Merge pull request elastic/x-pack-elasticsearch#591 from spinscale/1702-rest-hijack-delete-by-query

Delete/Update by query was not disabled for the watcher index
on HTTP.

Test suite was renamed from hijack to `block_direct_index_access` in the watcher tests

relates elastic/x-pack-elasticsearch#586

Original commit: elastic/x-pack-elasticsearch@5984ee3624

plugin/src/main/java/org/elasticsearch/xpack/watcher/rest/action/RestHijackOperationAction.java

@@ -43,6 +43,10 @@ public class RestHijackOperationAction extends WatcherRestHandler {
             controller.registerHandler(PUT, Watch.INDEX + "/watch/_bulk", unsupportedHandler);
             controller.registerHandler(PUT, Watch.INDEX + "/_bulk", unsupportedHandler);
             controller.registerHandler(DELETE, Watch.INDEX, unsupportedHandler);
+            controller.registerHandler(POST, Watch.INDEX + "/_delete_by_query", unsupportedHandler);
+            controller.registerHandler(POST, Watch.INDEX + "/watch/_delete_by_query", unsupportedHandler);
+            controller.registerHandler(POST, Watch.INDEX + "/_update_by_query", unsupportedHandler);
+            controller.registerHandler(POST, Watch.INDEX + "/watch/_update_by_query", unsupportedHandler);
         }
     }
 

plugin/src/test/resources/rest-api-spec/test/watcher/block_direct_index_access/10_basic.yaml

@@ -48,7 +48,6 @@
             -  { "index": {}}
             -  {}
 
-
   - do:
       catch: /not supported/
       bulk:
@@ -56,3 +55,29 @@
           body:
             -  { "index": {}}
             -  {}
+
+  - do:
+      catch: /not supported/
+      delete_by_query:
+          index: ".watches"
+          body: {}
+
+  - do:
+      catch: /not supported/
+      delete_by_query:
+          index: ".watches"
+          type: "watch"
+          body: {}
+
+  - do:
+      catch: /not supported/
+      update_by_query:
+          index: ".watches"
+          body: {}
+
+  - do:
+      catch: /not supported/
+      update_by_query:
+          index: ".watches"
+          type: "watch"
+          body: {}