# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  telvis:
    id: d7fac0ab-184a-4f76-ab2f-2acdcdf14ba0
    roles:
      - user
    attr:
      type: human
      tenants:
        "test-account-uuid":
          tenant_uuid: "test-account-uuid"
          tenant_type: "account"
          roles:
            somerole:
              role: somerole

  machine_impersonating_telvis:
    id: d7fac0ab-184a-4f76-ab2f-2acdcdf14ba0
    roles:
      - user
    attr:
      type: machine
      tenants:
        "test-account-uuid":
          tenant_uuid: "test-account-uuid"
          tenant_type: "account"
          roles:
            somerole:
              role: somerole
      impersonated_by_identity_uuid: some_machine_id

  dude_impersonating_telvis:
    id: d7fac0ab-184a-4f76-ab2f-2acdcdf14ba0
    roles:
      - user
    attr:
      type: human
      tenants:
        "test-account-uuid":
          tenant_uuid: "test-account-uuid"
          tenant_type: "account"
          roles:
            somerole:
              role: somerole
      impersonated_by_identity_uuid: dude

resources:
  test_identity:
    id: test_identity_uuid
    kind: identity
    attr:
      identity_uuid: other_user_id
      tenant:
        tenant_uuid: "test-account-uuid"
        tenant_type: account
        tenant_hierarchy: []

  demo_resource:
    id: demo_resource_1
    kind: demo_impersonation

name: IdentityImpersonationTestSuite
description: Test that impersonated pde_team_pp members cannot perform identity actions
tests:
  - name: pde_team_pp_impersonation_blocked
    input:
      principals:
        - telvis
        - machine_impersonating_telvis
        - dude_impersonating_telvis
      resources:
        - test_identity
      actions:
        - list_tenants
        - view
        - attach_and_detach_role
        - deactivate_all
        - deactivate
        - check_resources
    expected:
      - principal: telvis
        resource: test_identity
        actions:
          list_tenants: EFFECT_ALLOW
          view: EFFECT_ALLOW
          attach_and_detach_role: EFFECT_ALLOW
          deactivate_all: EFFECT_ALLOW
          deactivate: EFFECT_ALLOW
          check_resources: EFFECT_ALLOW
      - principal: machine_impersonating_telvis
        resource: test_identity
        actions:
          list_tenants: EFFECT_DENY
          view: EFFECT_DENY
          attach_and_detach_role: EFFECT_DENY
          deactivate_all: EFFECT_DENY
          deactivate: EFFECT_DENY
          check_resources: EFFECT_DENY
      - principal: dude_impersonating_telvis
        resource: test_identity
        actions:
          list_tenants: EFFECT_DENY
          view: EFFECT_DENY
          attach_and_detach_role: EFFECT_DENY
          deactivate_all: EFFECT_DENY
          deactivate: EFFECT_DENY
          check_resources: EFFECT_DENY

  - name: impersonated_principals_can_access_demo_resource
    input:
      principals:
        - machine_impersonating_telvis
        - dude_impersonating_telvis
      resources:
        - demo_resource
      actions:
        - yolo
        - only_on_behalf_of
        - machine_obo_op
    expected:
      - principal: machine_impersonating_telvis
        resource: demo_resource
        actions:
          yolo: EFFECT_ALLOW
          only_on_behalf_of: EFFECT_ALLOW
          machine_obo_op: EFFECT_ALLOW
      - principal: dude_impersonating_telvis
        resource: demo_resource
        actions:
          yolo: EFFECT_ALLOW
          only_on_behalf_of: EFFECT_ALLOW
          machine_obo_op: EFFECT_DENY