accesslog

type AppTraffic struct {
	App string `json:"app"`
	HTTPTraffic
}

type AuditResult struct {
	Status string `json:"status"` // ok, denied, error
	Code   string `json:"code"`   // stable code, never a raw error message
}

type Count struct {
	Key      string     `json:"key"`
	Count    int        `json:"count"`
	Allowed  int        `json:"allowed"`
	Denied   int        `json:"denied"`
	LastSeen *time.Time `json:"last_seen"`
}

type Event struct {
	Via           string            `json:"via,omitempty"`
	Surface       string            `json:"surface,omitempty"`
	Changes       []mcpaudit.Change `json:"changes,omitempty"`
	SchemaVersion int               `json:"schema_version"`
	Time          time.Time         `json:"time"`
	Kind          string            `json:"kind"` // http, tcp_open, tcp_close, mcp, guest
	App           string            `json:"app"`
	Identity      Identity          `json:"identity"`
	Method        string            `json:"method,omitempty"`
	Path          string            `json:"path,omitempty"`
	Status        int               `json:"status"`
	BytesIn       int64             `json:"bytes_in"`
	BytesOut      int64             `json:"bytes_out"`
	DurationMS    float64           `json:"duration_ms"`
	Decision      string            `json:"decision"`
	Reason        string            `json:"reason,omitempty"`
	ErrorClass    string            `json:"error_class,omitempty"` // backend failure class; never a URL or address
	Grant         *Grant            `json:"grant,omitempty"`
	Connection    string            `json:"connection,omitempty"`
	MCP           *MCPAudit         `json:"mcp,omitempty"`
	Guest         *GuestDecision    `json:"guest,omitempty"`
	PathMode      string            `json:"-"` // selected per-service policy; not HTTP metadata
}

type Filter struct {
	// AllowedApps is an authority filter applied before counts and truncation.
	// nil is unrestricted; an empty non-nil list authorizes no records.
	AllowedApps []string   `json:"-"`
	App         string     `json:"app,omitempty"`
	Who         string     `json:"who,omitempty"`
	Since       *time.Time `json:"since,omitempty"`
	Until       *time.Time `json:"until,omitempty"`
	Decision    string     `json:"decision,omitempty"`
	Limit       int        `json:"limit,omitempty"`
}

type Grant struct {
	Kind  string `json:"kind"` // person or legacy_allow
	Entry string `json:"entry"`
}

type GuestDecision struct {
	LinkID   string `json:"link_id"`
	App      string `json:"app"`
	Decision string `json:"decision"`
	Reason   string `json:"reason"`
}

type HTTPTraffic struct {
	Requests      int        `json:"requests"`
	Allowed       int        `json:"allowed"`
	Denied        int        `json:"denied"`
	BytesIn       int64      `json:"bytes_in"`
	BytesOut      int64      `json:"bytes_out"`
	LastRequestAt *time.Time `json:"last_request_at"`
	LastAllowedAt *time.Time `json:"last_allowed_at"`
}

type Health struct {
	Current        bool            `json:"current"`
	MissingHistory []HistoryWindow `json:"missing_history,omitempty"`
	Enabled        bool            `json:"enabled"`
	LastWrite      *time.Time      `json:"last_write"`
	Drops          uint64          `json:"drops"`
	Size           int64           `json:"size_bytes"`
	Error          string          `json:"error,omitempty"`
	UpdatedAt      time.Time       `json:"updated_at"`
}

type HistoryWindow struct {
	Start  time.Time  `json:"start"`
	End    *time.Time `json:"end,omitempty"` // absent while history is unavailable
	Reason string     `json:"reason"`
}

type Identity struct {
	Login  string   `json:"login"`
	Node   string   `json:"node"`
	Tags   []string `json:"tags"`
	Remote string   `json:"remote,omitempty"`
}

type Lifecycle struct {
	// contains filtered or unexported fields
}

type MCPAudit struct {
	Identity       *MCPIdentity    `json:"identity,omitempty"`
	Role           string          `json:"role,omitempty"`
	ID             string          `json:"id"`
	Principal      string          `json:"principal"` // F6 Principal (legacy Who): login, tag or local OS user
	Scope          string          `json:"scope,omitempty"`
	Capabilities   MCPCapabilities `json:"capabilities"`
	ScopeExpiresAt *time.Time      `json:"scope_expires_at,omitempty"`
	Tool           string          `json:"tool"`
	Apps           []string        `json:"apps"`
	Result         AuditResult     `json:"result"`
	Phase          string          `json:"phase,omitempty"` // intent/completion; started supports the older F6 journal
}

type MCPCapabilities struct {
	Role        string   `json:"role"`
	Apps        []string `json:"apps,omitempty"`
	Inventory   bool     `json:"inventory,omitempty"`
	MaxDuration string   `json:"max_duration,omitempty"`
}

type MCPIdentity struct {
	Login string `json:"login"`
	Node  string `json:"node"`
}

type Options struct {
	Enabled       *bool  `json:"enabled,omitempty"`
	RecordPath    *bool  `json:"record_path,omitempty"`
	PathMode      string `json:"path_mode,omitempty"`
	RetentionDays int    `json:"retention_days,omitempty"`
	MaxBytes      int64  `json:"max_bytes,omitempty"`
	QueueSize     int    `json:"queue_size,omitempty"`
}

type Result struct {
	Events    []Event `json:"events"`
	Summary   Summary `json:"summary"`
	Truncated bool    `json:"truncated"`
}

type Store struct {
	// contains filtered or unexported fields
}

type SubjectAppTraffic struct {
	SubjectKind string `json:"subject_kind"` // human, tagged, public, unknown
	Login       string `json:"login,omitempty"`
	Subject     string `json:"subject,omitempty"` // non-human bucket, never an inferred login
	App         string `json:"app"`
	HTTPTraffic
}

type Summary struct {
	Traffic TrafficSummary `json:"traffic"`
	Reasons []Count        `json:"reasons,omitempty"`
	Count   int            `json:"count"`
	Allowed int            `json:"allowed"`
	Denied  int            `json:"denied"`
	People  []Count        `json:"people"`
	Apps    []Count        `json:"apps"`
}

type TCPTraffic struct {
	Connections int   `json:"connections"` // opens, excluding gateway gate drops
	Allowed     int   `json:"allowed"`
	Denied      int   `json:"denied"`
	Closed      int   `json:"closed"`
	BytesIn     int64 `json:"bytes_in"` // close events only
	BytesOut    int64 `json:"bytes_out"`
	GateDrops   int   `json:"gate_drops"` // recorded, rate-limited diagnostics
}

type TrafficSummary struct {
	HTTP       HTTPTraffic         `json:"http"`
	PeopleApps []SubjectAppTraffic `json:"people_apps"`
	Apps       []AppTraffic        `json:"apps"`
	TCP        TCPTraffic          `json:"tcp"`
}

type Writer interface{ Record(Event) bool }