh: true
        wait_for_completion: false
        body:
          source:
            index: source
          dest:
            index: dest
  - set: {task: task}

  - do:
      headers: {es-security-runas-user: minimal_with_task_user}
      tasks.get:
        wait_for_completion: true
        task_id: $task
  - match: {response.created: 1}

  - do:
      search:
        index: dest
        rest_total_hits_as_int: true
        body:
          query:
            match:
              text: test
  - match: { hits.total: 1 }

  # the minimal user doesn't have permission to read the tasks API
  - do:
      headers: {es-security-runas-user: minimal_user}
      catch: forbidden
      tasks.get:
        task_id: $task
