# METADATA
# schemas:
#   - input: schema["input"]
#   - data: schema["data"]

package rules.require_approvals

import rego.v1

default allow := false

allow if {
	count(violations) == 0
}

violations contains {"code": "insufficient_approvals", "message": sprintf("need at least %d approval(s), got %d", [min_approvals, count(active_approvals)])} if {
	cfg := data.deploygate.config[input.deployment.environment]
	cfg.min_approvals > 0
	count(active_approvals) < cfg.min_approvals
}

min_approvals := data.deploygate.config[input.deployment.environment].min_approvals if {
	input.deployment
}

active_approvals contains approval if {
	some approval in input.approvals
	approval.active
}

violations contains {"code": "not_configured", "message": sprintf("no min_approvals configured for environment %q", [input.deployment.environment])} if {
	input.deployment
	not data.deploygate.config[input.deployment.environment].min_approvals
}