Fix a bug and verify it in a preview environment

default allow := false

organization_id := "REPLACE_WITH_ORGANIZATION_ID"
project_id := "REPLACE_WITH_PROJECT_ID"
production_environment_id := "REPLACE_WITH_PRODUCTION_ENVIRONMENT_ID"

# Long-lived environments in the project that the agent must never change.
protected_environment_ids := {
	production_environment_id,
	"REPLACE_WITH_STAGING_ENVIRONMENT_ID",
}

allow if cli_lookup
allow if read_project
allow if manage_preview

# Let the Qovery CLI find the organization, project and environment by name.
cli_lookup if {
	input.request.method == "GET"
	input.request.path in {
		["api", "organization"],
		["api", "organization", organization_id],
		["api", "organization", organization_id, "project"],
		["api", "project", project_id],
		["api", "project", project_id, "environment"],
	}
}

# Read every environment of the project, production included, except environment variables.
read_project if {
	input.request.method in {"GET", "HEAD"}
	input.qovery_metadata.project_id == project_id
	not "environmentVariable" in input.request.path
}

# Deploy, redeploy, restart or stop a preview environment, or one of its services.
manage_preview if {
	input.request.method == "POST"
	input.qovery_metadata.project_id == project_id
	not input.qovery_metadata.environment_id in protected_environment_ids
	input.request.path[count(input.request.path) - 1] in {"deploy", "redeploy", "restart", "restart-service", "stop"}
}