From b24cc44d72e29c882789826fec368f29a69d03ed Mon Sep 17 00:00:00 2001
From: Aleh Zasypkin <aleh.zasypkin@elastic.co>
Date: Thu, 3 Jul 2025 21:00:10 +0300
Subject: [PATCH] chore(security, tests): log a warning in tests if deprecated
 feature privilege is replaced with more privileges than necessary

---
 .../tests/features/deprecated_features.ts          | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/x-pack/test/security_api_integration/tests/features/deprecated_features.ts b/x-pack/test/security_api_integration/tests/features/deprecated_features.ts
index 1842c512fcfd5..3f5f7cb413933 100644
--- a/x-pack/test/security_api_integration/tests/features/deprecated_features.ts
+++ b/x-pack/test/security_api_integration/tests/features/deprecated_features.ts
@@ -316,13 +316,25 @@ export default function ({ getService }: FtrProviderContext) {
           for (const deprecatedAction of deprecatedActions) {
             if (
               isReplaceableAction(deprecatedAction) &&
-              !replacementActions.has(deprecatedAction)
+              !replacementActions.delete(deprecatedAction)
             ) {
               throw new Error(
                 `Action "${deprecatedAction}" granted by the privilege "${privilegeId}" of the deprecated feature "${feature.id}" is not properly replaced.`
               );
             }
           }
+
+          const extraReplacementActions =
+            Array.from(replacementActions).filter(isReplaceableAction);
+          if (extraReplacementActions.length > 0) {
+            log.warning(
+              `Replacement actions for the privilege "${privilegeId}" of the deprecated feature "${
+                feature.id
+              }" grant more privileges than they were granting before: ${JSON.stringify(
+                extraReplacementActions
+              )} via ${JSON.stringify(replacedBy)}.`
+            );
+          }
         }
       }
     });