|
| 1 | +# Licensed to Elasticsearch B.V. under one or more contributor |
| 2 | +# license agreements. See the NOTICE file distributed with |
| 3 | +# this work for additional information regarding copyright |
| 4 | +# ownership. Elasticsearch B.V. licenses this file to you under |
| 5 | +# the Apache License, Version 2.0 (the "License"); you may |
| 6 | +# not use this file except in compliance with the License. |
| 7 | +# You may obtain a copy of the License at |
| 8 | +# |
| 9 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +# |
| 11 | +# Unless required by applicable law or agreed to in writing, |
| 12 | +# software distributed under the License is distributed on an |
| 13 | +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 14 | +# KIND, either express or implied. See the License for the |
| 15 | +# specific language governing permissions and limitations |
| 16 | +# under the License. |
| 17 | + |
| 18 | +require_relative '../platinum_helper' |
| 19 | + |
| 20 | +describe 'API keys' do |
| 21 | + before do |
| 22 | + ADMIN_CLIENT.security.put_role( |
| 23 | + name: 'admin_role', |
| 24 | + body: { cluster: ['manage_api_key'] } |
| 25 | + ) |
| 26 | + ADMIN_CLIENT.security.put_role( |
| 27 | + name: 'user_role', |
| 28 | + body: { |
| 29 | + cluster: ['manage_own_api_key'], |
| 30 | + } |
| 31 | + ) |
| 32 | + ADMIN_CLIENT.security.put_user( |
| 33 | + username: 'api_key_manager', |
| 34 | + body: { |
| 35 | + password: 'x-pack-test-password', |
| 36 | + roles: [ 'admin_role' ], |
| 37 | + full_name: 'API key manager' |
| 38 | + } |
| 39 | + ) |
| 40 | + |
| 41 | + ADMIN_CLIENT.security.put_user( |
| 42 | + username: 'api_key_user', |
| 43 | + body: { |
| 44 | + password: 'x-pack-test-password', |
| 45 | + roles: [ 'user_role' ], |
| 46 | + full_name: 'API key user' |
| 47 | + } |
| 48 | + ) |
| 49 | + end |
| 50 | + after do |
| 51 | + ADMIN_CLIENT.security.delete_role(name: "admin_role", ignore: 404) |
| 52 | + ADMIN_CLIENT.security.delete_role(name: "user_role", ignore: 404) |
| 53 | + ADMIN_CLIENT.security.delete_user(username: "api_key_user", ignore: 404) |
| 54 | + ADMIN_CLIENT.security.delete_user(username: "api_key_manager", ignore: 404) |
| 55 | + end |
| 56 | + |
| 57 | + def client(headers) |
| 58 | + Elasticsearch::Client.new( |
| 59 | + host: "https://#{HOST_URI.host}:#{HOST_URI.port}", |
| 60 | + transport_options: TRANSPORT_OPTIONS.merge(headers: headers) |
| 61 | + ) |
| 62 | + end |
| 63 | + |
| 64 | + let(:manager_auth) do |
| 65 | + { Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } |
| 66 | + end |
| 67 | + let(:user_auth) do |
| 68 | + { Authorization: "Basic YXBpX2tleV9tYW5hZ2VyOngtcGFjay10ZXN0LXBhc3N3b3Jk" } |
| 69 | + end |
| 70 | + |
| 71 | + it 'queries api key with args' do |
| 72 | + # api_key_manager authorization: |
| 73 | + client = client(manager_auth) |
| 74 | + response = client.security.create_api_key( |
| 75 | + body: { |
| 76 | + name: 'manager-api-key', |
| 77 | + expiration: '10d', |
| 78 | + metadata: { |
| 79 | + letter: 'a', |
| 80 | + number: 42 |
| 81 | + } |
| 82 | + } |
| 83 | + ) |
| 84 | + expect(response.status).to eq 200 |
| 85 | + id = response['id'] |
| 86 | + api_key = response['api_key'] |
| 87 | + expect(response['encoded']).to eq Base64.strict_encode64("#{id}:#{api_key}") |
| 88 | + |
| 89 | + client = client(user_auth) |
| 90 | + response = client.security.create_api_key( |
| 91 | + body: { |
| 92 | + name: 'user-api-key', |
| 93 | + expiration: '1d', |
| 94 | + metadata: { |
| 95 | + letter: 'a', |
| 96 | + number: 1 |
| 97 | + } |
| 98 | + } |
| 99 | + ) |
| 100 | + expect(response.status).to eq 200 |
| 101 | + id = response['id'] |
| 102 | + api_key = response['api_key'] |
| 103 | + expect(response['encoded']).to eq Base64.strict_encode64("#{id}:#{api_key}") |
| 104 | + |
| 105 | + response = client.security.query_api_keys( |
| 106 | + body: { |
| 107 | + size: 0, |
| 108 | + aggs: { |
| 109 | + my_buckets: { |
| 110 | + composite: { |
| 111 | + sources: [{ key_name: { terms: { field: "name" } } } ] |
| 112 | + } |
| 113 | + } |
| 114 | + } |
| 115 | + } |
| 116 | + ) |
| 117 | + expect(response.dig('aggregations', 'my_buckets', 'buckets').find { |a| a.dig('key', 'key_name') == 'manager-api-key'}) |
| 118 | + expect(response.dig('aggregations', 'my_buckets', 'buckets').find { |a| a.dig('key', 'key_name') == 'user-api-key'}) |
| 119 | + end |
| 120 | +end |
0 commit comments