# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: "api.cerbos.dev/v1"
derivedRoles:
  name: multitenancy_roles
  definitions:
    - name: vendor_star 
      parentRoles: ["user"] 
      condition: 
        match:
          expr: P.attr.tenants["*"] != null
    - name: tenant
      parentRoles: ["user"]
      condition:
        match:
          any:
            of:
            - expr: R.attr.account_id in P.attr.tenants
#  issue is if someone is subaccount 31 but should not have access to all the parent label stuff
    - name: subaccount_tenant
      parentRoles: ["user"]
      condition:
        match:
          any:
            of:
            # - expr: P.attr.tenants.exists(t, "subaccounts" in P.attr.tenants[t])
            - expr: P.attr.tenants.exists(t, R.attr.subaccount_id in P.attr.tenants[t].subaccounts.subaccount_ids)