appsec

type AppsecCollection struct {
	Rules       []string
	NativeRules []string
}

type AppsecCollectionConfig struct {
	Type              string                   `yaml:"type"`
	Name              string                   `yaml:"name"`
	Debug             bool                     `yaml:"debug"`
	Description       string                   `yaml:"description"`
	SecLangFilesRules []string                 `yaml:"seclang_files_rules"`
	SecLangRules      []string                 `yaml:"seclang_rules"`
	Rules             []appsec_rule.CustomRule `yaml:"rules"`
	Severity          string                   `yaml:"severity"`

	Labels map[string]any `yaml:"labels"` // Labels is K:V list aiming at providing context the overflow

	Data []*enrichment.DataProvider `yaml:"data"`
	// contains filtered or unexported fields
}

type AppsecConfig struct {
	Name                   string   `yaml:"name"`
	OutOfBandRules         []string `yaml:"outofband_rules"`
	InBandRules            []string `yaml:"inband_rules"`
	DefaultRemediation     string   `yaml:"default_remediation"`
	DefaultPassAction      string   `yaml:"default_pass_action"`
	BouncerBlockedHTTPCode int      `yaml:"blocked_http_code"`      // returned to the bouncer
	BouncerPassedHTTPCode  int      `yaml:"passed_http_code"`       // returned to the bouncer
	UserBlockedHTTPCode    int      `yaml:"user_blocked_http_code"` // returned to the user
	UserPassedHTTPCode     int      `yaml:"user_passed_http_code"`  // returned to the user

	OnLoad            []Hook              `yaml:"on_load"`
	PreEval           []Hook              `yaml:"pre_eval"`
	PostEval          []Hook              `yaml:"post_eval"`
	OnMatch           []Hook              `yaml:"on_match"`
	OnChallenge       []Hook              `yaml:"on_challenge"`
	OnChallengeSubmit []Hook              `yaml:"on_challenge_submit"`
	VariablesTracking []string            `yaml:"variables_tracking"`
	InbandOptions     AppsecSubEngineOpts `yaml:"inband_options"`
	OutOfBandOptions  AppsecSubEngineOpts `yaml:"outofband_options"`

	InBand    *AppsecPhaseConfig `yaml:"inband"`
	OutOfBand *AppsecPhaseConfig `yaml:"outofband"`

	// Data declares datafiles (e.g. bot lists queried by MatchKnownBot) that
	// cwhub downloads and Build() loads into the expr datafile registry — the
	// same `data:` mechanism parsers/scenarios/appsec-rules use.
	Data []*enrichment.DataProvider `yaml:"data"`

	// Challenge carries the WAF challenge / bot-detection runtime tuning.
	// All fields are optional; unset fields fall back to the runtime
	// defaults at NewChallengeRuntime time. When multiple appsec-configs
	// are loaded, each later config's non-nil fields override the earlier
	// values (see LoadByPath).
	Challenge *challenge.Config `yaml:"challenge"`

	LogLevel *log.Level `yaml:"log_level"`
	Logger   *log.Entry `yaml:"-"`
}

type AppsecDropInfo struct {
	Reason       string
	Interruption *corazatypes.Interruption
}

type AppsecPhaseConfig struct {
	Rules             []string            `yaml:"rules"`
	OnMatch           []Hook              `yaml:"on_match"`
	PreEval           []Hook              `yaml:"pre_eval"`
	PostEval          []Hook              `yaml:"post_eval"`
	OnChallenge       []Hook              `yaml:"on_challenge"`
	OnChallengeSubmit []Hook              `yaml:"on_challenge_submit"`
	Options           AppsecSubEngineOpts `yaml:"options"`
	VariablesTracking []string            `yaml:"variables_tracking"`
}

type AppsecRequestState struct {
	Tx           ExtendedTransaction
	CurrentPhase phase
	Response     AppsecTempResponse

	InBandDrop    *AppsecDropInfo
	OutOfBandDrop *AppsecDropInfo

	PendingAction   *string
	PendingHTTPCode *int

	RequireChallenge    bool
	Fingerprint         *challenge.FingerprintData
	CookiePowDifficulty int  // PoW difficulty proven by the client for the current cookie (0 if no/invalid cookie)
	ChallengeDifficulty *int // per-request PoW difficulty override (nil = use runtime default)

	// SubmissionRejection is set by RejectSubmission inside an
	// on_challenge_submit hook to refuse cookie issuance for the current
	// challenge submission. nil for any other phase / outcome.
	SubmissionRejection *SubmissionRejectInfo

	// ChallengeBypassed is set by GrantChallengeCookie to suppress later
	// SendChallenge calls in the same request. Per-request only; cleared
	// on ResetResponse. The bypass for subsequent requests is carried by
	// the allowlist cookie itself, not by this flag.
	ChallengeBypassed bool

	// ChallengeExempt is set by the ExemptFromChallenge expr helper to exempt
	// the current request from the bot challenge: SendChallenge becomes a no-op
	// once it is set. It only affects the current request and doesn't mint a
	// cookie (unlike GrantChallengeCookie). Deliberately not cleared by
	// ResetResponse so a pre_eval exemption survives into post_eval.
	ChallengeExempt bool

	// HooksHalted is flipped by terminal hook actions (currently
	// RejectSubmission and the inline GrantChallengeCookie variant
	// exposed in on_challenge_submit) to short-circuit later rules in
	// the same phase. Without this, a `LogAccepted` rule following a
	// `RejectSubmission` rule with `filter: "true"` would emit a
	// contradictory accept-log line for an already-rejected submission.
	// Per-request only; cleared by ResetResponse.
	HooksHalted bool

	// LastMismatchReport caches the result of the EvaluateMismatches expr
	// closure for the current request, so repeated calls from a single
	// rule expression don't redo the work (or re-emit observability).
	// nil until the first call.
	LastMismatchReport *challenge.MismatchReport

	// HookVars is a per-request scratch space exposed to expr hooks as
	// `hook_vars`. Helpers (e.g. ValidateRequestWithSchema) publish string
	// values here so that later hook expressions — including the `apply`
	// block of the same hook — can read them. The map is allocated once in
	// NewRequestState, persists across in-band/out-of-band phases, and is
	// copied into pipeline.AppsecEvent.HookVars when an event is emitted.
	HookVars              map[string]string
	DisableBodyInspection bool
}

type AppsecRuntimeConfig struct {
	Name           string
	OutOfBandRules []AppsecCollection

	InBandRules []AppsecCollection

	DefaultRemediation string
	RemediationByTag   map[string]string // Also used for ByName, as the name (for modsec rules) is a tag crowdsec-NAME
	RemediationById    map[int]string

	CompiledOnLoad            []Hook     // runs once at startup, not phase-scoped
	CompiledOnChallenge       []Hook     // in-band only; runs before pre_eval
	CompiledOnChallengeSubmit []Hook     // in-band only; runs at /submit POST after validation
	CommonHooks               PhaseHooks // apply to both phases
	InBandHooks               PhaseHooks // only run during in-band
	OutOfBandHooks            PhaseHooks // only run during out-of-band

	CompiledVariablesTracking []*regexp.Regexp
	Config                    *AppsecConfig

	Logger *log.Entry

	// Set by on_load to ignore some rules on loading
	DisabledInBandRuleIds   []int
	DisabledInBandRulesTags []string // Also used for ByName, as the name (for modsec rules) is a tag crowdsec-NAME

	DisabledOutOfBandRuleIds   []int
	DisabledOutOfBandRulesTags []string // Also used for ByName, as the name (for modsec rules) is a tag crowdsec-NAME

	// True if at least one of the hooks use `RequireValidChallenge`
	NeedWASMVM       bool
	ChallengeRuntime *challenge.ChallengeRuntime

	// OutChan is the pipeline output channel challenge lifecycle events are sent
	// on, and Labels are the datasource labels stamped on those events. Both are
	// wired by the appsec datasource at startup; nil OutChan disables emission
	// (e.g. in unit tests with no datasource).
	OutChan chan pipeline.Event
	Labels  map[string]string

	// FingerprintDumpDir is the on-disk directory the DumpFingerprint
	FingerprintDumpDir string

	RequestValidator *apivalidation.RequestValidator
	DataDir          string
	// BodySettings controls how oversized request bodies are handled. Settable via on_load hooks.
	BodySettings BodySettings
}

type AppsecSubEngineOpts struct {
	DisableBodyInspection    bool `yaml:"disable_body_inspection"`
	RequestBodyInMemoryLimit *int `yaml:"request_body_in_memory_limit"`
}

type AppsecTempResponse struct {
	InBandInterrupt         bool
	OutOfBandInterrupt      bool
	Action                  string                // allow, deny, captcha, challenge, log
	UserHTTPResponseCode    int                   // The response code to send to the user
	UserHTTPBodyContent     string                // The body content to send to the user, only for challenge response
	UserHTTPCookies         []cookie.AppsecCookie // Raw Set-Cookie headers to send to the user.
	UserHeaders             map[string][]string   // Headers to send to the user
	BouncerHTTPResponseCode int                   // The response code to send to the remediation component
	SendEvent               bool                  // do we send an internal event on rule match
	SendAlert               bool                  // do we send an alert on rule match
}

type BodyResponse struct {
	Action          string              `json:"action"`
	HTTPStatus      int                 `json:"http_status"`
	UserBodyContent string              `json:"user_body_content,omitempty"`
	UserCookies     []string            `json:"user_cookies,omitempty"`
	UserHeaders     map[string][]string `json:"user_headers,omitempty"`
}

type BodySettings struct {
	// MaxSize is the maximum allowed body size in bytes. Defaults to DefaultMaxBodySize (10MB).
	MaxSize int64 `yaml:"max_body_size"`
	// Action controls what happens when a body exceeds MaxSize:
	// "drop" (default) - block the request, "partial" - inspect up to MaxSize bytes, "allow" - skip body inspection.
	Action string `yaml:"body_size_exceeded_action"`
}

type ChallengeEventInfo struct {
	Reason      ChallengeReason            // requested | submitted | failed | rejected | solved
	FailReason  string                     // set on failed (raw error message) or rejected (operator-supplied reason)
	FailErr     error                      // set on failed; carries the sentinel-wrapped error so metrics can classify via errors.Is.
	Difficulty  int                        // target PoW difficulty for this moment
	Fingerprint *challenge.FingerprintData // nil when none available (e.g. requested w/o cookie)
}

type ChallengeReason string

type ExtendedTransaction struct {
	Tx experimental.FullTransaction
}

type Hook struct {
	Filter     string      `yaml:"filter"`
	FilterExpr *vm.Program `yaml:"-"`

	OnSuccess string        `yaml:"on_success"`
	Apply     []string      `yaml:"apply"`
	ApplyExpr []*vm.Program `yaml:"-"`
}

type ParsedRequest struct {
	RemoteAddr           string                  `json:"remote_addr,omitempty"`
	Host                 string                  `json:"host,omitempty"`
	ClientIP             string                  `json:"client_ip,omitempty"`
	URI                  string                  `json:"uri,omitempty"`
	Args                 url.Values              `json:"args,omitempty"`
	ClientHost           string                  `json:"client_host,omitempty"`
	Headers              http.Header             `json:"headers,omitempty"`
	URL                  *url.URL                `json:"url,omitempty"`
	Method               string                  `json:"method,omitempty"`
	Proto                string                  `json:"proto,omitempty"`
	Body                 []byte                  `json:"body,omitempty"`
	TransferEncoding     []string                `json:"transfer_encoding,omitempty"`
	UUID                 string                  `json:"uuid,omitempty"`
	ResponseChannel      chan AppsecTempResponse `json:"-"`
	IsInBand             bool                    `json:"-"`
	IsOutBand            bool                    `json:"-"`
	AppsecEngine         string                  `json:"appsec_engine,omitempty"`
	RemoteAddrNormalized string                  `json:"normalized_remote_addr,omitempty"`
	HTTPRequest          *http.Request           `json:"-"`
	// BodyTruncated is true when the body was larger than the configured limit and was truncated (partial mode).
	BodyTruncated bool `json:"body_truncated,omitempty"`
	// BodySizeExceeded is true when the body exceeded the configured limit and the action is drop.
	// The body is not populated in this case; a fake interruption will be triggered in the runner.
	BodySizeExceeded bool `json:"body_size_exceeded,omitempty"`
}

type PhaseHooks struct {
	PreEval  []Hook
	PostEval []Hook
	OnMatch  []Hook
}

type ReqDumpFilter struct {
	HeadersContentFilters []string
	HeadersNameFilters    []string
	HeadersDrop           bool

	BodyDrop bool

	ArgsContentFilters []string
	ArgsNameFilters    []string
	ArgsDrop           bool
	// contains filtered or unexported fields
}

type RulesDetails struct {
	LogLevel log.Level
	Hash     string
	Version  string
	Name     string
}

type SubmissionRejectInfo struct {
	Reason string
}