# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
derivedRoles:
  name: audience_development_multitenancy_roles
  variables:
    import:
    - common_variables
    local:
      resource_joint_venture_consumer_tenant_hierarchy_list: R.attr.joint_venture.tenants.filter(t, t["is_consumer"]).map(t, t["tenant_hierarchy"])
      principal_audience_development_admin_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'audience_development_admin')).map(t,t)
      principal_audience_development_client_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'audience_development_client')).map(t,t)
      principal_audience_development_analyst_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'audience_development_analyst')).map(t,t)
      principal_audience_development_audience_manager_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'audience_development_audience_manager')).map(t,t)
      audience_development_roles: '[
        "audience_development_admin",
        "audience_development_client"
        ]'
      tenants_with_audience_development_roles: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r in V.audience_development_roles)).map(t,t)
  definitions:
  - name: audience_development_admin
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['audience_development_admin'] != null
          - expr: hasIntersection(V.principal_audience_development_admin_tenant_list, V.resource_tenant_hierarchy)

  - name: audience_development_client
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['audience_development_client'] != null
          - expr: hasIntersection(V.principal_audience_development_client_tenant_list, V.resource_tenant_hierarchy)
  - name: audience_development_analyst
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['audience_development_analyst'] != null
          - expr: hasIntersection(V.principal_audience_development_analyst_tenant_list, V.resource_tenant_hierarchy)
  - name: audience_development_audience_manager
    parentRoles:
      - user
    condition:
      match:
        any:
          of:
            - expr: P.attr.tenants[V.resource_tenant].roles['audience_development_audience_manager'] != null
            - expr: hasIntersection(V.principal_audience_development_audience_manager_tenant_list, V.resource_tenant_hierarchy)
  - name: audience_development_joint_venture_consumer
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          # hasIntersection is evaluating the intersection of two lists:
          # List of tenants that are consumers of the resource's joint venture
          # List of the principal's tenants where they have the specified role (e.g. audience_development_admin)
          - expr: hasIntersection(R.attr.joint_venture.tenants.filter(t, t["is_consumer"]).map(t, t["tenant_uuid"]), V.principal_audience_development_admin_tenant_list)
          - expr: hasIntersection(R.attr.joint_venture.tenants.filter(t, t["is_consumer"]).map(t, t["tenant_uuid"]), V.principal_audience_development_client_tenant_list)
          - expr: hasIntersection(R.attr.joint_venture.tenants.filter(t, t["is_consumer"]).map(t, t["tenant_uuid"]), V.principal_audience_development_analyst_tenant_list)
          - expr: hasIntersection(R.attr.joint_venture.tenants.filter(t, t["is_consumer"]).map(t, t["tenant_uuid"]), V.principal_audience_development_audience_manager_tenant_list)
          # Below we are looking to see if the principal has an audience development role in a tenant that
          # exists in the tenant hierarchy of any of the joint venture's tenants
          - expr: V.resource_joint_venture_consumer_tenant_hierarchy_list.exists(th, hasIntersection(th, V.principal_audience_development_admin_tenant_list))
          - expr: V.resource_joint_venture_consumer_tenant_hierarchy_list.exists(th, hasIntersection(th, V.principal_audience_development_client_tenant_list))
          - expr: V.resource_joint_venture_consumer_tenant_hierarchy_list.exists(th, hasIntersection(th, V.principal_audience_development_analyst_tenant_list))
          - expr: V.resource_joint_venture_consumer_tenant_hierarchy_list.exists(th, hasIntersection(th, V.principal_audience_development_audience_manager_tenant_list))
  - name: any_tenant_audience_development_admin
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_audience_development_admin_tenant_list.size() > 0
  - name: any_tenant_audience_development_client
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_audience_development_client_tenant_list.size() > 0
  - name: any_tenant_audience_development_analyst
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_audience_development_analyst_tenant_list.size() > 0
  - name: any_tenant_audience_development_audience_manager
    parentRoles:
      - user
    condition:
      match:
        expr: V.principal_audience_development_audience_manager_tenant_list.size() > 0
  - name: audience_development_tenant_shared_with
    parentRoles:
      - user
    condition:
      match:
        expr: hasIntersection(V.tenants_with_audience_development_roles, R.attr.shared_with_tenants.map(t, t["tenant_uuid"]))