# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
name: Auth0ActionInvitationValidityCheckTestSuite
description: Tests for auth0_action_invitation_validity_check principal policy (2d9b7d6c-2655-4f10-8287-02ac0cbeae70)

principals:
  auth0_action_invitation_validity_check:
    id: 2d9b7d6c-2655-4f10-8287-02ac0cbeae70
    roles:
      - user
    attr:
      type: machine
      tenants: {}

resources:
  some_identity:
    id: some_identity
    kind: identity
    attr:
      identity_uuid: f6c5cb40-cc5c-402c-bc9b-186883688b2b
      tenant:
        tenant_uuid: some_account
        tenant_hierarchy: []
        tenant_type: account

tests:
  - name: can only validate invitations, all other actions denied
    input:
      principals:
        - auth0_action_invitation_validity_check
      resources:
        - some_identity
      actions:
        - validate_invitation
        - attach_and_detach_role
        - view
        - list_tenants
        - deactivate_all
        - deactivate
    expected:
      - principal: auth0_action_invitation_validity_check
        resource: some_identity
        actions:
          validate_invitation: EFFECT_ALLOW
          attach_and_detach_role: EFFECT_DENY
          view: EFFECT_DENY
          list_tenants: EFFECT_DENY
          deactivate_all: EFFECT_DENY
          deactivate: EFFECT_DENY