# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json --- principals: user_with_share_audience_role: id: "user_with_share_audience_role_uuid" roles: - user attr: type: human tenants: "bad45218-68d8-42b6-b4ee-730ef9e16309": tenant_uuid: "bad45218-68d8-42b6-b4ee-730ef9e16309" tenant_type: "account" roles: fansifter_can_share_ad_campaign_audiences: role: fansifter_can_share_ad_campaign_audiences user_with_can_create_email_campaigns_role: id: "user_with_can_create_email_campaigns_role_uuid" roles: - user attr: type: human tenants: "bad45218-68d8-42b6-b4ee-730ef9e16309": tenant_uuid: "bad45218-68d8-42b6-b4ee-730ef9e16309" tenant_type: "account" roles: fansifter_can_create_email_campaigns: role: fansifter_can_create_email_campaigns user_with_can_create_sms_campaigns_role: id: "user_with_can_create_sms_campaigns_role_uuid" roles: - user attr: type: human tenants: "bad45218-68d8-42b6-b4ee-730ef9e16309": tenant_uuid: "bad45218-68d8-42b6-b4ee-730ef9e16309" tenant_type: "account" roles: fansifter_can_create_sms_campaigns: role: fansifter_can_create_sms_campaigns resources: audience_1: id: "audience_1" kind: "audience" attr: tenant: tenant_uuid: "bad45218-68d8-42b6-b4ee-730ef9e16309" tenant_hierarchy: [] audience_2: id: "audience_2" kind: "audience" attr: tenant: tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319" tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] company_brand_level_audience: id: "company_brand_level_audience" kind: "audience" attr: tenant: tenant_uuid: "d25a4cd1-e820-45f2-be5c-56edcfeb8298" tenant_hierarchy: ["parent_company_1"] name: AudienceTestSuite description: Tests for verifying the audience resource policy tests: - name: Managing an Audience input: principals: - brian - olivia - rob - international_bob - user_with_share_audience_role - user_with_can_create_email_campaigns_role - user_with_can_create_sms_campaigns_role resources: - audience_1 - audience_2 - company_brand_level_audience actions: - create - edit - archive - share - view - export_to_csv - create_ad_target - edit_ad_target - archive_ad_target - share_ad_target - view_ad_target - create_email_target - edit_email_target - archive_email_target - share_email_target - view_email_target - create_text_target - edit_text_target - archive_text_target - share_text_target - view_text_target - access expected: - principal: brian resource: audience_1 actions: create: EFFECT_ALLOW edit: EFFECT_ALLOW archive: EFFECT_ALLOW share: EFFECT_ALLOW view: EFFECT_ALLOW export_to_csv: EFFECT_DENY create_ad_target: EFFECT_ALLOW edit_ad_target: EFFECT_ALLOW archive_ad_target: EFFECT_ALLOW share_ad_target: EFFECT_ALLOW view_ad_target: EFFECT_ALLOW create_email_target: EFFECT_ALLOW edit_email_target: EFFECT_ALLOW archive_email_target: EFFECT_ALLOW share_email_target: EFFECT_ALLOW view_email_target: EFFECT_ALLOW create_text_target: EFFECT_ALLOW edit_text_target: EFFECT_ALLOW archive_text_target: EFFECT_ALLOW share_text_target: EFFECT_ALLOW view_text_target: EFFECT_ALLOW access: EFFECT_DENY - principal: brian resource: audience_2 actions: create: EFFECT_DENY edit: EFFECT_DENY archive: EFFECT_DENY share: EFFECT_DENY view: EFFECT_DENY export_to_csv: EFFECT_DENY create_ad_target: EFFECT_DENY edit_ad_target: EFFECT_DENY archive_ad_target: EFFECT_DENY share_ad_target: EFFECT_DENY view_ad_target: EFFECT_DENY create_email_target: EFFECT_DENY edit_email_target: EFFECT_DENY archive_email_target: EFFECT_DENY share_email_target: EFFECT_DENY view_email_target: EFFECT_DENY create_text_target: EFFECT_DENY edit_text_target: EFFECT_DENY archive_text_target: EFFECT_DENY share_text_target: EFFECT_DENY view_text_target: EFFECT_DENY access: EFFECT_DENY - principal: olivia resource: audience_1 actions: create: EFFECT_DENY edit: EFFECT_DENY archive: EFFECT_DENY share: EFFECT_DENY view: EFFECT_DENY export_to_csv: EFFECT_DENY create_ad_target: EFFECT_DENY edit_ad_target: EFFECT_DENY archive_ad_target: EFFECT_DENY share_ad_target: EFFECT_DENY view_ad_target: EFFECT_DENY create_email_target: EFFECT_DENY edit_email_target: EFFECT_DENY archive_email_target: EFFECT_DENY share_email_target: EFFECT_DENY view_email_target: EFFECT_DENY create_text_target: EFFECT_DENY edit_text_target: EFFECT_DENY archive_text_target: EFFECT_DENY share_text_target: EFFECT_DENY view_text_target: EFFECT_DENY access: EFFECT_DENY - principal: olivia resource: audience_2 actions: create: EFFECT_ALLOW edit: EFFECT_ALLOW archive: EFFECT_ALLOW share: EFFECT_ALLOW view: EFFECT_ALLOW export_to_csv: EFFECT_ALLOW create_ad_target: EFFECT_ALLOW edit_ad_target: EFFECT_ALLOW archive_ad_target: EFFECT_ALLOW share_ad_target: EFFECT_ALLOW view_ad_target: EFFECT_ALLOW create_email_target: EFFECT_ALLOW edit_email_target: EFFECT_ALLOW archive_email_target: EFFECT_ALLOW share_email_target: EFFECT_ALLOW view_email_target: EFFECT_ALLOW create_text_target: EFFECT_ALLOW edit_text_target: EFFECT_ALLOW archive_text_target: EFFECT_ALLOW share_text_target: EFFECT_ALLOW view_text_target: EFFECT_ALLOW access: EFFECT_ALLOW - principal: olivia resource: company_brand_level_audience actions: create: EFFECT_ALLOW edit: EFFECT_ALLOW archive: EFFECT_ALLOW share: EFFECT_ALLOW view: EFFECT_ALLOW export_to_csv: EFFECT_ALLOW create_ad_target: EFFECT_ALLOW edit_ad_target: EFFECT_ALLOW archive_ad_target: EFFECT_ALLOW share_ad_target: EFFECT_ALLOW view_ad_target: EFFECT_ALLOW create_email_target: EFFECT_ALLOW edit_email_target: EFFECT_ALLOW archive_email_target: EFFECT_ALLOW share_email_target: EFFECT_ALLOW view_email_target: EFFECT_ALLOW create_text_target: EFFECT_ALLOW edit_text_target: EFFECT_ALLOW archive_text_target: EFFECT_ALLOW share_text_target: EFFECT_ALLOW view_text_target: EFFECT_ALLOW access: EFFECT_ALLOW - principal: rob resource: audience_2 actions: create: EFFECT_ALLOW edit: EFFECT_ALLOW archive: EFFECT_ALLOW share: EFFECT_ALLOW view: EFFECT_ALLOW export_to_csv: EFFECT_ALLOW create_ad_target: EFFECT_ALLOW edit_ad_target: EFFECT_ALLOW archive_ad_target: EFFECT_ALLOW share_ad_target: EFFECT_ALLOW view_ad_target: EFFECT_ALLOW create_email_target: EFFECT_ALLOW edit_email_target: EFFECT_ALLOW archive_email_target: EFFECT_ALLOW share_email_target: EFFECT_ALLOW view_email_target: EFFECT_ALLOW create_text_target: EFFECT_ALLOW edit_text_target: EFFECT_ALLOW archive_text_target: EFFECT_ALLOW share_text_target: EFFECT_ALLOW view_text_target: EFFECT_ALLOW access: EFFECT_ALLOW - principal: rob resource: company_brand_level_audience actions: create: EFFECT_ALLOW edit: EFFECT_ALLOW archive: EFFECT_ALLOW share: EFFECT_ALLOW view: EFFECT_ALLOW export_to_csv: EFFECT_ALLOW create_ad_target: EFFECT_ALLOW edit_ad_target: EFFECT_ALLOW archive_ad_target: EFFECT_ALLOW share_ad_target: EFFECT_ALLOW view_ad_target: EFFECT_ALLOW create_email_target: EFFECT_ALLOW edit_email_target: EFFECT_ALLOW archive_email_target: EFFECT_ALLOW share_email_target: EFFECT_ALLOW view_email_target: EFFECT_ALLOW create_text_target: EFFECT_ALLOW edit_text_target: EFFECT_ALLOW archive_text_target: EFFECT_ALLOW share_text_target: EFFECT_ALLOW view_text_target: EFFECT_ALLOW access: EFFECT_ALLOW - principal: international_bob resource: audience_1 actions: create: EFFECT_ALLOW edit: EFFECT_ALLOW archive: EFFECT_ALLOW share: EFFECT_ALLOW view: EFFECT_ALLOW export_to_csv: EFFECT_ALLOW create_ad_target: EFFECT_ALLOW edit_ad_target: EFFECT_ALLOW archive_ad_target: EFFECT_ALLOW share_ad_target: EFFECT_ALLOW view_ad_target: EFFECT_ALLOW create_email_target: EFFECT_ALLOW edit_email_target: EFFECT_ALLOW archive_email_target: EFFECT_ALLOW share_email_target: EFFECT_ALLOW view_email_target: EFFECT_ALLOW create_text_target: EFFECT_ALLOW edit_text_target: EFFECT_ALLOW archive_text_target: EFFECT_ALLOW share_text_target: EFFECT_ALLOW view_text_target: EFFECT_ALLOW access: EFFECT_ALLOW - principal: user_with_can_create_email_campaigns_role resource: audience_1 actions: create: EFFECT_DENY edit: EFFECT_DENY archive: EFFECT_DENY share: EFFECT_DENY view: EFFECT_DENY export_to_csv: EFFECT_DENY create_ad_target: EFFECT_DENY edit_ad_target: EFFECT_DENY archive_ad_target: EFFECT_DENY share_ad_target: EFFECT_DENY view_ad_target: EFFECT_DENY create_email_target: EFFECT_ALLOW edit_email_target: EFFECT_ALLOW archive_email_target: EFFECT_ALLOW share_email_target: EFFECT_ALLOW view_email_target: EFFECT_ALLOW create_text_target: EFFECT_DENY edit_text_target: EFFECT_DENY archive_text_target: EFFECT_DENY share_text_target: EFFECT_DENY view_text_target: EFFECT_DENY access: EFFECT_ALLOW - principal: user_with_can_create_sms_campaigns_role resource: audience_1 actions: create: EFFECT_DENY edit: EFFECT_DENY archive: EFFECT_DENY share: EFFECT_DENY view: EFFECT_DENY export_to_csv: EFFECT_DENY create_ad_target: EFFECT_DENY edit_ad_target: EFFECT_DENY archive_ad_target: EFFECT_DENY share_ad_target: EFFECT_DENY view_ad_target: EFFECT_DENY create_email_target: EFFECT_DENY edit_email_target: EFFECT_DENY archive_email_target: EFFECT_DENY share_email_target: EFFECT_DENY view_email_target: EFFECT_DENY create_text_target: EFFECT_ALLOW edit_text_target: EFFECT_ALLOW archive_text_target: EFFECT_ALLOW share_text_target: EFFECT_ALLOW view_text_target: EFFECT_ALLOW access: EFFECT_ALLOW - principal: user_with_share_audience_role resource: audience_1 actions: create: EFFECT_ALLOW edit: EFFECT_ALLOW archive: EFFECT_ALLOW share: EFFECT_ALLOW view: EFFECT_ALLOW export_to_csv: EFFECT_ALLOW create_ad_target: EFFECT_ALLOW edit_ad_target: EFFECT_ALLOW archive_ad_target: EFFECT_ALLOW share_ad_target: EFFECT_ALLOW view_ad_target: EFFECT_ALLOW create_email_target: EFFECT_DENY edit_email_target: EFFECT_DENY archive_email_target: EFFECT_DENY share_email_target: EFFECT_DENY view_email_target: EFFECT_DENY create_text_target: EFFECT_DENY edit_text_target: EFFECT_DENY archive_text_target: EFFECT_DENY share_text_target: EFFECT_DENY view_text_target: EFFECT_DENY access: EFFECT_ALLOW - name: Managing an Audience when Hierarchy is Lengthy input: principals: - principal_in_hierarchies - principal_in_hierarchies_but_no_roles resources: - audience_1 - audience_2 - company_brand_level_audience actions: - create - edit - archive - share - view - export_to_csv expected: - principal: principal_in_hierarchies resource: audience_1 actions: create: EFFECT_DENY edit: EFFECT_DENY archive: EFFECT_DENY share: EFFECT_DENY view: EFFECT_DENY export_to_csv: EFFECT_DENY - principal: principal_in_hierarchies resource: audience_2 actions: create: EFFECT_ALLOW edit: EFFECT_ALLOW archive: EFFECT_ALLOW share: EFFECT_ALLOW view: EFFECT_ALLOW export_to_csv: EFFECT_ALLOW - principal: principal_in_hierarchies resource: company_brand_level_audience actions: create: EFFECT_ALLOW edit: EFFECT_ALLOW archive: EFFECT_ALLOW share: EFFECT_ALLOW view: EFFECT_ALLOW export_to_csv: EFFECT_ALLOW - principal: principal_in_hierarchies_but_no_roles resource: audience_1 actions: create: EFFECT_DENY edit: EFFECT_DENY archive: EFFECT_DENY share: EFFECT_DENY view: EFFECT_DENY export_to_csv: EFFECT_DENY - principal: principal_in_hierarchies_but_no_roles resource: audience_2 actions: create: EFFECT_DENY edit: EFFECT_DENY archive: EFFECT_DENY share: EFFECT_DENY view: EFFECT_DENY export_to_csv: EFFECT_DENY - principal: principal_in_hierarchies_but_no_roles resource: company_brand_level_audience actions: create: EFFECT_DENY edit: EFFECT_DENY archive: EFFECT_DENY share: EFFECT_DENY view: EFFECT_DENY export_to_csv: EFFECT_DENY