# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
name: GraphQLUserIntegrationTestSuite
description: Tests for graphql-user-integration-test principal policy (a1967faa-bb5b-4f07-89dc-6d455c8edf8f)

principals:
  graphql-user-integration-test:
    id: a1967faa-bb5b-4f07-89dc-6d455c8edf8f
    roles:
      - user
    attr:
      type: machine
      tenants: {}

resources:
  identity_allowed_tenant:
    id: identity_allowed_tenant
    kind: identity
    attr:
      tenant:
        tenant_type: account
        tenant_uuid: 573d0372-7f2f-48a6-8deb-c9a6558f9549  # test_account_tenant_uuid

  identity_different_tenant:
    id: identity_different_tenant
    kind: identity
    attr:
      identity_uuid: "some identity"
      tenant:
        tenant_type: account
        tenant_uuid: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee  # Different tenant UUID

  identity_wrong_tenant_type:
    id: identity_wrong_tenant_type
    kind: identity
    attr:
      identity_uuid: "some identity"
      tenant:
        tenant_type: company_brand
        tenant_uuid: 573d0372-7f2f-48a6-8deb-c9a6558f9549

tests:
  - name: Test to verify the identity can only perform actions on the test vendor
    input:
      principals:
        - graphql-user-integration-test
      resources:
        - identity_allowed_tenant
        - identity_different_tenant
        - identity_wrong_tenant_type
      actions:
        - attach_and_detach_role
        - list_tenants
        - view
    expected:
      - principal: graphql-user-integration-test
        resource: identity_allowed_tenant
        actions:
          attach_and_detach_role: EFFECT_ALLOW
          list_tenants: EFFECT_ALLOW
          view: EFFECT_ALLOW
      - principal: graphql-user-integration-test
        resource: identity_different_tenant
        actions:
          attach_and_detach_role: EFFECT_DENY
          list_tenants: EFFECT_DENY
          view: EFFECT_DENY
      - principal: graphql-user-integration-test
        resource: identity_wrong_tenant_type
        actions:
          attach_and_detach_role: EFFECT_DENY
          list_tenants: EFFECT_DENY
          view: EFFECT_DENY