# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: ad_connection
  schemas:
    principalSchema:
      ref: cerbos:///principal.json
    resourceSchema:
      ref: cerbos:///identity_and_tenant_owned_resource.json
  importDerivedRoles:
    - audience_development_multitenancy_roles
    - fansifter_multitenancy_roles
  rules:
  - name: connect
    actions: ["connect"]
    derivedRoles: [
      "any_tenant_audience_development_admin",
      "any_tenant_audience_development_client",
      "any_tenant_fansifter_can_connect_ad_accounts",
    ]
    condition:
      match:
        expr: P.id == R.attr.identity_uuid
    effect: EFFECT_ALLOW
  - name: revoke
    actions: ["revoke"]
    derivedRoles: [
      "any_tenant_audience_development_admin",
      "any_tenant_audience_development_client",
      "any_tenant_fansifter_can_connect_ad_accounts",
    ]
    condition:
      match:
        expr: P.id == R.attr.identity_uuid
    effect: EFFECT_ALLOW
  - name: view
    actions: ["view"]
    derivedRoles: [
      "any_tenant_audience_development_admin",
      "any_tenant_audience_development_client",
      "any_tenant_fansifter_can_connect_ad_accounts",
    ]
    condition:
      match:
        expr: P.id == R.attr.identity_uuid
    effect: EFFECT_ALLOW
  - name: access
    actions: ["access"]
    derivedRoles: [
      "fansifter_can_connect_ad_accounts",
    ]
    effect: EFFECT_ALLOW