security

type Decision struct {
	Decision string `json:"decision"`
	Reason   string `json:"reason"`
	RuleID   string `json:"rule_id,omitempty"`
	// Mode records whether the matched rule enforces ("enforce") or only
	// observes ("detect"). Intended is the action the rule WOULD take when it
	// runs in enforce mode, preserved even when a detect-mode match downgrades
	// the effective Decision to "audit" -- the compliance view needs it to show
	// "detected, would have killed" vs "detected and killed".
	Mode     string `json:"mode,omitempty"`
	Intended string `json:"intended_decision,omitempty"`
}

type DecisionRecord struct {
	ID        string `json:"id"`
	EventID   string `json:"event_id"`
	RunID     string `json:"run_id"`
	SessionID string `json:"session_id"`
	RuleID    string `json:"rule_id"`
	Decision  string `json:"decision"`
	Reason    string `json:"reason"`
	CreatedAt string `json:"created_at"`
}

type Engine struct {
	SecretPathPatterns []string
	Rules              []Rule
}

type Event struct {
	Source     string   `json:"source"`
	EventType  string   `json:"event_type"`
	RunID      string   `json:"run_id"`
	SessionID  string   `json:"session_id"`
	ToolCallID string   `json:"tool_call_id"`
	ProcessID  string   `json:"process_id"`
	SnapshotID string   `json:"snapshot_id"`
	DstIP      string   `json:"dst_ip"`
	Path       string   `json:"path"`
	Args       []string `json:"args"`
}

type QueryRefs struct {
	Drilldowns []string `json:"drilldowns"`
}

type ResponseActionRecord struct {
	ID               string `json:"id"`
	RunID            string `json:"run_id"`
	SessionID        string `json:"session_id"`
	ProcessID        string `json:"process_id"`
	SnapshotID       string `json:"snapshot_id"`
	RiskSignalID     string `json:"risk_signal_id"`
	PolicyDecisionID string `json:"policy_decision_id"`
	ActionType       string `json:"action_type"`
	TargetType       string `json:"target_type"`
	TargetID         string `json:"target_id"`
	Status           string `json:"status"`
	ResultRef        string `json:"result_ref"`
	Payload          string `json:"payload"`
	CreatedAt        string `json:"created_at"`
}

type ResponseActionView struct {
	Response ResponseActionRecord `json:"response"`
	Query    QueryRefs            `json:"query"`
}

type ResponseActionsReport struct {
	SchemaVersion string               `json:"schema_version"`
	RunID         string               `json:"run_id,omitempty"`
	ResultSetID   string               `json:"result_set_id"`
	PageHash      string               `json:"page_hash"`
	Count         int                  `json:"count"`
	Responses     []ResponseActionView `json:"responses"`
}

type RiskSignalRecord struct {
	ID                string `json:"id"`
	RunID             string `json:"run_id"`
	SessionID         string `json:"session_id"`
	ToolCallID        string `json:"tool_call_id"`
	ProcessID         string `json:"process_id"`
	SnapshotID        string `json:"snapshot_id"`
	EventID           string `json:"event_id"`
	PolicyDecisionID  string `json:"policy_decision_id"`
	SignalType        string `json:"signal_type"`
	Severity          string `json:"severity"`
	Reason            string `json:"reason"`
	RecommendedAction string `json:"recommended_action"`
	Payload           string `json:"payload"`
	CreatedAt         string `json:"created_at"`
}

type RiskSignalView struct {
	Risk  RiskSignalRecord `json:"risk"`
	Query QueryRefs        `json:"query"`
}

type RiskSignalsReport struct {
	SchemaVersion string           `json:"schema_version"`
	RunID         string           `json:"run_id,omitempty"`
	ResultSetID   string           `json:"result_set_id"`
	PageHash      string           `json:"page_hash"`
	Count         int              `json:"count"`
	Risks         []RiskSignalView `json:"risks"`
}

type Rule struct {
	ID       string    `yaml:"id" json:"id"`
	Match    RuleMatch `yaml:"match" json:"match"`
	Decision string    `yaml:"decision" json:"decision"`
	Reason   string    `yaml:"reason" json:"reason"`
	// Mode is "enforce" (default when empty) or "detect". A detect rule records
	// the would-be decision as an audit signal but takes no kill/quarantine
	// action -- the run is observed, not blocked. This is what makes the
	// compliance view's "detected, not enforced" state real rather than cosmetic.
	Mode string `yaml:"mode,omitempty" json:"mode,omitempty"`
	// Controls are the compliance control IDs (e.g. ASI03, Q1) this rule maps
	// to. The detection engine treats them as opaque tags; the compliance layer
	// reads them to answer "which control is covered by which rule, and did it
	// fire". Custom YAML rules set this to map themselves onto a framework.
	Controls []string `yaml:"controls,omitempty" json:"controls,omitempty"`
}

type RuleFile struct {
	Rules []Rule `yaml:"rules"`
}

type RuleMatch struct {
	Source       string   `yaml:"source"`
	EventType    string   `yaml:"event_type"`
	DstIP        string   `yaml:"dst_ip"`
	PrivateCIDR  bool     `yaml:"private_cidr"`
	PathContains []string `yaml:"path_contains"`
	ArgsContains []string `yaml:"args_contains"`
}