Test on a copy of production

default allow := false

organization_id := "REPLACE_WITH_ORGANIZATION_ID"
project_id := "REPLACE_WITH_PROJECT_ID"
production_environment_id := "REPLACE_WITH_PRODUCTION_ENVIRONMENT_ID"

# A project and a cluster dedicated to test copies.
sandbox_project_id := "REPLACE_WITH_SANDBOX_PROJECT_ID"
sandbox_cluster_id := "REPLACE_WITH_NON_PRODUCTION_CLUSTER_ID"

allow if cli_lookup
allow if read_production
allow if clone_production
allow if manage_sandbox

# Let the Qovery CLI find the organization, projects, environments and clusters by name.
cli_lookup if {
	input.request.method == "GET"
	input.request.path in {
		["api", "organization"],
		["api", "organization", organization_id],
		["api", "organization", organization_id, "project"],
		["api", "organization", organization_id, "cluster"],
		["api", "project", project_id],
		["api", "project", project_id, "environment"],
		["api", "project", sandbox_project_id],
		["api", "project", sandbox_project_id, "environment"],
	}
}

# Read production configuration and status, except environment variables.
read_production if {
	input.request.method in {"GET", "HEAD"}
	input.qovery_metadata.environment_id == production_environment_id
	not "environmentVariable" in input.request.path
}

# Clone production, only into the sandbox project, on the non-production cluster,
# and never as a production environment.
clone_production if {
	input.request.method == "POST"
	input.request.path == ["api", "environment", production_environment_id, "clone"]
	input.request.body.project_id == sandbox_project_id
	input.request.body.cluster_id == sandbox_cluster_id
	input.request.body.mode != "PRODUCTION"
}

# Do anything inside the sandbox project: deploy the copy, run tests, change it, delete it.
# Cloning or moving out of the sandbox is excluded, so nothing can land in production.
manage_sandbox if {
	input.qovery_metadata.project_id == sandbox_project_id
	input.qovery_metadata.environment_id != null
	not "clone" in input.request.path
	not "moveToProject" in input.request.path
}