50_user_profile.yml

---
requires:
  stack: true
  serverless: false
---
setup:
  - do:
      security.put_user:
        username: "joe"
        body:  >
          {
            "password" : "s3krit-password",
            "roles" : [ "superuser" ],
            "full_name" : "Bazooka Joe",
            "email" : "joe@bazooka.gum"
          }

  - do:
      security.put_user:
        username: "doe"
        body:  >
          {
            "password" : "s3krit-password",
            "roles" : [ "superuser" ],
            "full_name" : "Bazooka Doe",
            "email" : "doe@bazooka.gum"
          }
---
teardown:
  - do:
      security.delete_user:
        username: "joe"
        ignore: 404
  - do:
      security.delete_user:
        username: "doe"
        ignore: 404
---
"Test user profiles":
  - do:
      security.activate_user_profile:
        body: >
          {
            "grant_type": "password",
            "username": "joe",
            "password" : "s3krit-password"
          }
  - is_true: uid
  - match: { "user.username" : "joe" }
  - match: { "user.roles" : [ "superuser" ] }
  - match: { "user.full_name" : "Bazooka Joe" }
  - match: { "user.realm_name" : "default_native" }
  - is_false: "user.realm_domain"
  - is_true: _doc
  - set: { uid: profile_uid_1 }

  - do:
      security.activate_user_profile:
        body: >
          {
            "grant_type": "password",
            "username": "doe",
            "password" : "s3krit-password"
          }
  - is_true: uid
  - match: { "user.username" : "doe" }
  - match: { "user.roles" : [ "superuser" ] }
  - match: { "user.full_name" : "Bazooka Doe" }
  - match: { "user.realm_name" : "default_native" }
  - is_false: "user.realm_domain"
  - is_true: _doc
  - set: { uid: profile_uid_2 }

  - do:
      security.get_user_profile:
        uid: "u_eGdcwXYIE3LEOrqz6p-3DHQ4HrAtxuk_ttRNFh2m7rM_0,u_eZ75KhGvkY4_t0HfQpNPO1aO0tk6wd908bjUGieTKm8_0,does_not_exist"

  - length: { profiles : 2 }
  - set: { profiles.0 : profile }
  - match: { $profile.uid : "$profile_uid_1" }
  - match: { $profile.user.username : "joe" }
  - match: { $profile.data : {} }
  - set: { profiles.1 : profile }
  - match: { $profile.uid : "$profile_uid_2" }
  - match: { $profile.user.username : "doe" }
  - match: { $profile.data : {} }

  - is_true: errors
  - set: { errors: errors }
  - match: { $errors.count : 1 }
  - match: { $errors.details.does_not_exist.type: "resource_not_found_exception" }

  # Get users with profile uid
  - do:
      security.get_user:
        username: [ 'joe', 'doe' ]
        with_profile_uid: true

  - match: { "joe.profile_uid": "$profile_uid_1" }
  - match: { "doe.profile_uid": "$profile_uid_2" }

  # disable profile
  - do:
      security.disable_user_profile:
        uid: "$profile_uid_1"

  - do:
      security.get_user_profile:
        uid: "$profile_uid_1"
  - set: { profiles.0: profile }
  - is_false: "$profile.enabled"

  # enable again
  - do:
      security.enable_user_profile:
        uid: "$profile_uid_1"

  - do:
      security.get_user_profile:
        uid: "$profile_uid_1"
  - set: { profiles.0: profile }
  - is_true: "$profile.enabled"

  - do:
      security.update_user_profile_data:
        uid: "$profile_uid_1"
        body: >
          {
            "labels": {
              "kibana": {
                "spaces": "demo"
              }
            },
            "data": {
              "app1": {
                "theme": "default"
              },
              "app2": {
                "theme": "dark"
              }
            }
          }
  - is_true: acknowledged
  - do:
      security.suggest_user_profiles:
        body: >
          {
            "name": "joe",
            "size": 5,
            "hint": {
              "uids": ["u_79HkWkwmnBH5gqFKwoxggWPjEBOur1zLPXQPEl1VBW0_0"],
              "labels": {
                "direction": ["north", "east"]
              }
            }
          }

  # None of the hints matches. But name match is sufficient
  - length: { profiles: 1 }
  - match: { "profiles.0.uid": "$profile_uid_1" }

  - do:
      security.has_privileges_user_profile:
        body:
          uids:
            - $profile_uid_1
            - $profile_uid_2
            - dummy_missing
          privileges:
            index:
              - names:
                  - index1*
                  - index2*
                privileges:
                  - read
  - is_true: has_privilege_uids
# disable the user
  - do:
      security.disable_user:
        username: "joe"

# validate user cannot login
  - do:
      catch: unauthorized
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      cluster.health: {}

# enable the user
  - do:
      security.enable_user:
        username: "joe"

# validate that the user can login again
  - do:
      headers:
        Authorization: "Basic am9lOnMza3JpdC1wYXNzd29yZA=="
      cluster.health: {}
  - match: { timed_out: false }

  - do:
      security.query_user:
        body: { }
  - match: { total: 2 }
  - match: { count: 2 }