logstore

type DecryptionBlock struct {
	SchemaVersion   int    `json:"schema_version"`             // independent version for the dec block
	Outcome         string `json:"outcome"`                    // decryptobs.Outcome
	DecisionSource  string `json:"decision_source"`            // decryptobs.DecisionSource
	RuleID          string `json:"rule_id,omitempty"`          // matched forward-proxy rule ULID
	RuleName        string `json:"rule_name,omitempty"`        // matched rule display name
	ProfileID       string `json:"profile_id,omitempty"`       // decryption-profile stable ID (autoexclude scopeID)
	ProfileName     string `json:"profile_name,omitempty"`     // decryption-profile display name
	Host            string `json:"host"`                       // CONNECT authority / normalized host (redactable by hashing)
	SNI             string `json:"sni,omitempty"`              // client-hello SNI when available (redactable)
	TLSVersion      string `json:"tls_version"`                // decryptobs.TLSVersion
	Cipher          string `json:"cipher,omitempty"`           // IANA suite name (record-only, never a metric label)
	ALPN            string `json:"alpn"`                       // decryptobs.ALPN ("" is a valid, explicit member)
	CertVerify      string `json:"cert_verify"`                // decryptobs.CertVerify
	FailStage       string `json:"fail_stage"`                 // decryptobs.FailStage ("none" when no failure)
	FailCategory    string `json:"fail_category"`              // decryptobs.FailCategory ("none" when no failure)
	ExclReason      string `json:"excl_reason"`                // autoexclude.Reason ("" = no exclusion — explicit)
	ExclScope       string `json:"excl_scope,omitempty"`       // owning profile ID (present only when excluded)
	CacheConsulted  bool   `json:"cache_consulted"`            // fail-open read path ran
	CacheHit        bool   `json:"cache_hit"`                  // a learned entry bypassed this session
	CacheLearned    bool   `json:"cache_learned"`              // this session's evidence was recorded
	Rescued         bool   `json:"rescued"`                    // live-rescue fired for this session
	ScopeRuleCount  int    `json:"scope_rule_count"`           // rules referencing the owning profile (explicit 0)
	NodeID          string `json:"node_id,omitempty"`          // CP/DP NodeID; empty in single-binary mode
	CertFingerprint string `json:"cert_fingerprint,omitempty"` // bounded SPKI/cert SHA-256 hash (privacy opt-in)
}

type Entry struct {
	TS          int64  `json:"ts"`
	Time        string `json:"time"`
	IP          string `json:"ip"`
	Identity    string `json:"identity,omitempty"` // authenticated username/email, empty if unauthenticated
	Method      string `json:"method"`
	Host        string `json:"host"`
	URI         string `json:"uri,omitempty"`        // full request URL (host+path, no query); only set when the matched rule has LogFullURI
	Status      string `json:"status"`               // OK | BLOCKED | AUTH_FAIL | RATE_LIMITED | IP_BLOCKED | POLICY_*
	Level       string `json:"level"`                // INFO | WARN | ERROR
	RuleMatched string `json:"ruleMatched"`          // policy rule name that matched, if any
	RuleID      string `json:"ruleId,omitempty"`     // stable ULID of the matched forward-proxy policy rule (rename-safe decision attribution, §1); omitted when no rule matched
	ActionTaken string `json:"actionTaken"`          // policy action taken, if any
	BytesSent   int64  `json:"bytesSent,omitempty"`  // bytes sent to upstream (request body / tunnel client→dest)
	BytesRecv   int64  `json:"bytesRecv,omitempty"`  // bytes received from upstream (response body / tunnel dest→client)
	SSLAction   string `json:"sslAction,omitempty"`  // "inspect", "bypass", or empty (non-CONNECT)
	DurationMs  int64  `json:"durationMs,omitempty"` // connection lifetime; set on TUNNEL_CLOSED accounting entries

	// Normalized authentication-policy SIEM fields (Phase 0 seam, §1.8; the
	// auth_* observability block is finalized in Phase 1 Slice 5). Declared as the
	// durable SIEM contract but populated only when an auth decision supplies them
	// — all are omitempty so wire output stays byte-identical for requests with no
	// auth decision. NO identity is carried in the auth_* block: an Exempt decision
	// is logged by outcome + rule id/name (+ low-cardinality subject predicate
	// types and the matched rule's subject schema version) only.
	SchemaVersion         int      `json:"schema_version,omitempty"`           // event schema version
	AuthSource            string   `json:"auth_source,omitempty"`              // categorical: idp|local|oidc:x|saml:x|exempt|unauth
	AuthOutcome           string   `json:"auth_outcome,omitempty"`             // Stage-1 outcome (e.g. "Exempt"); "" = none
	AuthPolicyRuleID      string   `json:"auth_policy_rule_id,omitempty"`      // ULID of matched Stage-1 rule
	AuthPolicyRuleName    string   `json:"auth_policy_rule_name,omitempty"`    // display name of matched Stage-1 rule
	AccessRuleID          string   `json:"access_rule_id,omitempty"`           // dormant Stage-2 auth-observability seam (unpopulated); forward-proxy decision attribution uses the top-level RuleID/ruleId field paired with RuleMatched
	AuthSubjectMatchTypes []string `json:"auth_subject_match_types,omitempty"` // low-cardinality predicate type names (e.g. ["cidr"])
	AuthSchemaVersion     int      `json:"auth_schema_version,omitempty"`      // matched rule's SubjectMatch schema version

	// Normalized decryption-observability block (ADR-0011). Nested pointer, block-level
	// omitempty: when no decryption decision occurred (plain non-CONNECT, feature-off)
	// Dec is nil and the "dec" key is ABSENT — wire stays byte-identical. When present,
	// every categorical/boolean/int field serializes EXPLICITLY (see DecryptionBlock),
	// so a negative outcome (cache_consulted:false, fail_stage:"none", scope_rule_count:0)
	// is queryable rather than indistinguishable from an old/forgotten record. Populated
	// only on the decryption decision path (a later ADR-0011 slice); nil until then.
	Dec *DecryptionBlock `json:"dec,omitempty"`
}

type PageResult struct {
	Entries []Entry
	// NextTS/NextSeq name the LAST entry RETURNED; a follow-up QueryPage
	// passing them resumes strictly AFTER it (exclusive) in newest-first
	// order. Meaningful only when len(Entries) > 0. When ScanLimited is
	// false this is the correct continuation point — it deliberately does
	// NOT skip the look-ahead match that proved HasMore.
	NextTS  int64
	NextSeq uint32
	// LastScanTS/LastScanSeq name the LAST raw entry VISITED and evaluated
	// (matched or not). Meaningful when Scanned > 0. When ScanLimited is
	// true this is the continuation point: resuming strictly after it never
	// rescans a raw range this walk already proved non-matching, so a
	// bounded continuation makes forward progress even when ZERO matching
	// rows were returned (the sparse-filter forward-progress guarantee).
	LastScanTS  int64
	LastScanSeq uint32
	// HasMore reports that this walk did not exhaust the requested window:
	// either a look-ahead MATCH proved another result exists (ScanLimited
	// false), or the scan budget ran out first (ScanLimited true) — in the
	// latter case more HISTORY remains to be SEARCHED, but no further match
	// is proven to exist.
	HasMore bool
	// ScanLimited reports the walk stopped because the scan budget was
	// exhausted before the window was exhausted and before a look-ahead
	// match ended the page normally. Distinguishes "more matches are known"
	// from "more history remains to be searched".
	ScanLimited bool
	// Scanned counts raw entries visited AND evaluated (matched or not) —
	// the deterministic cost seam the Monitor scale gate asserts on: page
	// cost is bounded by the entries visited to fill ONE page, never by how
	// many pages precede it. Never exceeds the scan budget.
	Scanned int
}

type Stats struct {
	Bytes    int64 `json:"bytes"`              // tracked logical size (same counter as the size cap)
	Count    int64 `json:"count"`              // entries scanned (capped)
	Capped   bool  `json:"capped"`             // true when Count hit the scan cap
	OldestMs int64 `json:"oldestMs,omitempty"` // timestamp of the oldest entry
}

type Store struct {
	// contains filtered or unexported fields
}