# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
resources:
  contentModerationResource123:
    id: "contentModerationResource123"
    kind: "content_moderation"

name: ContentModerationTestSuite
description: Test for verifying content_moderation resource policies
tests:
  - name: Accessing content moderation resource
    input:
      principals:
        - content_moderation_manager_1
        - content_moderation_manager_2
        - some_hacker
      resources:
        - contentModerationResource123
      actions:
        - view
        - edit
        - create
        - delete
    expected:
      # Has any_tenant_content_moderation_tool_can_manage derived role (subaccount tenant)
      - principal: content_moderation_manager_1
        resource: contentModerationResource123
        actions:
          view: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          create: EFFECT_ALLOW
          delete: EFFECT_ALLOW
      # Has any_tenant_content_moderation_tool_can_manage derived role (account tenant)
      - principal: content_moderation_manager_2
        resource: contentModerationResource123
        actions:
          view: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          create: EFFECT_ALLOW
          delete: EFFECT_ALLOW
      # Missing content_moderation_tool_can_manage role entirely
      - principal: some_hacker
        resource: contentModerationResource123
        actions:
          view: EFFECT_DENY
          edit: EFFECT_DENY
          create: EFFECT_DENY
          delete: EFFECT_DENY