config

type Allowlist struct {
	Description string   `json:"description"`
	Condition   string   `json:"condition"`
	Commits     []string `json:"commits"`
	Paths       []string `json:"paths"`
	RegexTarget string   `json:"regexTarget"` // secret (default) | match | line | prefix (match text before the secret)
	Regexes     []string `json:"regexes"`
	Stopwords   []string `json:"stopwords"`
	TargetRules []string `json:"targetRules"` // global allowlists only
	// TargetTags limits a global allowlist to rules carrying one of these
	// tags (e.g. ["generic"]), so value-based suppressions written for noisy
	// generic rules can never hide a structured provider token.
	TargetTags []string `json:"targetTags"`
}

type CompiledAllowlist struct {
	Description string
	And         bool
	Commits     map[string]bool
	Paths       []*regexp.Regexp
	Target      string
	Regexes     []*regexp.Regexp
	Stopwords   []string
	TargetRules map[string]bool
	TargetTags  map[string]bool
}

type CompiledRule struct {
	Rule
	Re         *regexp.Regexp
	PathRe     *regexp.Regexp
	LowerKeys  []string
	Allowlists []*CompiledAllowlist
	Generic    bool // tagged "generic": yields to specific rules on overlap
	Multiline  bool // regex can span lines; widens keyword windows
	Bounded    bool // token rule: boundary chars are checked in code, not regex
	Semi       bool // keyword-context rule ("name = value" with a provider charset)
	Before     int  // keyword window radius before / after an occurrence
	After      int
	// contains filtered or unexported fields
}

type Config struct {
	Title       string      `json:"title"`
	Description string      `json:"description"`
	Extend      Extend      `json:"extend"`
	Rules       []Rule      `json:"rules"`
	Allowlist   *Allowlist  `json:"allowlist"`  // legacy single global allowlist
	Allowlists  []Allowlist `json:"allowlists"` // global allowlists
	Remediation Remediation `json:"remediation"`
	// Policy decides what blocks: "strict" (every finding) or "balanced"
	// (high and medium confidence; low-confidence findings are reported for review).
	Policy string `json:"policy"`
	// TestFixtures decides whether balanced blocks generic values in
	// test/example files: "block" (default) or "review". Provider-format
	// secrets in test files always block.
	TestFixtures string `json:"testFixtures"`
}

type Extend struct {
	// UseDefault keeps the built-in rule pack. Unlike gitleaks, it defaults
	// to true: custom rules are additive unless you set useDefault = false.
	UseDefault    *bool    `json:"useDefault"`
	Path          string   `json:"path"`          // another config to extend
	DisabledRules []string `json:"disabledRules"` // rule IDs to drop
}

type Options struct {
	ConfigPath      string
	NoDefaults      bool
	Patterns        []string // "id=regex" or bare regex
	PatternsFiles   []string
	EnableRules     []string // if set, only these rule IDs
	DisableRules    []string
	Tags            []string // if set, only rules carrying one of these tags
	ExcludePaths    []string // extra global path allowlist regexes
	SearchDirs      []string // where to auto-discover a config
	DefaultSeverity string
}

type Remediation struct {
	Store   string `json:"store"`   // env | vault | aws | azure | gcp: the secret store snippets target
	Runbook string `json:"runbook"` // link to your internal secret-handling / rotation runbook
}

type Rule struct {
	ID          string      `json:"id"`
	Description string      `json:"description"`
	Regex       string      `json:"regex"`       // RE2 syntax; optional if Path is set
	SecretGroup int         `json:"secretGroup"` // capture group holding the secret
	Entropy     float64     `json:"entropy"`     // minimum Shannon entropy of the secret
	Keywords    []string    `json:"keywords"`    // fast prefilter (case-insensitive)
	Path        string      `json:"path"`        // only scan matching paths; alone = file-name rule
	Tags        []string    `json:"tags"`
	Severity    string      `json:"severity"` // critical|high|medium|low|info (default high)
	Allowlist   *Allowlist  `json:"allowlist"`
	Allowlists  []Allowlist `json:"allowlists"`
	// Validate names a built-in content check (see Validators) a candidate
	// must pass to qualify, e.g. "basic-auth": the value must decode to
	// user:password. A candidate that fails it never qualified; it is not a
	// suppression.
	Validate string `json:"validate"`
	// Self-tests, checked by `secretscan config validate`.
	Examples  []string `json:"examples"`  // must produce a finding
	Negatives []string `json:"negatives"` // must not produce a finding
}

type Ruleset struct {
	Rules        []*CompiledRule
	Allowlists   []*CompiledAllowlist // global
	Remediation  Remediation
	Policy       string
	TestFixtures string
}