test(kibana): fix faulty Kibana integration test definitions

codegen/functional/generator.ts

@@ -487,6 +487,10 @@ function buildCommand (mapped: MappedAction, step: DoStep): string {
         }
         if (originalBodyStr != null) {
           extraArgs.push(`--${singleBodyArg.cliFlag}`, shellEscape(originalBodyStr))
+        } else if (containsVarRef(body)) {
+          // Whole-body arg carrying $var references (e.g. patch_rule's body.id
+          // set from a create step) — expand vars instead of quoting literally.
+          extraArgs.push(`--${singleBodyArg.cliFlag}`, buildVarExpandingJson(body))
         } else {
           extraArgs.push(`--${singleBodyArg.cliFlag}`, toShellArg(body))
         }

codegen/functional/kb.ts

@@ -316,11 +316,6 @@ const skippedFilesServerless = new Set<string>([
   "elastic_agent_actions_post_fleet_agents_bulk_upgrade.yml",
   "elastic_agents_post_fleet_agents_bulk_privilege_level_change.yml",
 
-  // Serverless env only permits the `testprefix` namespace; test payloads use another.
-  "elastic_agent_actions_post_fleet_agents_bulk_reassign.yml",
-  "elastic_agent_actions_reassign.yml",
-  "elastic_agent_policies_get_fleet_agent_policies_agentpolicyid_download.yml",
-
   // `.fleet-*` indices are absent in the serverless env (nothing enrolled),
   // so the op 404s with index_not_found_exception.
   "elastic_agent_actions_post_fleet_agents_bulk_update_agent_tags.yml",
@@ -528,6 +523,8 @@ const skippedFilesStack = new Set<string>([
   "elastic_agent_actions_rollback.yml",
   "elastic_agent_actions_unenroll.yml",
   "elastic_agent_actions_upgrade.yml",
+  "elastic_agent_actions_reassign.yml",
+  "elastic_agent_actions_post_fleet_agents_bulk_reassign.yml",
   "elastic_agents_delete_fleet_agents_agentid.yml",
   "elastic_agents_delete_fleet_agents_files_fileid.yml",
   "elastic_agents_get_fleet_agents_agentid.yml",
@@ -554,20 +551,6 @@ const skippedFilesStack = new Set<string>([
   "elastic_agent_actions_post_fleet_agents_bulk_upgrade.yml",
   "elastic_agents_post_fleet_agents_bulk_privilege_level_change.yml",
 
-  // Stack env only permits the `testprefix` namespace; test payloads use another.
-  "elastic_agent_actions_post_fleet_agents_bulk_reassign.yml",
-  "elastic_agent_actions_reassign.yml",
-  "elastic_agent_policies_get_fleet_agent_policies_agentpolicyid_download.yml",
-
-  // Watchlist schema mismatch: upstream caps riskModifier at 2, but the test
-  // payload exceeds it (too_big: expected number to be <=2).
-  "security_entity_analytics_api_create_watchlist.yml",
-  "security_entity_analytics_api_get_watchlist.yml",
-  "security_entity_analytics_api_list_watchlists.yml",
-  "security_entity_analytics_api_unassign_watchlist_entities.yml",
-  "security_entity_analytics_api_update_watchlist.yml",
-  "security_entity_analytics_api_upload_watchlist_csv.yml",
-
   // Entity Store is not installed in the stack env; every entity-store op 400s
   // asking for POST /api/security/entity_store/install first.
   "security_entity_store_delete_security_entity_store_entities.yml",
@@ -585,20 +568,6 @@ const skippedFilesStack = new Set<string>([
   "security_entity_analytics_api_configure_risk_engine_saved_object.yml",
   "security_entity_analytics_api_schedule_risk_engine_now.yml",
 
-  // Prerequisite exception lists are never created (endpoint_blocklists / shared
-  // list id), so every dependent op 404s.
-  "security_exceptions_api_create_exception_list_item.yml",
-  "security_exceptions_api_create_rule_exception_list_items.yml",
-  "security_exceptions_api_create_shared_exception_list.yml",
-  "security_exceptions_api_delete_exception_list_item.yml",
-  "security_exceptions_api_find_exception_list_items.yml",
-  "security_exceptions_api_read_exception_list_item.yml",
-  "security_exceptions_api_update_exception_list_item.yml",
-
-  // Test supplies a non-UUID rule id, rejected by body validation (Invalid UUID).
-  "security_detections_api_patch_rule.yml",
-  "security_detections_api_update_rule.yml",
-
   // Significant events feature is disabled (403); requires enabling
   // observability:streamsEnableSignificantEvents in Advanced Settings.
   "significantevents_delete_streams_name_queries_queryid.yml",
@@ -624,26 +593,23 @@ const skippedFilesStack = new Set<string>([
   "streams_put_streams_name_query.yml",
   "streams_put_streams_streamname_attachments_attachmenttype_attachmentid.yml",
 
-  // No SLO definitions exist in the env (404) or the op sends unsupported args
-  // (purgePolicy validation, cannot delete instance '*').
+  // No SLO definitions exist in the env (404); slo_bulk_snapshot and slo_get_snapshot
+  // depend on data that is never provisioned.
   "slo_bulk_snapshot_op.yml",
-  "slo_delete_rollup_data_op.yml",
-  "slo_delete_slo_instances_op.yml",
   "slo_get_definitions_op.yml",
   "slo_get_snapshot_op.yml",
 
-  // APM setup state: config already exists / expected settings missing /
-  // annotation body fails upstream validation.
-  "apm_agent_configuration_get_environments_for_service.yml",
-  "apm_agent_configuration_search_single_configuration.yml",
-  "apm_annotations_get_annotation.yml",
-
   // Feature or route gated off in this stack config (404 / not available with
   // current configuration).
   "agent_builder_get_plugins.yml",
-  "alerting_get_alerting_rule_id_query_inspector.yml",
-  "elastic_package_manager_epm_delete_fleet_epm_packages_pkgname_pkgversion_kibana_assets.yml",
   "security_timeline_api_copy_timeline.yml",
+  "security_entity_analytics_api_create_watchlist.yml",
+  "security_entity_analytics_api_get_watchlist.yml",
+  "security_entity_analytics_api_list_watchlists.yml",
+  "security_entity_analytics_api_unassign_watchlist_entities.yml",
+  "security_entity_analytics_api_update_watchlist.yml",
+  "security_entity_analytics_api_upload_watchlist_csv.yml",
+  "alerting_get_alerting_rule_id_query_inspector.yml",
 
   // Assertions fail or the response is unparseable: required objects were never
   // provisioned in the stack env, or the body isn't the JSON/YAML the check expects.
@@ -654,6 +620,13 @@ const skippedFilesStack = new Set<string>([
   "security_entity_analytics_api_bulk_upsert_asset_criticality_records.yml",
   "security_lists_api_export_list_items.yml",
   "security_timeline_api_resolve_timeline.yml",
+  "apm_agent_configuration_search_single_configuration.yml",
+  "security_exceptions_api_create_shared_exception_list.yml",
+
+  // Kibana forbids deleting EPM package kibana assets from the space where the
+  // package is installed (400: "you must uninstall the package"); the op is not
+  // exercisable without a separate space, which the test does not provision.
+  "elastic_package_manager_epm_delete_fleet_epm_packages_pkgname_pkgversion_kibana_assets.yml",
 
   // @elastic/schemas defect:
   // Upstream bugs tracked at:
@@ -667,6 +640,14 @@ const skippedFilesStack = new Set<string>([
   'ml_ml_update_jobs_spaces.yml',
   'ml_ml_update_trained_models_spaces.yml',
   'visualizations_create_visualization.yml',
+  // create/read/update/delete/find exception-list-item request schemas restrict
+  // `list_id` to the enum ["endpoint_blocklists"], so any real list id fails CLI
+  // input validation before the request is sent.
+  "security_exceptions_api_create_exception_list_item.yml",
+  "security_exceptions_api_read_exception_list_item.yml",
+  "security_exceptions_api_update_exception_list_item.yml",
+  "security_exceptions_api_delete_exception_list_item.yml",
+  "security_exceptions_api_find_exception_list_items.yml",
 ])
 
 const skippedFiles = env === 'serverless' ? skippedFilesServerless : skippedFilesStack

codegen/functional/test/fixtures/body-var.yml

@@ -0,0 +1,17 @@
+---
+requires:
+  serverless: true
+  stack: true
+---
+setup:
+  - do:
+      index:
+        index: 'bv_test'
+        body: { name: 'seed' }
+  - set: { _id: doc_id }
+---
+'body var':
+  - do:
+      index:
+        index: 'bv_test'
+        body: { id: $doc_id, name: 'updated' }

codegen/functional/test/generator.test.ts

@@ -133,6 +133,22 @@ describe('generateScript', () => {
     assert.ok(result.script.includes('# SKIPPED: catch not supported'))
   })
 
+  it('expands $var references inside a whole-body arg', () => {
+    const content = readFileSync(join(fixturesDir, 'body-var.yml'), 'utf-8')
+    const testFile = parseTestFile(content, 'body-var.yml')
+    const result = generateScript(testFile, testDefs)
+    // The body maps to the single --document flag; the $doc_id reference must
+    // be emitted as an expanding "$DOC_ID" break-out, not a literal $doc_id.
+    assert.ok(
+      result.script.includes('"$DOC_ID"'),
+      'whole-body $var must expand to the bash variable'
+    )
+    assert.ok(
+      !result.script.includes('$doc_id'),
+      'literal $doc_id must not survive into the generated script'
+    )
+  })
+
   it('generates comparison assertions', () => {
     const content = readFileSync(join(fixturesDir, 'comparisons.yml'), 'utf-8')
     const testFile = parseTestFile(content, 'comparisons.yml')

test/functional/kb/definitions/alerting_get_alerting_rule_id_query_inspector.yml

@@ -2,18 +2,13 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # Kibana alerting API: inspect the Elasticsearch query for a rule.
+# Uses searchType esQuery (not esqlQuery) which supports query inspection.
 ---
 requires:
   serverless: true
   stack: true
 ---
-teardown:
-  - do:
-      alerting.delete_alerting_rule_id:
-        id: cli-ft-rule-qi
-        ignore: [404]
----
-"alerting get rule query inspector":
+setup:
   - do:
       alerting.post_alerting_rule_id:
         id: cli-ft-rule-qi
@@ -23,16 +18,24 @@ teardown:
           rule_type_id: ".es-query"
           schedule: {interval: "1m"}
           params:
-            searchType: esqlQuery
-            esqlQuery: {esql: "FROM * | LIMIT 1"}
+            searchType: esQuery
+            esQuery: "{\"query\":{\"match_all\":{}}}"
+            index:
+              - "*"
             timeWindowSize: 5
             timeWindowUnit: m
             threshold: [0]
             thresholdComparator: ">"
             size: 0
             timeField: "@timestamp"
-  - match: {id: cli-ft-rule-qi}
-
+---
+teardown:
+  - do:
+      alerting.delete_alerting_rule_id:
+        id: cli-ft-rule-qi
+        ignore: [404]
+---
+"alerting get rule query inspector":
   - do:
       alerting.get_alerting_rule_id_query_inspector:
         id: cli-ft-rule-qi

test/functional/kb/definitions/apm_agent_configuration_get_environments_for_service.yml

@@ -2,30 +2,40 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # Kibana apm-agent-configuration API: get environments for a service.
+# Deletes any stale config first, creates one, then verifies environments are returned.
 ---
 requires:
   serverless: true
   stack: true
 ---
-teardown:
+setup:
   - do:
       apm-agent-configuration.delete_agent_configuration:
         body:
           service:
-            name: cli-ft-apm-svc
+            name: cli-ft-apm-env-svc
+            environment: production
         ignore: [404]
----
-"apm-agent-configuration get environments for service":
   - do:
       apm-agent-configuration.create_update_agent_configuration:
         body:
           service:
-            name: cli-ft-apm-svc
+            name: cli-ft-apm-env-svc
             environment: production
           settings:
             transaction_sample_rate: "0.5"
-
+---
+teardown:
+  - do:
+      apm-agent-configuration.delete_agent_configuration:
+        body:
+          service:
+            name: cli-ft-apm-env-svc
+            environment: production
+        ignore: [404]
+---
+"apm-agent-configuration get environments for service":
   - do:
       apm-agent-configuration.get_environments_for_service:
-        service_name: cli-ft-apm-svc
+        service_name: cli-ft-apm-env-svc
   - is_true: ""

test/functional/kb/definitions/apm_agent_configuration_search_single_configuration.yml

@@ -8,11 +8,17 @@ requires:
   stack: true
 ---
 setup:
+  - do:
+      apm-agent-configuration.delete_agent_configuration:
+        body:
+          service:
+            name: cli-ft-apm-search-svc
+        ignore: [404]
   - do:
       apm-agent-configuration.create_update_agent_configuration:
         body:
           service:
-            name: cli-ft-apm-svc
+            name: cli-ft-apm-search-svc
           settings:
             transaction_sample_rate: "0.5"
 ---
@@ -21,12 +27,12 @@ teardown:
       apm-agent-configuration.delete_agent_configuration:
         body:
           service:
-            name: cli-ft-apm-svc
+            name: cli-ft-apm-search-svc
         ignore: [404]
 ---
 "apm-agent-configuration search single configuration":
   - do:
       apm-agent-configuration.search_single_configuration:
         service:
-          name: cli-ft-apm-svc
+          name: cli-ft-apm-search-svc
   - is_true: settings

test/functional/kb/definitions/apm_annotations_get_annotation.yml

@@ -1,7 +1,7 @@
 # Copyright Elasticsearch B.V. and contributors
 # SPDX-License-Identifier: Apache-2.0
 #
-# Kibana apm-annotations API: create an annotation then search for it by service name.
+# Kibana apm-annotations API: create an annotation then retrieve it by service name and time range.
 ---
 requires:
   serverless: true
@@ -19,4 +19,7 @@ requires:
   - do:
       apm-annotations.get_annotation:
         service_name: cli-ft-apm-svc
+        start: "2024-01-01T00:00:00.000Z"
+        end: "2024-01-02T00:00:00.000Z"
+        environment: all
   - is_true: ""

test/functional/kb/definitions/elastic_agent_actions_post_fleet_agents_bulk_reassign.yml

@@ -16,7 +16,7 @@ setup:
       elastic-agent-policies.post_fleet_agent_policies:
         body:
           name: cli-ft-ea-bulk-reassign
-          namespace: default
+          namespace: testprefix
   - set: {"item.id": new_policy_id}
 ---
 teardown:

test/functional/kb/definitions/elastic_agent_actions_reassign.yml

@@ -16,7 +16,7 @@ setup:
       elastic-agent-policies.post_fleet_agent_policies:
         body:
           name: cli-ft-ea-reassign
-          namespace: default
+          namespace: testprefix
   - set: {"item.id": new_policy_id}
 ---
 teardown:

test/functional/kb/definitions/elastic_agent_policies_get_fleet_agent_policies_agentpolicyid_download.yml

@@ -12,7 +12,7 @@ setup:
       elastic-agent-policies.post_fleet_agent_policies:
         body:
           name: cli-ft-ea-policy-download
-          namespace: default
+          namespace: testprefix
   - set: {"item.id": policy_id}
 ---
 teardown:

test/functional/kb/definitions/elastic_package_manager_epm_delete_fleet_epm_packages_pkgname_pkgversion_kibana_assets.yml

@@ -2,6 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 #
 # Kibana elastic-package-manager-epm API: delete Kibana assets for a package version.
+# Installs just the kibana assets via POST first, then deletes them.
 ---
 requires:
   serverless: true
@@ -16,6 +17,10 @@ setup:
       elastic-package-manager-epm.post_fleet_epm_packages_pkgname_pkgversion:
         pkg_name: apache
         pkg_version: $pkg_version
+  - do:
+      elastic-package-manager-epm.post_fleet_epm_packages_pkgname_pkgversion_kibana_assets:
+        pkg_name: apache
+        pkg_version: $pkg_version
 ---
 teardown:
   - do:

test/functional/kb/definitions/security_entity_analytics_api_assign_watchlist_entities.yml

@@ -14,7 +14,7 @@ setup:
       security-entity-analytics-api.create_watchlist:
         body:
           name: cli-ft-assign-watchlist-entities-test
-          riskModifier: 10
+          riskModifier: 2
   - set: {id: watchlist_id}
 ---
 teardown:

test/functional/kb/definitions/security_entity_analytics_api_create_watchlist.yml

@@ -14,7 +14,7 @@ requires:
       security-entity-analytics-api.create_watchlist:
         body:
           name: cli-ft-create-watchlist-test
-          riskModifier: 10
+          riskModifier: 2
   - is_true: id
   - match: {name: cli-ft-create-watchlist-test}
-  - match: {risk_modifier: 10}
+  - match: {risk_modifier: 2}