# Unit tests (not deployed). Run with:
#   podman run --rm -v ./roles/opa_server/files:/files:Z docker.io/openpolicyagent/opa:1.21.1-static \
#     test /files/policies /files/tests -v
package aap.policy_test

import rego.v1

import data.aap.policy

cfg := {
	"allowed_ee_registries": ["aap.toal.ca/", "registry.redhat.io/"],
	"forbidden_extra_vars": ["ansible_password"],
	"change_freeze": false,
	"change_freeze_exempt_teams": ["Platform"],
}

job := {
	"job_type": "run",
	"execution_environment": {"image": "aap.toal.ca/toallab/ee-demo:latest"},
	"extra_vars": {"target": "web"},
	"created_by": {"username": "dev", "is_superuser": false, "teams": [{"id": 1, "name": "Dev"}]},
}

test_compliant_job_allowed if {
	d := policy.decision with input as job with data.aap_policy_config as cfg
	d.allowed
	d.violations == []
}

test_unapproved_registry_denied if {
	j := object.union(job, {"execution_environment": {"image": "quay.io/scottharwell/cloud-ee:latest"}})
	d := policy.decision with input as j with data.aap_policy_config as cfg
	not d.allowed
	count(d.violations) == 1
}

test_forbidden_extra_var_denied_case_insensitive if {
	j := object.union(job, {"extra_vars": {"Ansible_Password": "x"}})
	d := policy.decision with input as j with data.aap_policy_config as cfg
	not d.allowed
}

test_null_extra_vars_and_ee_allowed if {
	j := object.union(job, {"extra_vars": null, "execution_environment": null})
	d := policy.decision with input as j with data.aap_policy_config as cfg
	d.allowed
}

test_freeze_blocks_run if {
	d := policy.decision with input as job with data.aap_policy_config as object.union(cfg, {"change_freeze": true})
	not d.allowed
}

test_freeze_allows_check if {
	j := object.union(job, {"job_type": "check"})
	d := policy.decision with input as j with data.aap_policy_config as object.union(cfg, {"change_freeze": true})
	d.allowed
}

test_freeze_exempt_team if {
	j := object.union(job, {"created_by": {"is_superuser": false, "teams": [{"name": "Platform"}]}})
	d := policy.decision with input as j with data.aap_policy_config as object.union(cfg, {"change_freeze": true})
	d.allowed
}

test_freeze_scheduled_job_without_creator if {
	j := object.union(job, {"created_by": null})
	d := policy.decision with input as j with data.aap_policy_config as object.union(cfg, {"change_freeze": true})
	not d.allowed
}

test_no_config_allows_everything if {
	j := object.union(job, {"execution_environment": {"image": "quay.io/anything:latest"}})
	d := policy.decision with input as j
	d.allowed
}

test_authz_health_open if {
	data.system.authz.allow with input as {"path": ["health"]}
}

test_authz_requires_token if {
	not data.system.authz.allow with input as {"path": ["v1", "data"], "identity": "bad"}
		with data.opa_authz.token as "good"
	data.system.authz.allow with input as {"path": ["v1", "data"], "identity": "good"}
		with data.opa_authz.token as "good"
}