elasticsearch-api 8.8.0 → 8.10.0

data/spec/platinum/integration/api_key/api_key_admin_user_spec.rb

@@ -0,0 +1,127 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'base64'
+require_relative '../platinum_helper'
+
+describe 'API keys' do
+  before do
+    ADMIN_CLIENT.security.put_user(
+      username: client_username,
+      body: { password: 'test-password', roles: ['superuser'] }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_user(username: client_username)
+  end
+
+  let(:client_username) { "superuser#{Time.now.to_i}"}
+
+  let(:client) do
+    Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      user: client_username,
+      password: 'test-password',
+      transport_options: TRANSPORT_OPTIONS
+    )
+  end
+
+  it 'gets api key (with role descriptors + metadata)' do
+    response = client.security.create_api_key(
+      body: {
+        name: "api-key-role",
+        expiration: "1d",
+        role_descriptors: {
+          'role-a': {
+                      cluster: ["all"],
+                      index: [
+                        {
+                          names: ["index-a"],
+                          privileges: ["read"]
+                        }
+                      ]
+                    }
+        },
+        metadata: {
+          string: "bean",
+          number: 5,
+          boolean: true
+        }
+      }
+    )
+    expect(response['name']).to eq 'api-key-role'
+    expect(response['id']).not_to be nil
+    expect(response['api_key']).not_to be nil
+    expect(response['expiration']).not_to be nil
+    api_key_id = response['id']
+    api_key_name = response['name']
+    credentials = response['encoded']
+
+    response = client.security.authenticate
+    owner_name = response['username']
+
+    response = client.security.get_api_key(id: api_key_id)
+    expect(response['api_keys'].first['id']).to eq api_key_id
+    expect(response['api_keys'].first['name']).to eq api_key_name
+    expect(response['api_keys'].first['username']).to eq owner_name
+    expect(response['api_keys'].first['invalidated']).to eq false
+    expect(response['api_keys'].first['creation']).not_to be nil
+    expect(response['api_keys'].first['metadata']['string']).to eq 'bean'
+    expect(response['api_keys'].first['metadata']['number']).to eq 5
+    expect(response['api_keys'].first['metadata']['boolean']).to eq true
+    expect(response['api_keys'].first['role_descriptors'])
+      .to eq(
+            {
+              'role-a' => {
+                'cluster' => ['all'],
+                'indices' => [
+                  {
+                    'names' => ['index-a'],
+                    'privileges' => ['read'],
+                    'allow_restricted_indices' => false
+                  }
+                ],
+                'applications' => [ ],
+                'run_as' => [ ],
+                'metadata' => { },
+                'transient_metadata' => { 'enabled' => true }
+              }
+            }
+          )
+
+    response = client.security.get_api_key(owner: true)
+    expect(response['api_keys'].length).to eq 1
+    expect(response['api_keys'].first['id']).to eq api_key_id
+    expect(response['api_keys'].first['name']).to eq api_key_name
+    expect(response['api_keys'].first['username']).to eq owner_name
+    expect(response['api_keys'].first['invalidated']).to eq false
+    expect(response['api_keys'].first['creation']).not_to be nil
+
+    client = Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      api_key: credentials,
+      transport_options: TRANSPORT_OPTIONS
+    )
+
+    response = client.security.get_api_key(id: api_key_id)
+    expect(response['api_keys'].length).to eq 1
+    expect(response['api_keys'].first['id']).to eq api_key_id
+    expect(response['api_keys'].first['name']).to eq api_key_name
+    expect(response['api_keys'].first['username']).to eq owner_name
+  end
+end

data/spec/platinum/integration/api_key/api_key_cross_cluster_spec.rb

@@ -0,0 +1,122 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'base64'
+require_relative '../platinum_helper'
+
+describe 'API keys API' do
+  let(:user) { 'admin_user' }
+  let(:password) { 'x-pack-test-password' }
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: { cluster: ['manage_security'] }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: user,
+      body: {
+        password: password,
+        roles: [ 'admin_role' ],
+        full_name: 'Admin user'
+      }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: 'admin_role', ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: user, ignore: 404)
+  end
+
+  describe 'Cross Cluster API Key' do
+    it 'updates api key' do
+      response = ADMIN_CLIENT.security.create_cross_cluster_api_key(
+        body: {
+          name: "my-cc-api-key",
+          expiration: "1d",
+          access: {
+            search: [
+              {
+                names: ["logs*"],
+                query: {
+                  term: { "category": "shared" }
+                },
+                field_security: {
+                  grant: ["*"],
+                  except: ["private"]
+                }
+              }
+            ],
+            replication: [
+              {
+                names: ["archive"],
+                allow_restricted_indices: false
+              }
+            ]
+          },
+          metadata: {
+            answer: 42,
+            tag: "dev"
+          }
+        }
+      )
+      expect(response.status).to eq 200
+      expect(response['name']).to eq 'my-cc-api-key'
+      id = response['id']
+      expect(id).not_to be nil
+      expect(response['api_key']).not_to be nil
+      expect(response['expiration']).not_to be nil
+      credentials = Base64.strict_encode64("#{response['id']}:#{response['api_key']}")
+      expect(credentials).to eq response['encoded']
+
+      new_client = Elasticsearch::Client.new(
+        host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+        transport_options: TRANSPORT_OPTIONS
+      )
+      expect do
+        new_client.security.authenticate(headers: { authorization: "ApiKey #{credentials}" })
+      end.to raise_error(Elastic::Transport::Transport::Errors::Unauthorized)
+
+      response = ADMIN_CLIENT.security.get_api_key(id: id, with_limited_by: true)
+      expect(response.status).to eq 200
+      api_key = response['api_keys'].first
+      expect(api_key['name']) == 'my-cc-api-key'
+      expect(api_key['type']) == 'cross_cluster'
+      expect(api_key['invalidated']).to be false
+      expect(api_key['metadata']).to eq({'answer' => 42, 'tag' => 'dev'})
+
+      # Tests update cc api_key
+      response = ADMIN_CLIENT.security.update_cross_cluster_api_key(
+        id: id,
+        body: {
+          access: {
+            replication: [{ names: ["archive"] }]
+          },
+          metadata: { "tag": "prod" }
+        }
+      )
+      expect(response['updated']).to be true
+
+      response = ADMIN_CLIENT.security.get_api_key(id: id, with_limited_by: true)
+      expect(response['api_keys'].length).to eq 1
+      api_key = response['api_keys'].first
+      expect(api_key['name']) == 'my-cc-api-key'
+      expect(api_key['type']) == 'cross_cluster'
+      expect(api_key['invalidated']).to be false
+      expect(api_key['metadata']).to eq({'tag' => 'prod'})
+    end
+  end
+end

data/spec/platinum/integration/api_key/api_key_invalidation_spec.rb

@@ -0,0 +1,104 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require_relative '../platinum_helper'
+
+describe 'API keys API invalidation' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: {
+        cluster: ['manage_api_key']
+      }
+    )
+    ADMIN_CLIENT.security.put_role(
+      name: 'user_role',
+      body: {
+        cluster: ['manage_own_api_key']
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_manager',
+      body: {
+        password: 'changeme',
+        roles: [ 'admin_role' ],
+        full_name: 'API key manager'
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_test_user1',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user'
+      }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_role(name: "user_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user1", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_manager", ignore: 404)
+  end
+
+  let(:credentials) { Base64.strict_encode64("api_key_manager:changeme") }
+
+  let(:client) do
+    Elasticsearch::Client.new(
+      host: HOST,
+      transport_options: TRANSPORT_OPTIONS.merge(headers: { Authorization: "Basic #{credentials}" })
+    )
+  end
+
+  it 'invalidates by realm name' do
+    response = client.security.create_api_key(
+      body: {
+        name: "manager-api-key",
+        expiration: "1d",
+        role_descriptors: {}
+      }
+    )
+    expect(response['name']).to eq 'manager-api-key'
+    id = response['id']
+    expect(id).not_to be nil
+    expect(response['api_key']).not_to be nil
+    expect(response['expiration']).not_to be nil
+
+    user_credentials = Base64.strict_encode64('api_key_test_user1:x-pack-test-password')
+    user_client = Elasticsearch::Client.new(
+      host: HOST,
+      transport_options: TRANSPORT_OPTIONS.merge(headers: { Authentication: "Basic #{user_credentials}" })
+    )
+    response = user_client.security.create_api_key(
+      body: {
+        name: "user1-api-key",
+        expiration: "1d",
+        role_descriptors: {}
+      }
+    )
+    expect(response['name']).to eq 'user1-api-key'
+    id = response['id']
+    expect(id).not_to be nil
+    expect(response['api_key']).not_to be nil
+    expect(response['expiration']).not_to be nil
+
+    response = client.security.invalidate_api_key(body: { realm_name: 'default_native'})
+    expect(response['invalidated_api_keys'].count).to be >= 2
+    expect(response['error_count']).to eq 0
+  end
+end

data/spec/platinum/integration/api_key/api_key_query_spec.rb

@@ -0,0 +1,149 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require_relative '../platinum_helper'
+
+describe 'API keys' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: { cluster: ['manage_api_key'] }
+    )
+    ADMIN_CLIENT.security.put_role(
+      name: 'user_role',
+      body: {
+        cluster: ['manage_own_api_key'],
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_manager',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'admin_role' ],
+        full_name: 'API key manager'
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user_1',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user 1'
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user_2',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user 2'
+      }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_role(name: "user_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user_1", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user_2", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_manager", ignore: 404)
+  end
+
+  def client(headers)
+    Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS.merge(headers: headers)
+    )
+  end
+
+  let(:manager_auth) do
+    { Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" }
+  end
+  let(:user1_auth) do
+    { Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" }
+  end
+  let(:user2_auth) do
+    { Authorization: "Basic YXBpX2tleV91c2VyXzI6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" }
+  end
+
+  it 'queries api key' do
+    # api_key_manager authorization:
+    client = client(manager_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'manager-api-key',
+        expiration: '10d',
+        metadata: {
+          letter: 'a',
+          number: 42
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    manager_key_id = response['id']
+
+    # api_key_user1 authorization:
+    client = client(user1_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'user1-api-key',
+        expiration: '1d',
+        metadata: {
+          letter: 'a',
+          number: 1
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    user1_key_id = response['id']
+
+    # api_key_user2 authorization
+    client = client(user2_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'user2-api-key',
+        expiration: '1d',
+        metadata: {
+          letter: 'b',
+          number: 42
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    user1_key_id = response['id']
+
+    client = client(manager_auth)
+    response = client.security.query_api_keys
+    expect(response.status).to eq 200
+    manager_total = response['total']
+    expect(manager_total).to be >= 3
+
+    client = client(user1_auth)
+    response = client.security.query_api_keys
+    expect(response.status).to eq 200
+    user_1_total = response['total']
+    expect(user_1_total).to be >= 1
+    expect(user_1_total).to be < manager_total
+
+    client = client(user2_auth)
+    response = client.security.query_api_keys
+    expect(response.status).to eq 200
+    user_2_total = response['total']
+    expect(user_2_total).to be >= 1
+    expect(user_2_total).to be < manager_total
+  end
+end

data/spec/platinum/integration/api_key/api_key_spec.rb

@@ -0,0 +1,156 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'base64'
+require_relative '../platinum_helper'
+
+describe 'API keys' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: {
+        cluster: ['manage_api_key'],
+        indices: [
+          {
+            names: '*',
+            privileges: ['all']
+          }
+        ],
+        applications: [
+          {
+            application: 'myapp',
+            privileges: ['*'],
+            resources: ['*']
+          }
+        ]
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user',
+      body: {
+        password: 'test-password',
+        roles: [ 'admin_role' ],
+        full_name: 'API key user'
+      }
+    )
+    ADMIN_CLIENT.security.put_privileges(
+      body:
+        {
+          myapp: {
+            read: {
+              application: 'myapp',
+              name: 'read',
+              actions: [ 'data:read/*' ]
+            },
+            write: {
+              application: 'myapp',
+              name: 'write',
+              actions: [ 'data:write/*' ]
+            }
+          }
+        }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user", ignore: 404)
+    ADMIN_CLIENT.security.delete_privileges(application: 'myapp', name: "read,write", ignore: 404)
+  end
+
+  let(:credentials) { Base64.strict_encode64("api_key_user:test-password") }
+  let(:client) do
+    Elasticsearch::Client.new(
+      host: HOST,
+      transport_options: TRANSPORT_OPTIONS.merge(headers: { Authorization: "Basic #{credentials}" })
+    )
+  end
+
+  it 'creates api key' do
+    response = client.security.create_api_key(
+      body: {
+        name: "my-api-key",
+        expiration: "1d",
+        role_descriptors: {
+          'role-a' => {
+            cluster: ["all"],
+            index: [
+              {
+                names: ["index-a"],
+                privileges: ["read"]
+              }
+            ]
+          },
+          'role-b' => {
+            cluster: ["manage"],
+            index: [
+              {
+                names: ["index-b"],
+                privileges: ["all"]
+              }
+            ]
+          }
+        }
+      }
+    )
+    expect(response['name']).to eq 'my-api-key'
+    id = response['id']
+    expect(id).not_to be nil
+    expect(response['api_key']).not_to be nil
+    expect(response['expiration']).not_to be nil
+    credentials = Base64.strict_encode64("#{response['id']}:#{response['api_key']}")
+    expect(credentials).to eq response['encoded']
+    new_client = Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS,
+      api_key: credentials
+    )
+    response = new_client.security.authenticate
+    expect(response['username']).to eq 'api_key_user'
+    expect(response['roles'].length).to eq 0
+    expect(response['authentication_realm']['name']).to eq '_es_api_key'
+    expect(response['authentication_realm']['type']).to eq '_es_api_key'
+    expect(response['api_key']['id']).to eq id
+    expect(response['api_key']['name']).to eq 'my-api-key'
+    response = ADMIN_CLIENT.security.clear_api_key_cache(ids: id)
+    expect(response['_nodes']['failed']).to eq 0
+  end
+
+  context 'Test get api key' do
+    let(:name) { 'my-api-key-2'}
+
+    it 'gets api key' do
+      response = ADMIN_CLIENT.security.create_api_key(
+        body: { name: name, expiration: '1d' }
+      )
+      expect(response['name']).to eq name
+      id = response['id']
+      expect(id).not_to be nil
+      expect(response['api_key']).not_to be nil
+      expect(response['expiration']).not_to be nil
+
+      response = ADMIN_CLIENT.security.get_api_key(id: id)
+      expect(response['api_keys'].first['id']).to eq id
+      expect(response['api_keys'].first['name']).to eq name
+      expect(response['api_keys'].first['username']).to eq 'elastic'
+      expect(response['api_keys'].first['invalidated']).to eq false
+      expect(response['api_keys'].first['creation']).not_to be nil
+      response = ADMIN_CLIENT.security.get_api_key(owner: true)
+      expect(response['api_keys'].length).to be > 0
+    end
+  end
+end