decryptobs

const (
	// ALPNNone — no ALPN negotiated (empty; a valid member, not "unset").
	ALPNNone ALPN = ""
	// ALPNH2 — HTTP/2.
	ALPNH2 ALPN = "h2"
	// ALPNHTTP11 — HTTP/1.1.
	ALPNHTTP11 ALPN = "http/1.1"
)

const (
	// CertVerifyNotChecked — verification did not run (e.g. no decryption on this session).
	CertVerifyNotChecked CertVerify = "not_checked"
	// CertVerifyVerified — the origin certificate verified against the trust store.
	CertVerifyVerified CertVerify = "verified"
	// CertVerifySkipped — verification was deliberately skipped (bypass path).
	CertVerifySkipped CertVerify = "skipped"
	// CertVerifyUntrustedIssuer — the chain did not build to a trusted root.
	CertVerifyUntrustedIssuer CertVerify = "untrusted_issuer"
	// CertVerifyExpired — the certificate was expired / not yet valid.
	CertVerifyExpired CertVerify = "expired"
	// CertVerifyHostnameMismatch — the certificate did not match the host.
	CertVerifyHostnameMismatch CertVerify = "hostname_mismatch"
	// CertVerifyUnknown — a verification failure that did not classify further.
	CertVerifyUnknown CertVerify = "unknown"
)

const (
	// DecisionPolicyInspect — a policy rule / decryption profile selected inspection.
	DecisionPolicyInspect DecisionSource = "policy_inspect"
	// DecisionManualSSLBypass — an explicit SSL-bypass match.
	// #nosec G101 -- categorical enum value, not a credential ("ssl_bypass" contains "pass", which trips gosec's hardcoded-credential pattern)
	DecisionManualSSLBypass DecisionSource = "manual_ssl_bypass"
	// DecisionAutoexcludeCache — a learned exclusion in the fail-open cache bypassed it.
	DecisionAutoexcludeCache DecisionSource = "autoexclude_cache"
	// DecisionAutoexcludeRescue — a live-rescue on the inspect-failure path.
	DecisionAutoexcludeRescue DecisionSource = "autoexclude_rescue"
	// DecisionNoFailOpen502 — inspect failed under a fail-CLOSE rule; the session was blocked (502).
	DecisionNoFailOpen502 DecisionSource = "no_fail_open_502"
	// DecisionCertVerifyBlock — the origin certificate failed verification and was blocked.
	DecisionCertVerifyBlock DecisionSource = "cert_verify_block"
	// DecisionNonTLSFallback — the CONNECT target was not TLS; the non-TLS relay fallback ran.
	DecisionNonTLSFallback DecisionSource = "non_tls_fallback"
	// DecisionInspectUnavailable — a rule selected inspection but the MITM CA was not
	// ready (no root CA / passphrase), so handleTunnel silently degraded to bypass
	// (proxy_tunnel.go). A distinct source so this MISCONFIGURATION is visible on the
	// coverage view rather than hiding inside manual bypass (PR #758 red-team, model gap).
	DecisionInspectUnavailable DecisionSource = "inspect_unavailable"
)

const (
	// FailCategoryNone — no failure on this session.
	FailCategoryNone FailCategory = "none"
	// FailCategoryCertificate — origin certificate untrusted/expired/mismatched.
	FailCategoryCertificate FailCategory = "certificate"
	// FailCategoryProtocol — a protocol-level handshake failure.
	FailCategoryProtocol FailCategory = "protocol"
	// FailCategoryVersion — no overlapping TLS version.
	FailCategoryVersion FailCategory = "version"
	// FailCategoryCipher — no overlapping cipher suite.
	FailCategoryCipher FailCategory = "cipher"
	// FailCategoryClientCertRequired — the origin demanded a client certificate.
	FailCategoryClientCertRequired FailCategory = "client_cert_required"
	// FailCategoryClientPinned — the client pinned and rejected our forged leaf.
	FailCategoryClientPinned FailCategory = "client_pinned"
	// FailCategoryResource — a local resource limit (fd/memory) aborted the session.
	FailCategoryResource FailCategory = "resource"
	// FailCategoryTimeout — a handshake/idle timeout.
	FailCategoryTimeout FailCategory = "timeout"
	// FailCategoryOther — a classified-but-uncategorised failure.
	FailCategoryOther FailCategory = "other"
)

const (
	// FailStageNone — no failure on this session.
	FailStageNone FailStage = "none"
	// FailStageTCPConnect — the upstream TCP dial failed.
	FailStageTCPConnect FailStage = "tcp_connect"
	// FailStageClientHello — the client-side TLS hello / handshake failed.
	FailStageClientHello FailStage = "client_hello"
	// FailStageUpstreamHandshake — the origin TLS handshake failed.
	FailStageUpstreamHandshake FailStage = "upstream_handshake"
	// FailStageCertVerify — origin certificate verification failed.
	FailStageCertVerify FailStage = "cert_verify"
	// FailStageClientLeafReject — the client rejected our forged leaf (pinning).
	FailStageClientLeafReject FailStage = "client_leaf_reject"
	// FailStageRelay — an error during the byte relay after a successful setup.
	FailStageRelay FailStage = "relay"
)

const (
	// OutcomeInspected — the session was MITM-decrypted and inspected.
	OutcomeInspected Outcome = "inspected"
	// OutcomeBypassManual — a decryption-profile / SSL-bypass rule chose not to inspect.
	OutcomeBypassManual Outcome = "bypass_manual"
	// OutcomeBypassLearned — the adaptive auto-exclusion cache bypassed this session.
	OutcomeBypassLearned Outcome = "bypass_learned"
	// OutcomeRescued — a live-rescue re-dialled the session in bypass after an inspect failure.
	OutcomeRescued Outcome = "rescued"
	// OutcomeFailed — decryption was attempted and failed (see FailStage/FailCategory).
	OutcomeFailed Outcome = "failed"
	// OutcomeNotDecrypted — no decryption decision applied (plain-HTTP / non-TLS / no decision).
	OutcomeNotDecrypted Outcome = "not_decrypted"
)

const (
	// TLSVersion12 — TLS 1.2.
	TLSVersion12 TLSVersion = "1.2"
	// TLSVersion13 — TLS 1.3.
	TLSVersion13 TLSVersion = "1.3"
	// TLSVersionUnknown — no handshake completed / version not observed.
	TLSVersionUnknown TLSVersion = "unknown"
)