# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  ows_delivery_metadata:
    id: 718db2d5-3507-41a2-9a47-c20aee8f9ebd
    roles:
      - user
    attr:
      type: machine
      tenants: {}

  delivery-metadata-xml-generator:
    id: 371510f1-75a9-42a6-974c-112961df049d
    roles:
      - user
    attr:
      type: machine
      tenants: {}

  pdp_backfill:
    id: 638d3a21-0394-4477-9f98-7fd27b56ed2f
    roles:
      - user
    attr:
      type: machine
      tenants: {}

resources:
  product1:
    id: product1
    kind: product
    attr:
      tenant:
        tenant_uuid: "d6455851-3f86-48d8-b102-8d996eb92645"
        tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"]
  product_subaccount_b25:
    id: product_subaccount_b25
    kind: product
    attr:
      tenant:
        tenant_uuid: "b25cdcad-68b6-4c06-a23b-5e6fd4706bf6"
        tenant_hierarchy: ["f2911cc7-0a08-4e8d-9773-d39eac7be8df"]
  product_no_attr:
    id: product_no_attr
    kind: product


name: ProductTestSuite
description: Test for product resource type
tests:
  - name: Operations related to instant grats
    input:
      principals:
        - ows_delivery_metadata
        - pdp_backfill
      resources:
        - product1
        - product_no_attr
      actions:
        - view_instant_grats
    expected:
      - principal: ows_delivery_metadata
        resources:
          - product1
          - product_no_attr
        actions:
          view_instant_grats: EFFECT_ALLOW
      - principal: pdp_backfill
        resources:
          - product1
          - product_no_attr
        actions:
          view_instant_grats: EFFECT_DENY
  - name: Operations related to delivery metadata
    input:
      principals:
        - delivery-metadata-xml-generator
      resources:
        - product1
        - product_no_attr
      actions:
        - generate_delivery_metadata
    expected:
      - principal: delivery-metadata-xml-generator
        resources:
          - product1
          - product_no_attr
        actions:
          generate_delivery_metadata: EFFECT_ALLOW

  - name: "view:metadata:* - workstation_catalog, workstation_admin, bulk_creator allowed; hierarchy match also allowed"
    input:
      principals:
        - workstation_catalog_1
        - workstation_admin_1
        - bulk_creator_1
        - workstation_catalog_2
        - some_hacker
      resources:
        - product_subaccount_b25
        - product_no_attr
      actions:
        - "view:metadata:title"
    expected:
      - principal: workstation_catalog_1
        resource: product_subaccount_b25
        actions:
          "view:metadata:title": EFFECT_ALLOW
      - principal: workstation_admin_1
        resource: product_subaccount_b25
        actions:
          "view:metadata:title": EFFECT_ALLOW
      - principal: bulk_creator_1
        resource: product_subaccount_b25
        actions:
          "view:metadata:title": EFFECT_ALLOW
      # workstation_catalog at ancestor account grants access via tenant_hierarchy
      - principal: workstation_catalog_2
        resource: product_subaccount_b25
        actions:
          "view:metadata:title": EFFECT_ALLOW
      - principal: some_hacker
        resource: product_subaccount_b25
        actions:
          "view:metadata:title": EFFECT_DENY
      - principals:
          - workstation_catalog_1
          - workstation_admin_1
          - bulk_creator_1
          - workstation_catalog_2
          - some_hacker
        resource: product_no_attr
        actions:
          "view:metadata:title": EFFECT_DENY

  - name: "update:metadata:* - workstation_catalog, workstation_admin, bulk_creator allowed"
    input:
      principals:
        - workstation_catalog_1
        - workstation_admin_1
        - bulk_creator_1
        - some_hacker
      resources:
        - product_subaccount_b25
        - product_no_attr
      actions:
        - "update:metadata:title"
    expected:
      - principal: workstation_catalog_1
        resource: product_subaccount_b25
        actions:
          "update:metadata:title": EFFECT_ALLOW
      - principal: workstation_admin_1
        resource: product_subaccount_b25
        actions:
          "update:metadata:title": EFFECT_ALLOW
      - principal: bulk_creator_1
        resource: product_subaccount_b25
        actions:
          "update:metadata:title": EFFECT_ALLOW
      - principal: some_hacker
        resource: product_subaccount_b25
        actions:
          "update:metadata:title": EFFECT_DENY
      - principals:
          - workstation_catalog_1
          - workstation_admin_1
          - bulk_creator_1
          - some_hacker
        resource: product_no_attr
        actions:
          "update:metadata:title": EFFECT_DENY

  - name: "delete:metadata:* - workstation_catalog and workstation_admin allowed; bulk_creator denied"
    input:
      principals:
        - workstation_catalog_1
        - workstation_admin_1
        - bulk_creator_1
        - some_hacker
      resources:
        - product_subaccount_b25
        - product_no_attr
      actions:
        - "delete:metadata:title"
    expected:
      - principal: workstation_catalog_1
        resource: product_subaccount_b25
        actions:
          "delete:metadata:title": EFFECT_ALLOW
      - principal: workstation_admin_1
        resource: product_subaccount_b25
        actions:
          "delete:metadata:title": EFFECT_ALLOW
      # bulk_creator can view/update but not delete
      - principal: bulk_creator_1
        resource: product_subaccount_b25
        actions:
          "delete:metadata:title": EFFECT_DENY
      - principal: some_hacker
        resource: product_subaccount_b25
        actions:
          "delete:metadata:title": EFFECT_DENY
      - principals:
          - workstation_catalog_1
          - workstation_admin_1
          - bulk_creator_1
          - some_hacker
        resource: product_no_attr
        actions:
          "delete:metadata:title": EFFECT_DENY