# METADATA
# schemas:
#   - input: schema["input"]
#   - data: schema["data"]

package rules.no_self_approval

import rego.v1

default allow := false

allow if {
	count(violations) == 0
}

violations contains {"code": "self_approval", "message": sprintf("approval by %q is the deployment requestor", [input.deployment.requested_by])} if {
	some approval in input.approvals
	approval.active
	approval.by == input.deployment.requested_by
}

violations contains {"code": "missing_requestor", "message": "deployment has no requestor"} if {
	input.deployment
	not input.deployment.requested_by
}