---
apiVersion: api.cerbos.dev/v1
resourcePolicy:
  resource: contact 
  version: default
  rules:

    # admins can do all actions
    - actions: ["*"]
      effect: EFFECT_ALLOW
      roles:
        - admin  

    # user role can read and list contacts
    - actions: ["read", "list"]
      effect: EFFECT_ALLOW
      roles:
        - user

    # user role can create and update contacts
    # if they are a member of the sales group
    - actions: ["create", "update"]
      effect: EFFECT_ALLOW
      roles:
        - user
      condition:
        match:
          expr: ("sales" in request.principal.attr.groups)

    # user role can delete a contact if they are one of:
    # - the owner of the contact
    # - member of the sales-manager group
    # - member of the product group
    - actions: ["delete"]
      effect: EFFECT_ALLOW
      roles:
        - user 
      condition:
        match:
          any:
            of:
              - expr: request.resource.attr.owner == request.principal.id
              - expr: ("sales-manager" in request.principal.attr.groups)
              - expr: ("product" in request.principal.attr.groups)