# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json --- principals: orlando: id: orlando roles: ['user'] attr: type: human tenants: parent_company_1: tenant_uuid: parent_company_1 tenant_type: parent_company roles: seat_can_administer_users: role: seat_can_administer_users vendor_star_esque_user_but_for_only_one_pc: id: vendor_star_esque_user_but_for_only_one_pc roles: ['user'] attr: type: human tenants: parent_company_1: tenant_uuid: parent_company_1 tenant_type: parent_company roles: ows_permissions_rap_admin: role: ows_permissions_rap_admin resources: id_role1: id: "id_role1" kind: "identity" attr: identity_uuid: "id_role1" tenant: tenant_uuid: "d6455851-3f86-48d8-b102-8d996eb92645" tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] tenant_type: account integration_test_id: id: "4d5f24f5-83f9-4989-9f82-0924a5feaf88" kind: "identity" attr: identity_uuid: "4d5f24f5-83f9-4989-9f82-0924a5feaf88" tenant: tenant_uuid: "some_account" tenant_hierarchy: [] tenant_type: account jess: id: "7f418dad-780b-4ab3-a4a2-2deba190f503" kind: "identity" attr: identity_uuid: "7f418dad-780b-4ab3-a4a2-2deba190f503" tenant: tenant_uuid: "some_account" tenant_hierarchy: [] tenant_type: account tenantless_identity: id: "probably not" kind: "identity" attr: identity_uuid: "probably not" artist_1_identity: id: 89357b2d-208b-4a6c-9470-39b917440a41 kind: "identity" attr: identity_uuid: 89357b2d-208b-4a6c-9470-39b917440a41 tenant: tenant_uuid: "8ddfd311-0dba-4148-8d00-9ca18461e27b" tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] tenant_type: label_participant orlando: id: orlando kind: identity attr: identity_uuid: orlando tenant: tenant_uuid: parent_company_1 tenant_type: parent_company tenant_hierarchy: [] identity_tenant_role_missing_tenant_type: id: identity_tenant_role_missing_tenant_type kind: identity attr: identity_uuid: identity_tenant_role_missing_tenant_type tenant: tenant_uuid: "8ddfd311-0dba-4148-8d00-9ca18461e27b" tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] client_manager_at_collab_level: id: client_manager_at_collab_level kind: identity attr: identity_uuid: client_manager_at_collab_level tenant: tenant_uuid: "c8961e85-15c1-48b7-820a-a6c9248f0557" tenant_type: "collaborator" tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] client_manager_at_artist_level: id: client_manager_at_artist_level kind: identity attr: identity_uuid: client_manager_at_artist_level tenant: tenant_uuid: "8ddfd311-0dba-4148-8d00-9ca18461e27b" tenant_type: "label_participant" tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] client_manager_at_subaccount_level: id: client_manager_at_subaccount_level kind: identity attr: identity_uuid: client_manager_at_subaccount_level tenant: tenant_uuid: 42196c6d-7ae4-4c78-ae8c-ba8bfec6a507 tenant_type: subaccount tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298", "d6455851-3f86-48d8-b102-8d996eb92645"] client_manager_at_account_level: id: client_manager_at_account_level kind: identity attr: identity_uuid: client_manager_at_account_level tenant: tenant_uuid: d6455851-3f86-48d8-b102-8d996eb92645 tenant_type: account tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"] client_manager_at_cb_level: id: client_manager_at_pc_level kind: identity attr: identity_uuid: client_manager_at_pc_level tenant: tenant_uuid: d25a4cd1-e820-45f2-be5c-56edcfeb8298 tenant_type: company_brand tenant_hierarchy: ["parent_company_1"] client_manager_at_pc_level: id: client_manager_at_pc_level kind: identity attr: identity_uuid: client_manager_at_pc_level tenant: tenant_uuid: parent_company_1 tenant_type: parent_company tenant_hierarchy: [] client_manager_at_other_pc: id: client_manager_at_other_pc kind: identity attr: identity_uuid: client_manager_at_other_pc tenant: tenant_uuid: parent_company_2 tenant_type: parent_company tenant_hierarchy: [] name: IdentityTestSuite description: Tests for verifying the Identity resource policy tests: - name: attach_role/detach_role input: principals: - some_hacker - jess - telvis - dima - integration_test_user - account_rap_admin - company_brand_rap_admin - other_account_rap_admin - other_company_brand_rap_admin - id_role1 - artist_1 - artist_2 - pdp_backfill resources: - id_role1 - integration_test_id - jess - tenantless_identity - artist_1_identity - orlando - identity_tenant_role_missing_tenant_type - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level - client_manager_at_account_level - client_manager_at_cb_level - client_manager_at_pc_level - client_manager_at_other_pc actions: - attach_and_detach_role - view - list_tenants - deactivate_all - deactivate expected: - principal: jess resource: jess actions: attach_and_detach_role: EFFECT_DENY # No self-escalation view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_DENY deactivate: EFFECT_DENY - principal: jess resources: - id_role1 - integration_test_id - tenantless_identity - artist_1_identity - orlando - identity_tenant_role_missing_tenant_type - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level - client_manager_at_account_level - client_manager_at_cb_level - client_manager_at_pc_level - client_manager_at_other_pc actions: attach_and_detach_role: EFFECT_ALLOW view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_ALLOW - principal: telvis resources: - id_role1 - integration_test_id - jess - tenantless_identity - artist_1_identity - orlando - identity_tenant_role_missing_tenant_type - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level - client_manager_at_account_level - client_manager_at_cb_level - client_manager_at_pc_level - client_manager_at_other_pc actions: attach_and_detach_role: EFFECT_ALLOW view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_ALLOW - principal: dima resources: - id_role1 - integration_test_id - jess - tenantless_identity - artist_1_identity - orlando - identity_tenant_role_missing_tenant_type - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level - client_manager_at_account_level - client_manager_at_cb_level - client_manager_at_pc_level - client_manager_at_other_pc actions: attach_and_detach_role: EFFECT_ALLOW view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_DENY deactivate: EFFECT_DENY - principal: integration_test_user resource: id_role1 actions: attach_and_detach_role: EFFECT_DENY view: EFFECT_DENY list_tenants: EFFECT_DENY deactivate_all: EFFECT_DENY deactivate: EFFECT_DENY - principal: integration_test_user resource: integration_test_id actions: view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW attach_and_detach_role: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_ALLOW - principal: account_rap_admin resources: - jess - integration_test_id - tenantless_identity - artist_1_identity - orlando - identity_tenant_role_missing_tenant_type - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_cb_level - client_manager_at_pc_level - client_manager_at_other_pc actions: attach_and_detach_role: EFFECT_DENY view: EFFECT_DENY list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_DENY - principal: account_rap_admin resources: - id_role1 - client_manager_at_account_level - client_manager_at_subaccount_level actions: attach_and_detach_role: EFFECT_ALLOW view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_ALLOW - principal: account_rap_admin resource: artist_1_identity actions: attach_and_detach_role: EFFECT_DENY view: EFFECT_DENY list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_DENY - principal: company_brand_rap_admin resources: - jess - tenantless_identity - integration_test_id - orlando - client_manager_at_pc_level - client_manager_at_other_pc actions: attach_and_detach_role: EFFECT_DENY view: EFFECT_DENY list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_DENY - principal: company_brand_rap_admin resources: - id_role1 - artist_1_identity - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level - client_manager_at_account_level actions: attach_and_detach_role: EFFECT_ALLOW view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_ALLOW - principal: company_brand_rap_admin resources: - identity_tenant_role_missing_tenant_type - client_manager_at_cb_level actions: attach_and_detach_role: EFFECT_DENY view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_ALLOW - principal: other_account_rap_admin resources: - jess - integration_test_id - tenantless_identity - id_role1 - artist_1_identity - orlando - identity_tenant_role_missing_tenant_type - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level - client_manager_at_account_level - client_manager_at_cb_level - client_manager_at_pc_level - client_manager_at_other_pc actions: attach_and_detach_role: EFFECT_DENY view: EFFECT_DENY list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_DENY - principal: other_company_brand_rap_admin resources: - jess - integration_test_id - tenantless_identity - id_role1 - artist_1_identity - orlando - identity_tenant_role_missing_tenant_type - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level - client_manager_at_account_level - client_manager_at_cb_level - client_manager_at_pc_level - client_manager_at_other_pc actions: attach_and_detach_role: EFFECT_DENY view: EFFECT_DENY list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_DENY - principal: id_role1 resource: id_role1 actions: attach_and_detach_role: EFFECT_DENY view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_DENY deactivate: EFFECT_DENY - principal: artist_1 resource: artist_1_identity actions: attach_and_detach_role: EFFECT_DENY view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_DENY deactivate: EFFECT_DENY - principal: pdp_backfill resources: - artist_1_identity - id_role1 - integration_test_id - jess - tenantless_identity - orlando - identity_tenant_role_missing_tenant_type - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level - client_manager_at_account_level - client_manager_at_cb_level - client_manager_at_pc_level - client_manager_at_other_pc actions: attach_and_detach_role: EFFECT_ALLOW view: EFFECT_DENY list_tenants: EFFECT_DENY deactivate_all: EFFECT_DENY deactivate: EFFECT_DENY - name: check identity resources input: principals: - integration_test_user - some_hacker - telvis - dima - artist_1 - artist_2 resources: - integration_test_id - id_role1 - artist_1_identity actions: - check_resources expected: - principal: integration_test_user resource: integration_test_id actions: check_resources: EFFECT_ALLOW - principal: integration_test_user resource: id_role1 actions: check_resources: EFFECT_DENY - principal: some_hacker resource: id_role1 actions: check_resources: EFFECT_DENY - principal: telvis resource: id_role1 actions: check_resources: EFFECT_ALLOW - principal: telvis resource: integration_test_id actions: check_resources: EFFECT_ALLOW - principal: telvis resource: artist_1_identity actions: check_resources: EFFECT_ALLOW - principal: dima resource: id_role1 actions: check_resources: EFFECT_DENY - principal: artist_1 resource: artist_1_identity actions: check_resources: EFFECT_ALLOW - name: pde team leadership input: principals: - masha - nate resources: - id_role1 - artist_1_identity actions: - deactivate - deactivate_all expected: - principal: masha resources: - id_role1 - artist_1_identity actions: deactivate: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW - principal: nate resources: - id_role1 - artist_1_identity actions: deactivate: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW - name: seat users input: principals: - orlando - vendor_star_esque_user_but_for_only_one_pc resources: - orlando - identity_tenant_role_missing_tenant_type - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level - client_manager_at_account_level - client_manager_at_cb_level - client_manager_at_pc_level - client_manager_at_other_pc actions: - view - list_employees - create_employee - manage_employee - list_tenants - attach_and_detach_role - deactivate_all - deactivate expected: - principal: orlando resources: - identity_tenant_role_missing_tenant_type - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level actions: view: EFFECT_DENY list_employees: EFFECT_ALLOW create_employee: EFFECT_ALLOW manage_employee: EFFECT_ALLOW list_tenants: EFFECT_ALLOW attach_and_detach_role: EFFECT_DENY deactivate_all: EFFECT_ALLOW deactivate: EFFECT_ALLOW - principal: orlando resources: - client_manager_at_account_level - client_manager_at_cb_level - client_manager_at_pc_level actions: view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW list_employees: EFFECT_ALLOW create_employee: EFFECT_ALLOW manage_employee: EFFECT_ALLOW attach_and_detach_role: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_ALLOW - principal: orlando resources: - orlando actions: view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW list_employees: EFFECT_ALLOW create_employee: EFFECT_ALLOW manage_employee: EFFECT_ALLOW attach_and_detach_role: EFFECT_DENY deactivate_all: EFFECT_DENY deactivate: EFFECT_DENY - principal: orlando resources: - client_manager_at_other_pc actions: view: EFFECT_DENY list_tenants: EFFECT_ALLOW list_employees: EFFECT_ALLOW create_employee: EFFECT_ALLOW manage_employee: EFFECT_ALLOW attach_and_detach_role: EFFECT_DENY deactivate_all: EFFECT_ALLOW deactivate: EFFECT_DENY - principal: vendor_star_esque_user_but_for_only_one_pc resources: - orlando - identity_tenant_role_missing_tenant_type - client_manager_at_cb_level - client_manager_at_pc_level actions: view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW list_employees: EFFECT_DENY create_employee: EFFECT_DENY manage_employee: EFFECT_DENY attach_and_detach_role: EFFECT_DENY deactivate_all: EFFECT_ALLOW deactivate: EFFECT_ALLOW - principal: vendor_star_esque_user_but_for_only_one_pc resources: - client_manager_at_collab_level - client_manager_at_artist_level - client_manager_at_subaccount_level - client_manager_at_account_level actions: view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW list_employees: EFFECT_DENY create_employee: EFFECT_DENY manage_employee: EFFECT_DENY attach_and_detach_role: EFFECT_ALLOW deactivate_all: EFFECT_ALLOW deactivate: EFFECT_ALLOW - principal: vendor_star_esque_user_but_for_only_one_pc resources: - client_manager_at_other_pc actions: view: EFFECT_DENY list_tenants: EFFECT_ALLOW list_employees: EFFECT_DENY create_employee: EFFECT_DENY manage_employee: EFFECT_DENY attach_and_detach_role: EFFECT_DENY deactivate_all: EFFECT_ALLOW deactivate: EFFECT_DENY - name: auth0_action_pdp_access_check input: principals: - auth0_action_pdp_access_check resources: - id_role1 - integration_test_id - jess - tenantless_identity - artist_1_identity actions: - attach_and_detach_role - view - list_tenants - deactivate_all - deactivate expected: - principal: auth0_action_pdp_access_check resources: - id_role1 - integration_test_id - jess - tenantless_identity - artist_1_identity actions: attach_and_detach_role: EFFECT_DENY view: EFFECT_ALLOW list_tenants: EFFECT_ALLOW deactivate_all: EFFECT_DENY deactivate: EFFECT_DENY