# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
name: LambdaAssetsHiveAiDetectionTestSuite
description: Tests for lambda-assets-hive-ai-detection principal policy (e10de33c-307e-44da-9ed1-8c93519a04b9)

principals:
  lambda-assets-hive-ai-detection:
    id: e10de33c-307e-44da-9ed1-8c93519a04b9
    roles:
      - user
    attr:
      type: machine
      tenants: {}

  some_hacker:
    id: some_hacker
    roles:
      - user
    attr:
      type: human
      tenants:
        "does_not_matter":
          tenant_uuid: "does_not_matter"
          roles: []

resources:
  some_product:
    id: some_product
    kind: product
    attr:
      tenant:
        tenant_uuid: "d6455851-3f86-48d8-b102-8d996eb92645"
        tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"]
  no_attr_product:
    id: no_attr_product
    kind: product

tests:
  - name: lambda-assets-hive-ai-detection can update:asset:ai_detection on product resources
    input:
      principals:
        - lambda-assets-hive-ai-detection
        - some_hacker
      resources:
        - some_product
        - no_attr_product
      actions:
        - update:asset:ai_detection
    expected:
      - principal: lambda-assets-hive-ai-detection
        resources:
          - some_product
          - no_attr_product
        actions:
          update:asset:ai_detection: EFFECT_ALLOW
      - principal: some_hacker
        resources:
          - some_product
          - no_attr_product
        actions:
          update:asset:ai_detection: EFFECT_DENY