# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
resources:
  product:
    id: product
    kind: product
    attr:
      tenant:
        tenant_uuid: "d6455851-3f86-48d8-b102-8d996eb92645"
        tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"]

name: ProductApplyAssetRevisionActionsTestSuite
description: Tests for the lambda-content-digital-revision-apply-assets machine principal policy covering the apply_asset_revision action on products
tests:
  - name: lambda-content-digital-revision-apply-assets can apply asset revisions; others cannot
    input:
      principals:
        - lambda-content-digital-revision-apply-assets
        - some_hacker
      resources:
        - product
      actions:
        - apply_asset_revision
    expected:
      - principal: lambda-content-digital-revision-apply-assets
        resource: product
        actions:
          apply_asset_revision: EFFECT_ALLOW
      - principal: some_hacker
        resource: product
        actions:
          apply_asset_revision: EFFECT_DENY