# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  user_with_view_fan_data_role:
    id: "user_with_view_fan_data_role_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        "gto35228-00d8-93c6-b4op-286ef3e79319":
          tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
          tenant_type: "account"
          roles:
            fansifter_can_view_fan_data:
              role: fansifter_can_view_fan_data
  audience_manager_user:
    id: "audience_manager_user_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        "gto35228-00d8-93c6-b4op-286ef3e79319":
          tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
          tenant_type: "account"
          roles:
            audience_development_audience_manager:
              role: audience_development_audience_manager
resources:
  fan_data_channel_444:
    id: "444-44-44"
    kind: "fan_data_channel"
    attr:
      tenant:
        tenant_uuid: "bad45218-68d8-42b6-b4ee-730ef9e16309"
        tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"]
      connection_type: "shopify"
  fan_data_channel_555:
    id: "555-55-55"
    kind: "fan_data_channel"
    attr:
      tenant:
        tenant_uuid: "gto35228-00d8-93c6-b4op-286ef3e79319"
        tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"]
      connection_type: "shopify"
  company_brand_level_fan_data_channel:
    id: "company_brand_level_fan_data_channel"
    kind: "fan_data_channel"
    attr:
      tenant:
        tenant_uuid: "d25a4cd1-e820-45f2-be5c-56edcfeb8298"
        tenant_hierarchy: ["parent_company_1"]
      connection_type: "shopify"

name: FanDataChannelTestSuite
description: Tests for verifying the fan data channel resource policy
tests:
  - name: Viewing a Fan Data Channel
    input:
      principals:
        - olivia
        - brian
        - jordy
        - user_with_view_fan_data_role
        - audience_manager_user
      resources:
        - fan_data_channel_444
        - fan_data_channel_555
        - company_brand_level_fan_data_channel
      actions:
        - view
    expected:
      - principal: olivia
        resource: fan_data_channel_444
        actions:
          view: EFFECT_ALLOW
      - principal: olivia
        resource: company_brand_level_fan_data_channel
        actions:
          view: EFFECT_ALLOW
      - principal: brian
        resource: fan_data_channel_444
        actions:
          view: EFFECT_ALLOW
      - principal: jordy
        resource: fan_data_channel_555
        actions:
          view: EFFECT_ALLOW
      - principal: olivia
        resource: fan_data_channel_555
        actions:
          view: EFFECT_ALLOW
      - principal: audience_manager_user
        resource: fan_data_channel_555
        actions:
          view: EFFECT_ALLOW
# Roles V2
      - principal: user_with_view_fan_data_role
        resource: fan_data_channel_555
        actions:
          view: EFFECT_ALLOW

  - name: Managing a Fan Data Channel
    input:
      principals:
        - olivia
        - brian
        - jordy
        - user_with_view_fan_data_role
      resources:
        - fan_data_channel_444
        - fan_data_channel_555
      actions:
        - connect
        - revoke
    expected:
      - principal: brian
        resource: fan_data_channel_444
        actions:
          connect: EFFECT_DENY
          revoke: EFFECT_DENY
      - principal: olivia
        resource: fan_data_channel_444
        actions:
          connect: EFFECT_ALLOW
          revoke: EFFECT_ALLOW
      - principal: olivia
        resource: fan_data_channel_555
        actions:
          connect: EFFECT_ALLOW
          revoke: EFFECT_ALLOW
      - principal: jordy
        resource: fan_data_channel_555
        actions:
          connect: EFFECT_DENY
          revoke: EFFECT_DENY
# Roles V2
      - principal: user_with_view_fan_data_role
        resource: fan_data_channel_555
        actions:
          connect: EFFECT_ALLOW
          revoke: EFFECT_ALLOW