# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  workstation_catalog_user:
    id: a1b2c3d4-0000-0000-0000-000000000001
    roles:
      - user
    attr:
      type: human
      tenants:
        "vendor-uuid-1":
          tenant_uuid: "vendor-uuid-1"
          tenant_type: "account"
          roles:
            workstation_catalog:
              role: workstation_catalog
  workstation_admin_user:
    id: a1b2c3d4-0000-0000-0000-000000000002
    roles:
      - user
    attr:
      type: human
      tenants:
        "vendor-uuid-1":
          tenant_uuid: "vendor-uuid-1"
          tenant_type: "account"
          roles:
            workstation_admin:
              role: workstation_admin
  content_reviewer:
    id: a1b2c3d4-0000-0000-0000-000000000003
    roles:
      - user
    attr:
      type: human
      tenants:
        "vendor-uuid-1":
          tenant_uuid: "vendor-uuid-1"
          tenant_type: "account"
          roles:
            content_can_review_digital_audio:
              role: content_can_review_digital_audio
  unauthorized_user:
    id: a1b2c3d4-0000-0000-0000-000000000004
    roles:
      - user
    attr:
      type: human
      tenants:
        "other-vendor-uuid":
          tenant_uuid: "other-vendor-uuid"
          tenant_type: "account"
          roles:
            workstation_catalog:
              role: workstation_catalog
  workstation_catalog_user_at_parent:
    id: a1b2c3d4-0000-0000-0000-000000000005
    roles:
      - user
    attr:
      type: human
      tenants:
        "parent-company-uuid-1":
          tenant_uuid: "parent-company-uuid-1"
          tenant_type: "parent_company"
          roles:
            workstation_catalog:
              role: workstation_catalog

resources:
  contributor_1:
    id: "contributor-uuid-1"
    kind: "contributor"
    attr:
      tenant:
        tenant_uuid: "vendor-uuid-1"
        tenant_hierarchy: []
  contributor_under_parent:
    id: "contributor-uuid-2"
    kind: "contributor"
    attr:
      tenant:
        tenant_uuid: "vendor-uuid-2"
        tenant_hierarchy: ["parent-company-uuid-1"]

name: ContributorTestSuite
description: Tests for verifying the contributor resource policy
tests:
  - name: workstation_catalog can view, create, and edit but not delete
    input:
      principals:
        - workstation_catalog_user
      resources:
        - contributor_1
      actions:
        - view
        - create
        - edit
        - delete
    expected:
      - principal: workstation_catalog_user
        resource: contributor_1
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_DENY

  - name: workstation_admin can view, create, edit, and delete
    input:
      principals:
        - workstation_admin_user
      resources:
        - contributor_1
      actions:
        - view
        - create
        - edit
        - delete
    expected:
      - principal: workstation_admin_user
        resource: contributor_1
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_ALLOW

  - name: content_can_review_digital_audio can view, create, and edit but not delete
    input:
      principals:
        - content_reviewer
      resources:
        - contributor_1
      actions:
        - view
        - create
        - edit
        - delete
    expected:
      - principal: content_reviewer
        resource: contributor_1
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_DENY

  - name: workstation_catalog at a parent tenant can access a contributor at a child tenant
    input:
      principals:
        - workstation_catalog_user_at_parent
      resources:
        - contributor_under_parent
      actions:
        - view
        - create
        - edit
        - delete
    expected:
      - principal: workstation_catalog_user_at_parent
        resource: contributor_under_parent
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_DENY

  - name: user with role at a different tenant is denied all actions
    input:
      principals:
        - unauthorized_user
      resources:
        - contributor_1
      actions:
        - view
        - create
        - edit
        - delete
    expected:
      - principal: unauthorized_user
        resource: contributor_1
        actions:
          view: EFFECT_DENY
          create: EFFECT_DENY
          edit: EFFECT_DENY
          delete: EFFECT_DENY