tests:
  - id: cat-env-file-denied
    command: "cat .env"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: less-env-file
    command: "less .env"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: less-env-local
    command: "less .env.local"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: less-env-production
    command: "less .env.production"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: bat-env-file
    command: "bat .env"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: more-ssh-key
    command: "more ~/.ssh/id_rsa"
    expected:
      decision: deny
      rule_id: cat-ssh-key
  - id: bat-ssh-ed25519
    command: "bat ~/.ssh/id_ed25519"
    expected:
      decision: deny
      rule_id: cat-ssh-key
  - id: less-aws-creds
    command: "less ~/.aws/credentials"
    expected:
      decision: deny
      rule_id: cat-aws-creds
  - id: more-kube-config
    command: "more ~/.kube/config"
    expected:
      decision: deny
      rule_id: cat-kube-config
  - id: printenv-secrets
    command: "printenv"
    expected:
      decision: ask
      rule_id: printenv
  - id: env-dump
    command: "env"
    expected:
      decision: ask
      rule_id: printenv
  - id: less-env-development
    command: "less .env.development"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: more-env-file
    command: "more .env"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: bat-env-local
    command: "bat .env.local"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: less-envrc
    command: "less .envrc"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: less-env-staging
    command: "less .env.staging"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: cat-env-local-denied
    command: "cat .env.local"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: head-env-denied
    command: "head .env"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: tail-env-denied
    command: "tail .env"
    expected:
      decision: deny
      rule_id: cat-env-file
  - id: less-ssh-id-rsa
    command: "less ~/.ssh/id_rsa"
    expected:
      decision: deny
      rule_id: cat-ssh-key
  - id: bat-ssh-id-ecdsa
    command: "bat ~/.ssh/id_ecdsa"
    expected:
      decision: deny
      rule_id: cat-ssh-key
  - id: more-ssh-ed25519
    command: "more ~/.ssh/id_ed25519"
    expected:
      decision: deny
      rule_id: cat-ssh-key
  - id: cat-ssh-key-denied
    command: "cat ~/.ssh/id_rsa"
    expected:
      decision: deny
      rule_id: cat-ssh-key
  - id: less-aws-config
    command: "less ~/.aws/config"
    expected:
      decision: deny
      rule_id: cat-aws-creds
  - id: bat-aws-creds
    command: "bat ~/.aws/credentials"
    expected:
      decision: deny
      rule_id: cat-aws-creds
  - id: bat-kube-config
    command: "bat ~/.kube/config"
    expected:
      decision: deny
      rule_id: cat-kube-config
  - id: less-kube-config
    command: "less ~/.kube/config"
    expected:
      decision: deny
      rule_id: cat-kube-config
  # cp secrets - caught by cp-secrets rule
  - id: cp-env
    command: "cp .env /tmp/backup.env"
    expected:
      decision: ask
      rule_id: cp-secrets
  - id: cp-env-local
    command: "cp .env.local .env.local.bak"
    expected:
      decision: ask
      rule_id: cp-secrets
  - id: cp-ssh-key
    command: "cp ~/.ssh/id_rsa /tmp/key"
    expected:
      decision: ask
      rule_id: cp-secrets
  - id: cp-aws-creds
    command: "cp ~/.aws/credentials /tmp/creds"
    expected:
      decision: ask
      rule_id: cp-secrets
  - id: cp-readme-safe
    command: "cp README.md /tmp/readme.bak"
    expected:
      decision: allow
  # mv - all mv commands require ask
  - id: mv-env
    command: "mv .env .env.old"
    expected:
      decision: ask
      rule_id: mv-any
  - id: mv-ssh-key
    command: "mv ~/.ssh/id_rsa ~/.ssh/id_rsa.bak"
    expected:
      decision: ask
      rule_id: mv-any
  # tee secrets - deny for secrets, ask for others
  - id: tee-env-deny
    command: "tee .env"
    expected:
      decision: deny
      rule_id: tee-secrets
  - id: tee-ssh-key-deny
    command: "tee ~/.ssh/id_rsa"
    expected:
      decision: deny
      rule_id: tee-secrets
  - id: tee-kube-config-deny
    command: "tee ~/.kube/config"
    expected:
      decision: deny
      rule_id: tee-secrets
  - id: tee-tmp-file
    command: "tee /tmp/output.txt"
    expected:
      decision: ask
      rule_id: tee-any
  # rm secrets
  - id: rm-env-ask
    command: "rm .env"
    expected:
      decision: ask
      rule_id: rm-secrets
  - id: rm-ssh-key-ask
    command: "rm ~/.ssh/id_rsa"
    expected:
      decision: ask
      rule_id: rm-secrets
  - id: rm-aws-creds-ask
    command: "rm ~/.aws/credentials"
    expected:
      decision: ask
      rule_id: rm-secrets
  - id: rm-safe-file-ask
    command: "rm file.txt"
    expected:
      decision: ask
