---
apiVersion: "api.cerbos.dev/v1"
principalPolicy:
  principal: ff8b855a-b316-4f31-87db-415da0e02079
  version: default
  constants:
    import:
      - company_brand_tenant_uuids
  variables:
    import:
      - common_variables
  rules:
    - resource: account 
      actions:
        - name: can_create_account_only_under_sme_company_brand
          action: create
          condition:
            match:
              expr: V.resource_tenant == C.sme_company_brand_tenant_uuid
          effect: EFFECT_ALLOW
        - name: can_update_external_identifier_1
          action: update_external_identifier_1
          condition:
            match:
              expr: C.sme_company_brand_tenant_uuid in V.resource_tenant_hierarchy
          effect: EFFECT_ALLOW
        - name: can_update_country_id_legacy
          action: update_vendor_country_id
          condition:
            match:
              expr: C.sme_company_brand_tenant_uuid in V.resource_tenant_hierarchy
          effect: EFFECT_ALLOW
        - name: can_update_country_id
          action: "update:country_id"
          condition:
            match:
              expr: C.sme_company_brand_tenant_uuid in V.resource_tenant_hierarchy
          effect: EFFECT_ALLOW
    - resource: subaccount
      actions:
        - name: can_create_subaccount_under_sme_distributor_account
          action: create
          condition:
            match:
              all:
                of:
                - expr: C.sme_company_brand_tenant_uuid in V.resource_tenant_hierarchy
                - expr: R.attr.tenant.tenant_type == 'account'
                - expr: R.attr.is_distributor == true
          effect: EFFECT_ALLOW