admin

type AdminAPIHandler struct {
	// contains filtered or unexported fields
}

type AdminAPIOption func(*AdminAPIHandler)

type AdminHandler struct {
	// contains filtered or unexported fields
}

type AuditEntry struct {
	Timestamp  string
	IdentityID string
	ToolName   string
	Decision   string
}

type AuditQueryResponse struct {
	Records    []AuditRecordDTO `json:"records"`
	NextCursor string           `json:"next_cursor,omitempty"`
	Count      int              `json:"count"`
}

type AuditReader interface {
	// GetRecent returns the N most recent audit records.
	GetRecent(n int) []audit.AuditRecord
	// Query retrieves audit records matching the filter.
	Query(filter audit.AuditFilter) ([]audit.AuditRecord, string, error)
}

type AuditRecordDTO struct {
	Timestamp      string                 `json:"timestamp"`
	SessionID      string                 `json:"session_id"`
	IdentityID     string                 `json:"identity_id"`
	IdentityName   string                 `json:"identity_name,omitempty"`
	ToolName       string                 `json:"tool_name"`
	ToolArguments  map[string]interface{} `json:"tool_arguments,omitempty"`
	Decision       string                 `json:"decision"`
	Reason         string                 `json:"reason"`
	RuleID         string                 `json:"rule_id"`
	RequestID      string                 `json:"request_id"`
	LatencyMicros  int64                  `json:"latency_micros"`
	Protocol       string                 `json:"protocol,omitempty"`
	Framework      string                 `json:"framework,omitempty"`
	ScanDetections int                    `json:"scan_detections"`
	ScanAction     string                 `json:"scan_action,omitempty"`
	ScanTypes      string                 `json:"scan_types,omitempty"`
}

type BuildInfo struct {
	Version   string
	Commit    string
	BuildDate string
}

type HTTPGatewayController interface {
	// TLS inspection
	TLSEnabled() bool
	SetTLSEnabled(enabled bool)
	BypassList() []string
	SetBypassList(list []string)
	// Upstream targets (from state.json)
	Targets() []httpgw.UpstreamTarget
	SetTargets(targets []httpgw.UpstreamTarget)
	// CA cert (PEM bytes, nil if no CA)
	CACertPEM() []byte
}

type MatchedRuleDetail struct {
	ID        string `json:"id"`
	Name      string `json:"name"`
	Priority  int    `json:"priority"`
	ToolMatch string `json:"tool_match"`
	Condition string `json:"condition"`
	Action    string `json:"action"`
}

type PolicyEvaluateStatusResponse struct {
	RequestID string `json:"request_id"`
	Status    string `json:"status"`
	Decision  string `json:"decision"`
	UpdatedAt string `json:"updated_at"`
}

type PolicyTestRequest struct {
	// ToolName is the tool to test against (required).
	ToolName string `json:"tool_name"`
	// Arguments are optional tool arguments for CEL evaluation.
	Arguments map[string]interface{} `json:"arguments,omitempty"`
	// Roles are user roles to simulate (defaults to empty).
	Roles []string `json:"roles,omitempty"`
	// IdentityID is a simulated identity ID.
	IdentityID string `json:"identity_id,omitempty"`
	// IdentityName is a simulated identity name.
	IdentityName string `json:"identity_name,omitempty"`
	// ActionType is the canonical action type: "tool_call", "file_read", "file_write", "command_exec", etc.
	ActionType string `json:"action_type,omitempty"`
	// Protocol is the originating protocol: "mcp", "http", "runtime".
	Protocol string `json:"protocol,omitempty"`
	// Framework is the AI framework: "crewai", "langchain", "autogen", etc.
	Framework string `json:"framework,omitempty"`
	// Gateway is the gateway that received the request.
	Gateway string `json:"gateway,omitempty"`
	// DestURL is the destination URL for outbound requests.
	DestURL string `json:"dest_url,omitempty"`
	// DestDomain is the destination domain.
	DestDomain string `json:"dest_domain,omitempty"`
	// DestCommand is the command being executed.
	DestCommand string `json:"dest_command,omitempty"`
}

type PolicyTestResponse struct {
	// Allowed indicates whether the tool call would be permitted.
	Allowed bool `json:"allowed"`
	// Decision is "allow" or "deny".
	Decision string `json:"decision"`
	// RuleID is the ID of the matched rule (empty if default deny with no match).
	RuleID string `json:"rule_id"`
	// RuleName is the name of the matched rule.
	RuleName string `json:"rule_name"`
	// Reason is the explanation from the policy engine.
	Reason string `json:"reason"`
	// MatchedRule contains the full rule details if a rule matched, nil otherwise.
	MatchedRule *MatchedRuleDetail `json:"matched_rule"`
}

type ResponseScanController interface {
	Mode() action.ScanMode
	Enabled() bool
	SetMode(mode action.ScanMode)
	SetEnabled(enabled bool)
}

type RuleRequest struct {
	PolicyIndex int    `json:"policyIndex"`
	RuleIndex   int    `json:"ruleIndex"` // -1 for new rule
	Name        string `json:"name"`
	Condition   string `json:"condition"`
	Action      string `json:"action"`
}

type StatsResponse struct {
	Upstreams       int              `json:"upstreams"`
	Tools           int              `json:"tools"`
	Policies        int              `json:"policies"`
	Allowed         int64            `json:"allowed"`
	Denied          int64            `json:"denied"`
	RateLimited     int64            `json:"rate_limited"`
	Errors          int64            `json:"errors"`
	ProtocolCounts  map[string]int64 `json:"protocol_counts"`
	FrameworkCounts map[string]int64 `json:"framework_counts"`
}

type SystemInfoResponse struct {
	Version   string `json:"version"`
	Commit    string `json:"commit"`
	BuildDate string `json:"build_date"`
	GoVersion string `json:"go_version"`
	OS        string `json:"os"`
	Arch      string `json:"arch"`
	Uptime    string `json:"uptime"`
	UptimeSec int64  `json:"uptime_seconds"`
}