no-pineapple.sentinel

# This policy uses the Sentinel tfstate import to block
# pizzas with name "Hawaiian" in order sent to Dominos by Terraform Cloud

##### Imports #####
import "tfstate"
import "strings"

##### Functions #####

# Find all data sources of specific type from all modules using the tfstate import
find_data_sources_from_state = func(type) {

  data_sources = {}

  # Iterate over all modules in the tfstate import
  for tfstate.module_paths as path {

    # Iterate over the named data sources of desired type in the module
    for tfstate.module(path).data[type] else {} as name, instances {

      # Iterate over data source instances
      for instances as index, d {

        # Get the address of the instance
        if length(path) == 0 {
          # root module
          address = type + "." + name + "[" + string(index) + "]"
        } else {
          # non-root module
          address = "module." + strings.join(path, ".module.") + "." +
                    type + "." + name + "[" + string(index) + "]"
        }

        # Add the instance to map, setting the key to the address
        data_sources[address] = d
      }
    }
  }

  return data_sources
}

no_pineapple = func() {

  no_pineapple = true

  # Get dominos_menu_item data sources
  menu_items = find_data_sources_from_state("dominos_menu_item")

  # Iterate over all menu items in the order
  # Note that each menu item has a list of matches
  # each of which has code, name, and price_cents
  for menu_items as address, d {
    for d.attr.matches as match {
      # Check if name includes "Hawaiian"
      if match.name matches "(.*)Hawaiian" {
        print( "We don't want pineapple on our pizza!")
        print("You ordered:", match.name)
        no_pineapple = false
      }
    }
  }

  return no_pineapple

}

##### Rules #####

# Main rule
no_pineapple = no_pineapple()
main = rule {
  no_pineapple
}