rbac

type Binding struct {
	Name          string
	Namespace     string // empty when ClusterScoped
	ClusterScoped bool
	Subjects      []Subject
	RoleRef       RoleRef
}

type CloudIdentity struct {
	Provider CloudProvider
	// Role is the provider-specific role reference: an IAM role ARN (AWS), a GCP
	// service-account email, or an Azure client id.
	Role string
	// Privilege, when supplied by the input, describes the bound role's power so
	// the analysis can flag over-privilege without querying the cloud. One of
	// "admin", "power", "write", "read", or "" (unknown).
	Privilege string
	// TrustAnyServiceAccount is true when the role's trust policy does not pin the
	// specific SA (subject condition) — a confused-deputy risk where any pod that
	// can present a token from the cluster's OIDC issuer can assume the role.
	TrustAnyServiceAccount bool
}

type CloudProvider string

type Cluster struct {
	Roles           map[string]*Role // key: roleKey(clusterScoped, ns, name)
	Bindings        []*Binding
	ServiceAccounts map[string]*ServiceAccount // key: ns/name
	Pods            []*Pod
	DockerHosts     []*DockerHost
	// ObservedUsage maps a subject key to the permissions it was actually seen
	// using (from an audit fixture). Drives least-privilege generation and the
	// NHI dormant-identity check. Empty when no usage data was supplied.
	ObservedUsage map[string][]Permission
}

type DockerHost struct {
	Name               string
	DockerGroupMembers []string
	Rootless           bool
	SocketMounts       []SocketMount
}

type Grant struct {
	Subject     Subject
	Role        *Role
	Binding     *Binding
	Namespace   string // effective scope of the grant ("" = cluster-wide)
	ClusterWide bool
}

type Graph struct {
	Grants []Grant
	// contains filtered or unexported fields
}

type Options struct {
	// EnableNHI turns on the non-human-identity risk graph (AI-age feature). Off
	// by default so the deterministic core never depends on the optional layer.
	EnableNHI bool
	// Now is the reference time for dormancy calculations. Zero means a fixed
	// epoch, keeping analysis deterministic when no clock is injected.
	Now time.Time
	// DormantAfter is how long since last use before an identity is "dormant".
	DormantAfter time.Duration
	// BroadThreshold is the reachable-principal count above which a non-human
	// identity is considered over-broad even without reaching a terminal target.
	BroadThreshold int
}

type Permission struct {
	Verb      string
	APIGroup  string
	Resource  string
	Namespace string // "" = cluster-wide
}

type Pod struct {
	Name               string
	Namespace          string
	ServiceAccountName string // empty means the namespace "default" SA
	AutomountToken     *bool
	Privileged         bool
	HostPID            bool
	HostNetwork        bool
	HostPathMounts     []string
	AddedCapabilities  []string
}

type PolicyRule struct {
	APIGroups       []string
	Resources       []string
	ResourceNames   []string
	Verbs           []string
	NonResourceURLs []string
}

type Report struct {
	Risks  []Risk
	Graph  *Graph
	Counts map[engine.Severity]int
}

type Risk struct {
	RuleID      string
	Severity    engine.Severity
	Title       string
	Description string
	// Subject is the principal at fault (subject key) when applicable; Resource
	// is the object at fault (role/binding name) otherwise. At least one is set.
	Subject     string
	Resource    string
	Remediation string
	References  []string
	// Path, when set, is a human-readable escalation chain (pod → … →
	// cluster-admin) that justifies an escalation finding.
	Path []string
	// Meta carries structured, machine-consumable context for agent remediation
	// (the "explain & auto-remediate" mandate): the exact verb/resource that
	// triggered the rule, the namespace, and so on.
	Meta map[string]string
}

type Role struct {
	Name          string
	Namespace     string // empty when ClusterScoped
	ClusterScoped bool
	Rules         []PolicyRule
	Labels        map[string]string
	// Aggregates is true when the role uses aggregationRule to absorb other
	// roles' rules; such roles are living permission sets and worth flagging.
	Aggregates bool
}

type RoleRef struct {
	Kind string // "Role" | "ClusterRole"
	Name string
}

type ServiceAccount struct {
	Name           string
	Namespace      string
	AutomountToken *bool
	Labels         map[string]string
	// LastUsed, when known (e.g. from an audit-usage fixture), lets the NHI
	// pass flag dormant automation identities. Zero means unknown.
	LastUsedUnix int64
	// Cloud, when non-nil, is the cloud IAM identity this ServiceAccount is
	// federated to via workload identity (IRSA / GKE / AKS). It is the bridge
	// where a compromised pod's K8s token becomes cloud credentials.
	Cloud *CloudIdentity
}

type SocketMount struct {
	Container string
	Path      string
}

type Subject struct {
	Kind      string // "User" | "Group" | "ServiceAccount"
	Name      string
	Namespace string
}