# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
derivedRoles:
  name: nr_ownership
  variables:
    import:
    - common_variables
    local:
      principal_content_nr_ownership_sr_can_view_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'content_nr_ownership_sr_can_view')).map(t,t)
      principal_content_nr_ownership_sr_can_create_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'content_nr_ownership_sr_can_create')).map(t,t)
      principal_content_nr_ownership_sr_can_manage_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'content_nr_ownership_sr_can_manage')).map(t,t)
      principal_content_nr_ownership_sr_can_delete_tenant_list: P.attr.tenants.filter(t, P.attr.tenants[t].roles.exists(r, r == 'content_nr_ownership_sr_can_delete')).map(t,t)
  definitions:
  - name: content_nr_ownership_sr_can_view
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['content_nr_ownership_sr_can_view'] != null
          - expr: hasIntersection(V.principal_content_nr_ownership_sr_can_view_tenant_list, V.resource_tenant_hierarchy)
  - name: content_nr_ownership_sr_can_create
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['content_nr_ownership_sr_can_create'] != null
          - expr: hasIntersection(V.principal_content_nr_ownership_sr_can_create_tenant_list, V.resource_tenant_hierarchy)
  - name: content_nr_ownership_sr_can_manage
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['content_nr_ownership_sr_can_manage'] != null
          - expr: hasIntersection(V.principal_content_nr_ownership_sr_can_manage_tenant_list, V.resource_tenant_hierarchy)
  - name: content_nr_ownership_sr_can_delete
    parentRoles:
    - user
    condition:
      match:
        any:
          of:
          - expr: P.attr.tenants[V.resource_tenant].roles['content_nr_ownership_sr_can_delete'] != null
          - expr: hasIntersection(V.principal_content_nr_ownership_sr_can_delete_tenant_list, V.resource_tenant_hierarchy)
  - name: any_tenant_content_nr_ownership_sr_can_view
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_content_nr_ownership_sr_can_view_tenant_list.size() > 0
  - name: any_tenant_content_nr_ownership_sr_can_create
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_content_nr_ownership_sr_can_create_tenant_list.size() > 0
  - name: any_tenant_content_nr_ownership_sr_can_manage
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_content_nr_ownership_sr_can_manage_tenant_list.size() > 0
  - name: any_tenant_content_nr_ownership_sr_can_delete
    parentRoles:
    - user
    condition:
      match:
        expr: V.principal_content_nr_ownership_sr_can_delete_tenant_list.size() > 0