import { PolicyPack } from '@pulumi/policy';
import { isTaggable } from './utils';

new PolicyPack('aws-mandatory-tags', {
  policies: [
    {
      name: 'aws-mandatory-tags',
      description:
        'AWS tagging policy',
      enforcementLevel: 'mandatory',
      configSchema: {
        properties: {
          requiredTags: {
            type: 'array',
            items: { type: 'string' },
          },
        },
      },
      validateResource: (args, reportViolation) => {
        const config = args.getConfig<AwsTagsPolicyConfig>();
        const requiredTags = config.requiredTags;
        if (requiredTags && isTaggable(args.type)) {
          const ts = args.props['tags'];
          for (const rt of requiredTags) {
            if (!ts || !ts[rt]) {
              reportViolation(`Taggable resource '${args.urn}' is missing required tag '${rt}'`);
            }
          }
        }
      },
    },
  ],
});

type AwsTagsPolicyConfig = {
  requiredTags?: string[];
};

{
  "all": "mandatory",
  "check-required-tags": {
    "requiredTags": [
      "stack-name",
      "service",
      "environment",
      "owner",
      "data-classification",
      "repository_url"
    ]
  }
}