# diagnose.rego — Diagnostic reporting entrypoint ==============================
#
# Classifies active policies (data.policies) as compliant or non-compliant
# using evaluate's deny/warn output. If a policy has both, deny wins. 
# Compliant includes not-applicable policies as well as genuine passes.
# Query (structured): data.diagnose.results
# Query (console)   : data.diagnose.summary

package diagnose

import data.common.policydoc as policydoc

# Policy Counter Helpers -------------------------------------------------------

policy_ids_total := {id | some id, p in data.policies; p.status == "active"}
policy_ids_non_compliant_deny := {id |
	some msg in data.evaluate.deny
	id := split(msg.rule_id, " ")[0]
}
policy_ids_non_compliant_warn := {id |
	some msg in data.evaluate.warn
	id := split(msg.rule_id, " ")[0]
} - policy_ids_non_compliant_deny
policy_ids_compliant := policy_ids_total - policy_ids_non_compliant_deny - policy_ids_non_compliant_warn

# Outputs (structured & console formatted) -------------------------------------

results := {
	"policies_in_catalog": count(policy_ids_total),
	"compliant": count(policy_ids_compliant),
	"non_compliant_deny": count(policy_ids_non_compliant_deny),
	"non_compliant_warn": count(policy_ids_non_compliant_warn),
	"compliant_ids": policy_ids_compliant,
	"non_compliant_deny_ids": policy_ids_non_compliant_deny,
	"non_compliant_warn_ids": policy_ids_non_compliant_warn,
}

summary_message := `Catalog contains %d active policies
Found %d compliant policies: %s
Found %d non-compliant policies (deny level): %s
Found %d non-compliant policies (warn level): %s
`

summary := sprintf(summary_message, [
	count(policy_ids_total),
	count(policy_ids_compliant), policydoc.concat_array(sort(policy_ids_compliant), "NA"),
	count(policy_ids_non_compliant_deny), policydoc.concat_array(sort(policy_ids_non_compliant_deny), "NA"),
	count(policy_ids_non_compliant_warn), policydoc.concat_array(sort(policy_ids_non_compliant_warn), "NA"),
])