elasticsearch-api 8.8.0 → 8.10.0

data/spec/platinum/integration/token/token_spec.rb

@@ -0,0 +1,94 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require_relative '../platinum_helper'
+
+describe 'Token API' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: { cluster: ['manage_security'] }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'token_user',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'admin_role' ],
+        full_name: 'Token user'
+      }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "token_user", ignore: 404)
+  end
+
+  it 'invalidates user token' do
+    response = ADMIN_CLIENT.security.get_token(
+      body: { grant_type: "password", username: "token_user", password: "x-pack-test-password" }
+    )
+
+    expect(response.status).to eq 200
+    expect(response['type']).to eq 'Bearer'
+    expect(response['access_token']).not_to be_nil
+    access_token = response['access_token']
+    client = Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS.merge(
+        headers: { Authorization: "Bearer #{access_token}" }
+      )
+    )
+    response = client.security.authenticate
+    expect(response.status).to eq 200
+    expect(response['username']).to eq 'token_user'
+    expect(response['roles'].first).to eq 'admin_role'
+    ADMIN_CLIENT.security.invalidate_token(
+      body: { username: 'token_user' }
+    )
+
+    expect do
+      client.security.authenticate
+    end.to raise_error(Elastic::Transport::Transport::Errors::Unauthorized)
+  end
+
+  it 'invalidates realm token' do
+    response = ADMIN_CLIENT.security.get_token(
+      body: { grant_type: "password", username: "token_user", password: "x-pack-test-password" }
+    )
+    expect(response.status).to eq 200
+    expect(response['type']).to eq 'Bearer'
+    expect(response['access_token']).not_to be_nil
+    access_token = response['access_token']
+    client = Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS.merge(
+        headers: { Authorization: "Bearer #{access_token}" }
+      )
+    )
+    response = client.security.authenticate
+    expect(response.status).to eq 200
+    expect(response['username']).to eq 'token_user'
+    expect(response['roles'].first).to eq 'admin_role'
+    response = ADMIN_CLIENT.security.invalidate_token(body: { realm_name: 'default_native' })
+    expect(response.status).to eq 200
+
+    expect do
+      client.security.authenticate
+    end.to raise_error(Elastic::Transport::Transport::Errors::Unauthorized)
+  end
+end

data/spec/{rest_api_tests_helper.rb → rest_api/rest_api_tests_helper.rb}

@@ -14,13 +14,13 @@
 # KIND, either express or implied.  See the License for the
 # specific language governing permissions and limitations
 # under the License.
-
 require "#{File.expand_path(File.dirname('..'))}/api-spec-testing/test_file"
 require "#{File.expand_path(File.dirname('..'))}/api-spec-testing/rspec_matchers"
 require "#{File.expand_path(File.dirname('..'))}/api-spec-testing/wipe_cluster"
 include Elasticsearch::RestAPIYAMLTests
 
 PROJECT_PATH = File.join(File.dirname(__FILE__), '..')
+CERTS_PATH = "#{PROJECT_PATH}/../../.buildkite/certs/"
 host = ENV['TEST_ES_SERVER'] || 'http://localhost:9200'
 raise URI::InvalidURIError unless host =~ /\A#{URI::DEFAULT_PARSER.make_regexp}\z/
 
@@ -29,13 +29,20 @@ password = ENV['ELASTIC_PASSWORD'] || 'changeme'
 uri = URI.parse(host)
 
 if test_suite == 'platinum'
-  raw_certificate = File.read(File.join(PROJECT_PATH, '../.ci/certs/testnode.crt'))
+  raw_certificate = File.read("#{CERTS_PATH}/testnode.crt")
   certificate = OpenSSL::X509::Certificate.new(raw_certificate)
-  raw_key = File.read(File.join(PROJECT_PATH, '../.ci/certs/testnode.key'))
+  raw_key = File.read("#{CERTS_PATH}/testnode.key")
   key = OpenSSL::PKey::RSA.new(raw_key)
-  ca_file = File.expand_path(File.join(PROJECT_PATH, '/.ci/certs/ca.crt'))
+  ca_file = File.expand_path("#{CERTS_PATH}/ca.crt")
   host = "https://elastic:#{password}@#{uri.host}:#{uri.port}".freeze
-  transport_options = { ssl: { verify: false, client_cert: certificate, client_key: key, ca_file: ca_file } }
+  transport_options = {
+    ssl: {
+      client_cert: certificate,
+      client_key: key,
+      ca_file: ca_file,
+      verify: false
+    }
+  }
 else
   host = "http://elastic:#{password}@#{uri.host}:#{uri.port}".freeze
   transport_options = {}
@@ -60,16 +67,16 @@ end
 
 Elasticsearch::RestAPIYAMLTests::WipeCluster.create_xpack_rest_user(ADMIN_CLIENT) if test_suite == 'platinum'
 
-YAML_FILES_DIRECTORY = "#{PROJECT_PATH}/../tmp/rest-api-spec/test/#{test_suite}".freeze
+YAML_FILES_DIRECTORY = "#{PROJECT_PATH}/../../tmp/rest-api-spec/test/#{test_suite}".freeze
 
 SINGLE_TEST = if ENV['SINGLE_TEST'] && !ENV['SINGLE_TEST'].empty?
                 test_target = ENV['SINGLE_TEST']
 
                 if test_target.match?(/\.yml$/)
-                  ["#{PROJECT_PATH}/../tmp/rest-api-spec/test/#{test_suite}/#{test_target}"]
+                  ["#{PROJECT_PATH}/../../tmp/rest-api-spec/test/#{test_suite}/#{test_target}"]
                 else
                   Dir.glob(
-                    ["#{PROJECT_PATH}/../tmp/rest-api-spec/test/#{test_suite}/#{test_target}/*.yml"]
+                    ["#{PROJECT_PATH}/../../tmp/rest-api-spec/test/#{test_suite}/#{test_target}/*.yml"]
                   )
                 end
               end

data/spec/{elasticsearch/api → rest_api}/rest_api_yaml_spec.rb

@@ -16,7 +16,7 @@
 # under the License.
 
 require 'spec_helper'
-require 'rest_api_tests_helper'
+require_relative 'rest_api_tests_helper'
 require_relative './run_rspec_matchers'
 
 LOGGER = Logger.new($stdout)

data/spec/rest_api/skipped_tests_platinum.yml

@@ -0,0 +1,111 @@
+# Response from Elasticsearch includes the ca.crt, so length doesn't match.
+-
+  :file:        'ssl/10_basic.yml'
+  :description: 'Test get SSL certificates'
+
+# TODO: Failing due to processing of regexp in test
+-
+  :file: 'ml/explain_data_frame_analytics.yml'
+  :description: 'Test non-empty data frame given body'
+
+-
+  :file: 'analytics/usage.yml'
+  :description: 'Usage stats on analytics indices'
+
+# TODO https://github.com/elastic/elasticsearch-ruby/issues/1269
+-
+  :file: 'searchable_snapshots/10_usage.yml'
+  :description: 'Tests searchable snapshots usage stats with full_copy and shared_cache indices'
+
+# TODO https://github.com/elastic/elasticsearch-ruby/issues/1291
+-
+  :file: 'service_accounts/10_basic.yml'
+  :description: 'Test service account tokens'
+
+# Migrated to manual integration test:
+-
+  :file: 'api_key/10_basic.yml'
+  :description: 'Test get api key'
+-
+  :file: 'api_key/11_invalidation.yml'
+  :description: '*'
+-
+  :file: 'api_key/20_query.yml'
+  :description: '*'
+-
+  :file: 'api_key/30_update.yml'
+  :description: '*'
+-
+  :file: 'api_key/40_view_role_descriptors.yml'
+  :description: '*'
+-
+  :file: 'api_key/50_cross_cluster.yml'
+  :description: '*'
+
+-
+  :file: 'health/10_usage.yml'
+  :description: 'Usage stats on the health API'
+
+-
+  :file: 'snapshot/10_basic.yml'
+  :description: 'Create a source only snapshot and then restore it'
+
+-
+  :file: 'token/10_basic.yml'
+  :description: "Test invalidate user's tokens"
+-
+  :file: 'token/10_basic.yml'
+  :description: "Test invalidate realm's tokens"
+
+ # Skipping due to testing conditions:
+-
+  :file: 'ml/3rd_party_deployment.yml'
+  :description: 'Test put model alias on pytorch model'
+-
+  :file: 'ml/3rd_party_deployment.yml'
+  :description: 'Test update model alias on pytorch model to undeployed model'
+-
+  :file: 'ml/3rd_party_deployment.yml'
+  :description: 'Test cannot start 2 deployments with the same Id'
+-
+  :file: 'ml/3rd_party_deployment.yml'
+  :description: 'Test cannot create model with a deployment Id'
+-
+  :file: 'ml/3rd_party_deployment.yml'
+  :description: 'Test clear deployment cache'
+- # Wrong error matching
+  :file: 'ml/3rd_party_deployment.yml'
+  :description: 'Test getting and putting Fill Mask with two mask tokens, as well as exceptions caused by requests with the wrong token'
+
+-
+  :file: 'searchable_snapshots/20_synthetic_source.yml'
+  :description: 'Tests searchable snapshots usage stats'
+-
+  :file: 'snapshot/20_operator_privileges_disabled.yml'
+  :description: '*'
+
+-
+  :file: 'token/11_invalidation.yml'
+  :description: 'Test invalidate access token return statuses'
+-
+  :file: 'token/11_invalidation.yml'
+  :description: 'Test invalidate refresh token return statuses'
+
+# Implemented manually:
+-
+  :file: 'ml/get_memory_stats.yml'
+  :description: '*'
+
+-
+  :file: 'eql/30_async_missing_events.yml'
+  :description: 'Execute async EQL with missing events'
+-
+  :file: 'api_key/60_admin_user.yml'
+  :description: 'Test get api key (with role descriptors + metadata)'
+-
+  :file: 'api_key/60_admin_user.yml'
+  :description: 'Test query api keys'
+
+-
+  :file: 'spatial/70_script_doc_values.yml'
+  :description: '*'