exposure

type Chain struct {
	// Readable is false when the chain could not be read; Reason says why.
	Readable bool
	Reason   string
	// NoChain is true when the firewall backend answers but has no
	// DOCKER-USER chain (nftables engines such as Podman with netavark).
	// That is permanent, not a transient read failure.
	NoChain bool
	Rules   []ChainRule
}

type ChainRule struct {
	Raw           string
	Proto         string
	DPort         int
	OrigDPort     int
	Source        string
	SourceNegated bool
	Target        string
	Comment       string
	Complex       bool
}

type Change struct {
	Port      int       `json:"port"`
	Protocol  string    `json:"protocol"`
	Allow     []string  `json:"allow"`
	ExpiresAt time.Time `json:"expires_at"`
}

type Class string

type Container struct {
	ID      string
	Name    string
	Image   string
	Owner   Owner
	Ports   []PortBinding
	Running bool
}

type DriftFinding struct {
	Kind     DriftKind `json:"kind"`
	Severity Severity  `json:"severity"`
	Port     int       `json:"port"`
	Protocol string    `json:"protocol"`
	Subject  string    `json:"subject,omitempty"`
	Message  string    `json:"message"`
	Fix      string    `json:"fix,omitempty"`
	// Rules are the DOCKER-USER rules involved, verbatim.
	Rules []string `json:"rules,omitempty"`
	// Ports lists every port/protocol one grouped listener row covers, sorted.
	Ports []string `json:"ports,omitempty"`
}

type DriftInput struct {
	Findings []Finding
	Declared []Restriction
	Chain    Chain
	// Listeners is nil when sockets could not be read, which skips that check.
	Listeners []Listener
	// Known lists ports expected to listen publicly (control plane, ingress, SSH).
	Known []int
	// Own lists the platform's own listeners (mesh, mesh DNS) as configured now.
	Own    []OwnListener
	Prefix string
}

type DriftKind string

type Finding struct {
	Container     string    `json:"container"`
	Image         string    `json:"image"`
	Owner         Owner     `json:"owner"`
	ImageKind     ImageKind `json:"image_kind"`
	Protocol      string    `json:"protocol"`
	HostPort      int       `json:"host_port"`
	ContainerPort int       `json:"container_port"`
	Binds         []string  `json:"binds"`
	Class         Class     `json:"class"`
	Severity      Severity  `json:"severity"`
	// AllowedSources lists the sources a matching rule lets through, when Class is restricted.
	AllowedSources []string `json:"allowed_sources,omitempty"`
	// Rules are the matching DOCKER-USER rules, verbatim.
	Rules []string `json:"rules,omitempty"`
	// Managed is true when the matching rule is one this platform created.
	Managed        bool   `json:"managed"`
	Explanation    string `json:"explanation"`
	Recommendation string `json:"recommendation,omitempty"`
	// CanRestrict is false when this audit cannot offer the guided fix, with the reason.
	CanRestrict       bool   `json:"can_restrict"`
	CannotRestrictWhy string `json:"cannot_restrict_reason,omitempty"`
}

type ImageKind string

type Listener struct {
	Protocol string
	Address  string
	Port     int
	// Process is the owning process name from ss -p, empty when ss could not say.
	Process string
	PID     int
}

type Manager struct {
	// contains filtered or unexported fields
}

type OwnListener struct {
	Port     int
	Protocol string
}

type Owner struct {
	Kind OwnerKind `json:"kind"`
	Name string    `json:"name,omitempty"`
	// Intentional is true when the operator explicitly asked for public
	// access (a database's PubliclyAccessible, an app's public bind).
	Intentional bool `json:"intentional,omitempty"`
}

type OwnerKind string

type Plan struct {
	Commands []string `json:"commands"`
	Drops    string   `json:"drops"`
	Tag      string   `json:"tag"`
	// Persistence says plainly how long the rules last.
	Persistence string `json:"persistence"`
}

type PortBinding struct {
	HostIP        string
	HostPort      int
	ContainerPort int
	Protocol      string
}

type ReachApp struct {
	Name       string
	Domains    []string
	Unshielded []string
}

type ReachCounts struct {
	High   int `json:"high"`
	Medium int `json:"medium"`
	Low    int `json:"low"`
	Info   int `json:"info"`
}

type ReachDB struct {
	Name       string
	PublicPort int
}

type ReachEndpoint struct {
	Kind  string `json:"kind"`
	Value string `json:"value"`
	Class Class  `json:"class,omitempty"`
}

type ReachFinding struct {
	ID       string            `json:"id"`
	Kind     ReachKind         `json:"kind"`
	Severity Severity          `json:"severity"`
	Subject  ReachRef          `json:"subject"`
	Node     string            `json:"node,omitempty"`
	Port     int               `json:"port,omitempty"`
	Params   map[string]string `json:"params,omitempty"`
	Fix      *ReachFix         `json:"fix,omitempty"`
}

type ReachFix struct {
	Kind   string            `json:"kind"`
	Method string            `json:"method,omitempty"`
	Path   string            `json:"path,omitempty"`
	Body   map[string]string `json:"body,omitempty"`
	Link   string            `json:"link,omitempty"`
	// Restarts is true when applying the fix recreates a container.
	Restarts bool `json:"restarts,omitempty"`
}

type ReachInput struct {
	Now       string
	Apps      []ReachApp
	Databases []ReachDB
	Nodes     []ReachNode
}

type ReachKind string

type ReachNode struct {
	Name          string
	Local         bool
	RulesReadable bool
	Findings      []Finding
}

type ReachRef struct {
	Type string `json:"type"`
	Name string `json:"name,omitempty"`
}

type ReachReport struct {
	GeneratedAt string         `json:"generated_at"`
	Counts      ReachCounts    `json:"counts"`
	Subjects    []ReachSubject `json:"subjects"`
	Findings    []ReachFinding `json:"findings"`
	// RulesReadable is false when a node's firewall could not be read, so restricted ports may be missing.
	RulesReadable bool `json:"rules_readable"`
	// RestrictedPorts is how many published ports a firewall rule narrows.
	RestrictedPorts int `json:"restricted_ports"`
}

type ReachSubject struct {
	Type      string          `json:"type"`
	Name      string          `json:"name"`
	Endpoints []ReachEndpoint `json:"endpoints"`
	Findings  int             `json:"findings"`
}

type Restriction struct {
	Port     int      `json:"port"`
	Protocol string   `json:"protocol"`
	Allow    []string `json:"allow"`
}

type Runner func(ctx context.Context, name string, args ...string) ([]byte, error)

type Severity string

type SyncResult struct {
	Applied int
	Removed int
	Errors  []string
}

type Verdict struct {
	Class   Class
	Allowed []string
	Rules   []string
	Managed bool
	Reason  string
}