# yaml-language-server: $schema=https://api.cerbos.dev/latest/cerbos/policy/v1/TestSuite.schema.json
---
resources:
  account_1:
    id: "d6455851-3f86-48d8-b102-8d996eb92645"
    kind: "account"
    attr:
      tenant:
        tenant_uuid: "d6455851-3f86-48d8-b102-8d996eb92645"
        tenant_hierarchy: ["parent_company_1", "d25a4cd1-e820-45f2-be5c-56edcfeb8298"]

name: AccountTestSuite 
description: Tests for verifying the Account resource policy 
tests: 
  - name: TAP
    input:
      principals:
        - some_hacker
        - payee
        - team_member
      resources:
        - account_1
      actions:
        - create
        - view
        - view_account_info
        - view_abacus_account_info
        - "update:info"
        - view_account_service_tier
        - update_account_service_tier
        - view_account_company_brand
        - update_account_company_brand
    expected:
      - principal: some_hacker
        resource: account_1
        actions:
          view_account_info: EFFECT_DENY
          view_abacus_account_info: EFFECT_DENY
          create: EFFECT_DENY
          "update:info": EFFECT_DENY
          view_account_service_tier: EFFECT_DENY
          update_account_service_tier: EFFECT_DENY
          view_account_company_brand: EFFECT_DENY
          update_account_company_brand: EFFECT_DENY
          view: EFFECT_DENY
      - principal: payee
        resource: account_1
        actions:
          view_account_info: EFFECT_DENY
          view_abacus_account_info: EFFECT_DENY
          create: EFFECT_DENY
          "update:info": EFFECT_DENY
          view_account_service_tier: EFFECT_DENY
          update_account_service_tier: EFFECT_DENY
          view_account_company_brand: EFFECT_DENY
          update_account_company_brand: EFFECT_DENY
          view: EFFECT_DENY
      - principal: team_member
        resource: account_1
        actions:
          view_account_info: EFFECT_ALLOW
          view_abacus_account_info: EFFECT_DENY
          create: EFFECT_DENY
          "update:info": EFFECT_DENY
          view_account_service_tier: EFFECT_DENY
          update_account_service_tier: EFFECT_DENY
          view_account_company_brand: EFFECT_DENY
          update_account_company_brand: EFFECT_DENY
          view: EFFECT_ALLOW