Roll back a bad release

default allow := false

organization_id := "REPLACE_WITH_ORGANIZATION_ID"
project_id := "REPLACE_WITH_PROJECT_ID"
production_environment_id := "REPLACE_WITH_PRODUCTION_ENVIRONMENT_ID"

# The production services the agent may roll back.
application_ids := {"REPLACE_WITH_API_APPLICATION_ID", "REPLACE_WITH_WEB_APPLICATION_ID"}
container_ids := {"REPLACE_WITH_WORKER_CONTAINER_ID"}

allow if cli_lookup
allow if read_production
allow if deploy_application_version
allow if deploy_container_version

# Let the Qovery CLI find the organization, project and environment by name.
cli_lookup if {
	input.request.method == "GET"
	input.request.path in {
		["api", "organization"],
		["api", "organization", organization_id],
		["api", "organization", organization_id, "project"],
		["api", "project", project_id],
		["api", "project", project_id, "environment"],
	}
}

# Read production: services, status, deployment history and logs.
read_production if {
	input.request.method in {"GET", "HEAD"}
	input.qovery_metadata.environment_id == production_environment_id
	not "environmentVariable" in input.request.path
}

# Deploy a given commit of an application. The commit must be named in the request.
deploy_application_version if {
	input.request.method == "POST"
	input.request.path[1] == "application"
	input.request.path[2] in application_ids
	input.request.path[3] == "deploy"
	count(input.request.path) == 4
	count(input.request.body.git_commit_id) > 0
}

# Deploy a given image tag of a container. The tag must be named in the request.
deploy_container_version if {
	input.request.method == "POST"
	input.request.path[1] == "container"
	input.request.path[2] in container_ids
	input.request.path[3] == "deploy"
	count(input.request.path) == 4
	count(input.request.body.image_tag) > 0
}