# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  user_with_connect_ad_accounts_role:
    id: "user_with_connect_ad_accounts_role_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        "gto35228-00d8-93c6-b4op-286ef3e79319":
          tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
          tenant_type: "account"
          roles:
            fansifter_can_connect_ad_accounts:
              role: fansifter_can_connect_ad_accounts
resources:
  olivia_ad_connection:
    id: "olivia facebook account"
    kind: "ad_connection"
    attr:
      identity_uuid: "3604ff98-f825-4ea1-9f48-a7f56f413ec4"
  brian_ad_connection:
    id: "brian facebook account"
    kind: "ad_connection"
    attr:
      identity_uuid: "08fc2c19-43fb-4804-9249-d0992554997f"
  jordy_ad_connection:
    id: "jordy facebook account"
    kind: "ad_connection"
    attr:
      identity_uuid: "a99ea45c-6841-4942-beac-d766f9c41071"
  when_someone_puts_tenant_on_ad_connection:
    id: "always rejected"
    kind: "ad_connection"
    attr:
      tenant:
        tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319-sub2"
        tenant_type: "subaccount"
        tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298", "gto35228-00d8-93c6-b4op-286ef3e79319"]
  user_ad_connection_with_connect_role:
    id: "test connection"
    kind: "ad_connection"
    attr:
      identity_uuid: "user_with_connect_ad_accounts_role_uuid"
  ad_connection_in_user_tenant:
    id: "ad_connection_in_user_tenant"
    kind: "ad_connection"
    attr:
      identity_uuid: "some_other_user_uuid"
      tenant:
        tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
        tenant_type: "account"
        tenant_hierarchy: []
  ad_connection_in_other_tenant:
    id: "ad_connection_in_other_tenant"
    kind: "ad_connection"
    attr:
      identity_uuid: "some_other_user_uuid"
      tenant:
        tenant_uuid: "unrelated_tenant_uuid"
        tenant_type: "account"
        tenant_hierarchy: []
  ad_connection_in_subaccount_of_user_tenant:
    id: "ad_connection_in_subaccount_of_user_tenant"
    kind: "ad_connection"
    attr:
      identity_uuid: "some_other_user_uuid"
      tenant:
        tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319-sub1"
        tenant_type: "subaccount"
        tenant_hierarchy: ["gto35228-00d8-93c6-b4op-286ef3e79319"]
  ad_connection_tenant_only_in_user_tenant:
    id: "ad_connection_tenant_only_in_user_tenant"
    kind: "ad_connection"
    attr:
      tenant:
        tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
        tenant_type: "account"
        tenant_hierarchy: []

name: AdvertisingConnectionTestSuite
description: Tests for verifying the ad connection resource policy
tests:
  - name: View, Connect, Revoke an Advertising Connection
    input:
      principals:
        - olivia
        - brian
        - jordy
        - user_with_connect_ad_accounts_role
      resources:
        - when_someone_puts_tenant_on_ad_connection # no identity_uuid, no allow
        - olivia_ad_connection
        - brian_ad_connection
        - jordy_ad_connection  # In a world where Jordy got demoted from client to analyst
        - user_ad_connection_with_connect_role
      actions:
        - view
        - connect
        - revoke
    expected:
      - principal: olivia
        resource: olivia_ad_connection
        actions:
          view: EFFECT_ALLOW
          connect: EFFECT_ALLOW
          revoke: EFFECT_ALLOW
      - principal: brian
        resource: brian_ad_connection
        actions:
          view: EFFECT_ALLOW
          connect: EFFECT_ALLOW
          revoke: EFFECT_ALLOW
# roles V2
      - principal: user_with_connect_ad_accounts_role
        resource: user_ad_connection_with_connect_role
        actions:
          view: EFFECT_ALLOW
          connect: EFFECT_ALLOW
          revoke: EFFECT_ALLOW
  - name: Access ad_connections per tenant (list tenants where user has the role)
    input:
      principals:
        - user_with_connect_ad_accounts_role
        - olivia
      resources:
        - ad_connection_in_user_tenant
        - ad_connection_in_other_tenant
        - ad_connection_in_subaccount_of_user_tenant
        - ad_connection_tenant_only_in_user_tenant
      actions:
        - access
    expected:
      # User has fansifter_can_connect_ad_accounts in the resource's tenant
      - principal: user_with_connect_ad_accounts_role
        resource: ad_connection_in_user_tenant
        actions:
          access: EFFECT_ALLOW
      - principal: user_with_connect_ad_accounts_role
        resource: ad_connection_tenant_only_in_user_tenant
        actions:
          access: EFFECT_ALLOW
      # User has the role in a parent tenant of the resource's tenant (via hierarchy)
      - principal: user_with_connect_ad_accounts_role
        resource: ad_connection_in_subaccount_of_user_tenant
        actions:
          access: EFFECT_ALLOW
      # User has the role but in a different (unrelated) tenant
      - principal: user_with_connect_ad_accounts_role
        resource: ad_connection_in_other_tenant
        actions:
          access: EFFECT_DENY
      # User has audience_development_admin but not the fansifter role
      - principal: olivia
        resource: ad_connection_in_user_tenant
        actions:
          access: EFFECT_DENY