---
setup:
  - skip:
      features: ["headers", "allowed_warnings"]

  - do:
      indices.create:
        index: shared_logs

  - do:
      cluster.health:
        wait_for_status: yellow
  - do:
      ingest.put_pipeline:
        id: "my_pipeline"
        body:  >
          {
            "processors": [
             {
                "set_security_user" : {
                  "field" : "user"
                }
              }
            ]
          }
  - do:
      security.put_user:
        username: "joe"
        body:  >
            {
              "password": "x-pack-test-password",
              "roles" : [ "small_companies_role" ],
              "metadata" : {
                "customer_id" : "1"
              }
            }
  - do:
      security.put_user:
        username: "john"
        body:  >
            {
              "password": "x-pack-test-password",
              "roles" : [ "small_companies_role" ],
              "metadata" : {
                "customer_id" : "2"
              }
            }

---
teardown:
  - do:
      security.delete_user:
        username: "joe"
        ignore: 404
  - do:
      security.delete_user:
        username: "john"
        ignore: 404
  - do:
      security.delete_role:
        name: "small_companies_role"
        ignore: 404

---
"Test shared index separating user by using DLS role query with user's username":
  - do:
      security.put_role:
        name: "small_companies_role"
        body:  >
            {
              "indices": [
                {
                  "names": "shared_logs",
                  "privileges": ["read", "create"],
                  "query" : {
                    "template" : {
                      "source" : {
                        "term" : { "user.username" : "{{_user.username}}" }
                      }
                    }
                  }
                }
              ]
            }

  - do:
      allowed_warnings:
        - "the index privilege [create] allowed the update mapping action [indices:admin/mapping/auto_put] on index [shared_logs], this privilege will not permit mapping updates in the next major release - users who require access to update mappings must be granted explicit privileges"
      headers:
        Authorization: "Basic am9lOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      index:
        index: shared_logs
        pipeline: "my_pipeline"
        body:  >
          {
            "log": "Joe's first log entry"
          }
  - do:
      headers:
        Authorization: "Basic am9objp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      index:
        index: shared_logs
        pipeline: "my_pipeline"
        body:  >
          {
            "log": "John's first log entry"
          }

  - do:
      indices.refresh:
        index: shared_logs

  # Joe searches:
  - do:
      headers:
        Authorization: "Basic am9lOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      search:
        rest_total_hits_as_int: true
        index: shared_logs
        body: { "query" : { "match_all" : {} } }
  - match: { hits.total: 1}
  - match: { hits.hits.0._source.user.username: joe}

  # John searches:
  - do:
      headers:
        Authorization: "Basic am9objp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      search:
        rest_total_hits_as_int: true
        index: shared_logs
        body: { "query" : { "match_all" : {} } }
  - match: { hits.total: 1}
  - match: { hits.hits.0._source.user.username: john}

---
"Test shared index separating user by using DLS role query with user's metadata":
  - do:
      security.put_role:
        name: "small_companies_role"
        body:  >
            {
              "indices": [
                {
                  "names": "shared_logs",
                  "privileges": ["read", "create"],
                  "query" : {
                    "template" : {
                      "source" : {
                        "term" : { "user.metadata.customer_id" : "{{_user.metadata.customer_id}}" }
                      }
                    }
                  }
                }
              ]
            }

  - do:
      allowed_warnings:
        - "the index privilege [create] allowed the update mapping action [indices:admin/mapping/auto_put] on index [shared_logs], this privilege will not permit mapping updates in the next major release - users who require access to update mappings must be granted explicit privileges"
      headers:
        Authorization: "Basic am9lOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      index:
        index: shared_logs
        pipeline: "my_pipeline"
        body:  >
          {
            "log": "Joe's first log entry"
          }
  - do:
      headers:
        Authorization: "Basic am9objp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      index:
        index: shared_logs
        pipeline: "my_pipeline"
        body:  >
          {
            "log": "John's first log entry"
          }

  - do:
      indices.refresh:
        index: shared_logs

  # Joe searches:
  - do:
      headers:
        Authorization: "Basic am9lOngtcGFjay10ZXN0LXBhc3N3b3Jk"
      search:
        rest_total_hits_as_int: true
        index: shared_logs
        body: { "query" : { "match_all" : {} } }
  - match: { hits.total: 1}
  - match: { hits.hits.0._source.user.username: joe}

  # John searches:
  - do:
      headers:
        Authorization: "Basic am9objp4LXBhY2stdGVzdC1wYXNzd29yZA=="
      search:
        rest_total_hits_as_int: true
        index: shared_logs
        body: { "query" : { "match_all" : {} } }
  - match: { hits.total: 1}
  - match: { hits.hits.0._source.user.username: john}
