# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
principals:
  no_role_user:
    id: 11111111-1111-1111-1111-111111111111
    roles:
      - user
    attr:
      type: human
      tenants:
        "vendor_a":
          tenant_uuid: "vendor_a"
          tenant_type: "account"
          roles: {}
  vendor_a_transfer_viewer:
    id: 22222222-2222-2222-2222-222222222222
    roles:
      - user
    attr:
      type: human
      tenants:
        "vendor_a":
          tenant_uuid: "vendor_a"
          tenant_type: "account"
          roles:
            transfer_viewer:
              role: transfer_viewer
  vendor_a_transfer_creator:
    id: 33333333-3333-3333-3333-333333333333
    roles:
      - user
    attr:
      type: human
      tenants:
        "vendor_a":
          tenant_uuid: "vendor_a"
          tenant_type: "account"
          roles:
            transfer_creator:
              role: transfer_creator
  vendor_a_transfer_operator:
    id: 44444444-4444-4444-4444-444444444444
    roles:
      - user
    attr:
      type: human
      tenants:
        "vendor_a":
          tenant_uuid: "vendor_a"
          tenant_type: "account"
          roles:
            transfer_operator:
              role: transfer_operator
  vendor_b_transfer_operator:
    id: 55555555-5555-5555-5555-555555555555
    roles:
      - user
    attr:
      type: human
      tenants:
        "vendor_b":
          tenant_uuid: "vendor_b"
          tenant_type: "account"
          roles:
            transfer_operator:
              role: transfer_operator
  vendor_b_transfer_viewer:
    id: 77777777-7777-7777-7777-777777777777
    roles:
      - user
    attr:
      type: human
      tenants:
        "vendor_b":
          tenant_uuid: "vendor_b"
          tenant_type: "account"
          roles:
            transfer_viewer:
              role: transfer_viewer
  vendor_b_transfer_creator:
    id: 88888888-8888-8888-8888-888888888888
    roles:
      - user
    attr:
      type: human
      tenants:
        "vendor_b":
          tenant_uuid: "vendor_b"
          tenant_type: "account"
          roles:
            transfer_creator:
              role: transfer_creator
  parent_company_transfer_creator:
    id: 66666666-6666-6666-6666-666666666666
    roles:
      - user
    attr:
      type: human
      tenants:
        "parent_company_1":
          tenant_uuid: "parent_company_1"
          tenant_type: "parent_company"
          roles:
            transfer_creator:
              role: transfer_creator

resources:
  transfer_job_vendor_a:
    id: "transfer_job_vendor_a"
    kind: "project_transfer"
    attr:
      tenant:
        tenant_uuid: "vendor_a"
        tenant_type: account
        tenant_hierarchy: ["parent_company_1"]
  transfer_job_vendor_b:
    id: "transfer_job_vendor_b"
    kind: "project_transfer"
    attr:
      tenant:
        tenant_uuid: "vendor_b"
        tenant_type: account
        tenant_hierarchy: ["parent_company_1"]
  transfer_batch_untenanted:
    id: "transfer_batch_untenanted"
    kind: "project_transfer"
    attr:
      tenant:
        tenant_uuid: ""
        tenant_hierarchy: []

name: ProjectTransferTestSuite
description: Tests for the project_transfer resource policy and abacus derived roles
tests:
  - name: per_role_action_matrix_on_originating_vendor
    input:
      principals:
        - no_role_user
        - vendor_a_transfer_viewer
        - vendor_a_transfer_creator
        - vendor_a_transfer_operator
      resources:
        - transfer_job_vendor_a
      actions:
        - view
        - create
        - execute_batch
    expected:
      - principal: no_role_user
        resource: transfer_job_vendor_a
        actions:
          view: EFFECT_DENY
          create: EFFECT_DENY
          execute_batch: EFFECT_DENY
      - principal: vendor_a_transfer_viewer
        resource: transfer_job_vendor_a
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_DENY
          execute_batch: EFFECT_DENY
      - principal: vendor_a_transfer_creator
        resource: transfer_job_vendor_a
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_ALLOW
          execute_batch: EFFECT_DENY
      - principal: vendor_a_transfer_operator
        resource: transfer_job_vendor_a
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_ALLOW
          execute_batch: EFFECT_ALLOW
  - name: any_tenant_grants_allow_cross_vendor_view_and_create
    input:
      principals:
        - vendor_b_transfer_viewer
        - vendor_b_transfer_operator
        - no_role_user
      resources:
        - transfer_job_vendor_a
      actions:
        - view
        - create
    expected:
      - principal: vendor_b_transfer_viewer
        resource: transfer_job_vendor_a
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_DENY
      - principal: vendor_b_transfer_operator
        resource: transfer_job_vendor_a
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_ALLOW
      - principal: no_role_user
        resource: transfer_job_vendor_a
        actions:
          view: EFFECT_DENY
          create: EFFECT_DENY
  - name: any_tenant_creator_grants_cross_vendor_create_not_execute
    input:
      principals:
        - vendor_b_transfer_creator
      resources:
        - transfer_job_vendor_a
      actions:
        - view
        - create
        - execute_batch
    expected:
      - principal: vendor_b_transfer_creator
        resource: transfer_job_vendor_a
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_ALLOW
          execute_batch: EFFECT_DENY
  - name: hierarchy_role_grants_cascade
    input:
      principals:
        - parent_company_transfer_creator
      resources:
        - transfer_job_vendor_a
        - transfer_job_vendor_b
      actions:
        - view
        - create
        - execute_batch
    expected:
      - principal: parent_company_transfer_creator
        resource: transfer_job_vendor_a
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_ALLOW
          execute_batch: EFFECT_DENY
      - principal: parent_company_transfer_creator
        resource: transfer_job_vendor_b
        actions:
          view: EFFECT_ALLOW
          create: EFFECT_ALLOW
          execute_batch: EFFECT_DENY
  - name: execute_batch_allows_operator_with_no_tenant_context
    input:
      principals:
        - vendor_a_transfer_operator
      resources:
        - transfer_batch_untenanted
      actions:
        - execute_batch
    expected:
      - principal: vendor_a_transfer_operator
        resource: transfer_batch_untenanted
        actions:
          execute_batch: EFFECT_ALLOW
  - name: execute_batch_denies_non_operator_with_no_tenant_context
    input:
      principals:
        - no_role_user
        - vendor_a_transfer_viewer
        - vendor_a_transfer_creator
        - parent_company_transfer_creator
      resources:
        - transfer_batch_untenanted
      actions:
        - execute_batch
    expected:
      - principal: no_role_user
        resource: transfer_batch_untenanted
        actions:
          execute_batch: EFFECT_DENY
      - principal: vendor_a_transfer_viewer
        resource: transfer_batch_untenanted
        actions:
          execute_batch: EFFECT_DENY
      - principal: vendor_a_transfer_creator
        resource: transfer_batch_untenanted
        actions:
          execute_batch: EFFECT_DENY
      - principal: parent_company_transfer_creator
        resource: transfer_batch_untenanted
        actions:
          execute_batch: EFFECT_DENY