wafv2

type APIKey struct {
	APIKeyValue string `json:"apiKey"`
	Scope       string `json:"scope"`
	// Region is the store.Table[APIKey] key material replacing the old
	// map[region]map[key]*APIKey nesting: the region bucket the key was
	// created under (storeRegion-normalized -- see CreateAPIKey). Tagged
	// json:"-" and round-tripped via persistence.go's apiKeySnapshot DTO,
	// mirroring ManagedRuleSet.Region.
	Region       string   `json:"-"`
	TokenDomains []string `json:"tokenDomains,omitempty"`
}

type Handler struct {
	// Backend is the storage interface for WAFv2 operations.
	Backend StorageBackend

	AccountID string
	Region    string
	// contains filtered or unexported fields
}

type IPSet struct {
	Tags             map[string]string `json:"tags,omitempty"`
	ARN              string            `json:"arn,omitempty"`
	ID               string            `json:"id"`
	Name             string            `json:"name"`
	Scope            string            `json:"scope"`
	Description      string            `json:"description"`
	IPAddressVersion string            `json:"ipAddressVersion"`
	LockToken        string            `json:"lockToken"`
	Addresses        []string          `json:"addresses,omitempty"`
}

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

type ManagedRuleSet struct {
	PublishedVersions map[string]ManagedRuleSetVersion `json:"publishedVersions,omitempty"`
	ID                string                           `json:"id"`
	Name              string                           `json:"name"`
	Scope             string                           `json:"scope"`
	ARN               string                           `json:"arn,omitempty"`
	LockToken         string                           `json:"lockToken"`
	// Region is the request region this managed rule set was created/looked
	// up under (see getRegion). Unlike WebACL/IPSet/RegexPatternSet/RuleGroup,
	// ManagedRuleSet storage keys off the RAW request region rather than the
	// scope-normalized region baked into ARN, so it cannot be reliably
	// recovered from ARN alone -- this field is the store.Table[ManagedRuleSet]
	// key material that replaces the old map[region]map[id] nesting. Tagged
	// json:"-" because it is not part of the AWS-facing shape; it is
	// round-tripped through persistence.go's managedRuleSetSnapshot DTO
	// instead (see that file's doc comment).
	Region             string `json:"-"`
	RecommendedVersion string `json:"recommendedVersion,omitempty"`
}

type ManagedRuleSetVersion struct {
	ExpiryTimestamp        *int64 `json:"ExpiryTimestamp,omitempty"`
	ForecastedLifetime     *int64 `json:"ForecastedLifetime,omitempty"`
	LastUpdateTimestamp    *int64 `json:"LastUpdateTimestamp,omitempty"`
	PublishTimestamp       *int64 `json:"PublishTimestamp,omitempty"`
	AssociatedRuleGroupArn string `json:"AssociatedRuleGroupArn,omitempty"`
	Capacity               int64  `json:"Capacity,omitempty"`
}

type Provider struct{}

type RegexEntry struct {
	RegexString string `json:"RegexString"`
}

type RegexPatternSet struct {
	Tags                  map[string]string `json:"tags,omitempty"`
	ARN                   string            `json:"arn,omitempty"`
	ID                    string            `json:"id"`
	Name                  string            `json:"name"`
	Scope                 string            `json:"scope"`
	Description           string            `json:"description"`
	LockToken             string            `json:"lockToken"`
	RegularExpressionList []RegexEntry      `json:"regularExpressionList,omitempty"`
}

type RuleGroup struct {
	Tags             map[string]string `json:"tags,omitempty"`
	ARN              string            `json:"arn,omitempty"`
	ID               string            `json:"id"`
	Name             string            `json:"name"`
	Scope            string            `json:"scope"`
	Description      string            `json:"description"`
	VisibilityConfig string            `json:"visibilityConfig"`
	LockToken        string            `json:"lockToken"`
	Rules            []map[string]any  `json:"rules,omitempty"`
	Capacity         int64             `json:"capacity"`
}

type StorageBackend interface {
	AccountID() string
	Region() string
	WebACLARN(name, id, scope string) string
	IPSetARN(name, id, scope string) string
	RegexPatternSetARN(name, id, scope string) string
	RuleGroupARN(name, id, scope string) string
	CreateWebACL(
		ctx context.Context,
		name, scope, description string,
		defaultAction, visibilityConfig json.RawMessage,
		rules []map[string]any,
		tokenDomains []string,
		customResponseBodies, associationConfig, captchaConfig, challengeConfig json.RawMessage,
		tags map[string]string,
	) (*WebACL, error)
	GetWebACL(ctx context.Context, id string) (*WebACL, error)
	UpdateWebACL(
		ctx context.Context,
		id, description, lockToken string,
		defaultAction, visibilityConfig json.RawMessage,
		rules []map[string]any,
		tokenDomains []string,
		customResponseBodies, associationConfig, captchaConfig, challengeConfig json.RawMessage,
	) (*WebACL, error)
	DeleteWebACL(ctx context.Context, id, lockToken string) error
	ListWebACLs(ctx context.Context) []*WebACL
	CreateIPSet(
		ctx context.Context,
		name, scope, description, ipAddressVersion string,
		addresses []string,
		tags map[string]string,
	) (*IPSet, error)
	GetIPSet(ctx context.Context, id string) (*IPSet, error)
	UpdateIPSet(ctx context.Context, id, description, lockToken string, addresses []string) (*IPSet, error)
	DeleteIPSet(ctx context.Context, id, lockToken string) error
	ListIPSets(ctx context.Context) []*IPSet
	TagResource(ctx context.Context, resourceARN string, tags map[string]string) error
	ListTagsForResource(ctx context.Context, resourceARN string) (map[string]string, error)
	UntagResource(ctx context.Context, resourceARN string, tagKeys []string) error
	Reset()
	AssociateWebACL(ctx context.Context, webACLARN, resourceARN string) error
	DisassociateWebACL(ctx context.Context, resourceARN string) error
	GetWebACLForResource(ctx context.Context, resourceARN string) (*WebACL, error)
	CheckCapacity(ctx context.Context, scope string, rules []map[string]any) (int64, error)
	CreateAPIKey(ctx context.Context, scope string, tokenDomains []string) (*APIKey, error)
	CreateRegexPatternSet(
		ctx context.Context,
		name, scope, description string,
		regularExpressionList []RegexEntry,
		tags map[string]string,
	) (*RegexPatternSet, error)
	GetRegexPatternSet(ctx context.Context, id string) (*RegexPatternSet, error)
	ListRegexPatternSets(ctx context.Context) []*RegexPatternSet
	UpdateRegexPatternSet(
		ctx context.Context,
		id, description, lockToken string,
		regularExpressionList []RegexEntry,
	) (*RegexPatternSet, error)
	CreateRuleGroup(
		ctx context.Context,
		name, scope, description, visibilityConfig string,
		capacity int64,
		rules []map[string]any,
		tags map[string]string,
	) (*RuleGroup, error)
	GetRuleGroup(ctx context.Context, id string) (*RuleGroup, error)
	ListRuleGroups(ctx context.Context) []*RuleGroup
	UpdateRuleGroup(
		ctx context.Context,
		id, description, visibilityConfig, lockToken string,
		rules []map[string]any,
	) (*RuleGroup, error)
	DeleteRuleGroup(ctx context.Context, id, lockToken string) error
	DeleteAPIKey(ctx context.Context, scope, apiKey string) error
	DeleteFirewallManagerRuleGroups(ctx context.Context, webACLARN string) (*WebACL, error)
	PutLoggingConfiguration(ctx context.Context, resourceARN string, configJSON json.RawMessage) error
	DeleteLoggingConfiguration(ctx context.Context, resourceARN string) error
	GetLoggingConfiguration(ctx context.Context, resourceARN string) (json.RawMessage, error)
	ListLoggingConfigurations(ctx context.Context) []json.RawMessage
	DeletePermissionPolicy(ctx context.Context, resourceARN string) error
	DeleteRegexPatternSet(ctx context.Context, id, lockToken string) error
	ListAPIKeys(ctx context.Context, scope string) []*APIKey
	GetDecryptedAPIKey(ctx context.Context, scope, apiKey string) (*APIKey, error)
	GetPermissionPolicy(ctx context.Context, resourceARN string) (string, error)
	ListResourcesForWebACL(ctx context.Context, webACLARN string) ([]string, error)
	PutPermissionPolicy(ctx context.Context, resourceARN, policy string) error
	ManagedRuleSetARN(name, id, scope string) string
	GetManagedRuleSet(ctx context.Context, id string) (*ManagedRuleSet, error)
	ListManagedRuleSets(ctx context.Context, scope string) []*ManagedRuleSet
	PutManagedRuleSetVersions(
		ctx context.Context,
		id, name, scope, lockToken, recommendedVersion string,
		versionsToPublish map[string]any,
	) (*ManagedRuleSet, error)
	UpdateManagedRuleSetVersionExpiryDate(
		ctx context.Context,
		id, lockToken, versionToExpire string,
		expiryTimestamp *int64,
	) (*ManagedRuleSet, error)
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

type TaggedEntry struct {
	Tags map[string]string
	ARN  string
}

type VisibilityConfig struct {
	MetricName               string `json:"MetricName"`
	SampledRequestsEnabled   bool   `json:"SampledRequestsEnabled"`
	CloudWatchMetricsEnabled bool   `json:"CloudWatchMetricsEnabled"`
}

type WebACL struct {
	Tags                 map[string]string `json:"tags,omitempty"`
	ARN                  string            `json:"arn,omitempty"`
	DefaultAction        json.RawMessage   `json:"defaultAction,omitempty"`
	VisibilityConfig     json.RawMessage   `json:"visibilityConfig,omitempty"`
	CustomResponseBodies json.RawMessage   `json:"customResponseBodies,omitempty"`
	AssociationConfig    json.RawMessage   `json:"associationConfig,omitempty"`
	CaptchaConfig        json.RawMessage   `json:"captchaConfig,omitempty"`
	ChallengeConfig      json.RawMessage   `json:"challengeConfig,omitempty"`
	ID                   string            `json:"id"`
	Name                 string            `json:"name"`
	Scope                string            `json:"scope"`
	Description          string            `json:"description"`
	LockToken            string            `json:"lockToken"`
	TokenDomains         []string          `json:"tokenDomains,omitempty"`
	Rules                []map[string]any  `json:"rules,omitempty"`
}