# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  songwhip_read_user_1:
    id: "ff48811d-8c50-4208-8c07-cf6500e29ae7"
    roles:
      - user
    attr:
      type: human
      tenants:
        "bad45218-68d8-42b6-b4ee-730ef9e16309":
          tenant_uuid: "bad45218-68d8-42b6-b4ee-730ef9e16309"
          tenant_type: "account"
          roles:
            songwhip_read:
              role: songwhip_read
  songwhip_read_user_2:
    id: "84a3fa81-69fc-4d3b-8997-be099226a068"
    roles:
      - user
    attr:
      type: human
      tenants:
        "d25a4cd1-e820-45f2-be5c-56edcfeb8298":
          tenant_uuid: "d25a4cd1-e820-45f2-be5c-56edcfeb8298"
          tenant_type: "company_brand"
          roles:
            songwhip_read:
              role: songwhip_read
  user_with_view_fan_data_role:
    id: "user_with_view_fan_data_role_uuid"
    roles:
      - user
    attr:
      type: human
      tenants:
        "d25a4cd1-e820-45f2-be5c-56edcfeb8298":
          tenant_uuid: "d25a4cd1-e820-45f2-be5c-56edcfeb8298"
          tenant_type: "company_brand"
          roles:
            fansifter_can_view_fan_data:
              role: fansifter_can_view_fan_data

resources:
  roster_1:
    id: roster_1
    kind: roster
    attr:
      tenant: 
        tenant_uuid: "bad45218-68d8-42b6-b4ee-730ef9e16309"
        tenant_hierarchy: []
  roster_2:
    id: roster_2
    kind: roster
    attr:
      tenant:
        tenant_uuid: "c715ede9-007d-4e2e-9c6f-46f1de04f010"
        tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"]

name: RosterTestSuite 
description: Tests for verifying the roster resource policy 
tests: 
  - name: Viewing a Roster
    input:
      principals:
        - olivia
        - songwhip_read_user_1
        - songwhip_read_user_2
        - user_with_view_fan_data_role
      resources:
        - roster_1
        - roster_2
      actions:
        - view
    expected:
      - principal: olivia
        resource: roster_1
        actions:
          view: EFFECT_DENY
      - principal: olivia
        resource: roster_2
        actions:
          view: EFFECT_ALLOW
      - principal: songwhip_read_user_1
        resource: roster_1
        actions:
          view: EFFECT_ALLOW
      - principal: songwhip_read_user_1
        resource: roster_2
        actions:
          view: EFFECT_DENY
      - principal: songwhip_read_user_2
        resource: roster_1
        actions:
          view: EFFECT_DENY
      - principal: songwhip_read_user_2
        resource: roster_2
        actions:
          view: EFFECT_ALLOW
      - principal: user_with_view_fan_data_role
        resource: roster_1
        actions:
          view: EFFECT_DENY
      - principal: user_with_view_fan_data_role
        resource: roster_2
        actions:
          view: EFFECT_ALLOW