# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  dedicated_m2m:
    id: dedicated_m2m
    roles:
      - user
    attr:
      type: machine
      tenants: {}

  dedicated_m2m_obo_dude:
    id: dude
    roles:
      - user
    attr:
      type: machine
      tenants: {}
      impersonated_by_identity_uuid: dedicated_m2m

  dude:
    id: dude
    roles:
      - user
    attr:
      type: human
      tenants: {}

  dude_impersonated_by_field_null:
    id: dude
    roles:
      - user
    attr:
      type: human
      tenants: {}
      impersonated_by_identity_uuid: null

  dude_impersonated_by_field_empty_string:
    id: dude
    roles:
      - user
    attr:
      type: human
      tenants: {}
      impersonated_by_identity_uuid: ""

  dude_impersonating_dude2:
    id: dude2
    roles:
      - user
    attr:
      type: human
      tenants: {}
      impersonated_by_identity_uuid: dude

  dancer:
    id: dancer
    roles:
      - user
    attr:
      type: dancer
      tenants: {}

resources:
  impersonation_demo_1:
    id: impersonation_demo_1
    kind: demo_impersonation

name: DemoImpersonationTestSuite 
description: Tests for demonstrating the impersonated_by_identity_uuid Principal attribute
tests:
  - name: machines
    input:
      principals:
        - dedicated_m2m
        - dedicated_m2m_obo_dude
      resources:
        - impersonation_demo_1
      actions:
        - yolo
        - sensitive_op
        - only_on_behalf_of
        - machine_obo_op
    expected:
      - principal: dedicated_m2m
        resource: impersonation_demo_1
        actions:
          yolo: EFFECT_ALLOW
          sensitive_op: EFFECT_ALLOW
          only_on_behalf_of: EFFECT_DENY
          machine_obo_op: EFFECT_DENY
      - principal: dedicated_m2m_obo_dude
        resource: impersonation_demo_1
        actions:
          yolo: EFFECT_ALLOW
          sensitive_op: EFFECT_DENY
          only_on_behalf_of: EFFECT_ALLOW
          machine_obo_op: EFFECT_ALLOW
  - name: humans
    input:
      principals:
        - dude
        - dude_impersonated_by_field_null
        - dude_impersonated_by_field_empty_string
        - dude_impersonating_dude2
      resources:
        - impersonation_demo_1
      actions:
        - yolo
        - sensitive_op
        - only_on_behalf_of
        - machine_obo_op
    expected:
      - principal: dude
        resource: impersonation_demo_1
        actions:
          yolo: EFFECT_ALLOW
          sensitive_op: EFFECT_ALLOW
          only_on_behalf_of: EFFECT_DENY
          machine_obo_op: EFFECT_DENY
      - principal: dude_impersonated_by_field_null
        resource: impersonation_demo_1
        actions:
          yolo: EFFECT_DENY
          sensitive_op: EFFECT_DENY
          only_on_behalf_of: EFFECT_DENY
          machine_obo_op: EFFECT_DENY
      - principal: dude_impersonated_by_field_empty_string
        resource: impersonation_demo_1
        actions:
          yolo: EFFECT_DENY
          sensitive_op: EFFECT_DENY
          only_on_behalf_of: EFFECT_DENY
          machine_obo_op: EFFECT_DENY
      - principal: dude_impersonating_dude2
        resource: impersonation_demo_1
        actions:
          yolo: EFFECT_ALLOW
          sensitive_op: EFFECT_DENY
          only_on_behalf_of: EFFECT_ALLOW
          machine_obo_op: EFFECT_DENY

  - name: DENY because it has failed the Principal schema check
    input:
      principals:
        - dancer
      resources:
        - impersonation_demo_1
      actions:
        - yolo
        - sensitive_op
        - only_on_behalf_of
        - machine_obo_op
    expected:
      - principal: dancer
        resource: impersonation_demo_1
        actions:
          yolo: EFFECT_DENY
          sensitive_op: EFFECT_DENY
          only_on_behalf_of: EFFECT_DENY
          machine_obo_op: EFFECT_DENY