# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  user_with_create_ad_reports_role:
    id: "user_with_create_ad_reports_role_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        "gto35228-00d8-93c6-b4op-286ef3e79319":
          tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
          tenant_type: "account"
          roles:
            fansifter_can_create_ad_reports:
              role: fansifter_can_create_ad_reports
  user_with_create_ad_reports_role_in_random_tenant:
    id: "user_with_create_ad_reports_role_in_random_tenant_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        random_tenant:
          tenant_uuid: random_tenant_uuid
          tenant_type: "account"
          roles:
            fansifter_can_create_ad_reports:
              role: fansifter_can_create_ad_reports

resources:
  ad_campaign_12345:
    id: "12345-6789-10"
    kind: "ad_campaign"
    attr:
      tenant:
        tenant_uuid: "d6455851-3f86-48d8-b102-8d996eb92645"
        tenant_hierarchy: [ "parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298" ]
  ad_campaign_3999:
    id: "3999-39-39"
    kind: "ad_campaign"
    attr:
      tenant:
        tenant_uuid: "bad45218-68d8-42b6-b4ee-730ef9e16309"
        tenant_hierarchy: [ "parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298" ]
  company_brand_level_ad_campaign:
    id: "company_brand_level_ad_campaign"
    kind: "ad_campaign"
    attr:
      tenant:
        tenant_uuid: "d25a4cd1-e820-45f2-be5c-56edcfeb8298"
        tenant_hierarchy: [ "parent_company_1" ]
  ad_campaign_sub1:
    id: "ad_campaign_sub1"
    kind: "ad_campaign"
    attr:
      tenant:
        tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319-sub1"
        tenant_type: "subaccount"
        tenant_hierarchy: [ "parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298", "gto35228-00d8-93c6-b4op-286ef3e79319" ]

name: AdCampaignTestSuite
description: Tests for verifying the ad_campaign resource policy
tests:
  - name: Managing an Ad Campaign
    input:
      principals:
        - olivia
        - brian
        - jordy
        - international_bob
        - user_with_create_ad_reports_role
        - user_with_create_ad_reports_role_in_random_tenant
      resources:
        - ad_campaign_12345
        - ad_campaign_3999
        - ad_campaign_sub1
        - company_brand_level_ad_campaign
      actions:
        - view
        - edit
    expected:
      - principal: olivia
        resource: ad_campaign_12345
        actions:
          view: EFFECT_ALLOW
          edit: EFFECT_ALLOW
      - principal: olivia
        resource: ad_campaign_sub1
        actions:
          view: EFFECT_ALLOW
          edit: EFFECT_ALLOW
      - principal: olivia
        resource: company_brand_level_ad_campaign
        actions:
          view: EFFECT_ALLOW
          edit: EFFECT_ALLOW
      - principal: brian
        resource: ad_campaign_12345
        actions:
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: jordy
        resource: ad_campaign_12345
        actions:
          view: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: olivia
        resource: ad_campaign_3999
        actions:
          view: EFFECT_ALLOW
          edit: EFFECT_ALLOW
      - principal: brian
        resource: ad_campaign_3999
        actions:
          view: EFFECT_ALLOW
          edit: EFFECT_ALLOW
      - principal: jordy
        resource: ad_campaign_sub1
        actions:
          view: EFFECT_ALLOW
          edit: EFFECT_ALLOW
      - principal: international_bob
        resource: ad_campaign_3999
        actions:
          view: EFFECT_DENY
          edit: EFFECT_DENY
# roles V2
      - principal: user_with_create_ad_reports_role
        resource: ad_campaign_sub1
        actions:
          view: EFFECT_ALLOW
          edit: EFFECT_ALLOW