config

type ArgList []string

type Delims struct {
	Left  string `yaml:"left"`
	Right string `yaml:"right"`
}

type DigitalSignature struct {
	Algorithm string `yaml:"algorithm"` // "ed25519"
	KeyID     string `yaml:"keyId"`     // Key identifier for lookup
	Signature string `yaml:"signature"` // base64-encoded signature
}

type DuckConf struct {
	Version int `yaml:"version"`
	// Default is the key of the target (in Targets) executed when the user omits a target.
	Default  string            `yaml:"default"`
	Remotes  map[string]Remote `yaml:"remotes,omitempty"`
	Targets  map[string]Target `yaml:"targets"`
	Settings *Settings         `yaml:"settings,omitempty"`
}

type FilePermissionPolicy struct {
	EnforceOwnership         bool `yaml:"enforceOwnership"`         // Require proper ownership (root for system files)
	EnforceReadOnly          bool `yaml:"enforceReadOnly"`          // Require read-only permissions
	AllowGroupWrite          bool `yaml:"allowGroupWrite"`          // Allow group write permissions
	RequireSecureDirectories bool `yaml:"requireSecureDirectories"` // Parent dirs must be secure
}

type FilePermissionResult struct {
	Path            string
	Type            SecurityFileType
	Valid           bool
	Issues          []string
	Owner           string
	Group           string
	Permissions     os.FileMode
	ParentDirSecure bool
	ParentDirIssues []string
}

type ParentDirectoryResult struct {
	Secure bool
	Issues []string
}

type PolicyEnforcement struct {
	ForceChecksumValidation bool `yaml:"forceChecksumValidation"` // Fail if template has no checksum
	ForceCommitTracking     bool `yaml:"forceCommitTracking"`     // Fail if trackCommitHash=false
	DisableAutoUpdate       bool `yaml:"disableAutoUpdate"`       // Override autoUpdateOnChange settings
	StrictPolicyMode        bool `yaml:"strictPolicyMode"`        // Require security config to exist
	EnforceFilePermissions  bool `yaml:"enforceFilePermissions"`  // Validate file permissions according to policy
}

type PolicyEnforcementResult struct {
	Allowed    bool
	Violations []PolicyViolation
	Warnings   []PolicyViolation
}

type PolicyViolation struct {
	Type       string // "checksum", "commit_tracking", "auto_update", "template_validation"
	Severity   string // "error", "warning", "info"
	Message    string
	TargetName string
	Suggestion string // How to fix the violation
}

type Remote struct {
	Repo               string `yaml:"repo"`
	Ref                string `yaml:"ref,omitempty"`
	Submodules         bool   `yaml:"submodules,omitempty"`
	TrackCommitHash    bool   `yaml:"trackCommitHash,omitempty"`
	AutoUpdateOnChange bool   `yaml:"autoUpdateOnChange,omitempty"`
}

type ResolvedTemplate struct {
	Repo               string
	Ref                string
	Path               string
	Submodules         bool
	TrackCommitHash    bool
	AutoUpdateOnChange bool
	Checksum           string
	Delims             *Delims
	AllowMissing       bool
}

type SecurityConfig struct {
	// Existing host restriction fields
	AllowedHosts []string `yaml:"allowedHosts,omitempty"`
	DeniedHosts  []string `yaml:"deniedHosts,omitempty"`
	StrictMode   bool     `yaml:"strictMode,omitempty"` // Fail if no restrictions are configured
	Source       string   `yaml:"source,omitempty"`     // "signed", "env", "cli", "unsigned", "none" for audit trail

	// NEW: Digital signature fields
	Signature *DigitalSignature `yaml:"signature,omitempty"`

	// NEW: Policy enforcement
	Enforcement *PolicyEnforcement `yaml:"enforcement,omitempty"`

	// NEW: File permission validation
	FilePermissions *FilePermissionPolicy `yaml:"filePermissions,omitempty"`

	// NEW: Metadata for audit trails
	Metadata *SecurityMetadata `yaml:"metadata,omitempty"`

	// NEW: Source tracking for precedence
	SourceFile string `yaml:"sourceFile,omitempty"` // Path to config file if loaded from file
	IsSigned   bool   `yaml:"isSigned,omitempty"`   // Whether this config was verified with a valid signature
	Version    int    `yaml:"version,omitempty"`    // Configuration version
}

type SecurityConfigFile struct {
	Path       string
	Type       SecurityFileType
	Exists     bool
	Readable   bool
	HasSigFile bool // Whether a corresponding .sig file exists
}

type SecurityConfigPrecedenceInfo struct {
	Sources         map[string]*SecurityConfig
	EffectiveConfig *SecurityConfig
	EffectiveSource string

} // LoadSecurityConfigFromEnv loads security configuration from environment variables.

type SecurityFileType int

type SecurityMetadata struct {
	CreatedBy string    `yaml:"createdBy"`
	CreatedAt time.Time `yaml:"createdAt"`
	Purpose   string    `yaml:"purpose"`
	Version   int       `yaml:"version,omitempty"`
}

type Settings struct {
	CacheDir           string `yaml:"cacheDir,omitempty"`
	LogLevel           string `yaml:"logLevel,omitempty"`
	Locked             bool   `yaml:"locked,omitempty"`
	TrackCommitHash    bool   `yaml:"trackCommitHash,omitempty"`
	AutoUpdateOnChange bool   `yaml:"autoUpdateOnChange,omitempty"`
}

type SignatureKeyPair struct {
	PublicKey  ed25519.PublicKey
	PrivateKey ed25519.PrivateKey
	KeyID      string
}

type Target struct {
	// Description is an optional human readable explanation printed by `duck list`.
	Description  string              `yaml:"description,omitempty"`
	Binary       string              `yaml:"binary,omitempty"`
	FileFlag     string              `yaml:"fileFlag,omitempty"`
	Template     Template            `yaml:"template"`
	Variables    map[string]VarValue `yaml:"variables,omitempty"`
	RenderedPath string              `yaml:"renderedPath,omitempty"`
	CopyRendered bool                `yaml:"copyRendered,omitempty"` // If true, copy instead of symlink. RenderedPath required.
	Args         ArgList             `yaml:"args,omitempty"`
}

type Template struct {
	// Remote reference (new approach)
	Remote string `yaml:"remote,omitempty"`

	// Inline configuration (existing approach - mutually exclusive with Remote)
	Repo     string `yaml:"repo,omitempty"`
	Ref      string `yaml:"ref,omitempty"`
	Path     string `yaml:"path"`
	Checksum string `yaml:"checksum,omitempty"`

	// Optional delimiter override to avoid conflicts with downstream tools (e.g., Taskfile).
	Delims *Delims `yaml:"delims,omitempty"`
	// If true, missing keys render as empty strings (zero values). Default: strict error.
	AllowMissing bool `yaml:"allowMissing,omitempty"`
	// If true, enables commit hash storage and validation. Default: false.
	TrackCommitHash bool `yaml:"trackCommitHash,omitempty"`
	// If true, auto-update if commit hash changes; otherwise warn and stop. Default: false.
	AutoUpdateOnChange bool `yaml:"autoUpdateOnChange,omitempty"`
	// If true, fetch submodules with --recurse-submodules. Default: false.
	Submodules bool `yaml:"submodules,omitempty"`
}

type VarKind int

type VarValue struct {
	Kind  VarKind
	Arg   string // tag argument (env name, command, or file path)
	Value any    // for literal
}