selfaudit

type Actor struct {
	Name string
	Can  func(perm string) bool
}

type ChainResult struct {
	// Checked is false when no verifier was wired.
	Checked bool
	OK      bool
	Detail  string
	Err     error
}

type ChainVerifier interface {
	Verify(ctx context.Context) (ok bool, detail string, err error)
}

type Check struct {
	ID       string `json:"id"`
	Title    string `json:"title"`
	Severity string `json:"severity"`
	Status   string `json:"status"`
	Detail   string `json:"detail"`
}

type Collector struct {
	Docker *docker.Client
	Store  *store.Store
	Cfg    config.Config
	// Chain is optional; nil skips the audit-chain check.
	Chain ChainVerifier
	// InContainer marks a run inside the platformd container (host-only checks are skipped).
	InContainer bool
	// DaemonJSONPath overrides DaemonJSONPath (tests).
	DaemonJSONPath string
	// Now is overridable for tests.
	Now func() time.Time
}

type DataFiles struct {
	AgeKeyMode   fs.FileMode
	AgeKeyExists bool
	AgeKeyErr    error
	// BootstrapTokenExists is true when <data>/bootstrap-token is present.
	BootstrapTokenExists bool
	BootstrapTokenErr    error
}

type HostFacts struct {
	// DaemonJSON is the parsed /etc/docker/daemon.json; nil when the file does not exist.
	DaemonJSON map[string]any
	// DaemonJSONErr is set when the file exists but could not be read or parsed.
	DaemonJSONErr error
}

type Inputs struct {
	Info system.Info
	// Bundle maps compose-bundle container names to their inspect result; a name that is absent
	// (or mapped to nil) was not found.
	Bundle map[string]*container.InspectResponse
	// Managed are the containers labelled redoubt.managed=true: apps, addons, one-shot jobs.
	Managed []container.InspectResponse
	Cfg     config.Config
	// InContainer is true when the audit runs inside the platformd container; host-only checks
	// are then skipped instead of reported.
	InContainer bool
	// Host holds the daemon file facts gathered on the host (nil inside the container).
	Host *HostFacts
	// Files holds facts about files under the data directory (readable from both sides).
	Files DataFiles
	// UserCount is the number of user accounts; OwnerTOTP is true when at least one enabled
	// Owner has a confirmed second factor.
	UserCount int64
	OwnerTOTP bool
	// Chain is the audit-chain verification outcome.
	Chain ChainResult
}

type Report struct {
	// Score is 0..100: passes / (passes + fails + 0.5*warns), skips excluded.
	Score       int       `json:"score"`
	Checks      []Check   `json:"checks"`
	GeneratedAt time.Time `json:"generated_at"`
}

type Service struct {
	Collector *Collector
	Audit     audit.Sink
	Logger    *slog.Logger
	Now       func() time.Time
}