diagnostics

type CharRange struct {
	StartIndex, EndIndex int64
}

type Confidence int

type DefaultSecurityDiagnosticsProvider struct {
	// contains filtered or unexported fields
}

type Evidence struct {
	Description string     `json:"description"`
	Confidence  Confidence `json:"confidence"`
}

type ExcludeContainer struct {
	ExcludeDef   *ExcludeDefinition
	Repositories []string
}

type ExcludeDefinition struct {
	//These specify regular expressions of matching strings that should be ignored as secrets anywhere they are found
	GloballyExcludedRegExs []string `yaml:"GloballyExcludedRegExs"`
	//These specify strings that should be ignored as secrets anywhere they are found
	GloballyExcludedStrings []string `yaml:"GloballyExcludedStrings"`
	//These specify SHA256 hashes that should be ignored as secrets anywhere they are found
	GloballyExcludedHashes []string `yaml:"GloballyExcludedHashes"`
	//These specify regular expressions that ignore files whose paths match
	PathExclusionRegExs []string `yaml:"PathExclusionRegExs"`
	//These specify sets of strings that should be excluded in a given file. That is filepath -> Set(strings)
	PerFileExcludedStrings map[string][]string `yaml:"PerFileExcludedStrings"`
	//These specify sets of SHA256 hashes that should be excluded in a given file. That is filepath -> Set(strings)
	PerFileExcludedHashes map[string][]string `yaml:"PerFileExcludedHashes"`
	//These specify sets of regular expressions that if matched on a path matched by the filepath key should be ignored. That is filepath_regex -> Set(regex)
	//This is a quite versatile construct and can model the four above
	PathRegexExcludedRegExs map[string][]string `yaml:"PathRegexExcludedRegex"`
}

type ExcludeRequirement struct {
	What      string
	Issue     SecurityDiagnostic
	ProjectID string
}

type ExclusionProvider interface {
	//ShouldExclude determines whether the supplied value should be excluded based on its value and the
	//path (if any) of the source file providing additional context
	ShouldExclude(pathContext, value string) bool
	ShouldExcludeHashOnPath(pathContext, hash string) bool
	ShouldExcludePath(path string) bool
	ShouldExcludeValue(value string) bool
	ShouldExcludeHash(hash string) bool
}

type Justification struct {
	Headline Evidence   `json:"headline,omitempty"` //Headline evidence
	Reasons  []Evidence `json:"reasons,omitempty"`  //sub-reasons that justify why this is an issue
}

type PolicyUpdateResult struct {
	Status    string
	NewPolicy string
}

type Progress struct {
	ProjectID   string
	ScanID      string
	Position    int64 //how many files processed so far
	Total       int64 //total number of files
	CurrentFile string
}

type SecurityDiagnostic struct {
	Justification  Justification `json:"justification,omitempty"`
	Range          code.Range    `json:"range,omitempty"`
	RawRange       CharRange     `json:"rawRange,omitempty"`
	HighlightRange code.Range    `json:"highlightRange,omitempty"`
	//Source code evidence optionally provided
	Source *string `json:"source,omitempty"`
	//SHA256 checksum is an optional SHA256 hash of the secret. High-security environments
	//may want to consider using an HMAC or similar and ommitting source from the reports
	SHA256 *string `json:"sha256,omitempty"`
	//Location is an optional value that could contain filepath or URI of resource that this diagnostic applies to
	Location *string `json:"location,omitempty"`
	//used for identifying the source of the diagnostics
	ProviderID *string   `json:"providerID,omitempty"`
	Excluded   bool      //indicates whether or not this diagnostics has been excluded
	Tags       *[]string `json:"tags,omitempty"` //optionally annotate diagnostic with tags, e.g. "test"
}

type SecurityDiagnosticsConsumer interface {
	ReceiveDiagnostic(diagnostic *SecurityDiagnostic)
}

type SecurityDiagnosticsProvider interface {
	//AddConsumers adds consumers to be notified by this provider when there is a new diagnostics
	AddConsumers(consumers ...SecurityDiagnosticsConsumer)
	Broadcast(diagnostic *SecurityDiagnostic)
}