package proofedmesh.data_sources.expense_db_app_test

import data.proofedmesh.data_sources.expense_db_app as ds
import rego.v1

employee_mapping := {"by_sub": {"user-12345": "EMP-12345"}}

test_allow_travel_own_assignments if {
	ds.allow with input as {
		"agent_id": "agent-travel",
		"user_sub": "user-12345",
		"session_id": "SES-abc",
		"data_source": "ds:expense-db-app",
		"resource": "project_assignments",
		"filters": {"employee_id": "EMP-12345"},
		"operation": "read",
	}
		with data.employee_mapping as employee_mapping
}

test_deny_travel_other_employee if {
	not ds.allow with input as {
		"agent_id": "agent-travel",
		"user_sub": "user-12345",
		"session_id": "SES-abc",
		"data_source": "ds:expense-db-app",
		"resource": "project_assignments",
		"filters": {"employee_id": "EMP-99999"},
		"operation": "read",
	}
		with data.employee_mapping as employee_mapping
}

test_deny_missing_required_filter if {
	not ds.allow with input as {
		"agent_id": "agent-travel",
		"user_sub": "user-12345",
		"session_id": "SES-abc",
		"data_source": "ds:expense-db-app",
		"resource": "project_assignments",
		"filters": {"active_on": "2026-10-25"},
		"operation": "read",
	}
		with data.employee_mapping as employee_mapping
}

test_deny_disallowed_filter_key if {
	not ds.allow with input as {
		"agent_id": "agent-travel",
		"user_sub": "user-12345",
		"session_id": "SES-abc",
		"data_source": "ds:expense-db-app",
		"resource": "project_assignments",
		"filters": {"employee_id": "EMP-12345", "department": "ENG"},
		"operation": "read",
	}
		with data.employee_mapping as employee_mapping
}

test_allow_mapping_account_assignments if {
	ds.allow with input as {
		"agent_id": "agent-sink-mapping",
		"user_sub": "user-12345",
		"session_id": "SES-abc",
		"data_source": "ds:expense-db-app",
		"resource": "account_assignments",
		"filters": {"project_code": "P-42"},
		"operation": "read",
	}
		with data.employee_mapping as employee_mapping
}

test_deny_missing_user_sub if {
	not ds.allow with input as {
		"agent_id": "agent-travel",
		"user_sub": "",
		"session_id": "SES-abc",
		"data_source": "ds:expense-db-app",
		"resource": "project_assignments",
		"filters": {"employee_id": "EMP-12345"},
		"operation": "read",
	}
		with data.employee_mapping as employee_mapping
}

test_deny_wrong_data_source if {
	not ds.allow with input as {
		"agent_id": "agent-travel",
		"user_sub": "user-12345",
		"session_id": "SES-abc",
		"data_source": "ds:other",
		"resource": "project_assignments",
		"filters": {"employee_id": "EMP-12345"},
		"operation": "read",
	}
		with data.employee_mapping as employee_mapping
}

test_deny_write_op if {
	not ds.allow with input as {
		"agent_id": "agent-travel",
		"user_sub": "user-12345",
		"session_id": "SES-abc",
		"data_source": "ds:expense-db-app",
		"resource": "project_assignments",
		"filters": {"employee_id": "EMP-12345"},
		"operation": "write",
	}
		with data.employee_mapping as employee_mapping
}