{% set check_tags = ["permanent", "inherent", "n_a", "not_applicable"] %}
{% set rule_arch = "" %}
{% if "supplemental" not in rule.rule_id and not (rule.tags | select("in", check_tags) | list) %}
  {% if rule.check %}
  #####----- Rule: {{ rule.rule_id }} -----#####
  ## Addresses the following NIST 800-53 controls:
  {{ rule.references.nist.nist_800_53r5 | group_ulify if rule.references.nist.nist_800_53r5 is not none else "# * N/A" }}

  {% if "arm64" in rule.tags %}
  {% set rule_arch = "arm64" %}
  {% elif "i386" in rule.tags %}
  {% set rule_arch = "i386" %}
  {% endif %}

  rule_id={{ rule.rule_id }}  
  expected_result="{{ rule.result_value | string }}"
  log_reference_id="{{ rule | log_reference(reference_log_id) }}"
  rule_arch="{{ rule_arch }}"
  result_status="passed"
  finding="NO"
  exemption_output=""

  if [[ "$arch" == "$rule_arch" ]] || [[ -z "$rule_arch" ]]; then
    local result_value=$({{ rule.check }}
    )
    local exempt=$(/usr/bin/osascript -l JavaScript -e "ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('org.$baseline_name.audit').objectForKey('$rule_id'))['exempt']")
    local exempt_reason=$(/usr/bin/osascript -l JavaScript -e "ObjC.unwrap($.NSUserDefaults.alloc.initWithSuiteName('org.$baseline_name.audit').objectForKey('$rule_id'))['exempt_reason']")

    customref="$(echo "$log_reference_id" | rev | cut -d ' ' -f 2- | rev | tr ' ' ',')"

    if [[ "$result_value" != "$expected_result" ]]; then
      result_status="failed"
      finding="YES"

      if [[ "$exempt" == "1" ]]; then
        exemption_output="- Exemption Allowed (Reason: \"$exempt_reason\")"
      fi
    fi

    logmessage "$log_reference_id $result_status (Result: $result_value, Expected: \"$expected_result\") $exemption_output"
    logcsv "$rule_id" "$result_status" "$result_value" "$expected_result" "$exemption_output"
    /usr/bin/defaults write "$audit_plist" "$rule_id" -dict-add finding -bool $finding

    if [[ ! "$customref" == "$rule_id" ]]; then
      /usr/bin/defaults write "$audit_plist" "$rule_id" -dict-add reference -string "$customref"
    fi

    /usr/bin/logger "mSCP: $baseline_name - $log_reference_id $result_status (Result: $result_value, Expected: \"$expected_result\") $exemption_output"

  else
    logmessage "$rule_id does not apply to this architecture"
    logcsv "$rule_id" "N/A" "" "" ""
    /usr/bin/defaults write "$audit_plist" "$rule_id" -dict-add finding -bool NO
  fi

  

  {% endif %}
{% endif %}
