# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
resources:
  pp_cache:
    id: "pp_cache"
    kind: "infra"
  pp_idx:
    id: "pp_idx"
    kind: "infra"

name: InfraTestSuite 
description: Tests for verifying the Infra resource policy 
tests: 
  - name: list_bust_bludgeon_pdp_cache
    input:
      principals:
        - some_hacker
        - jess
        - telvis
        - dima
        - melissa
        - integration_test_user
      resources:
        - pp_cache
      actions:
        - list_cache
        - bust_cache
        - bludgeon_cache
    expected:
      - principal: jess
        resource: pp_cache
        actions:
          list_cache: EFFECT_ALLOW
          bust_cache: EFFECT_ALLOW
          bludgeon_cache: EFFECT_ALLOW
      - principal: telvis
        resource: pp_cache
        actions:
          list_cache: EFFECT_ALLOW
          bust_cache: EFFECT_ALLOW
          bludgeon_cache: EFFECT_ALLOW
      - principal: melissa
        resource: pp_cache
        actions:
          list_cache: EFFECT_ALLOW
          bust_cache: EFFECT_ALLOW
          bludgeon_cache: EFFECT_ALLOW
      - principal: some_hacker
        resource: pp_cache
        actions:
          list_cache: EFFECT_DENY
          bust_cache: EFFECT_DENY
          bludgeon_cache: EFFECT_DENY
      - principal: dima
        resource: pp_cache
        actions:
          list_cache: EFFECT_DENY
          bust_cache: EFFECT_DENY
          bludgeon_cache: EFFECT_DENY
      - principal: integration_test_user
        resource: pp_cache
        actions:
          list_cache: EFFECT_ALLOW
          bust_cache: EFFECT_ALLOW
          bludgeon_cache: EFFECT_ALLOW

  - name: check_idx_exchanges
    input:
      principals:
        - some_hacker
        - jess
        - telvis
        - dima
        - melissa
        - integration_test_user
      resources:
        - pp_idx
      actions:
        - id_to_uuid_exchange
        - uuid_to_id_exchange
    expected:
      - principal: jess
        resource: pp_idx
        actions:
          id_to_uuid_exchange: EFFECT_ALLOW
          uuid_to_id_exchange: EFFECT_ALLOW
      - principal: telvis
        resource: pp_idx
        actions:
          id_to_uuid_exchange: EFFECT_ALLOW
          uuid_to_id_exchange: EFFECT_ALLOW
      - principal: melissa
        resource: pp_idx
        actions:
          id_to_uuid_exchange: EFFECT_ALLOW
          uuid_to_id_exchange: EFFECT_ALLOW
      - principal: some_hacker
        resource: pp_idx
        actions:
          id_to_uuid_exchange: EFFECT_DENY
          uuid_to_id_exchange: EFFECT_DENY
      - principal: dima
        resource: pp_idx
        actions:
          id_to_uuid_exchange: EFFECT_DENY
          uuid_to_id_exchange: EFFECT_DENY
      - principal: integration_test_user
        resource: pp_idx
        actions:
          id_to_uuid_exchange: EFFECT_ALLOW
          uuid_to_id_exchange: EFFECT_ALLOW