models

type AuthConfig struct {
	Type   string `yaml:"type"`   // bearer|basic|apikey|cookie|oauth2|none
	Token  string `yaml:"token"`  // supports ${ENV_VAR} substitution
	Key    string `yaml:"key"`    // for apikey type
	Header string `yaml:"header"` // for apikey: header name, default X-API-Key
	User   string `yaml:"user"`   // for basic auth
	Pass   string `yaml:"pass"`   // for basic auth
	Cookie string `yaml:"cookie"` // for cookie auth: cookie name=value
}

type BFLAConfig struct {
	Enabled           bool     `yaml:"enabled"`
	UnprivilegedRoles []string `yaml:"unprivileged_roles"`
	AdminPathPatterns []string `yaml:"admin_path_patterns"`
	PrivilegedMethods []string `yaml:"privileged_methods"`
}

type BOLAConfig struct {
	Enabled       bool          `yaml:"enabled"`
	AttackerRoles []string      `yaml:"attacker_roles"`
	VictimRoles   []string      `yaml:"victim_roles"`
	Detection     BOLADetection `yaml:"detection"`
	Strategies    []IDStrategy  `yaml:"strategies"`
}

type BOLADetection struct {
	SuccessCodes []int    `yaml:"success_codes"` // codes that mean access was granted
	FailureCodes []int    `yaml:"failure_codes"` // codes that mean access was denied
	DataFields   []string `yaml:"data_fields"`   // response fields proving ownership
}

type BrokenAuthConfig struct {
	Enabled bool     `yaml:"enabled"`
	Tests   []string `yaml:"tests"` // universal: no_token|invalid_token · bearer: expired_token|wrong_algo_token|malformed_jwt · basic: empty_creds|malformed_basic · apikey: empty_key · cookie: empty_cookie
}

type BrokenPropertyConfig struct {
	Enabled bool `yaml:"enabled"`
}

type DASTScope struct {
	IncludeEndpoints []string `yaml:"include_endpoints,omitempty"` // glob patterns; empty = all
	ExcludeEndpoints []string `yaml:"exclude_endpoints,omitempty"` // glob patterns; always deny
	Methods          []string `yaml:"methods,omitempty"`           // HTTP methods; empty = all
}

type DetectionConfig struct {
	SuccessCodes   []int    `yaml:"success_codes,omitempty"`   // HTTP codes meaning success (default: 200, 201, 202)
	DenialKeywords []string `yaml:"denial_keywords,omitempty"` // body keywords indicating denial (replaces defaults when set)
	CustomDSL      string   `yaml:"custom_dsl,omitempty"`      // full DSL override — replaces auto-generated expression
}

type IDStrategy struct {
	Type string `yaml:"type"` // role_owned|sequential|uuid_fuzz
}

type InjectionConfig struct {
	Enabled bool           `yaml:"enabled"`
	Types   InjectionTypes `yaml:"types"`
	Targets []string       `yaml:"targets"` // query_params|path_params|body_fields|headers — controls nuclei fuzzing parts
}

type InjectionType struct {
	Enabled     bool     `yaml:"enabled"`
	Payloads    []string `yaml:"payloads"`     // inline payload list
	PayloadFile string   `yaml:"payload_file"` // path to payload file (nuclei resolves at scan time)
}

type InjectionTypes struct {
	SQLi          InjectionType `yaml:"sqli"`
	XSS           InjectionType `yaml:"xss"`
	SSTI          InjectionType `yaml:"ssti"`
	SSRF          InjectionType `yaml:"ssrf"`
	NoSQLi        InjectionType `yaml:"nosqli"`
	CMDi          InjectionType `yaml:"cmdi"`           // command injection via OOB DNS
	OpenRedirect  InjectionType `yaml:"open_redirect"`  // unvalidated redirect params
	PathTraversal InjectionType `yaml:"path_traversal"` // directory traversal / LFI
}

type MassAssignConfig struct {
	Enabled     bool                     `yaml:"enabled"`
	ExtraFields []map[string]interface{} `yaml:"extra_fields"`
}

type MisconfigConfig struct {
	Enabled bool     `yaml:"enabled"`
	Checks  []string `yaml:"checks"` // cors_wildcard|security_headers|tls_version|debug_endpoints|error_disclosure
}

type Params struct {
	Path  map[string]string `yaml:"path"`  // {param} substitutions
	Query map[string]string `yaml:"query"` // ?key=value appended
	Body  map[string]any    `yaml:"body"`  // request body field overrides (supports strings, numbers, lists, booleans)
}

type RaceCondConfig struct {
	Enabled   bool `yaml:"enabled"`
	RaceCount int  `yaml:"race_count"` // number of simultaneous requests (default 10)
}

type RateLimitConfig struct {
	Enabled            bool                `yaml:"enabled"`
	RequestCount       int                 `yaml:"request_count"`
	SensitiveEndpoints []SensitiveEndpoint `yaml:"sensitive_endpoints"`
}

type Role struct {
	Description    string            `yaml:"description"`
	PrivilegeLevel int               `yaml:"privilege_level"` // 0=none, 100=admin
	Auth           AuthConfig        `yaml:"auth"`
	Headers        map[string]string `yaml:"headers"`
	Owns           map[string]string `yaml:"owns"` // param_name → owned resource ID
}

type SensitiveEndpoint struct {
	Path   string `yaml:"path"`
	Method string `yaml:"method"`
}