# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json --- principals: sudo: id: sudo roles: - user - sudo attr: type: human tenants: {} integration_role_admin: id: integration_role_admin roles: - user attr: type: human tenants: d25a4cd1-e820-45f2-be5c-56edcfeb8298: tenant_uuid: d25a4cd1-e820-45f2-be5c-56edcfeb8298 tenant_type: company_brand roles: mock_LabelProfile_administrator: role: mock_LabelProfile_administrator integration_role_accounting: id: dude roles: - user attr: type: human tenants: d25a4cd1-e820-45f2-be5c-56edcfeb8298: tenant_uuid: d25a4cd1-e820-45f2-be5c-56edcfeb8298 tenant_type: company_brand roles: mock_LabelProfile_accounting: role: mock_LabelProfile_accounting integration_role_analytics: id: integration_role_analytics roles: - user attr: type: human tenants: d25a4cd1-e820-45f2-be5c-56edcfeb8298: tenant_uuid: d25a4cd1-e820-45f2-be5c-56edcfeb8298 tenant_type: company_brand roles: mock_InsightsProfile_analytics: role: mock_InsightsProfile_analytics resources: demo_action_wildcard_1: id: demo_action_wildcard_1 kind: demo_action_wildcard attr: tenant: tenant_uuid: d25a4cd1-e820-45f2-be5c-56edcfeb8298 tenant_type: company_brand tenant_hierarchy: [] demo_action_wildcard_2: id: demo_action_wildcard_2 kind: demo_action_wildcard attr: tenant: tenant_uuid: bad45218-68d8-42b6-b4ee-730ef9e16309 tenant_type: company_brand tenant_hierarchy: [] name: DemoActionWildcardTestSuite description: Tests for verifying the demo_action_wildcard resource policy tests: - name: All principals have same tenant, but different roles input: principals: - sudo - integration_role_admin - integration_role_accounting - integration_role_analytics resources: - demo_action_wildcard_1 - demo_action_wildcard_2 actions: - make - make:sandwich - view - view:* - view:basic - view:accounting - view:accounting:advances - view:accounting:advances:needs_explicit_wildcard_pattern - view:not - view:not:explicitly_defined_in_policy - view:view:accounting* - view:accounting:advances:* - view:accountingsomething expected: - principal: sudo resource: demo_action_wildcard_1 actions: make: EFFECT_ALLOW make:sandwich: EFFECT_ALLOW view: EFFECT_ALLOW view:*: EFFECT_ALLOW view:basic: EFFECT_ALLOW view:accounting: EFFECT_ALLOW view:accounting:advances: EFFECT_ALLOW view:accounting:advances:needs_explicit_wildcard_pattern: EFFECT_ALLOW view:not: EFFECT_ALLOW view:not:explicitly_defined_in_policy: EFFECT_ALLOW view:view:accounting*: EFFECT_ALLOW view:accounting:advances:*: EFFECT_ALLOW view:accountingsomething: EFFECT_ALLOW - principal: integration_role_admin resource: demo_action_wildcard_1 actions: make: EFFECT_ALLOW make:sandwich: EFFECT_DENY view: EFFECT_DENY view:*: EFFECT_ALLOW view:basic: EFFECT_ALLOW view:accounting: EFFECT_ALLOW view:accounting:advances: EFFECT_ALLOW view:accounting:advances:needs_explicit_wildcard_pattern: EFFECT_DENY view:not: EFFECT_ALLOW view:not:explicitly_defined_in_policy: EFFECT_ALLOW view:view:accounting*: EFFECT_ALLOW view:accounting:advances:*: EFFECT_DENY view:accountingsomething: EFFECT_ALLOW - principal: integration_role_accounting resource: demo_action_wildcard_1 actions: make: EFFECT_DENY make:sandwich: EFFECT_DENY view: EFFECT_DENY view:*: EFFECT_DENY view:basic: EFFECT_ALLOW view:accounting: EFFECT_ALLOW view:accounting:advances: EFFECT_DENY view:accounting:advances:needs_explicit_wildcard_pattern: EFFECT_ALLOW view:not: EFFECT_DENY view:not:explicitly_defined_in_policy: EFFECT_DENY view:view:accounting*: EFFECT_DENY view:accounting:advances:*: EFFECT_ALLOW view:accountingsomething: EFFECT_ALLOW - principal: integration_role_analytics resource: demo_action_wildcard_1 actions: make: EFFECT_DENY make:sandwich: EFFECT_DENY view: EFFECT_DENY view:*: EFFECT_DENY view:basic: EFFECT_ALLOW view:accounting: EFFECT_DENY view:accounting:advances: EFFECT_DENY view:accounting:advances:needs_explicit_wildcard_pattern: EFFECT_DENY view:not: EFFECT_DENY view:not:explicitly_defined_in_policy: EFFECT_DENY view:view:accounting*: EFFECT_DENY view:accounting:advances:*: EFFECT_DENY view:accountingsomething: EFFECT_DENY - principal: sudo resource: demo_action_wildcard_2 actions: make: EFFECT_ALLOW make:sandwich: EFFECT_ALLOW view: EFFECT_ALLOW view:*: EFFECT_ALLOW view:basic: EFFECT_ALLOW view:accounting: EFFECT_ALLOW view:accounting:advances: EFFECT_ALLOW view:accounting:advances:needs_explicit_wildcard_pattern: EFFECT_ALLOW view:not: EFFECT_ALLOW view:not:explicitly_defined_in_policy: EFFECT_ALLOW view:view:accounting*: EFFECT_ALLOW view:accounting:advances:*: EFFECT_ALLOW view:accountingsomething: EFFECT_ALLOW - principal: integration_role_admin resource: demo_action_wildcard_2 actions: make: EFFECT_DENY make:sandwich: EFFECT_DENY view: EFFECT_DENY view:*: EFFECT_DENY view:basic: EFFECT_DENY view:accounting: EFFECT_DENY view:accounting:advances: EFFECT_DENY view:accounting:advances:needs_explicit_wildcard_pattern: EFFECT_DENY view:not: EFFECT_DENY view:not:explicitly_defined_in_policy: EFFECT_DENY view:view:accounting*: EFFECT_DENY view:accounting:advances:*: EFFECT_DENY view:accountingsomething: EFFECT_DENY - principal: integration_role_accounting resource: demo_action_wildcard_2 actions: make: EFFECT_DENY make:sandwich: EFFECT_DENY view: EFFECT_DENY view:*: EFFECT_DENY view:basic: EFFECT_DENY view:accounting: EFFECT_DENY view:accounting:advances: EFFECT_DENY view:accounting:advances:needs_explicit_wildcard_pattern: EFFECT_DENY view:not: EFFECT_DENY view:not:explicitly_defined_in_policy: EFFECT_DENY view:view:accounting*: EFFECT_DENY view:accounting:advances:*: EFFECT_DENY view:accountingsomething: EFFECT_DENY - principal: integration_role_analytics resource: demo_action_wildcard_2 actions: make: EFFECT_DENY make:sandwich: EFFECT_DENY view: EFFECT_DENY view:*: EFFECT_DENY view:basic: EFFECT_DENY view:accounting: EFFECT_DENY view:accounting:advances: EFFECT_DENY view:accounting:advances:needs_explicit_wildcard_pattern: EFFECT_DENY view:not: EFFECT_DENY view:not:explicitly_defined_in_policy: EFFECT_DENY view:view:accounting*: EFFECT_DENY view:accounting:advances:*: EFFECT_DENY view:accountingsomething: EFFECT_DENY