# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/Policy.schema.json
---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  version: default
  resource: contribution
  schemas:
    principalSchema:
      ref: cerbos:///principal.json
    resourceSchema:
      ref: cerbos:///identity_and_tenant_owned_resource.json
  importDerivedRoles:
    - nr_performance
    - a360_roles
  rules:
  - name: contribution_view
    actions: ["view:*"]
    derivedRoles: [
      "content_nr_contribution_can_view",
      "content_nr_contribution_can_create",
      "content_nr_contribution_can_manage",
      "content_nr_contribution_can_delete",
    ]
    effect: EFFECT_ALLOW
  - name: contribution_create
    actions: ["create"]
    derivedRoles: [
      "content_nr_contribution_can_create",
      "content_nr_contribution_can_manage",
      "content_nr_contribution_can_delete",
    ]
    effect: EFFECT_ALLOW
  - name: contribution_edit
    actions: ["edit"]
    derivedRoles: [
      "content_nr_contribution_can_manage",
      "content_nr_contribution_can_delete",
    ]
    effect: EFFECT_ALLOW
  - name: contribution_delete
    actions: ["delete"]
    derivedRoles: [
      "content_nr_contribution_can_delete",
    ]
    effect: EFFECT_ALLOW
  - name: abacus_a360_view_only
    actions: [
      "view:basic",
      "view:accounting",
    ]
    derivedRoles: [
      "account_admin",
      "contract_admin",
      "account_edit",
      "contract_viewer",
    ]
    effect: EFFECT_ALLOW