# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  user_with_create_email_role:
    id: "user_with_create_email_role_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        "gto35228-00d8-93c6-b4op-286ef3e79319":
          tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
          tenant_type: "account"
          roles:
            fansifter_can_create_email_campaigns:
              role: fansifter_can_create_email_campaigns
  user_with_view_email_role:
    id: "user_with_view_email_role_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        "gto35228-00d8-93c6-b4op-286ef3e79319":
          tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
          tenant_type: "account"
          roles:
            fansifter_can_view_email_campaigns:
              role: fansifter_can_view_email_campaigns

resources:
  email_campaign_1:
    id: "email_campaign_1"
    kind: "email_campaign"
    attr:
      tenant:
        tenant_uuid: "bad45218-68d8-42b6-b4ee-730ef9e16309"
        tenant_hierarchy: []
  email_campaign_2:
    id: "email_campaign_2"
    kind: "email_campaign"
    attr:
      tenant:
        tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
        tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"]
  company_brand_level_email_campaign:
    id: "company_brand_level_email_campaign"
    kind: "email_campaign"
    attr:
      tenant:
        tenant_uuid: "d25a4cd1-e820-45f2-be5c-56edcfeb8298"
        tenant_hierarchy: ["parent_company_1"]

name: EmailCampaignTestSuite
description: Tests for verifying the email campaign resource policy
tests:
  - name: Managing an Email Campaign
    input:
      principals:
        - brian
        - olivia
        - rob
        - international_bob
        - user_with_create_email_role
        - user_with_view_email_role
      resources:
        - email_campaign_1
        - email_campaign_2
        - company_brand_level_email_campaign
      actions:
        - create
        - edit
        - delete
        - view
        - schedule
        - send
    expected:
      - principal: brian
        resource: email_campaign_1
        actions:
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          schedule: EFFECT_ALLOW
          send: EFFECT_ALLOW
      - principal: brian
        resource: email_campaign_2
        actions:
          create: EFFECT_DENY
          edit: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          schedule: EFFECT_DENY
          send: EFFECT_DENY
      - principal: olivia
        resource: email_campaign_1
        actions:
          create: EFFECT_DENY
          edit: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          schedule: EFFECT_DENY
          send: EFFECT_DENY
      - principal: olivia
        resource: email_campaign_2
        actions:
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          schedule: EFFECT_ALLOW
          send: EFFECT_ALLOW
      - principal: olivia
        resource: company_brand_level_email_campaign
        actions:
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          schedule: EFFECT_ALLOW
          send: EFFECT_ALLOW
      - principal: rob
        resource: email_campaign_2
        actions:
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          schedule: EFFECT_ALLOW
          send: EFFECT_ALLOW
      - principal: rob
        resource: company_brand_level_email_campaign
        actions:
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          schedule: EFFECT_ALLOW
          send: EFFECT_ALLOW
      - principal: international_bob
        resource: email_campaign_1
        actions:
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          schedule: EFFECT_ALLOW
          send: EFFECT_ALLOW
# roles V2
      - principal: user_with_create_email_role
        resource: email_campaign_2
        actions:
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          schedule: EFFECT_ALLOW
          send: EFFECT_ALLOW
      - principal: user_with_view_email_role
        resource: email_campaign_2
        actions:
          create: EFFECT_DENY
          edit: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_ALLOW
          schedule: EFFECT_DENY
          send: EFFECT_DENY

  - name: Managing an Email Campaign when Hierarchy is Lengthy
    input:
      principals:
        - principal_in_hierarchies
        - principal_in_hierarchies_but_no_roles
      resources:
        - email_campaign_1
        - email_campaign_2
        - company_brand_level_email_campaign
      actions:
        - create
        - edit
        - delete
        - view
        - schedule
        - send
    expected:
      - principal: principal_in_hierarchies
        resource: email_campaign_1
        actions:
          create: EFFECT_DENY
          edit: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          schedule: EFFECT_DENY
          send: EFFECT_DENY
      - principal: principal_in_hierarchies
        resource: email_campaign_2
        actions:
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          schedule: EFFECT_ALLOW
          send: EFFECT_ALLOW
      - principal: principal_in_hierarchies
        resource: company_brand_level_email_campaign
        actions:
          create: EFFECT_ALLOW
          edit: EFFECT_ALLOW
          delete: EFFECT_ALLOW
          view: EFFECT_ALLOW
          schedule: EFFECT_ALLOW
          send: EFFECT_ALLOW
      - principal: principal_in_hierarchies_but_no_roles
        resource: email_campaign_1
        actions:
          create: EFFECT_DENY
          edit: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          schedule: EFFECT_DENY
          send: EFFECT_DENY
      - principal: principal_in_hierarchies_but_no_roles
        resource: email_campaign_2
        actions:
          create: EFFECT_DENY
          edit: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          schedule: EFFECT_DENY
          send: EFFECT_DENY
      - principal: principal_in_hierarchies_but_no_roles
        resource: company_brand_level_email_campaign
        actions:
          create: EFFECT_DENY
          edit: EFFECT_DENY
          delete: EFFECT_DENY
          view: EFFECT_DENY
          schedule: EFFECT_DENY
          send: EFFECT_DENY