# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
name: SpatialAssetIngesterMachineTestSuite
description: Tests for the spatial-asset-ingester machine principal policy (1383a1f1-ced9-4396-be43-a630f967489f) covering update:asset and view:asset on products

principals:
  spatial-asset-ingester:
    id: 1383a1f1-ced9-4396-be43-a630f967489f
    roles:
      - user
    attr:
      type: machine
      tenants: {}
  some_hacker:
    id: some_hacker
    roles:
      - user
    attr:
      type: human
      tenants: {}

resources:
  product:
    id: product
    kind: product
    attr:
      tenant:
        tenant_uuid: "d6455851-3f86-48d8-b102-8d996eb92645"
        tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"]

tests:
  - name: spatial-asset-ingester can update and view product assets; others cannot
    input:
      principals:
        - spatial-asset-ingester
        - some_hacker
      resources:
        - product
      actions:
        - update:asset
        - view:asset
    expected:
      - principal: spatial-asset-ingester
        resource: product
        actions:
          update:asset: EFFECT_ALLOW
          view:asset: EFFECT_ALLOW
      - principal: some_hacker
        resource: product
        actions:
          update:asset: EFFECT_DENY
          view:asset: EFFECT_DENY