# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
resources:
  queueResource123:
    id: "queueResource123"
    kind: "product_queue_global"

name: ProductQueueTestSuite
description: Test for verifying product_queue_global resource policies
tests:
  - name: Accessing product queue data
    input:
      principals:
        - reviewer_1
        - reviewer_2
        - some_hacker
      resources:
        - queueResource123
      actions:
        - view
        - review
    expected:
      # Has any_tenant_content_can_review_digital_audio derived role
      - principal: reviewer_1
        resource: queueResource123
        actions:
          view: EFFECT_ALLOW
          review: EFFECT_ALLOW
      # Has any_tenant_content_can_review_digital_audio derived role, through different tenant
      - principal: reviewer_2
        resource: queueResource123
        actions:
          view: EFFECT_ALLOW
          review: EFFECT_ALLOW
      # Missing proper role entirely
      - principal: some_hacker
        resource: queueResource123
        actions:
          view: EFFECT_DENY
          review: EFFECT_DENY