scanner

type AuthGroup struct {
	AuthTypes map[string][]CVEEntry
}

type BruteforceContext struct {
	ScanContext
	Mu       *sync.Mutex
	Wg       *sync.WaitGroup
	Sem      chan struct{}
	Detected *[]string
	Versions *map[string]string
	// Forbidden collects slugs that matched ONLY via a 403 response. A bare 403 is
	// ambiguous: a plugin hardened with its own .htaccess and a WAF blocking the
	// slug for a plugin that is NOT installed look identical here (both forbid
	// every file under <slug>/). These are held and reconciled in aggregate after
	// the scan instead of being reported as confirmed installs (issue #27).
	Forbidden *[]string
	Ctx       context.Context
	Client    *wphttp.HTTPClientManager
	// Fingerprints maps a plugin slug to the ordered list of files to probe
	// (e.g. "woocommerce.php", "readme.txt"). The plugin is present on disk when
	// any of them returns a response that differs from the calibrated miss
	// baseline, even if it is installed but not activated.
	Fingerprints map[string][]string
	// Calibrator holds the per-target "not found" baseline so that file
	// detection works regardless of the web server (Apache/nginx) and its config.
	Calibrator *Calibrator
}

type BruteforceRequest struct {
	Target     string
	Plugins    []string
	Threads    int
	Progress   Progress
	HTTP       wphttp.Config
	Calibrator *Calibrator
}

type CVEEntry struct {
	ID    string
	Title string
}

type Calibrator struct {
	// contains filtered or unexported fields
}

type DisplayResultsContext struct {
	Target    string
	Detected  map[string]string
	PluginRes PluginDetectionResult
	Results   []file.PluginEntry
	Opts      ScanOptions
	Progress  Progress
}

type HTMLDiscoveryResult struct {
	Plugins []string
	Themes  []string
}

type HybridScanRequest struct {
	Target            string
	StealthyPlugins   []string
	BruteforcePlugins []string
	Threads           int
	Progress          Progress
	HTTP              wphttp.Config
}

type PluginAuthGroups struct {
	Plugins map[string]SeverityAuthGroup
}

type PluginData struct {
	Score      int
	Confidence float64
	Ambiguous  bool
	Matches    []string
}

type PluginDetectionResult struct {
	Plugins  map[string]*PluginData
	Detected []string
}

type PluginVulnerabilities struct {
	Plugins map[string]VulnCategories
}

type Progress interface {
	Increment()
	Finish()
	SetTotal(int)
	SetMessage(string)
	RenderBlank()
	ClearLine()
	Bprintln(a ...interface{}) (int, error)
}

type ScanContext struct {
	Target   string
	Threads  int
	HTTP     wphttp.Config
	Progress Progress
}

type ScanDetectionResult struct {
	Plugins      []string
	Themes       []string
	PluginResult PluginDetectionResult
	Versions     map[string]string
}

type ScanExecutionConfig struct {
	Targets  []string
	Opts     ScanOptions
	Vulns    []wordfence.Vulnerability
	Config   scanConfig
	Progress Progress
	Writer   file.WriterInterface
}

type ScanExecutionContext struct {
	Target   string
	Opts     ScanOptions
	Progress Progress
	Ctx      context.Context
}

type ScanOptions struct {
	URL            string
	File           string
	NoCheckVersion bool
	Threads        int
	Output         string
	OutputFormat   string
	Verbose        bool
	ScanMode       string
	PluginList     string
	Headers        []string
	Proxy          string
	RateLimit      int                                      // Requests per second (0 = unlimited)
	MaxRedirects   int                                      // Maximum redirects to follow (0 = disable, -1 = default: 10)
	Context        context.Context                          // Context for cancellation
	HTTPClient     *http.Client                             // External HTTP client (optional, for connection pooling)
	SharedLimiter  *wphttp.RateLimiter                      // Global rate limiter shared across all targets
	Calibrator     *Calibrator                              // Per-target miss-response baseline
	NewProgress    func(total int, message string) Progress // Factory for creating progress bars (CLI only)
	DisplayFunc    func(DisplayResultsContext)              // Callback for displaying results (CLI only)
}

type ScanSiteContext struct {
	Target   string
	Opts     ScanOptions
	Writer   file.WriterInterface
	Progress Progress
	Vulns    []wordfence.Vulnerability
}

type SeverityAuthGroup struct {
	Severities map[string]AuthGroup
}

type TargetScanContext struct {
	Target   string
	Opts     ScanOptions
	PerSite  int
	Writer   file.WriterInterface
	Progress Progress
	Vulns    []wordfence.Vulnerability
	Sem      chan struct{}
	Wg       *sync.WaitGroup
}

type VulnCategories struct {
	Critical []string
	High     []string
	Medium   []string
	Low      []string
}

type VulnerabilityCheckContext struct {
	ScanContext
	Mu                  *sync.Mutex
	Wg                  *sync.WaitGroup
	Sem                 chan struct{}
	EntriesMap          *map[string]string
	EntriesList         *[]file.PluginEntry
	Vulnerabilities     []wordfence.Vulnerability
	VulnIndex           map[vulnIndexKeyType][]*wordfence.Vulnerability // Indexed by type and slug for fast lookup
	PreDetectedVersions map[string]string
	Ctx                 context.Context // Context for cancellation
	// Client is shared by every version lookup in the run. Building one per
	// plugin gives each its own empty connection pool, so no connection is ever
	// reused and every plugin pays a fresh TCP (and TLS) handshake.
	Client *wphttp.HTTPClientManager
}

type VulnerabilityCheckRequest struct {
	Plugins  []string
	Themes   []string
	Target   string
	Vulns    []wordfence.Vulnerability
	Opts     ScanOptions
	Progress Progress
	Versions map[string]string
	Ctx      context.Context // Context for cancellation
}