# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  user_with_view_fan_data_role:
    id: "user_with_view_fan_data_role_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        "columbia_tenant_uuid":
          tenant_uuid: "columbia_tenant_uuid"
          tenant_type: "account"
          roles:
            fansifter_can_view_fan_data:
              role: fansifter_can_view_fan_data
resources:
  rca_artist_name_fan_list_with_joint_venture:
    id: "rca_1"
    kind: "fan_data_list"
    attr:
      joint_venture:
        tenants:
        - tenant_uuid: "columbia_tenant_uuid"
          tenant_type: "account"
          tenant_hierarchy: [ "sony_company_brand", "sony_parent_company" ]
          is_provider: true
          is_consumer: true
        - tenant_uuid: "only_a_provider_tenant_uuid"
          tenant_type: "account"
          tenant_hierarchy: []
          is_provider: true
          is_consumer: false
  rca_artist_name_fan_list_with_tenant:
    id: "rca_2"
    kind: fan_data_list
    attr:
      tenant:
        tenant_uuid: rca_tenant_uuid
        tenant_type: account
        tenant_hierarchy: []
  columbia_artist_name_fan_list_with_tenant:
    id: "columbia_1"
    kind: fan_data_list
    attr:
      tenant:
        tenant_uuid: columbia_tenant_uuid
        tenant_type: account
        tenant_hierarchy: []
  columbia_artist_name_fan_list_with_tenant_and_jv:
    id: "columbia_2"
    kind: fan_data_list
    attr:
      tenant:
        tenant_uuid: columbia_tenant_uuid
        tenant_type: account
        tenant_hierarchy: []
      joint_venture:
        tenants:
        - tenant_uuid: "columbia_tenant_uuid"
          tenant_type: "account"
          tenant_hierarchy: [ "sony_company_brand", "sony_parent_company" ]
          is_provider: true
          is_consumer: true
  fan_data_list_with_joint_venture_tenant_hierarchy:
    id: "fan_data_list_with_joint_venture_tenant_hierarchy"
    kind: "fan_data_list"
    attr:
      joint_venture:
        tenants:
        - tenant_uuid: "subaccount_1_uuid"
          tenant_type: "subaccount"
          tenant_hierarchy: [ "account_32_uuid", "company_brand_1" ]
          is_provider: true
          is_consumer: true
        - tenant_uuid: "account_46_uuid"
          tenant_type: "account"
          tenant_hierarchy: ["company_brand_1"]
          is_provider: true
          is_consumer: false

name: FanDataListJointVentureTestSuite
description: Tests for Fan Data List with joint_venture attributes
tests:
  - name: Columbia user can view RCA artist fan_data_list in a joint_venture
    input:
      principals:
        - columbia_user_analyst
        - columbia_user_client
        - columbia_user_admin
        - columbia_user_no_audience_development_roles
        - user_with_tenant_that_is_provider_for_joint_venture
        - client_user_with_account_32_tenant
        - admin_user_with_account_32_tenant
        - admin_user_with_account_46_tenant
        - client_user_with_company_brand_1_tenant
        - analyst_user_with_company_brand_1_tenant
        - random_role_user
        - international_bob
        - user_with_view_fan_data_role
      resources:
        - rca_artist_name_fan_list_with_joint_venture
        - rca_artist_name_fan_list_with_tenant
        - columbia_artist_name_fan_list_with_tenant
        - columbia_artist_name_fan_list_with_tenant_and_jv
        - fan_data_list_with_joint_venture_tenant_hierarchy
      actions:
        - view
    expected:
    # Columbia users with audience_development roles can view an RCA fan data list
    # that is in a joint venture with the Columbia tenant
      - principal: columbia_user_analyst
        resource: rca_artist_name_fan_list_with_joint_venture
        actions:
          view: EFFECT_ALLOW
      - principal: columbia_user_client
        resource: rca_artist_name_fan_list_with_joint_venture
        actions:
          view: EFFECT_ALLOW
      - principal: columbia_user_admin
        resource: rca_artist_name_fan_list_with_joint_venture
        actions:
          view: EFFECT_ALLOW
      - principal: international_bob
        resource: rca_artist_name_fan_list_with_joint_venture
        actions:
          view: EFFECT_ALLOW
    # Columbia users with audience_development roles cannot view a
    # fan data list that is under the RCA tenant
      - principal: columbia_user_analyst
        resource: rca_artist_name_fan_list_with_tenant
        actions:
          view: EFFECT_DENY
      - principal: columbia_user_client
        resource: rca_artist_name_fan_list_with_tenant
        actions:
          view: EFFECT_DENY
      - principal: columbia_user_admin
        resource: rca_artist_name_fan_list_with_tenant
        actions:
          view: EFFECT_DENY
    # Columbia users with audience_development roles can view a
    # fan data list that is under the Columbia tenant
      - principal: columbia_user_analyst
        resource: columbia_artist_name_fan_list_with_tenant
        actions:
          view: EFFECT_ALLOW
      - principal: columbia_user_client
        resource: columbia_artist_name_fan_list_with_tenant
        actions:
          view: EFFECT_ALLOW
      - principal: columbia_user_admin
        resource: columbia_artist_name_fan_list_with_tenant
        actions:
          view: EFFECT_ALLOW
      - principal: international_bob
        resource: columbia_artist_name_fan_list_with_tenant
        actions:
          view: EFFECT_ALLOW
    # Columbia users with no audience_development roles cannot
    # view fan data lists
      - principal: columbia_user_no_audience_development_roles
        resource: columbia_artist_name_fan_list_with_tenant
        actions:
          view: EFFECT_DENY
      - principal: columbia_user_no_audience_development_roles
        resource: rca_artist_name_fan_list_with_joint_venture
        actions:
          view: EFFECT_DENY
    # A user with access to a tenant that is a provider (and not consumer)
    # of the joint venture cannot view the fan data list
      - principal: user_with_tenant_that_is_provider_for_joint_venture
        resource: rca_artist_name_fan_list_with_joint_venture
        actions:
          view: EFFECT_DENY
    # Fan data lists cannot be under a tenant AND a joint venture. These
    # will get denies because of resource schema validation errors
      - principal: columbia_user_analyst
        resource: columbia_artist_name_fan_list_with_tenant_and_jv
        actions:
          view: EFFECT_DENY
      - principal: columbia_user_client
        resource: columbia_artist_name_fan_list_with_tenant_and_jv
        actions:
          view: EFFECT_DENY
      - principal: columbia_user_admin
        resource: columbia_artist_name_fan_list_with_tenant_and_jv
        actions:
          view: EFFECT_DENY
    # A user with audience development access to a tenant in the tenant_hierarchy
    #  of a tenant in a joint venture can view the fan data list
      - principal: client_user_with_account_32_tenant
        resource: fan_data_list_with_joint_venture_tenant_hierarchy
        actions:
          view: EFFECT_ALLOW
      - principal: admin_user_with_account_32_tenant
        resource: fan_data_list_with_joint_venture_tenant_hierarchy
        actions:
          view: EFFECT_ALLOW
      - principal: client_user_with_company_brand_1_tenant
        resource: fan_data_list_with_joint_venture_tenant_hierarchy
        actions:
          view: EFFECT_ALLOW
      - principal: analyst_user_with_company_brand_1_tenant
        resource: fan_data_list_with_joint_venture_tenant_hierarchy
        actions:
          view: EFFECT_ALLOW
    # A user with access to a tenant that is NOT a consumer in the
    # joint venture can NOT view the fan data list
      - principal: admin_user_with_account_46_tenant
        resource: fan_data_list_with_joint_venture_tenant_hierarchy
        actions:
          view: EFFECT_DENY
    # A user with a random role for a tenant in the tenant_hierarchy
    # of a tenant in a joint venture can NOT view the fan data list
      - principal: random_role_user
        resource: fan_data_list_with_joint_venture_tenant_hierarchy
        actions:
          view: EFFECT_DENY
    # Roles V2
      - principal: user_with_view_fan_data_role
        resource: columbia_artist_name_fan_list_with_tenant
        actions:
          view: EFFECT_ALLOW
      - principal: user_with_view_fan_data_role
        resource: rca_artist_name_fan_list_with_joint_venture
        actions:
          view: EFFECT_ALLOW