# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  kat_seat_admin:
    id: kat_seat_admin
    roles: ['user']
    attr:
      type: human
      tenants:
        parent_company_1:
          tenant_uuid: parent_company_1
          tenant_type: parent_company
          roles:
            seat_can_administer_users:
              role: seat_can_administer_users

resources:
  parent_company_1:
    id: parent_company_1
    kind: parent_company
    attr:
      parent_company_uuid: parent_company_1
  parent_company_2:
    id: parent_company_2
    kind: parent_company
    attr:
      parent_company_uuid: parent_company_2

name: ParentCompanyTestSuite
description: Tests for verifying the ParentCompany resource policy
tests:
  - name: list_parent_companies
    input:
      principals:
        - some_hacker
        - jess
        - telvis
        - dima
        - melissa
        - kat_seat_admin
      resources:
        - parent_company_1
        - parent_company_2
      actions:
        - list
    expected:
      - principal: kat_seat_admin
        resources:
          - parent_company_1
          - parent_company_2
        actions:
          list: EFFECT_ALLOW
      - principal: some_hacker
        resources:
          - parent_company_1
          - parent_company_2
        actions:
          list: EFFECT_DENY
      - principal: jess
        resources:
          - parent_company_1
          - parent_company_2
        actions:
          list: EFFECT_DENY
      - principal: telvis
        resources:
          - parent_company_1
          - parent_company_2
        actions:
          list: EFFECT_DENY
      - principal: dima
        resources:
          - parent_company_1
          - parent_company_2
        actions:
          list: EFFECT_DENY