# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
name: CucumberPDPE2ETestSuite
description: Tests for cucumber-pdp-e2e-test principal policy (2aa8d761-732f-4853-afd3-2e6dcfac47cc)

principals:
  cucumber-pdp-e2e-test:
    id: 2aa8d761-732f-4853-afd3-2e6dcfac47cc
    roles:
      - user
    attr:
      type: machine
      tenants: {}

resources:
  self_at_some_account_tenant:
    id: self_at_some_account_tenant
    kind: identity
    attr:
      identity_uuid: 2aa8d761-732f-4853-afd3-2e6dcfac47cc
      tenant:
        tenant_type: account
        tenant_uuid: "some account"

  self_at_frenchkiss_tenant:
    id: self_at_frenchkiss_tenant
    kind: identity
    attr:
      identity_uuid: 2aa8d761-732f-4853-afd3-2e6dcfac47cc
      tenant:
        tenant_type: account
        tenant_uuid: fff741c2-6def-4493-bfdf-c2bcb1128e02  # frenchkiss_tenant_uuid

  another_identity_uuid_at_some_account_tenant:
    id: another_identity_uuid_at_some_account_tenant
    kind: identity
    attr:
      identity_uuid: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
      tenant:
        tenant_type: account
        tenant_uuid: "some account"

  another_identity_uuid_at_frenchkiss_tenant:
    id: another_identity_uuid_at_frenchkiss_tenant
    kind: identity
    attr:
      identity_uuid: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
      tenant:
        tenant_type: account
        tenant_uuid: fff741c2-6def-4493-bfdf-c2bcb1128e02  # frenchkiss_tenant_uuid

tests:
  - name: Test to verify the identity can only perform actions when identity_uuid matches principal id
    input:
      principals:
        - cucumber-pdp-e2e-test
      resources:
        - self_at_some_account_tenant
        - self_at_frenchkiss_tenant
        - another_identity_uuid_at_some_account_tenant
        - another_identity_uuid_at_frenchkiss_tenant
      actions:
        - attach_and_detach_role
        - list_tenants
        - view
        - check_resources
    expected:
      - principal: cucumber-pdp-e2e-test
        resource:
          self_at_some_account_tenant
        actions:
          attach_and_detach_role: EFFECT_DENY
          list_tenants: EFFECT_ALLOW
          view: EFFECT_ALLOW
          check_resources: EFFECT_ALLOW
      - principal: cucumber-pdp-e2e-test
        resource:
          self_at_frenchkiss_tenant
        actions:
          attach_and_detach_role: EFFECT_ALLOW
          list_tenants: EFFECT_ALLOW
          view: EFFECT_ALLOW
          check_resources: EFFECT_ALLOW
      - principal: cucumber-pdp-e2e-test
        resource: another_identity_uuid_at_some_account_tenant
        actions:
          attach_and_detach_role: EFFECT_DENY
          list_tenants: EFFECT_DENY
          view: EFFECT_DENY
          check_resources: EFFECT_DENY
      - principal: cucumber-pdp-e2e-test
        resource: another_identity_uuid_at_frenchkiss_tenant
        actions:
          attach_and_detach_role: EFFECT_DENY
          list_tenants: EFFECT_DENY
          view: EFFECT_DENY
          check_resources: EFFECT_DENY