# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: account
  schemas:
    principalSchema:
      ref: cerbos:///principal.json
    resourceSchema:
      ref: cerbos:///tenant_owned_resource.json
  importDerivedRoles:
    - a360_roles
    - pde_teams
  rules:
  - name: create
    actions: ["create"]
    derivedRoles: [
      "account_admin",
      "contract_admin"
    ]
    effect: EFFECT_ALLOW
  - name: view
    actions: ["view"]
    derivedRoles: [
      "account_admin",
      "account_edit",
      "contract_admin",
      "contract_viewer",
      "pde_team_pp",
      "pde_team_tap",
      "pde_team_platform_oncall"
    ]
    effect: EFFECT_ALLOW
  - name: view_account_info
    actions: ["view_account_info"]
    derivedRoles: [
      "account_admin",
      "account_edit",
      "contract_admin",
      "contract_viewer",
      "pde_team_pp",
      "pde_team_tap",
      "pde_team_platform_oncall"
    ]
    effect: EFFECT_ALLOW
  - name: view_abacus_account_info
    actions: ["view_abacus_account_info"]
    derivedRoles: [
      "account_admin",
      "account_edit",
      "contract_admin",
      "contract_viewer"
    ]
    effect: EFFECT_ALLOW
  - name: view_account_payee_abacus_state
    actions: ["view_account_payee_abacus_state"]
    derivedRoles: [
      "account_admin",
      "account_edit",
      "contract_admin",
      "contract_viewer"
    ]
    effect: EFFECT_ALLOW
  - name: view_pending_payment
    actions: ["view_pending_payment"]
    derivedRoles: [
      "account_admin",
      "account_edit",
      "contract_admin",
      "contract_viewer"
    ]
    effect: EFFECT_ALLOW
  - name: update_info
    actions: ["update:info"]
    derivedRoles: [
      "account_admin",
      "contract_admin",
      "account_edit"
    ]
    effect: EFFECT_ALLOW
  - name: update_internal_staff
    actions: ["update:internal_staff"]
    derivedRoles: [
      "account_admin"
    ]
    effect: EFFECT_ALLOW
  - name: update_country_id
    actions: ["update:country_id"]
    derivedRoles: [
      "account_admin"
    ]
    effect: EFFECT_ALLOW
  # unused - will be used soon.
  - name: view_account_service_tier
    actions: ["view_account_service_tier"]
    derivedRoles: [
      "account_admin",
      "account_edit",
      "contract_admin",
      "contract_viewer"
    ]
    effect: EFFECT_ALLOW
  - name: update_service_tier
    actions: ["update:service_tier"]
    derivedRoles: [
      "account_admin"
    ]
    effect: EFFECT_ALLOW
  # unused and basic company_brand info is public
  - name: view_account_company_brand
    actions: ["view_account_company_brand"]
    derivedRoles: [
      "account_admin",
      "account_edit",
      "contract_admin",
      "contract_viewer"
    ]
    effect: EFFECT_ALLOW
  # unused - will be used in ows-account.
  - name: update_account_company_brand
    actions: ["update_account_company_brand"]
    derivedRoles: [
      "account_admin",
      "contract_admin"
    ]
    effect: EFFECT_ALLOW
  - name: delete
    actions: ["delete"]
    derivedRoles: [
      "account_admin"
    ]
    effect: EFFECT_ALLOW