# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
resources:
  contribution:
    id: "nr_contribution"
    kind: "contribution"
    attr:
      tenant:
        tenant_uuid: "77c6c150-19f3-451f-a692-1a5d7ef30e85"
        tenant_type: "company_brand"
        tenant_hierarchy: ["77c6c150-19f3-451f-a692-1a5d7ef30e85"]

name: ContributionTestSuite
description: Test for verifying contribution resource policies
tests:
  - name: Viewing a contribution
    input:
      principals:
        - rob
        - allan
        - georgios
        - kath
        - alex
        - account_admin
        - contract_admin
        - account_edit
        - contract_viewer
      resources:
        - contribution
      actions:
        - view
        - view:basic
        - view:nr
        - view:accounting
    expected:
      - principal: rob
        resource: contribution
        actions:
          view: EFFECT_DENY
          view:basic: EFFECT_ALLOW
          view:nr: EFFECT_ALLOW
          view:accounting: EFFECT_ALLOW
      - principal: allan
        resource: contribution
        actions:
          view: EFFECT_DENY
          view:basic: EFFECT_DENY
          view:nr: EFFECT_DENY
          view:accounting: EFFECT_DENY
      - principal: georgios
        resource: contribution
        actions:
          view: EFFECT_DENY
          view:basic: EFFECT_ALLOW
          view:nr: EFFECT_ALLOW
          view:accounting: EFFECT_ALLOW
      - principal: kath
        resource: contribution
        actions:
          view: EFFECT_DENY
          view:basic: EFFECT_ALLOW
          view:nr: EFFECT_ALLOW
          view:accounting: EFFECT_ALLOW
      - principal: alex
        resource: contribution
        actions:
          view: EFFECT_DENY
          view:basic: EFFECT_ALLOW
          view:nr: EFFECT_ALLOW
          view:accounting: EFFECT_ALLOW
      - principal: account_admin
        resource: contribution
        actions:
          view: EFFECT_DENY
          view:basic: EFFECT_ALLOW
          view:nr: EFFECT_DENY
          view:accounting: EFFECT_ALLOW
      - principal: contract_admin
        resource: contribution
        actions:
          view: EFFECT_DENY
          view:basic: EFFECT_ALLOW
          view:nr: EFFECT_DENY
          view:accounting: EFFECT_ALLOW
      - principal: account_edit
        resource: contribution
        actions:
          view: EFFECT_DENY
          view:basic: EFFECT_ALLOW
          view:nr: EFFECT_DENY
          view:accounting: EFFECT_ALLOW
      - principal: contract_viewer
        resource: contribution
        actions:
          view: EFFECT_DENY
          view:basic: EFFECT_ALLOW
          view:nr: EFFECT_DENY
          view:accounting: EFFECT_ALLOW
  - name: Managing and Deleting a contribution
    input:
      principals:
        - rob
        - allan
        - georgios
        - kath
        - alex
        - account_admin
        - contract_admin
        - account_edit
        - contract_viewer
      resources:
        - contribution
      actions:
        - edit
        - delete
    expected:
      - principal: rob
        resource: contribution
        actions:
          delete: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: allan
        resource: contribution
        actions:
          delete: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: georgios
        resource: contribution
        actions:
          delete: EFFECT_DENY
          edit: EFFECT_ALLOW
      - principal: kath
        resource: contribution
        actions:
          delete: EFFECT_ALLOW
          edit: EFFECT_ALLOW
      - principal: alex
        resource: contribution
        actions:
          delete: EFFECT_ALLOW
          edit: EFFECT_ALLOW
      - principal: account_admin
        resource: contribution
        actions:
          delete: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: contract_admin
        resource: contribution
        actions:
          delete: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: account_edit
        resource: contribution
        actions:
          delete: EFFECT_DENY
          edit: EFFECT_DENY
      - principal: contract_viewer
        resource: contribution
        actions:
          delete: EFFECT_DENY
          edit: EFFECT_DENY
  - name: Machine Policies for Contributions
    input:
      principals:
        - machine_lambda_abacus_schedule_auto_add
      resources:
        - contribution
      actions:
        - view
        - view:basic
        - view:nr
        - view:accounting
        - edit
        - delete
    expected:
      - principal: machine_lambda_abacus_schedule_auto_add
        resource: contribution
        actions:
          view: EFFECT_DENY
          view:basic: EFFECT_ALLOW
          view:nr: EFFECT_DENY
          view:accounting: EFFECT_ALLOW
          delete: EFFECT_DENY
          edit: EFFECT_DENY