policy

type Engine struct {
	// contains filtered or unexported fields
}

type ExpiringToleration struct {
	CVEID     string
	Statement string
	ExpiresAt time.Time
	DaysUntil int
}

type PolicyConfig struct {
	// Expression is the CEL expression that must evaluate to true for the policy to pass
	// Available variables:
	//   - vulnerabilities: list of enriched vulnerabilities with fields:
	//       id, severity, packageName, version, fixedVersion, description, tolerated, tolerationStatement, tolerationExpiry
	//   - imageRef: string reference to the image
	//   - criticalCount: number of critical vulnerabilities (not tolerated)
	//   - highCount: number of high vulnerabilities (not tolerated)
	//   - mediumCount: number of medium vulnerabilities (not tolerated)
	//   - toleratedCount: number of tolerated vulnerabilities
	Expression string `yaml:"expression" json:"expression"`

	// FailureMessage is the message to return when the policy fails (optional)
	FailureMessage string `yaml:"failureMessage" json:"failureMessage"`
}

type PolicyDecision struct {
	Passed              bool
	Reason              string
	ShouldSign          bool
	ShouldAttest        bool
	CriticalVulnCount   int
	ToleratedVulnCount  int
	UnfixedVulnCount    int
	ToleratedCVEs       []string
	ExpiringTolerations []ExpiringToleration
}

type PolicyEngine interface {
	// Evaluate determines if an image passes security policy
	// Applies CVE tolerations from regsync config for the target repository
	Evaluate(ctx context.Context, imageRef string, result *scanner.ScanResult, tolerations []types.CVEToleration) (*PolicyDecision, error)
}