# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: audience
  schemas:
    principalSchema:
      ref: cerbos:///principal.json
    resourceSchema:
      ref: cerbos:///tenant_owned_resource.json
  importDerivedRoles:
    - audience_development_multitenancy_roles
    - fansifter_multitenancy_roles
  rules:
  - name: create
    actions: ["create"]
    derivedRoles: [
      "audience_development_admin",
      "audience_development_client",
      "audience_development_audience_manager",
      "fansifter_can_share_ad_campaign_audiences",
    ]
    effect: EFFECT_ALLOW
  - name: edit
    actions: ["edit"]
    derivedRoles: [
      "audience_development_admin",
      "audience_development_client",
      "audience_development_audience_manager",
      "fansifter_can_share_ad_campaign_audiences",
    ]
    effect: EFFECT_ALLOW
  - name: archive
    actions: ["archive"]
    derivedRoles: [
      "audience_development_admin",
      "audience_development_client",
      "audience_development_audience_manager",
      "fansifter_can_share_ad_campaign_audiences",
    ]
    effect: EFFECT_ALLOW
  - name: share
    actions: ["share"]
    derivedRoles: [
      "audience_development_admin",
      "audience_development_client",
      "audience_development_audience_manager",
      "fansifter_can_share_ad_campaign_audiences",
    ]
    effect: EFFECT_ALLOW
  - name: view
    actions: ["view"]
    derivedRoles: [
      "audience_development_admin",
      "audience_development_client",
      "audience_development_analyst",
      "audience_development_audience_manager",
      "fansifter_can_share_ad_campaign_audiences",
    ]
    effect: EFFECT_ALLOW
  - name: export_to_csv
    actions: ["export_to_csv"]
    derivedRoles: [
      "audience_development_admin",
      "audience_development_audience_manager",
      "fansifter_can_share_ad_campaign_audiences",
    ]
    effect: EFFECT_ALLOW
  - name: ad_target
    actions: [
      "create_ad_target",
      "edit_ad_target",
      "archive_ad_target",
      "share_ad_target",
      "view_ad_target",
    ]
    derivedRoles: [
      "fansifter_can_share_ad_campaign_audiences",
      "audience_development_admin",
      "audience_development_client",
      "audience_development_audience_manager",
    ]
    effect: EFFECT_ALLOW
  - name: email_target
    actions: [
      "create_email_target",
      "edit_email_target",
      "archive_email_target",
      "share_email_target",
      "view_email_target",
    ]
    derivedRoles: [
      "fansifter_can_create_email_campaigns",
      "audience_development_admin",
      "audience_development_client",
      "audience_development_audience_manager",
    ]
    effect: EFFECT_ALLOW
  - name: text_target
    actions: [
      "create_text_target",
      "edit_text_target",
      "archive_text_target",
      "share_text_target",
      "view_text_target",
    ]
    derivedRoles: [
      "fansifter_can_create_sms_campaigns",
      "audience_development_admin",
      "audience_development_client",
      "audience_development_audience_manager",
    ]
    effect: EFFECT_ALLOW
  - name: access
    actions: [ "access" ]
    derivedRoles: [
      "fansifter_can_share_ad_campaign_audiences",
      "fansifter_can_create_email_campaigns",
      "fansifter_can_create_sms_campaigns",
      "audience_development_admin",
      "audience_development_audience_manager",
    ]
    effect: EFFECT_ALLOW