# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: identity
  schemas:
    principalSchema:
      ref: cerbos:///principal.json
    resourceSchema:
      ref: cerbos:///identity_and_tenant_owned_resource.json
  importDerivedRoles:
    - pde_teams
    - pp_machines
    - rap_admin
    - resource_owner
    - seat_roles
  constants:
    local:
      label: latest
      seat_tenant_types:
        - account
        - company_brand
        - parent_company
      ows_permissions_rap_admin_tenant_types:
        - account
        - subaccount
        - label_participant
        - collaborator
  rules:
  - name: list_tenants_for_identity
    actions: ["list_tenants"]
    derivedRoles: [
      "pde_team_pp",
      "pde_team_fansifter",
      "pde_team_leadership",
      "pde_team_songwhip",
      "any_tenant_ows_permissions_rap_admin",
      "any_tenant_seat_can_administer_users"
    ]
    effect: EFFECT_ALLOW
  - name: view_single_identity_tenant
    actions: ["view"]
    derivedRoles: [
      "pde_team_pp",
      "pde_team_fansifter",
      "pde_team_leadership",
      "pde_team_songwhip",
      "ows_permissions_rap_admin",
    ]
    effect: EFFECT_ALLOW
  - name: view_and_list_yourself
    actions: ["view", "list_tenants"]
    derivedRoles: ["identity_owned_resource"]
    effect: EFFECT_ALLOW
  - name: attach_and_detach_for_single_tenant
    actions: ["attach_and_detach_role"]
    derivedRoles: [
      "pde_team_pp",
      "pde_team_fansifter",
      "pde_team_leadership",
      "pde_team_songwhip",
      "pdp_backfill",
    ]
    condition:
      match:
        expr: P.id != R.attr.identity_uuid
    effect: EFFECT_ALLOW
  - name: deactivate_all_tenants
    actions: ["deactivate_all"]
    derivedRoles: [
      "pde_team_pp",
      "pde_team_leadership",
      "any_tenant_ows_permissions_rap_admin",
      "any_tenant_seat_can_administer_users",
    ]
    condition:
      match:
        expr: P.id != R.attr.identity_uuid
    effect: EFFECT_ALLOW
  - name: deactivate_for_single_tenant
    actions: ["deactivate"]
    derivedRoles: [
      "pde_team_pp",
      "pde_team_leadership",
      "ows_permissions_rap_admin",
      "seat_can_administer_users",
    ]
    condition:
      match:
        expr: P.id != R.attr.identity_uuid
    effect: EFFECT_ALLOW
  - name: check_identity_resources
    actions: ["check_resources"]
    derivedRoles: [
      "identity_owned_resource",
      "pde_team_pp",
      "pde_team_knr",
    ]
    effect: EFFECT_ALLOW
  - name: seat_attach_and_detach
    actions: ["attach_and_detach_role"]
    derivedRoles: ["seat_can_administer_users"]
    condition:
      match:
        all:
          of:
            - expr: R.attr.tenant.tenant_type in C.seat_tenant_types
            - expr: P.id != R.attr.identity_uuid
    effect: EFFECT_ALLOW
  - name: seat_view_single_identity_tenant
    actions: ["view"]
    derivedRoles: ["seat_can_administer_users"]
    condition:
      match:
        expr: R.attr.tenant.tenant_type in C.seat_tenant_types
    effect: EFFECT_ALLOW
  - name: seat_list_employees
    actions: ["list_employees"]
    derivedRoles: ["any_tenant_seat_can_administer_users"]
    effect: EFFECT_ALLOW
  - name: seat_create_employee
    actions: ["create_employee"]
    derivedRoles: ["any_tenant_seat_can_administer_users"]
    effect: EFFECT_ALLOW
  - name: seat_manage_employee
    actions: ["manage_employee"]
    derivedRoles: ["any_tenant_seat_can_administer_users"]
    effect: EFFECT_ALLOW
  - name: ows_permissions_rap_admin_attach_and_detach
    actions: ["attach_and_detach_role"]
    derivedRoles: ["ows_permissions_rap_admin"]
    condition:
      match:
        all:
          of:
            - expr: R.attr.tenant.tenant_type in C.ows_permissions_rap_admin_tenant_types
            - expr: P.id != R.attr.identity_uuid
    effect: EFFECT_ALLOW