enforce_https.sentinel

##### restrict-app-service-to-https.sentinel #####
# This policy uses the Sentinel tfplan import to require that
# all Azure app services have https_only set to true so that
# they can only be accessed via HTTPS

##### Imports #####
import "tfplan/v2" as tfplan
import "strings"
import "types"

##### Functions #####

### find_resources ###
find_resources = func(type) {
  resources = filter tfplan.resource_changes as address, rc {
  	rc.type is type and
  	rc.mode is "managed" and
  	(rc.change.actions contains "create" or rc.change.actions contains "update")
  }

  return resources
}

### filter_attribute_is_not_value ###
filter_attribute_is_not_value = func(resources, attr, value, prtmsg) {
  violators = {}
	messages = {}
  for resources as address, rc {
    v = evaluate_attribute(rc, attr) else null
    if v is null {
      # Add the resource and a warning message to the violators list
      message = to_string(address) + " has " + to_string(attr) +
                " that is null or undefined"
      violators[address] = rc
			messages[address] = message
      if prtmsg {
        print(message)
      }
    } else if v is not value {
      # Add the resource and a warning message to the violators list
      message = to_string(address) + " has " + to_string(attr) + " with value " +
                to_string(v) + " that is not equal to " + to_string(value)
      violators[address] = rc
			messages[address] = message
      if prtmsg {
        print(message)
      }
    }
  }
  return {"resources":violators,"messages":messages}
}

### evaluate_attribute ###
evaluate_attribute = func(r, attribute) {

  # Split the attribute into a list, using "." as the separator
  attributes = strings.split(attribute, ".")

  # Convert numeric strings to integers for indices
  if attributes[0] matches "^[0-9]+$" {
    a = int(attributes[0])
    # Make sure r is of type list
    if types.type_of(r) is not "list" {
      return undefined
    }
  } else {
    a = attributes[0]
  }

  # Append the current attribute to the resource instance
  if (types.type_of(r) is "map" and "change" in keys(r)) and
     (types.type_of(r.change) is "map" and "after" in keys(r.change)) {
    new_r = r.change.after[a] else null
  } else {
    new_r = r[a] else null
  }

  # Process based on length of attributes
  # being greater than or equal to 1
  if length(attributes) > 1 {

    # Strip first element from attributes
    attributes = attributes[1:length(attributes)]
    attribute = strings.join(attributes, ".")

    # Make recursive call
    return evaluate_attribute(new_r, attribute)
  } else {

    # We reached the end of the attribute and can stop the
    # recursive calls and return the value of the attribute
    return new_r

  }
}

### to_string ###
to_string = func(obj) {
  case types.type_of(obj) {
    when "string":
      return obj
    when "int", "float", "bool":
      return string(obj)
    when "null":
      return "null"
    when "undefined":
      return "undefined"
    when "list":
      output = "["
      lastIndex = length(obj) - 1
      for obj as index, value {
        if index < lastIndex {
          output += to_string(value) + ", "
        } else {
          output += to_string(value) + "]"
        }
      }
      return output
    when "map":
      output = "{"
      theKeys = keys(obj)
      lastIndex = length(theKeys) - 1
      for theKeys as index, key {
        if index < lastIndex {
          output += to_string(key) + ": " + to_string(obj[key]) + ", "
        } else {
          output += to_string(key) + ": " + to_string(obj[key]) + "}"
        }
      }
      return output
    else:
      return ""
  }
}

# Get all Azure app services
allAzureAppServices = find_resources("azurerm_app_service")

# Filter to Azure app services with violations
# Warnings will be printed for all violations since the last parameter is true
violatingAzureAppServices = filter_attribute_is_not_value(allAzureAppServices,
                            "https_only", true, true)

# Main rule
main = rule {
  length(violatingAzureAppServices["messages"]) is 0
}