api

const (
	// DefaultLogPerm default logfile permission for Manager
	DefaultLogPerm = 0600
	// DefaultManagerLogSize  default size for Manager's logfiles
	DefaultManagerLogSize = utils.Mega * 100
	// DefaultKeySize default size for API key generation
	DefaultKeySize = 64
	// EptAPIDefaultPort default port used by manager's endpoint API
	EptAPIDefaultPort = 1519
	// AdmAPIDefaultPort default port used by manager's admin API
	AdmAPIDefaultPort = 1520
	// DefaultMaxUploadSize default maximum upload size
	DefaultMaxUploadSize = 100 * utils.Mega
)

const (
	AuthKeyHeader = "X-Api-Key"

	// Endpoint related
	EndpointUUIDHeader     = "X-Endpoint-Uuid"
	EndpointIPHeader       = "X-Endpoint-IP"
	EndpointHostnameHeader = "X-Endpoint-Hostname"
)

const (
	QpIdentifier  = "identifier"
	QpGroup       = "group"
	QpStatus      = "status"
	QpShowKey     = "showkey"
	QpNewKey      = "newkey"
	QpCriticality = "criticality"
	QpWait        = "wait"
	QpSince       = "since"
	QpUntil       = "until"
	QpLast        = "last"
	QpLimit       = "limit"
	QpPivot       = "pivot"
	QpDelta       = "delta"
	QpSkip        = "skip"
	QpSource      = "source"
	QpValue       = "value"
	QpType        = "type"
	QpName        = "name"
	QpFilters     = "filters"
	QpUpdate      = "update"
	QpRaw         = "raw"
	QpGunzip      = "gunzip"
	QpUuid        = "uuid"
	QpGroupUuid   = "guuid"
	QpFormat      = "format"
	QpVersion     = "version"
	QpOS          = "os"
	QpBinary      = "binary"
	QpHash        = "hash"
)

const (

	// EptAPIServerKeyPath API route used to get server key
	EptAPIServerKeyPath = "/key"
	// EptAPIConfigPath API route used to get/post endpoint configuration
	EptAPIConfigPath = "/config"
	// EptAPIRulesPath API route used to get Gene rules available in server
	EptAPIRulesPath = "/rules"
	// EptAPIRulesSha256Path API route used to retrieve sha256 of latest batch of Gene rules
	EptAPIRulesSha256Path = "/rules/sha256"

	// Routes to work with sysmon configuration
	EptAPISysmonConfigPath       = "/sysmon/config"
	EptAPISysmonConfigSha256Path = "/sysmon/config/sha256"

	// EptAPIIoCsPath API route used to serve IOC container
	EptAPIIoCsPath = "/iocs"
	// EptAPIIoCsSha256Path API route used to serve sha256 of IOC container
	EptAPIIoCsSha256Path = "/iocs/sha256"
	// EptAPITools API route used to update local tools
	EptAPITools = "/tools"

	// EptAPIPostLogsPath API route used to post logs
	EptAPIPostLogsPath = "/logs"
	// EptAPIPostDumpPath API route used to dump things
	EptAPIPostDumpPath = "/upload/dumps"
	// EptAPIPostSystemInfo API route used to send system information
	EptAPIPostSystemInfo = "/info/system"

	// EptAPICommandPath used to GET commands and POST results
	EptAPICommandPath = "/commands"
)

const (
	AdmAPIUsers    = "/users"
	AdmAPIUserByID = AdmAPIUsers + "/{uuuid:" + uuidRe + "}"

	AdmAPIStatsPath     = "/stats"
	AdmAPIIocsPath      = "/iocs"
	AdmAPIRulesPath     = "/rules"
	AdmAPIEndpointsPath = "/endpoints"

	AdmAPIEndpointsOSPath = AdmAPIEndpointsPath + `/{os:\w+}`

	// Sysmon related
	AdmAPIEndpointsSysmonPath   = AdmAPIEndpointsOSPath + `/sysmon`
	AdmAPIEndpointsSysmonBinary = AdmAPIEndpointsSysmonPath + `/binary`
	AdmAPIEndpointsSysmonConfig = AdmAPIEndpointsSysmonPath + `/config`

	// OSQueryi related
	AdmAPIEndpointsOSQueryiPath   = AdmAPIEndpointsOSPath + `/osqueryi`
	AdmAPIEndpointsOSQueryiBinary = AdmAPIEndpointsOSQueryiPath + `/binary`

	// Endpoint by UUID
	AdmAPIEndpointsByIDPath = AdmAPIEndpointsPath + "/{euuid:" + uuidRe + "}"
	// Config related
	AdmAPIConfigSuffix       = "/config"
	AdmAPIEndpointConfigPath = AdmAPIEndpointsByIDPath + AdmAPIConfigSuffix
	// Command related
	AdmAPICommandSuffix            = "/command"
	AdmAPIEndpointCommandPath      = AdmAPIEndpointsByIDPath + AdmAPICommandSuffix
	AdmAPIEndpointCommandFieldPath = AdmAPIEndpointCommandPath + "/{field}"
	// Logs related
	AdmAPILogsSuffix             = "/logs"
	AdmAPIEndpointLogsPath       = AdmAPIEndpointsByIDPath + AdmAPILogsSuffix
	AdmAPIDetectionSuffix        = "/detections"
	AdmAPIEndpointDetectionsPath = AdmAPIEndpointsByIDPath + AdmAPIDetectionSuffix
	// Reports related
	AdmAPIReportSuffix              = "/report"
	AdmAPIEndpointsReportsPath      = AdmAPIEndpointsPath + "/reports"
	AdmAPIEndpointReportPath        = AdmAPIEndpointsByIDPath + AdmAPIReportSuffix
	AdmAPIArchiveSuffix             = "/archive"
	AdmAPIEndpointReportArchivePath = AdmAPIEndpointReportPath + AdmAPIArchiveSuffix
	// Dumps related
	AdmAPIArticfactsSuffix       = "/artifacts"
	AdmAPIEndpointsArtifactsPath = AdmAPIEndpointsPath + AdmAPIArticfactsSuffix
	AdmAPIEndpointArtifacts      = AdmAPIEndpointsByIDPath + AdmAPIArticfactsSuffix
	AdmAPIEndpointArtifact       = AdmAPIEndpointArtifacts + "/{pguid:" + uuidRe + "}/{ehash:[[:xdigit:]]+}/{fname:.*}"

	//Websockets
	AdmAPIStreamEvents     = "/stream/events"
	AdmAPIStreamDetections = "/stream/detections"
)