security

type Decision struct {
	Decision string `json:"decision"`
	Reason   string `json:"reason"`
	RuleID   string `json:"rule_id,omitempty"`
}

type DecisionRecord struct {
	ID        string `json:"id"`
	EventID   string `json:"event_id"`
	RunID     string `json:"run_id"`
	SessionID string `json:"session_id"`
	RuleID    string `json:"rule_id"`
	Decision  string `json:"decision"`
	Reason    string `json:"reason"`
	CreatedAt string `json:"created_at"`
}

type Engine struct {
	SecretPathPatterns []string
	Rules              []Rule
}

type Event struct {
	Source     string   `json:"source"`
	EventType  string   `json:"event_type"`
	RunID      string   `json:"run_id"`
	SessionID  string   `json:"session_id"`
	ToolCallID string   `json:"tool_call_id"`
	ProcessID  string   `json:"process_id"`
	SnapshotID string   `json:"snapshot_id"`
	DstIP      string   `json:"dst_ip"`
	Path       string   `json:"path"`
	Args       []string `json:"args"`
}

type QueryRefs struct {
	Drilldowns []string `json:"drilldowns"`
}

type ResponseActionRecord struct {
	ID               string `json:"id"`
	RunID            string `json:"run_id"`
	SessionID        string `json:"session_id"`
	ProcessID        string `json:"process_id"`
	SnapshotID       string `json:"snapshot_id"`
	RiskSignalID     string `json:"risk_signal_id"`
	PolicyDecisionID string `json:"policy_decision_id"`
	ActionType       string `json:"action_type"`
	TargetType       string `json:"target_type"`
	TargetID         string `json:"target_id"`
	Status           string `json:"status"`
	ResultRef        string `json:"result_ref"`
	Payload          string `json:"payload"`
	CreatedAt        string `json:"created_at"`
}

type ResponseActionView struct {
	Response ResponseActionRecord `json:"response"`
	Query    QueryRefs            `json:"query"`
}

type ResponseActionsReport struct {
	SchemaVersion string               `json:"schema_version"`
	RunID         string               `json:"run_id,omitempty"`
	ResultSetID   string               `json:"result_set_id"`
	PageHash      string               `json:"page_hash"`
	Count         int                  `json:"count"`
	Responses     []ResponseActionView `json:"responses"`
}

type RiskSignalRecord struct {
	ID                string `json:"id"`
	RunID             string `json:"run_id"`
	SessionID         string `json:"session_id"`
	ToolCallID        string `json:"tool_call_id"`
	ProcessID         string `json:"process_id"`
	SnapshotID        string `json:"snapshot_id"`
	EventID           string `json:"event_id"`
	PolicyDecisionID  string `json:"policy_decision_id"`
	SignalType        string `json:"signal_type"`
	Severity          string `json:"severity"`
	Reason            string `json:"reason"`
	RecommendedAction string `json:"recommended_action"`
	Payload           string `json:"payload"`
	CreatedAt         string `json:"created_at"`
}

type RiskSignalView struct {
	Risk  RiskSignalRecord `json:"risk"`
	Query QueryRefs        `json:"query"`
}

type RiskSignalsReport struct {
	SchemaVersion string           `json:"schema_version"`
	RunID         string           `json:"run_id,omitempty"`
	ResultSetID   string           `json:"result_set_id"`
	PageHash      string           `json:"page_hash"`
	Count         int              `json:"count"`
	Risks         []RiskSignalView `json:"risks"`
}

type Rule struct {
	ID       string    `yaml:"id"`
	Match    RuleMatch `yaml:"match"`
	Decision string    `yaml:"decision"`
	Reason   string    `yaml:"reason"`
}

type RuleFile struct {
	Rules []Rule `yaml:"rules"`
}

type RuleMatch struct {
	Source       string   `yaml:"source"`
	EventType    string   `yaml:"event_type"`
	DstIP        string   `yaml:"dst_ip"`
	PrivateCIDR  bool     `yaml:"private_cidr"`
	PathContains []string `yaml:"path_contains"`
	ArgsContains []string `yaml:"args_contains"`
}