upsert ten=10 can_admin_relocate_range=true can_admin_scatter=true can_admin_split=true can_admin_unsplit=true can_view_node_info=true can_view_tsdb_metrics=true can_prepare_txns=true
----
ok

upsert ten=11 can_admin_relocate_range=false can_admin_scatter=false can_admin_split=false can_admin_unsplit=false can_view_node_info=false can_view_tsdb_metrics=false can_prepare_txns=false
----
ok

has-capability-for-batch ten=10 cmds=(AdminChangeReplicas, AdminRelocateRange, AdminTransferLease, Scan, ConditionalPut)
----
ok

has-capability-for-batch ten=10 cmds=(AdminScatter, Scan, ConditionalPut)
----
ok

# Tenant 10 should be able to issue splits, given it has the capability to do
# so.
has-capability-for-batch ten=10 cmds=(AdminSplit, Scan, ConditionalPut)
----
ok

has-capability-for-batch ten=10 cmds=(AdminUnsplit, Scan, ConditionalPut)
----
ok

has-capability-for-batch ten=11 cmds=(AdminChangeReplicas, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_relocate_range" (*kvpb.AdminChangeReplicasRequest)

has-capability-for-batch ten=11 cmds=(AdminRelocateRange, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_relocate_range" (*kvpb.AdminRelocateRangeRequest)

has-capability-for-batch ten=11 cmds=(AdminScatter, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_scatter" (*kvpb.AdminScatterRequest)

# Tenant 11 shouldn't be able to issue splits.
has-capability-for-batch ten=11 cmds=(AdminSplit, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_split" (*kvpb.AdminSplitRequest)

has-capability-for-batch ten=11 cmds=(AdminTransferLease, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_relocate_range" (*kvpb.AdminTransferLeaseRequest)

has-capability-for-batch ten=11 cmds=(AdminUnsplit, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_unsplit" (*kvpb.AdminUnsplitRequest)

# Test that the order of the split request doesn't have any effect.
has-capability-for-batch ten=11 cmds=(Scan, ConditionalPut, AdminSplit)
----
client tenant does not have capability "can_admin_split" (*kvpb.AdminSplitRequest)

# However, a batch request which doesn't include a split (by tenant 11) should
# work as you'd expect.
has-capability-for-batch ten=11 cmds=(Scan, ConditionalPut)
----
ok

# Ditto for tenant 10.
has-capability-for-batch ten=10 cmds=(Scan, ConditionalPut)
----
ok

# Lastly, flip tenant 10's capability for splits; ensure it can no longer issue
# splits as a result.
upsert ten=10 can_admin_relocate_range=false can_admin_scatter=true can_admin_split=false can_admin_unsplit=false can_view_node_info=true can_view_tsdb_metrics=true can_prepare_txns=true
----
ok

has-capability-for-batch ten=10 cmds=(AdminChangeReplicas, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_relocate_range" (*kvpb.AdminChangeReplicasRequest)

has-capability-for-batch ten=10 cmds=(AdminRelocateRange, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_relocate_range" (*kvpb.AdminRelocateRangeRequest)

has-capability-for-batch ten=10 cmds=(AdminChangeReplicas, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_relocate_range" (*kvpb.AdminChangeReplicasRequest)

has-capability-for-batch ten=10 cmds=(AdminScatter, Scan, ConditionalPut)
----
ok

has-capability-for-batch ten=10 cmds=(AdminSplit, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_split" (*kvpb.AdminSplitRequest)

# Does not affect admin scatters.
has-capability-for-batch ten=10 cmds=(AdminScatter, Scan, ConditionalPut)
----
ok

has-capability-for-batch ten=10 cmds=(AdminTransferLease, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_relocate_range" (*kvpb.AdminTransferLeaseRequest)

has-capability-for-batch ten=10 cmds=(AdminUnsplit, Scan, ConditionalPut)
----
client tenant does not have capability "can_admin_unsplit" (*kvpb.AdminUnsplitRequest)

# However, this has no effect on batch requests that don't contain splits.
has-capability-for-batch ten=10 cmds=(Scan, ConditionalPut)
----
ok

# Tenant 10 should be able to prepare transactions, but tenant 11 should not.
has-capability-for-batch ten=10 cmds=(EndTxn)
----
ok

has-capability-for-batch ten=10 cmds=(EndTxn{Prepare})
----
ok

has-capability-for-batch ten=11 cmds=(EndTxn)
----
ok

has-capability-for-batch ten=11 cmds=(EndTxn{Prepare})
----
client tenant does not have capability "can_prepare_txns" (*kvpb.EndTxnRequest)

upsert ten=10 can_admin_relocate_range=false can_admin_scatter=true can_admin_split=false can_admin_unsplit=false can_view_node_info=true can_view_tsdb_metrics=true can_prepare_txns=false
----
ok

has-capability-for-batch ten=10 cmds=(EndTxn)
----
ok

has-capability-for-batch ten=10 cmds=(EndTxn{Prepare})
----
client tenant does not have capability "can_prepare_txns" (*kvpb.EndTxnRequest)

has-node-status-capability ten=10
----
ok

has-node-status-capability ten=11
----
client tenant does not have capability to query cluster node metadata

has-tsdb-query-capability ten=10
----
ok

has-tsdb-query-capability ten=11
----
client tenant does not have capability to query timeseries data

upsert ten=11 exempt_from_rate_limiting=true
----
ok

is-exempt-from-rate-limiting ten=11
----
true

is-exempt-from-rate-limiting ten=10
----
false
