# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  apollo_mcp_pilot_user:
    id: 8f7d3d2b-5e0e-4a3f-9d3f-1e6c4b7a2c10
    roles:
      - user
    attr:
      type: human
      tenants:
        "b1d2e3f4-5a6b-4c7d-8e9f-0a1b2c3d4e5f":
          tenant_uuid: "b1d2e3f4-5a6b-4c7d-8e9f-0a1b2c3d4e5f"
          tenant_type: "account"
          roles:
            ai_can_apollo_mcp_pilot:
              role: ai_can_apollo_mcp_pilot

  no_apollo_mcp_pilot_role_user:
    id: a5b6c7d8-1e2f-4a3b-9c8d-7e6f5a4b3c2d
    roles:
      - user
    attr:
      type: human
      tenants:
        "b1d2e3f4-5a6b-4c7d-8e9f-0a1b2c3d4e5f":
          tenant_uuid: "b1d2e3f4-5a6b-4c7d-8e9f-0a1b2c3d4e5f"
          tenant_type: "account"
          roles:
            minion:
              role: minion

resources:
  apollo_mcp_pilot_resource:
    id: apollo_mcp_pilot_1
    kind: apollo_mcp_pilot

name: ApolloMcpPilotTestSuite
description: Tests for verifying the apollo_mcp_pilot resource policy
tests:
  - name: Using apollo_mcp_pilot
    input:
      principals:
        - apollo_mcp_pilot_user
        - no_apollo_mcp_pilot_role_user
      resources:
        - apollo_mcp_pilot_resource
      actions:
        - use
    expected:
      - principal: apollo_mcp_pilot_user
        resource: apollo_mcp_pilot_resource
        actions:
          use: EFFECT_ALLOW
      - principal: no_apollo_mcp_pilot_role_user
        resource: apollo_mcp_pilot_resource
        actions:
          use: EFFECT_DENY