# Copyright (c) Microsoft Corporation.
# Licensed under the MIT License.

# Policy Rule Test Suite
# Tests that complete policyRule objects (with "if" and "then") parse correctly.

cases:
  # =========================================================================
  # Basic policy rules
  # =========================================================================

  - note: simple_deny
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "deny"
        }
      }

  - note: audit_effect
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "location",
          "notIn": ["eastus", "westus"]
        },
        "then": {
          "effect": "audit"
        }
      }

  - note: disabled_effect
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        "then": {
          "effect": "disabled"
        }
      }

  # =========================================================================
  # Effects with details
  # =========================================================================

  - note: append_effect
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        "then": {
          "effect": "Append",
          "details": [
            {
              "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
              "value": "Deny"
            }
          ]
        }
      }

  - note: modify_effect
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "Modify",
          "details": {
            "roleDefinitionIds": [
              "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
            ],
            "operations": [
              {
                "operation": "addOrReplace",
                "field": "tags.environment",
                "value": "production"
              }
            ]
          }
        }
      }

  - note: deny_action_effect
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Sql/servers/databases"
        },
        "then": {
          "effect": "DenyAction",
          "details": {
            "actionNames": ["delete"]
          }
        }
      }

  - note: manual_effect
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Resources/subscriptions"
        },
        "then": {
          "effect": "Manual",
          "details": {
            "defaultState": "Unknown"
          }
        }
      }

  - note: deploy_if_not_exists
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "DeployIfNotExists",
          "details": {
            "type": "Microsoft.Compute/virtualMachines/extensions",
            "existenceCondition": {
              "field": "Microsoft.Compute/virtualMachines/extensions/type",
              "equals": "MicrosoftMonitoringAgent"
            }
          }
        }
      }

  - note: audit_if_not_exists
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Sql/servers"
        },
        "then": {
          "effect": "AuditIfNotExists",
          "details": {
            "type": "Microsoft.Sql/servers/auditingSettings",
            "existenceCondition": {
              "field": "Microsoft.Sql/servers/auditingSettings/state",
              "equals": "Enabled"
            }
          }
        }
      }

  # =========================================================================
  # Parameterized effect
  # =========================================================================

  - note: parameterized_effect
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        "then": {
          "effect": "[parameters('effect')]"
        }
      }

  # =========================================================================
  # Complex conditions with then
  # =========================================================================

  - note: allof_condition_with_then
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Compute/virtualMachines"
            },
            {
              "field": "location",
              "equals": "eastus"
            }
          ]
        },
        "then": {
          "effect": "deny"
        }
      }

  - note: unknown_extra_keys_ignored
    parse_level: policy_rule
    policy_rule: |
      {
        "if": {
          "field": "type",
          "equals": "Microsoft.Compute/virtualMachines"
        },
        "then": {
          "effect": "deny"
        },
        "extraKey": "ignored"
      }