monitor

type Agents interface {
	ListAgents(ctx context.Context, who keys.Who) ([]agents.Agent, error)
	GetAgent(ctx context.Context, who keys.Who, id string) (*agents.Agent, error)
}

type Alert struct {
	ID, Key, Kind, Subject, Severity, Detail, Href string
	FirstSeen, LastSeen                            time.Time
	Resolved                                       time.Time // zero while open
	NotifiedSeverity                               string    // "" = not reported yet
	Notified                                       time.Time
}

type Changes struct {
	Opened, Raised, Lowered, Resolved []Alert
}

type DigestOptions struct {
	Server      string              // host name in the subject
	RepeatEvery time.Duration       // reminder for an alert still open
	Link        func(string) string // UI path → absolute link; nil = none
	Channels    []string            // queue one message per channel
}

type EndpointSource interface {
	List(ctx context.Context, who keys.Who) ([]tlsscan.Endpoint, error)
}

type EndpointState struct {
	Endpoint   tlsscan.Endpoint
	Assessment tlsscan.Assessment
	// Input is the expected set and the served leaf as the PKI knows it (the
	// serial of the newest certificate, for the page).
	Input tlsscan.Input
	// ServedID is the ID of the served leaf if the PKI issued it, else "".
	ServedID string
}

type Endpoints struct {
	Service *tlsscan.Service
	Eval    *Evaluator
	Clock   clock.Clock
}

type Engine interface {
	Certificates(ctx context.Context, who keys.Who, f ca.CertificateFilter) (*ca.CertificatePage, error)
	Certificate(ctx context.Context, who keys.Who, id string) (*ca.CertificateInfo, error)
	CAs(ctx context.Context, who keys.Who) ([]ca.CAInfo, error)
	// CertificateByFingerprint finds the certificate a TLS endpoint serves.
	CertificateByFingerprint(ctx context.Context, who keys.Who, fingerprint string) (*ca.CertificateInfo, error)
}

type Evaluator struct {
	Engine Engine
	Agents Agents // nil = no agent rules
	Seal   func() keys.Status
	Rules  Rules
	Who    keys.Who // a system principal that may read the whole tenant
	// Scan gives the TLS endpoints and their last scans; nil = no scan rules
	// (docs/PHASE3.md §10.2).
	Scan EndpointSource
	// ScanOff: scanning is switched off (monitor.scan_interval: off). The scan
	// alerts are not produced, so they resolve – there is no fresh result –
	// but EndpointStates still tells the last known state.
	ScanOff bool
}

type Finding struct {
	Key, Kind, Subject, Severity, Detail, Href string
}

type Rules struct {
	// End-entity certificates: warning and critical before they expire.
	ExpiryWarn, ExpiryCrit time.Duration
	// CA certificates.
	CAWarn, CACrit time.Duration
	// A sealed server: warning after SealedAfter; critical once a CRL's
	// next update is closer than CRLHorizon (a sealed server can't sign).
	SealedAfter, CRLHorizon time.Duration
	// Agents: warning and critical after this long without a report.
	AgentSilentWarn, AgentSilentCrit time.Duration
	// An active agent's own certificate: critical below this.
	AgentCertificate time.Duration
	// ExpiredFor: an expired, not superseded certificate stays an alert this
	// long after its end, then the alert is closed.
	ExpiredFor time.Duration
	// RepeatEvery: a reminder for an open alert (step 23).
	RepeatEvery time.Duration
	// The TLS scan (docs/PHASE3.md §10.2): failed scans in a row before an
	// endpoint is unreachable, and how old the newest certificate for a name
	// must be before an older one that is still served is an alert.
	ScanUnreachableAfter int
	ScanMismatchAfter    time.Duration
}

type Store struct {
	DB     *sql.DB // system.db, the write connection
	Tenant string
	Rand   io.Reader // nil = crypto/rand (IDs)
}