# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
name: OWSPermissionsIntegrationTestSuite
description: Tests for ows-permissions-integration-test principal policy (27d2fd9c-a3c5-4183-8f0f-e552962cf855)

principals:
  ows-permissions-integration-test:
    id: 27d2fd9c-a3c5-4183-8f0f-e552962cf855
    roles:
      - user
    attr:
      type: machine
      tenants: {}

resources:
  identity_matching_uuid:
    id: identity_matching_uuid
    kind: identity
    attr:
      identity_uuid: 27d2fd9c-a3c5-4183-8f0f-e552962cf855
      tenant:
        tenant_type: account
        tenant_uuid: "some account"

  identity_different_uuid:
    id: identity_different_uuid
    kind: identity
    attr:
      identity_uuid: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
      tenant:
        tenant_type: account
        tenant_uuid: "some account"

tests:
  - name: Test to verify the identity can only perform actions when identity_uuid matches principal id
    input:
      principals:
        - ows-permissions-integration-test
      resources:
        - identity_matching_uuid
        - identity_different_uuid
      actions:
        - list_tenants
        - view
    expected:
      - principal: ows-permissions-integration-test
        resource: identity_matching_uuid
        actions:
          list_tenants: EFFECT_ALLOW
          view: EFFECT_ALLOW
      - principal: ows-permissions-integration-test
        resource: identity_different_uuid
        actions:
          list_tenants: EFFECT_DENY
          view: EFFECT_DENY