# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

# Policy Definition Test Suite
# Tests that full policy definition envelopes parse correctly via parse_policy_definition.

cases:
  # =========================================================================
  # Unwrapped form (properties-level keys directly)
  # =========================================================================

  - note: unwrapped_simple
    parse_level: policy_definition
    policy_rule: |
      {
        "displayName": "Deny VMs",
        "description": "Deny creation of VMs",
        "mode": "All",
        "policyRule": {
          "if": {
            "field": "type",
            "equals": "Microsoft.Compute/virtualMachines"
          },
          "then": {
            "effect": "deny"
          }
        }
      }

  - note: unwrapped_with_parameters
    parse_level: policy_definition
    policy_rule: |
      {
        "displayName": "Allowed locations",
        "mode": "Indexed",
        "parameters": {
          "allowedLocations": {
            "type": "Array",
            "metadata": {
              "displayName": "Allowed locations",
              "description": "The list of allowed locations."
            }
          }
        },
        "policyRule": {
          "if": {
            "not": {
              "field": "location",
              "in": "[parameters('allowedLocations')]"
            }
          },
          "then": {
            "effect": "deny"
          }
        }
      }

  # =========================================================================
  # Wrapped form (ARM resource envelope)
  # =========================================================================

  - note: wrapped_arm_envelope
    parse_level: policy_definition
    policy_rule: |
      {
        "id": "/providers/Microsoft.Authorization/policyDefinitions/abc",
        "name": "abc",
        "type": "Microsoft.Authorization/policyDefinitions",
        "properties": {
          "displayName": "Test policy",
          "policyRule": {
            "if": {
              "field": "type",
              "equals": "Microsoft.Storage/storageAccounts"
            },
            "then": {
              "effect": "audit"
            }
          }
        }
      }

  # =========================================================================
  # Missing policyRule (should error)
  # =========================================================================

  - note: missing_policy_rule
    parse_level: policy_definition
    policy_rule: |
      {
        "displayName": "No rule here",
        "mode": "All"
      }
    want_parse_error: true

  # =========================================================================
  # Duplicate keys (should error)
  # =========================================================================

  - note: wrapped_duplicate_properties_key
    parse_level: policy_definition
    policy_rule: |
      {
        "id": "/providers/Microsoft.Authorization/policyDefinitions/dup-properties",
        "name": "dup-properties",
        "type": "Microsoft.Authorization/policyDefinitions",
        "properties": {
          "displayName": "First properties block"
        },
        "properties": {
          "policyRule": {
            "if": {
              "field": "type",
              "equals": "Microsoft.Storage/storageAccounts"
            },
            "then": {
              "effect": "audit"
            }
          }
        }
      }
    want_parse_error: true

  - note: unwrapped_duplicate_policy_rule
    parse_level: policy_definition
    policy_rule: |
      {
        "displayName": "Duplicate policyRule",
        "mode": "All",
        "policyRule": {
          "if": {
            "field": "type",
            "equals": "Microsoft.Compute/virtualMachines"
          },
          "then": {
            "effect": "deny"
          }
        },
        "policyRule": {
          "if": {
            "field": "type",
            "equals": "Microsoft.Storage/storageAccounts"
          },
          "then": {
            "effect": "audit"
          }
        }
      }
    want_parse_error: true

  - note: wrapped_cross_scope_duplicate_key
    parse_level: policy_definition
    policy_rule: |
      {
        "displayName": "Outer displayName",
        "properties": {
          "displayName": "Inner displayName",
          "policyRule": {
            "if": {
              "field": "type",
              "equals": "Microsoft.Compute/virtualMachines"
            },
            "then": {
              "effect": "deny"
            }
          }
        }
      }
    want_parse_error: true

  - note: unwrapped_duplicate_parameter_name_case_insensitive
    parse_level: policy_definition
    policy_rule: |
      {
        "displayName": "Duplicate parameter names by casing",
        "mode": "Indexed",
        "parameters": {
          "allowedLocations": {
            "type": "Array"
          },
          "AllowedLocations": {
            "type": "Array"
          }
        },
        "policyRule": {
          "if": {
            "not": {
              "field": "location",
              "in": "[parameters('allowedLocations')]"
            }
          },
          "then": {
            "effect": "deny"
          }
        }
      }
    want_parse_error: true