core

type Coverage struct {
	Profile             string   `json:"profile"`
	LoadedPlugins       []string `json:"loaded_plugins"`
	SkippedPlugins      []string `json:"skipped_plugins"`
	RuleCoverage        string   `json:"rule_coverage"`
	NetworkDisabled     bool     `json:"network_disabled"`
	HighDisturbanceMode bool     `json:"high_disturbance_mode"`
}

type EvidenceItem struct {
	ID      string `json:"id"`
	Plugin  string `json:"plugin"`
	Summary string `json:"summary"`
}

type GraphSnapshot struct {
	DotPath string `json:"dot_path"`
	Nodes   int    `json:"nodes"`
	Edges   int    `json:"edges"`
}

type Plugin interface {
	Name() string
	Run(ctx context.Context, config *ScanConfig) ([]Result, error)
}

type Result struct {
	Plugin      string   `json:"plugin"`      // 插件名称
	Level       string   `json:"level"`       // "INFO", "low", "medium", "high", "critical"
	Description string   `json:"description"` // 描述
	Reference   string   `json:"reference"`   // 引用 (文件路径, 进程ID 等)
	Advice      string   `json:"advice"`      // 建议
	Score       int      `json:"score,omitempty"`
	Confidence  int      `json:"confidence,omitempty"`
	Evidence    []string `json:"evidence,omitempty"`
	RuleSource  string   `json:"rule_source,omitempty"`
	RuleName    string   `json:"rule_name,omitempty"`
	MITRE       []string `json:"mitre,omitempty"`
}

type RuleBundleInfo struct {
	RulesDir  string           `json:"rules_dir"`
	LockPath  string           `json:"lock_path"`
	Version   string           `json:"version"`
	UpdatedAt string           `json:"updated_at"`
	Status    string           `json:"status"`
	Sources   []RuleSourceInfo `json:"sources"`
	Files     int              `json:"files"`
}

type RuleSourceInfo struct {
	Name    string `json:"name"`
	URL     string `json:"url"`
	License string `json:"license"`
	Commit  string `json:"commit,omitempty"`
	Enabled bool   `json:"enabled"`
}

type ScanConfig struct {
	Debug      bool
	Offline    bool
	NoNetwork  bool
	Output     string
	OutputDir  string
	ReportPath string
	CaseID     string
	Profile    string
	RulesDir   string
	JSONL      bool

	ExplicitModules map[string]bool
	SkippedModules  []SkippedModule
	Coverage        Coverage
	RuleBundle      *RuleBundleInfo
}

type ScanReport struct {
	ScanSession    ScanSession     `json:"scan_session"`
	RuleBundle     *RuleBundleInfo `json:"rule_bundle,omitempty"`
	Profile        string          `json:"profile"`
	Coverage       Coverage        `json:"coverage"`
	Summary        Summary         `json:"summary"`
	Findings       []Result        `json:"findings"`
	Evidence       []EvidenceItem  `json:"evidence"`
	Timeline       []TimelineItem  `json:"timeline"`
	SkippedModules []SkippedModule `json:"skipped_modules"`
	AttackGraph    *GraphSnapshot  `json:"attack_graph,omitempty"`
}

type ScanSession struct {
	CaseID            string `json:"case_id,omitempty"`
	Hostname          string `json:"hostname"`
	User              string `json:"user,omitempty"`
	OS                string `json:"os"`
	Arch              string `json:"arch"`
	StartedAt         string `json:"started_at"`
	EndedAt           string `json:"ended_at"`
	Duration          string `json:"duration"`
	Offline           bool   `json:"offline"`
	NoNetwork         bool   `json:"no_network"`
	NetworkPolicyText string `json:"network_policy_text,omitempty"`
}

type SkippedModule struct {
	Name   string `json:"name"`
	Reason string `json:"reason"`
}

type Summary struct {
	Critical int `json:"critical"`
	High     int `json:"high"`
	Medium   int `json:"medium"`
	Low      int `json:"low"`
	Info     int `json:"info"`
	Pass     int `json:"pass"`
	Error    int `json:"error"`
	Total    int `json:"total"`
}

type TimelineItem struct {
	Time    string `json:"time"`
	Plugin  string `json:"plugin"`
	Level   string `json:"level"`
	Summary string `json:"summary"`
}