data "datadog_team" "teams" {
  for_each = var.team_security_notification_rules
  filter_keyword = each.key
}

locals {
  teams = {
    for key, config in var.team_security_notification_rules : key => {
      name             = config.name != "" ? config.name : "[${data.datadog_team.teams[key].name}] Security Notifications Rule"
      enabled          = config.enabled
      severities       = config.severities
      time_aggregation = config.time_aggregation

      query = join(" ", distinct(compact(flatten([
        "team:${data.datadog_team.teams[key].handle}",
        config.filters
      ]))))

      targets = distinct(compact([
          config.team_notification ? "@team-${data.datadog_team.teams[key].handle}" : "",
          config.slack_channel != "" ? "@slack-${config.slack_channel}" : "",
          config.jira_project != "" ? "@jira-${upper(config.jira_project)}" : ""
      ]))
    }
  }
}

resource "datadog_security_notification_rule" "rule" {
  for_each = local.teams

  enabled = each.value.enabled
  name    = each.value.name

  selectors {
    // TODO: Add rule types to config if we want to support more than just application library vulnerabilities in the future
    rule_types     = ["application_library_vulnerability"]
    trigger_source = "security_findings"
    severities     = each.value.severities
    query          = each.value.query
  }

  time_aggregation = each.value.time_aggregation
  targets          = each.value.targets
}