elasticsearch-api 7.13.3 → 8.14.0

data/spec/platinum/integration/api_key/api_key_invalidation_spec.rb

@@ -0,0 +1,105 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'base64'
+require_relative '../platinum_helper'
+
+describe 'API keys API invalidation' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: {
+        cluster: ['manage_api_key']
+      }
+    )
+    ADMIN_CLIENT.security.put_role(
+      name: 'user_role',
+      body: {
+        cluster: ['manage_own_api_key']
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_manager',
+      body: {
+        password: 'changeme',
+        roles: [ 'admin_role' ],
+        full_name: 'API key manager'
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_test_user1',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user'
+      }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_role(name: "user_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user1", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_manager", ignore: 404)
+  end
+
+  let(:credentials) { Base64.strict_encode64("api_key_manager:changeme") }
+
+  let(:client) do
+    Elasticsearch::Client.new(
+      host: HOST,
+      transport_options: TRANSPORT_OPTIONS.merge(headers: { Authorization: "Basic #{credentials}" })
+    )
+  end
+
+  it 'invalidates by realm name' do
+    response = client.security.create_api_key(
+      body: {
+        name: "manager-api-key",
+        expiration: "1d",
+        role_descriptors: {}
+      }
+    )
+    expect(response['name']).to eq 'manager-api-key'
+    id = response['id']
+    expect(id).not_to be nil
+    expect(response['api_key']).not_to be nil
+    expect(response['expiration']).not_to be nil
+
+    user_credentials = Base64.strict_encode64('api_key_test_user1:x-pack-test-password')
+    user_client = Elasticsearch::Client.new(
+      host: HOST,
+      transport_options: TRANSPORT_OPTIONS.merge(headers: { Authentication: "Basic #{user_credentials}" })
+    )
+    response = user_client.security.create_api_key(
+      body: {
+        name: "user1-api-key",
+        expiration: "1d",
+        role_descriptors: {}
+      }
+    )
+    expect(response['name']).to eq 'user1-api-key'
+    id = response['id']
+    expect(id).not_to be nil
+    expect(response['api_key']).not_to be nil
+    expect(response['expiration']).not_to be nil
+
+    response = client.security.invalidate_api_key(body: { realm_name: 'default_native'})
+    expect(response['invalidated_api_keys'].count).to be >= 2
+    expect(response['error_count']).to eq 0
+  end
+end

data/spec/platinum/integration/api_key/api_key_query_spec.rb

@@ -0,0 +1,149 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require_relative '../platinum_helper'
+
+describe 'API keys' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: { cluster: ['manage_api_key'] }
+    )
+    ADMIN_CLIENT.security.put_role(
+      name: 'user_role',
+      body: {
+        cluster: ['manage_own_api_key'],
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_manager',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'admin_role' ],
+        full_name: 'API key manager'
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user_1',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user 1'
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user_2',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user 2'
+      }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_role(name: "user_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user_1", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user_2", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_manager", ignore: 404)
+  end
+
+  def client(headers)
+    Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS.merge(headers: headers)
+    )
+  end
+
+  let(:manager_auth) do
+    { Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" }
+  end
+  let(:user1_auth) do
+    { Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" }
+  end
+  let(:user2_auth) do
+    { Authorization: "Basic YXBpX2tleV91c2VyXzI6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" }
+  end
+
+  it 'queries api key' do
+    # api_key_manager authorization:
+    client = client(manager_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'manager-api-key',
+        expiration: '10d',
+        metadata: {
+          letter: 'a',
+          number: 42
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    manager_key_id = response['id']
+
+    # api_key_user1 authorization:
+    client = client(user1_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'user1-api-key',
+        expiration: '1d',
+        metadata: {
+          letter: 'a',
+          number: 1
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    user1_key_id = response['id']
+
+    # api_key_user2 authorization
+    client = client(user2_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'user2-api-key',
+        expiration: '1d',
+        metadata: {
+          letter: 'b',
+          number: 42
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    user1_key_id = response['id']
+
+    client = client(manager_auth)
+    response = client.security.query_api_keys
+    expect(response.status).to eq 200
+    manager_total = response['total']
+    expect(manager_total).to be >= 3
+
+    client = client(user1_auth)
+    response = client.security.query_api_keys
+    expect(response.status).to eq 200
+    user_1_total = response['total']
+    expect(user_1_total).to be >= 1
+    expect(user_1_total).to be < manager_total
+
+    client = client(user2_auth)
+    response = client.security.query_api_keys
+    expect(response.status).to eq 200
+    user_2_total = response['total']
+    expect(user_2_total).to be >= 1
+    expect(user_2_total).to be < manager_total
+  end
+end

data/spec/platinum/integration/api_key/api_key_query_with_aggs_spec.rb

@@ -0,0 +1,120 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require_relative '../platinum_helper'
+
+describe 'API keys' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: { cluster: ['manage_api_key'] }
+    )
+    ADMIN_CLIENT.security.put_role(
+      name: 'user_role',
+      body: {
+        cluster: ['manage_own_api_key'],
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_manager',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'admin_role' ],
+        full_name: 'API key manager'
+      }
+    )
+
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user'
+      }
+    )
+  end
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_role(name: "user_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_manager", ignore: 404)
+  end
+
+  def client(headers)
+    Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS.merge(headers: headers)
+    )
+  end
+
+  let(:manager_auth) do
+    { Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" }
+  end
+  let(:user_auth) do
+    { Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" }
+  end
+
+  it 'queries api key with args' do
+    # api_key_manager authorization:
+    client = client(manager_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'manager-api-key',
+        expiration: '10d',
+        metadata: {
+          letter: 'a',
+          number: 42
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    id = response['id']
+    api_key = response['api_key']
+    expect(response['encoded']).to eq Base64.strict_encode64("#{id}:#{api_key}")
+
+    client = client(user_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'user-api-key',
+        expiration: '1d',
+        metadata: {
+          letter: 'a',
+          number: 1
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    id = response['id']
+    api_key = response['api_key']
+    expect(response['encoded']).to eq Base64.strict_encode64("#{id}:#{api_key}")
+
+    response = client.security.query_api_keys(
+      body: {
+        size: 0,
+        aggs: {
+          my_buckets: {
+            composite: {
+              sources: [{ key_name: { terms: { field: "name" } } } ]
+            }
+          }
+        }
+      }
+    )
+    expect(response.dig('aggregations', 'my_buckets', 'buckets').find { |a| a.dig('key', 'key_name') == 'manager-api-key'})
+    expect(response.dig('aggregations', 'my_buckets', 'buckets').find { |a| a.dig('key', 'key_name') == 'user-api-key'})
+  end
+end

data/spec/platinum/integration/api_key/api_key_spec.rb

@@ -0,0 +1,156 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'base64'
+require_relative '../platinum_helper'
+
+describe 'API keys' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: {
+        cluster: ['manage_api_key'],
+        indices: [
+          {
+            names: '*',
+            privileges: ['all']
+          }
+        ],
+        applications: [
+          {
+            application: 'myapp',
+            privileges: ['*'],
+            resources: ['*']
+          }
+        ]
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user',
+      body: {
+        password: 'test-password',
+        roles: [ 'admin_role' ],
+        full_name: 'API key user'
+      }
+    )
+    ADMIN_CLIENT.security.put_privileges(
+      body:
+        {
+          myapp: {
+            read: {
+              application: 'myapp',
+              name: 'read',
+              actions: [ 'data:read/*' ]
+            },
+            write: {
+              application: 'myapp',
+              name: 'write',
+              actions: [ 'data:write/*' ]
+            }
+          }
+        }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user", ignore: 404)
+    ADMIN_CLIENT.security.delete_privileges(application: 'myapp', name: "read,write", ignore: 404)
+  end
+
+  let(:credentials) { Base64.strict_encode64("api_key_user:test-password") }
+  let(:client) do
+    Elasticsearch::Client.new(
+      host: HOST,
+      transport_options: TRANSPORT_OPTIONS.merge(headers: { Authorization: "Basic #{credentials}" })
+    )
+  end
+
+  it 'creates api key' do
+    response = client.security.create_api_key(
+      body: {
+        name: "my-api-key",
+        expiration: "1d",
+        role_descriptors: {
+          'role-a' => {
+            cluster: ["all"],
+            index: [
+              {
+                names: ["index-a"],
+                privileges: ["read"]
+              }
+            ]
+          },
+          'role-b' => {
+            cluster: ["manage"],
+            index: [
+              {
+                names: ["index-b"],
+                privileges: ["all"]
+              }
+            ]
+          }
+        }
+      }
+    )
+    expect(response['name']).to eq 'my-api-key'
+    id = response['id']
+    expect(id).not_to be nil
+    expect(response['api_key']).not_to be nil
+    expect(response['expiration']).not_to be nil
+    credentials = Base64.strict_encode64("#{response['id']}:#{response['api_key']}")
+    expect(credentials).to eq response['encoded']
+    new_client = Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS,
+      api_key: credentials
+    )
+    response = new_client.security.authenticate
+    expect(response['username']).to eq 'api_key_user'
+    expect(response['roles'].length).to eq 0
+    expect(response['authentication_realm']['name']).to eq '_es_api_key'
+    expect(response['authentication_realm']['type']).to eq '_es_api_key'
+    expect(response['api_key']['id']).to eq id
+    expect(response['api_key']['name']).to eq 'my-api-key'
+    response = ADMIN_CLIENT.security.clear_api_key_cache(ids: id)
+    expect(response['_nodes']['failed']).to eq 0
+  end
+
+  context 'Test get api key' do
+    let(:name) { 'my-api-key-2'}
+
+    it 'gets api key' do
+      response = ADMIN_CLIENT.security.create_api_key(
+        body: { name: name, expiration: '1d' }
+      )
+      expect(response['name']).to eq name
+      id = response['id']
+      expect(id).not_to be nil
+      expect(response['api_key']).not_to be nil
+      expect(response['expiration']).not_to be nil
+
+      response = ADMIN_CLIENT.security.get_api_key(id: id)
+      expect(response['api_keys'].first['id']).to eq id
+      expect(response['api_keys'].first['name']).to eq name
+      expect(response['api_keys'].first['username']).to eq 'elastic'
+      expect(response['api_keys'].first['invalidated']).to eq false
+      expect(response['api_keys'].first['creation']).not_to be nil
+      response = ADMIN_CLIENT.security.get_api_key(owner: true)
+      expect(response['api_keys'].length).to be > 0
+    end
+  end
+end

data/spec/platinum/integration/api_key/api_key_update_spec.rb

@@ -0,0 +1,134 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'base64'
+require_relative '../platinum_helper'
+
+describe 'API keys API' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'user_role',
+      body: {
+        cluster: ['manage_own_api_key'],
+        indices: [
+          {
+            names: '*',
+            privileges: ['all']
+          }
+        ]
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user_1',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user 1'
+      }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "user_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user_1", ignore: 404)
+  end
+
+  let(:client) do
+    Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS.merge(
+        headers: { Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" }
+      )
+    )
+  end
+
+  it 'updates api key' do
+    response = client.security.create_api_key(
+      body: {
+        name: 'user1-api-key',
+        role_descriptors: {
+          "role-a" => {
+            cluster: ["none"],
+            index: [
+              {
+                names: ["index-a"],
+                privileges: ["read"]
+              }
+            ]
+          }
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    expect(response['name']).to eq 'user1-api-key'
+    id = response['id']
+    expect(id).not_to be nil
+    expect(response['api_key']).not_to be nil
+    credentials = Base64.strict_encode64("#{response['id']}:#{response['api_key']}")
+    expect(credentials).to eq response['encoded']
+
+    new_client = Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS,
+      api_key: credentials
+    )
+    privileges_body = {
+      cluster: ['manage_own_api_key'],
+      index: [
+        {
+          names: ['index-a'],
+          privileges: ['write']
+        },
+        {
+          names: ['index-b'],
+          privileges: ['read']
+        }
+      ]
+    }
+    response = new_client.security.has_privileges(body: privileges_body)
+    expect(response['has_all_requested']).to eq false
+
+    response = client.security.update_api_key(
+      id: id,
+      body: {
+        role_descriptors: {
+          "role-a" => {
+            cluster: ["all"],
+            index: [
+              {
+                names: ["index-a"],
+                privileges: ["write"]
+              },
+              {
+                names: ["index-b"],
+                privileges: ["read"]
+              }
+            ]
+          }
+        },
+        metadata: {
+          letter: "a",
+          number: 42
+        }
+      }
+    )
+    expect(response['updated']).to eq true
+
+    response = new_client.security.has_privileges(user: nil, body: privileges_body)
+    expect(response['has_all_requested']).to eq true
+  end
+end