# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  user_with_can_connect_ad_accounts_role:
    id: "user_with_can_connect_ad_accounts_role_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        "gto35228-00d8-93c6-b4op-286ef3e79319":
          tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
          tenant_type: "account"
          roles:
            fansifter_can_connect_ad_accounts:
              role: fansifter_can_connect_ad_accounts
  user_with_can_connect_ad_accounts_in_random_tenant:
    id: "user_with_can_connect_ad_accounts_in_random_tenant_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        random_tenant:
          tenant_uuid: random_tenant_uuid
          tenant_type: "account"
          roles:
            fansifter_can_connect_ad_accounts:
              role: fansifter_can_connect_ad_accounts
  user_with_can_share_ad_campaign_audiences_role:
    id: "user_with_can_share_ad_campaign_audiences_role_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        "4abb13a2-aa83-438e-9159-23be3909889d":
          tenant_uuid: "4abb13a2-aa83-438e-9159-23be3909889d"
          tenant_type: "account"
          roles:
            fansifter_can_share_ad_campaign_audiences:
              role: fansifter_can_share_ad_campaign_audiences
resources:
  olivia_ad_account_without_tenant:
    id: "olivia ad account without tenant"
    kind: "ad_account"
    attr:
      identity_uuid: "3604ff98-f825-4ea1-9f48-a7f56f413ec4"
  olivia_ad_account_with_tenant:
    id: "olivia ad account with tenant"
    kind: "ad_account"
    attr:
      identity_uuid: "3604ff98-f825-4ea1-9f48-a7f56f413ec4"
      tenant:
        tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
        tenant_hierarchy: [ "parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298" ]
  brian_ad_account_without_tenant:
    id: "brian ad account without tenant"
    kind: "ad_account"
    attr:
      identity_uuid: "08fc2c19-43fb-4804-9249-d0992554997f"
  brian_ad_account_with_tenant:
    id: "brian ad account with tenant"
    kind: "ad_account"
    attr:
      identity_uuid: "08fc2c19-43fb-4804-9249-d0992554997f"
      tenant:
        tenant_uuid: "4abb13a2-aa83-438e-9159-23be3909889d"

name: AdAccountTestSuite
description: Tests for verifying the ad account resource policy
tests:
  - name: Managing an Ad Account
    input:
      principals:
        - olivia
        - brian
        - jordy
        - user_with_can_connect_ad_accounts_role
        - user_with_can_connect_ad_accounts_in_random_tenant
        - user_with_can_share_ad_campaign_audiences_role
      resources:
        - olivia_ad_account_without_tenant
        - olivia_ad_account_with_tenant
        - brian_ad_account_without_tenant
        - brian_ad_account_with_tenant
      actions:
        - assign
        - delete
        - view
        - edit
    expected:
      - principal: olivia
        resource: olivia_ad_account_without_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_ALLOW
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: brian
        resource: olivia_ad_account_without_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: olivia
        resource: olivia_ad_account_with_tenant
        actions:
          assign: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          edit: EFFECT_DENY
      - principal: brian
        resource: olivia_ad_account_with_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: olivia
        resource: brian_ad_account_with_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          edit: EFFECT_DENY
      - principal: brian
        resource: brian_ad_account_with_tenant
        actions:
          assign: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          edit: EFFECT_DENY
      - principal: olivia
        resource: brian_ad_account_without_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: brian
        resource: brian_ad_account_without_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_ALLOW
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: jordy
        resource: olivia_ad_account_with_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: jordy
        resource: olivia_ad_account_without_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          edit: EFFECT_DENY
#  roles V2 user with fansifter_can_connect_ad_accounts role
      - principal: user_with_can_connect_ad_accounts_role
        resource: olivia_ad_account_without_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: user_with_can_connect_ad_accounts_role
        resource: olivia_ad_account_with_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          edit: EFFECT_ALLOW
      - principal: user_with_can_connect_ad_accounts_role
        resource: brian_ad_account_without_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: user_with_can_connect_ad_accounts_role
        resource: brian_ad_account_with_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: user_with_can_share_ad_campaign_audiences_role
        resource: brian_ad_account_with_tenant
        actions:
          assign: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_ALLOW
          edit: EFFECT_DENY