# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
derivedRoles:
  name: fansifter_multitenancy_roles
  variables:
    import:
    - common_variables
    local:
      resource_joint_venture_consumer_tenant_hierarchy_list: R.attr.joint_venture.tenants.filter(t, t["is_consumer"]).map(t, t["tenant_hierarchy"])
      principal_fansifter_can_view_fan_data_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'fansifter_can_view_fan_data')).map(t,t)
      principal_fansifter_can_create_ad_reports_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'fansifter_can_create_ad_reports')).map(t,t)
      principal_fansifter_can_share_ad_campaign_audiences_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'fansifter_can_share_ad_campaign_audiences')).map(t,t)
      principal_fansifter_can_connect_ad_accounts_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'fansifter_can_connect_ad_accounts')).map(t,t)
      principal_fansifter_can_view_email_campaigns_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'fansifter_can_view_email_campaigns')).map(t,t)
      principal_fansifter_can_create_email_campaigns_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'fansifter_can_create_email_campaigns')).map(t,t)
      principal_fansifter_can_view_sms_campaigns_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'fansifter_can_view_sms_campaigns')).map(t,t)
      principal_fansifter_can_create_sms_campaigns_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'fansifter_can_create_sms_campaigns')).map(t,t)
  definitions:
  - name: fansifter_can_view_fan_data
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['fansifter_can_view_fan_data'] != null
          - expr: hasIntersection(V.principal_fansifter_can_view_fan_data_tenant_list, V.resource_tenant_hierarchy)
  - name: fansifter_can_create_ad_reports
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['fansifter_can_create_ad_reports'] != null
          - expr: hasIntersection(V.principal_fansifter_can_create_ad_reports_tenant_list, V.resource_tenant_hierarchy)
  - name: fansifter_can_share_ad_campaign_audiences
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['fansifter_can_share_ad_campaign_audiences'] != null
          - expr: hasIntersection(V.principal_fansifter_can_share_ad_campaign_audiences_tenant_list, V.resource_tenant_hierarchy)
  - name: fansifter_can_connect_ad_accounts
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['fansifter_can_connect_ad_accounts'] != null
          - expr: hasIntersection(V.principal_fansifter_can_connect_ad_accounts_tenant_list, V.resource_tenant_hierarchy)
  - name: fansifter_can_view_email_campaigns
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['fansifter_can_view_email_campaigns'] != null
          - expr: hasIntersection(V.principal_fansifter_can_view_email_campaigns_tenant_list, V.resource_tenant_hierarchy)
  - name: fansifter_can_create_email_campaigns
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['fansifter_can_create_email_campaigns'] != null
          - expr: hasIntersection(V.principal_fansifter_can_create_email_campaigns_tenant_list, V.resource_tenant_hierarchy)
  - name: fansifter_can_view_sms_campaigns
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['fansifter_can_view_sms_campaigns'] != null
          - expr: hasIntersection(V.principal_fansifter_can_view_sms_campaigns_tenant_list, V.resource_tenant_hierarchy)
  - name: fansifter_can_create_sms_campaigns
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['fansifter_can_create_sms_campaigns'] != null
          - expr: hasIntersection(V.principal_fansifter_can_create_sms_campaigns_tenant_list, V.resource_tenant_hierarchy)
  - name: fansifter_joint_venture_consumer
    parentRoles:
      - user
    condition:
      match:
        any:
          of:
            # hasIntersection is evaluating the intersection of two lists:
            # List of tenants that are consumers of the resource's joint venture
            # List of the principal's tenants where they have the specified role (e.g. fansifter_can_view_fan_data)
            - expr: hasIntersection(R.attr.joint_venture.tenants.filter(t, t["is_consumer"]).map(t, t["tenant_uuid"]), V.principal_fansifter_can_view_fan_data_tenant_list)
            # Below we are looking to see if the principal has a fansifter role in a tenant that
            # exists in the tenant hierarchy of any of the joint venture's tenants
            - expr: V.resource_joint_venture_consumer_tenant_hierarchy_list.exists(th, hasIntersection(th, V.principal_fansifter_can_view_fan_data_tenant_list))
  - name: any_tenant_fansifter_can_view_fan_data
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_fansifter_can_view_fan_data_tenant_list.size() > 0
  - name: any_tenant_fansifter_can_create_ad_reports
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_fansifter_can_create_ad_reports_tenant_list.size() > 0
  - name: any_tenant_fansifter_can_share_ad_campaign_audiences
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_fansifter_can_share_ad_campaign_audiences_tenant_list.size() > 0
  - name: any_tenant_fansifter_can_connect_ad_accounts
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_fansifter_can_connect_ad_accounts_tenant_list.size() > 0
  - name: any_tenant_fansifter_can_view_email_campaigns
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_fansifter_can_view_email_campaigns_tenant_list.size() > 0
  - name: any_tenant_fansifter_can_create_email_campaigns
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_fansifter_can_create_email_campaigns_tenant_list.size() > 0
  - name: any_tenant_fansifter_can_view_sms_campaigns
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_fansifter_can_view_sms_campaigns_tenant_list.size() > 0
  - name: any_tenant_fansifter_can_create_sms_campaigns
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_fansifter_can_create_sms_campaigns_tenant_list.size() > 0