elasticsearch-api 8.8.0 → 8.9.0

data/spec/platinum/integration/api_key/api_key_query_spec.rb

@@ -0,0 +1,149 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require_relative '../platinum_helper'
+
+describe 'API keys' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: { cluster: ['manage_api_key'] }
+    )
+    ADMIN_CLIENT.security.put_role(
+      name: 'user_role',
+      body: {
+        cluster: ['manage_own_api_key'],
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_manager',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'admin_role' ],
+        full_name: 'API key manager'
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user_1',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user 1'
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user_2',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user 2'
+      }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_role(name: "user_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user_1", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user_2", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_manager", ignore: 404)
+  end
+
+  def client(headers)
+    Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS.merge(headers: headers)
+    )
+  end
+
+  let(:manager_auth) do
+    { Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" }
+  end
+  let(:user1_auth) do
+    { Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" }
+  end
+  let(:user2_auth) do
+    { Authorization: "Basic YXBpX2tleV91c2VyXzI6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" }
+  end
+
+  it 'queries api key' do
+    # api_key_manager authorization:
+    client = client(manager_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'manager-api-key',
+        expiration: '10d',
+        metadata: {
+          letter: 'a',
+          number: 42
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    manager_key_id = response['id']
+
+    # api_key_user1 authorization:
+    client = client(user1_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'user1-api-key',
+        expiration: '1d',
+        metadata: {
+          letter: 'a',
+          number: 1
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    user1_key_id = response['id']
+
+    # api_key_user2 authorization
+    client = client(user2_auth)
+    response = client.security.create_api_key(
+      body: {
+        name: 'user2-api-key',
+        expiration: '1d',
+        metadata: {
+          letter: 'b',
+          number: 42
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    user1_key_id = response['id']
+
+    client = client(manager_auth)
+    response = client.security.query_api_keys
+    expect(response.status).to eq 200
+    manager_total = response['total']
+    expect(manager_total).to be >= 3
+
+    client = client(user1_auth)
+    response = client.security.query_api_keys
+    expect(response.status).to eq 200
+    user_1_total = response['total']
+    expect(user_1_total).to be >= 1
+    expect(user_1_total).to be < manager_total
+
+    client = client(user2_auth)
+    response = client.security.query_api_keys
+    expect(response.status).to eq 200
+    user_2_total = response['total']
+    expect(user_2_total).to be >= 1
+    expect(user_2_total).to be < manager_total
+  end
+end

data/spec/platinum/integration/api_key/api_key_spec.rb

@@ -0,0 +1,157 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'base64'
+require_relative '../platinum_helper'
+
+describe 'API keys' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'admin_role',
+      body: {
+        cluster: ['manage_api_key'],
+        indices: [
+          {
+            names: '*',
+            privileges: ['all']
+          }
+        ],
+        applications: [
+          {
+            application: 'myapp',
+            privileges: ['*'],
+            resources: ['*']
+          }
+        ]
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'admin_role' ],
+        full_name: 'API key user'
+      }
+    )
+    ADMIN_CLIENT.security.put_privileges(
+      body:
+        {
+          myapp: {
+            read: {
+              application: 'myapp',
+              name: 'read',
+              actions: [ 'data:read/*' ]
+            },
+            write: {
+              application: 'myapp',
+              name: 'write',
+              actions: [ 'data:write/*' ]
+            }
+          }
+        }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user", ignore: 404)
+    ADMIN_CLIENT.security.delete_privileges(application: 'myapp', name: "read,write", ignore: 404)
+  end
+
+  let(:client) do
+    Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      user: 'api_key_user',
+      password: 'x-pack-test-password',
+      transport_options: TRANSPORT_OPTIONS
+    )
+  end
+
+  it 'creates api key' do
+    response = client.security.create_api_key(
+      body: {
+        name: "my-api-key",
+        expiration: "1d",
+        role_descriptors: {
+          'role-a' => {
+            cluster: ["all"],
+            index: [
+              {
+                names: ["index-a"],
+                privileges: ["read"]
+              }
+            ]
+          },
+          'role-b' => {
+            cluster: ["manage"],
+            index: [
+              {
+                names: ["index-b"],
+                privileges: ["all"]
+              }
+            ]
+          }
+        }
+      }
+    )
+    expect(response['name']).to eq 'my-api-key'
+    id = response['id']
+    expect(id).not_to be nil
+    expect(response['api_key']).not_to be nil
+    expect(response['expiration']).not_to be nil
+    credentials = Base64.strict_encode64("#{response['id']}:#{response['api_key']}")
+    expect(credentials).to eq response['encoded']
+    new_client = Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS,
+      api_key: credentials
+    )
+    response = new_client.security.authenticate
+    expect(response['username']).to eq 'api_key_user'
+    expect(response['roles'].length).to eq 0
+    expect(response['authentication_realm']['name']).to eq '_es_api_key'
+    expect(response['authentication_realm']['type']).to eq '_es_api_key'
+    expect(response['api_key']['id']).to eq id
+    expect(response['api_key']['name']).to eq 'my-api-key'
+    response = ADMIN_CLIENT.security.clear_api_key_cache(ids: id)
+    expect(response['_nodes']['failed']).to eq 0
+  end
+
+  context 'Test get api key' do
+    let(:name) { 'my-api-key-2'}
+
+    it 'gets api key' do
+      response = ADMIN_CLIENT.security.create_api_key(
+        body: { name: name, expiration: '1d' }
+      )
+      expect(response['name']).to eq name
+      id = response['id']
+      expect(id).not_to be nil
+      expect(response['api_key']).not_to be nil
+      expect(response['expiration']).not_to be nil
+
+      response = ADMIN_CLIENT.security.get_api_key(id: id)
+      expect(response['api_keys'].first['id']).to eq id
+      expect(response['api_keys'].first['name']).to eq name
+      expect(response['api_keys'].first['username']).to eq 'elastic'
+      expect(response['api_keys'].first['invalidated']).to eq false
+      expect(response['api_keys'].first['creation']).not_to be nil
+      response = ADMIN_CLIENT.security.get_api_key(owner: true)
+      expect(response['api_keys'].length).to be > 0
+    end
+  end
+end

data/spec/platinum/integration/api_key/api_key_update_spec.rb

@@ -0,0 +1,134 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'base64'
+require_relative '../platinum_helper'
+
+describe 'API keys API' do
+  before do
+    ADMIN_CLIENT.security.put_role(
+      name: 'user_role',
+      body: {
+        cluster: ['manage_own_api_key'],
+        indices: [
+          {
+            names: '*',
+            privileges: ['all']
+          }
+        ]
+      }
+    )
+    ADMIN_CLIENT.security.put_user(
+      username: 'api_key_user_1',
+      body: {
+        password: 'x-pack-test-password',
+        roles: [ 'user_role' ],
+        full_name: 'API key user 1'
+      }
+    )
+  end
+
+  after do
+    ADMIN_CLIENT.security.delete_role(name: "user_role", ignore: 404)
+    ADMIN_CLIENT.security.delete_user(username: "api_key_user_1", ignore: 404)
+  end
+
+  let(:client) do
+    Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS.merge(
+        headers: { Authorization: "Basic YXBpX2tleV91c2VyXzE6eC1wYWNrLXRlc3QtcGFzc3dvcmQ=" }
+      )
+    )
+  end
+
+  it 'updates api key' do
+    response = client.security.create_api_key(
+      body: {
+        name: 'user1-api-key',
+        role_descriptors: {
+          "role-a" => {
+            cluster: ["none"],
+            index: [
+              {
+                names: ["index-a"],
+                privileges: ["read"]
+              }
+            ]
+          }
+        }
+      }
+    )
+    expect(response.status).to eq 200
+    expect(response['name']).to eq 'user1-api-key'
+    id = response['id']
+    expect(id).not_to be nil
+    expect(response['api_key']).not_to be nil
+    credentials = Base64.strict_encode64("#{response['id']}:#{response['api_key']}")
+    expect(credentials).to eq response['encoded']
+
+    new_client = Elasticsearch::Client.new(
+      host: "https://#{HOST_URI.host}:#{HOST_URI.port}",
+      transport_options: TRANSPORT_OPTIONS,
+      api_key: credentials
+    )
+    privileges_body = {
+      cluster: ['manage_own_api_key'],
+      index: [
+        {
+          names: ['index-a'],
+          privileges: ['write']
+        },
+        {
+          names: ['index-b'],
+          privileges: ['read']
+        }
+      ]
+    }
+    response = new_client.security.has_privileges(body: privileges_body)
+    expect(response['has_all_requested']).to eq false
+
+    response = client.security.update_api_key(
+      id: id,
+      body: {
+        role_descriptors: {
+          "role-a" => {
+            cluster: ["all"],
+            index: [
+              {
+                names: ["index-a"],
+                privileges: ["write"]
+              },
+              {
+                names: ["index-b"],
+                privileges: ["read"]
+              }
+            ]
+          }
+        },
+        metadata: {
+          letter: "a",
+          number: 42
+        }
+      }
+    )
+    expect(response['updated']).to eq true
+
+    response = new_client.security.has_privileges(user: nil, body: privileges_body)
+    expect(response['has_all_requested']).to eq true
+  end
+end

data/spec/platinum/integration/health/health_spec.rb

@@ -0,0 +1,49 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require_relative '../platinum_helper'
+
+describe 'Health API' do
+  context 'Usage stats on the health API' do
+    before do
+      ADMIN_CLIENT.indices.create(
+        index: 'red_index',
+        body: {
+          settings: {
+            number_of_shards: 1,
+            number_of_replicas: 0,
+            'index.routing.allocation.enable' => 'none'
+          }
+        }
+      )
+    end
+
+    after do
+      ADMIN_CLIENT.indices.delete(index: 'red_index')
+    end
+
+    it 'responds with health report' do
+      expect(ADMIN_CLIENT.health_report.status).to eq 200
+      expect(ADMIN_CLIENT.health_report(feature: 'disk').status).to eq 200
+      response = ADMIN_CLIENT.xpack.usage
+      expect(response['health_api']['available']).to eq true
+      expect(response['health_api']['enabled']).to eq true
+      expect(response['health_api']['invocations']['total']).to be >= 2
+      expect(response['health_api']['invocations']['verbose_true']).to be >= 2
+    end
+  end
+end

data/spec/platinum/integration/ml/get_memory_stats_spec.rb

@@ -0,0 +1,47 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require_relative '../platinum_helper'
+
+describe 'ML/Get Memory Stats API' do
+    it 'gets memory for all nodes' do
+      response = ADMIN_CLIENT.ml.get_memory_stats
+      expect(response.status).to eq 200
+      expect(response['cluster_name']).not_to be_nil
+      expect(response['_nodes']['total']).to be >= 1
+      expect(response['nodes'].first[1]['mem']['total_in_bytes']).to be > 1
+    end
+
+    it 'gets memory for ML nodes' do
+      response = ADMIN_CLIENT.ml.get_memory_stats
+      expect(response.status).to eq 200
+      expect(response['cluster_name']).not_to be_nil
+      expect(response['nodes'].first[1]['mem']['total_in_bytes']).to be > 1
+    end
+
+    it 'gets memory for specific node' do
+      response = ADMIN_CLIENT.ml.get_memory_stats
+      expect(response.status).to eq 200
+      node_id = response['nodes'].keys.first
+
+      response = ADMIN_CLIENT.ml.get_memory_stats(node_id: node_id, timeout: '29s')
+      expect(response.status).to eq 200
+      expect(response['cluster_name']).not_to be_nil
+      expect(response['nodes'].first[1]['mem']['total_in_bytes']).to be > 1
+      expect(response['_nodes']['total']).to be 1
+    end
+  end

data/spec/platinum/integration/platinum_helper.rb

@@ -0,0 +1,36 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require 'openssl'
+require 'elasticsearch'
+
+CERTS_PATH = File.expand_path('./../.buildkite/certs')
+
+host = ENV['TEST_ES_SERVER'] || 'https://localhost:9200'
+raise URI::InvalidURIError unless host =~ /\A#{URI::DEFAULT_PARSER.make_regexp}\z/
+
+password = ENV['ELASTIC_PASSWORD'] || 'changeme'
+HOST_URI = URI.parse(host)
+raw_certificate = File.read("#{CERTS_PATH}/testnode.crt")
+certificate = OpenSSL::X509::Certificate.new(raw_certificate)
+raw_key = File.read("#{CERTS_PATH}/testnode.key")
+key = OpenSSL::PKey::RSA.new(raw_key)
+ca_file = File.expand_path("#{CERTS_PATH}/ca.crt")
+TRANSPORT_OPTIONS = { ssl: { verify: false, client_cert: certificate, client_key: key, ca_file: ca_file } }
+HOST = "https://elastic:#{password}@#{HOST_URI.host}:#{HOST_URI.port}".freeze
+
+ADMIN_CLIENT = Elasticsearch::Client.new(host: HOST, transport_options: TRANSPORT_OPTIONS)

data/spec/platinum/integration/service_accounts/service_accounts_spec.rb

@@ -0,0 +1,65 @@
+# Licensed to Elasticsearch B.V. under one or more contributor
+# license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright
+# ownership. Elasticsearch B.V. licenses this file to you under
+# the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+require_relative '../platinum_helper'
+
+describe 'Service Accounts API' do
+  context 'service account tokens' do
+    before do
+
+    end
+
+    after do
+      ADMIN_CLIENT.security.delete_service_token(
+        namespace: 'elastic',
+        service: 'fleet-server',
+        name: 'api-token-fleet'
+      )
+    end
+
+    it 'responds with health report' do
+      response = ADMIN_CLIENT.security.create_service_token(
+        namespace: 'elastic',
+        service: 'fleet-server',
+        name: 'api-token-fleet'
+      )
+      expect(response.status).to eq 200
+      expect(response['created']).to eq true
+      service_token_fleet = response['token']['value']
+      headers = { 'Authorization' => "Bearer #{service_token_fleet}"}
+      client = Elasticsearch::Client.new(
+        host: HOST,
+        transport_options: TRANSPORT_OPTIONS.merge(headers: headers)
+      )
+      response = client.security.authenticate
+
+      expect(response.status).to eq 200
+      expect(response['username']).to eq 'elastic/fleet-server'
+      expect(response['full_name']).to eq 'Service account - elastic/fleet-server'
+
+
+      expect do
+        client.security.delete_user(username: 'foo')
+      end.to raise_error Elastic::Transport::Transport::Errors::Forbidden
+
+      response = ADMIN_CLIENT.security.get_service_credentials(
+        namespace: 'elastic', service: 'fleet-server'
+      )
+      expect(response['service_account']).to eq 'elastic/fleet-server'
+    end
+  end
+end