# METADATA
# title: Sink policy for sink:expense-db-app
# description: |
#   Only the posting agent may call the own DB-app sink, only with the
#   expense.post action, and only with the sink.db.expense payload schema
#   that was explicitly listed in the approval's allowed_sinks.
# authors:
#   - CTO Agent <cto@basicstack.de>
# related_resources:
#   - ref: docs/architecture/v1.1.md#user-content-70-vertrag-jedes-senken-adapters
#   - ref: schemas/sink/db/expense/v1.0.0.json
package proofedmesh.sinks.expense_db_app

import rego.v1

default allow := false

allowed_agent := "agent-sink-posting"

allowed_actions := {"expense.post"}

allow if {
	input.sink_id == "sink:expense-db-app"
	input.agent_id == allowed_agent
	input.action in allowed_actions
	payload_schema_ok
	approval_lists_sink
}

payload_schema_ok if {
	input.payload.schema.name == "sink.db.expense"
	startswith(input.payload.schema.version, "1.")
}

approval_lists_sink if {
	some s in input.approval.allowed_sinks
	s == "sink:expense-db-app"
}

deny_reason contains msg if {
	input.sink_id != "sink:expense-db-app"
	msg := sprintf("wrong sink_id: %s", [input.sink_id])
}

deny_reason contains msg if {
	input.agent_id != allowed_agent
	msg := sprintf("agent %s not allowed to post to sink:expense-db-app", [input.agent_id])
}

deny_reason contains msg if {
	not input.action in allowed_actions
	msg := sprintf("action %s not allowed on sink:expense-db-app", [input.action])
}

deny_reason contains msg if {
	not payload_schema_ok
	msg := "payload schema mismatch (expected sink.db.expense v1.x)"
}

deny_reason contains msg if {
	not approval_lists_sink
	msg := "sink:expense-db-app not in approval.allowed_sinks"
}