# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
resources:
  release123:
    id: release123
    kind: digital_audio
    attr:
      tenant:
        tenant_uuid: "b25cdcad-68b6-4c06-a23b-5e6fd4706bf6"
  release123_with_empty_feature_controls:
    id: release1234
    kind: digital_audio
    attr:
      tenant:
        tenant_uuid: "b25cdcad-68b6-4c06-a23b-5e6fd4706bf6"
        account_feature_controls: []
  release123_with_irrelevant_feature_controls:
    id: release1234
    kind: digital_audio
    attr:
      tenant:
        tenant_uuid: "b25cdcad-68b6-4c06-a23b-5e6fd4706bf6"
        account_feature_controls:
          - 1
          - 2
          - 3
  release123_with_bulk_upload_feature_control:
    id: release1234
    kind: digital_audio
    attr:
      tenant:
        tenant_uuid: "b25cdcad-68b6-4c06-a23b-5e6fd4706bf6"
        account_feature_controls:
          - 1
          - 2
          - 3
          - 43
  release123_with_bulk_session_id:
    id: release1234
    kind: digital_audio
    attr:
      bulk_session_id: "session-abc-123"
      tenant:
        tenant_uuid: "b25cdcad-68b6-4c06-a23b-5e6fd4706bf6"
        account_feature_controls:
          - 1
          - 2
          - 3
          - 43

name: DigitalAudioTestSuite
description: Test for verifying digital_audio resource policies
tests:
  - name: Viewing a digital audio product
    input:
      principals:
        - reviewer_1
        - reviewer_2
        - some_hacker
      resources:
        - release123
      actions:
        - view
    expected:
      # Same tenant_uuid, user has content_can_review_digital_audio role
      - principal: reviewer_1
        resource: release123
        actions:
          view: EFFECT_ALLOW
      # Different tenant_uuid, user has content_can_review_digital_audio role
      - principal: reviewer_2
        resource: release123
        actions:
          view: EFFECT_DENY
      # Missing content_can_review_digital_audio role
      - principal: some_hacker
        resource: release123
        actions:
          view: EFFECT_DENY

  - name: Reviewing a digital audio product
    input:
      principals:
        - reviewer_1
        - reviewer_2
        - some_hacker
      resources:
        - release123
      actions:
        - review
    expected:
      # Same tenant_uuid, user has content_can_review_digital_audio role
      - principal: reviewer_1
        resource: release123
        actions:
          review: EFFECT_ALLOW
      # Different tenant_uuid, user has content_can_review_digital_audio role
      - principal: reviewer_2
        resource: release123
        actions:
          review: EFFECT_DENY
      # Missing content_can_review_digital_audio role
      - principal: some_hacker
        resource: release123
        actions:
          review: EFFECT_DENY
  - name: Bulk creating digital audio products
    input:
      principals:
        - bulk_creator_1
        - bulk_creator_2
        - some_hacker
        - workstation_catalog_1
        - workstation_catalog_2
        - workstation_admin_1
        - workstation_admin_2
      resources:
        - release123
        - release123_with_empty_feature_controls
        - release123_with_irrelevant_feature_controls
        - release123_with_bulk_upload_feature_control
      actions:
        - bulk_create
    expected:
      # Same tenant_uuid, user has content_ccm_digital_audio_can_bulk_create role
      - principal: bulk_creator_1
        resource: release123
        actions:
          bulk_create: EFFECT_ALLOW
      - principal: bulk_creator_1
        resource: release123_with_empty_feature_controls
        actions:
          bulk_create: EFFECT_ALLOW
      - principal: bulk_creator_1
        resource: release123_with_irrelevant_feature_controls
        actions:
          bulk_create: EFFECT_ALLOW
      - principal: bulk_creator_1
        resource: release123_with_bulk_upload_feature_control
        actions:
          bulk_create: EFFECT_ALLOW
      # Different tenant_uuid, user has content_ccm_digital_audio_can_bulk_create role
      - principal: bulk_creator_2
        resource: release123
        actions:
          bulk_create: EFFECT_DENY
      - principal: bulk_creator_2
        resource: release123_with_empty_feature_controls
        actions:
          bulk_create: EFFECT_DENY
      - principal: bulk_creator_2
        resource: release123_with_irrelevant_feature_controls
        actions:
          bulk_create: EFFECT_DENY
      - principal: bulk_creator_2
        resource: release123_with_bulk_upload_feature_control
        actions:
          bulk_create: EFFECT_DENY
      # Missing content_ccm_digital_audio_can_bulk_create role
      - principal: some_hacker
        resource: release123
        actions:
          bulk_create: EFFECT_DENY
      - principal: some_hacker
        resource: release123_with_empty_feature_controls
        actions:
          bulk_create: EFFECT_DENY
      - principal: some_hacker
        resource: release123_with_irrelevant_feature_controls
        actions:
          bulk_create: EFFECT_DENY
      - principal: some_hacker
        resource: release123_with_bulk_upload_feature_control
        actions:
          bulk_create: EFFECT_DENY
      - principal: workstation_catalog_1
        resource: release123
        actions:
          bulk_create: EFFECT_DENY
      - principal: workstation_catalog_1
        resource: release123_with_empty_feature_controls
        actions:
          bulk_create: EFFECT_DENY
      - principal: workstation_catalog_1
        resource: release123_with_irrelevant_feature_controls
        actions:
          bulk_create: EFFECT_DENY
      - principal: workstation_catalog_1
        resource: release123_with_bulk_upload_feature_control
        actions:
          bulk_create: EFFECT_ALLOW
      - principal: workstation_admin_1
        resource: release123
        actions:
          bulk_create: EFFECT_DENY
      - principal: workstation_admin_1
        resource: release123_with_empty_feature_controls
        actions:
          bulk_create: EFFECT_DENY
      - principal: workstation_admin_1
        resource: release123_with_irrelevant_feature_controls
        actions:
          bulk_create: EFFECT_DENY
      - principal: workstation_admin_1
        resource: release123_with_bulk_upload_feature_control
        actions:
          bulk_create: EFFECT_ALLOW

  - name: bulk_session_id attribute is accepted and does not change outcomes
    input:
      principals:
        - bulk_creator_1
        - bulk_creator_2
        - some_hacker
        - workstation_catalog_1
        - workstation_admin_1
      resources:
        - release123_with_bulk_session_id
      actions:
        - view
        - review
        - bulk_create
    expected:
      # bulk_creator_1: same tenant + bulk_create role -> ALLOW (matches release123_with_bulk_upload_feature_control)
      - principal: bulk_creator_1
        resource: release123_with_bulk_session_id
        actions:
          view: EFFECT_DENY
          review: EFFECT_DENY
          bulk_create: EFFECT_ALLOW
      # bulk_creator_2: different tenant -> DENY
      - principal: bulk_creator_2
        resource: release123_with_bulk_session_id
        actions:
          view: EFFECT_DENY
          review: EFFECT_DENY
          bulk_create: EFFECT_DENY
      # some_hacker: no relevant roles -> DENY
      - principal: some_hacker
        resource: release123_with_bulk_session_id
        actions:
          view: EFFECT_DENY
          review: EFFECT_DENY
          bulk_create: EFFECT_DENY
      # workstation_catalog_1: feature control 43 present -> bulk_create ALLOW
      - principal: workstation_catalog_1
        resource: release123_with_bulk_session_id
        actions:
          view: EFFECT_DENY
          review: EFFECT_DENY
          bulk_create: EFFECT_ALLOW
      # workstation_admin_1: feature control 43 present -> bulk_create ALLOW
      - principal: workstation_admin_1
        resource: release123_with_bulk_session_id
        actions:
          view: EFFECT_DENY
          review: EFFECT_DENY
          bulk_create: EFFECT_ALLOW
  - name: Machine can update digital audio; others cannot
    input:
      principals:
        # lambda_product_staging_submit_product is the name of the machine
        - lambda_product_staging_submit_product
        - bulk_creator_1
        - workstation_admin_1
      resources:
        - release123
        - release123_with_bulk_session_id
      actions:
        - update
    expected:
      - principal: lambda_product_staging_submit_product
        resource: release123
        actions:
          update: EFFECT_ALLOW
      - principal: lambda_product_staging_submit_product
        resource: release123_with_bulk_session_id
        actions:
          update: EFFECT_ALLOW
      - principal: bulk_creator_1
        resource: release123
        actions:
          update: EFFECT_DENY
      - principal: bulk_creator_1
        resource: release123_with_bulk_session_id
        actions:
          update: EFFECT_DENY
      - principal: workstation_admin_1
        resource: release123
        actions:
          update: EFFECT_DENY
      - principal: workstation_admin_1
        resource: release123_with_bulk_session_id
        actions:
          update: EFFECT_DENY