sealed

type Advisories struct {
	Advisories []Advisory `yaml:"advisories"`
}

type Advisory struct {
	// ID is the identifier a scanner reports: a CVE where there is one.
	ID string `yaml:"id"`
	// GoID is the Go vulnerability database's own identifier, for an advisory govulncheck reads.
	GoID string `yaml:"goID,omitempty"`
	// Ecosystem is the package ecosystem: pip, npm, go, rubygems, cargo, composer, nuget, maven,
	// or js for a library retire.js identifies by its file.
	Ecosystem string `yaml:"ecosystem"`
	// Package is the name the ecosystem gives the package.
	Package string `yaml:"package"`
	// Fixed is the first version without the vulnerability; every earlier version is affected.
	Fixed string `yaml:"fixed"`
	// Severity is CRITICAL, HIGH, MEDIUM or LOW.
	Severity string `yaml:"severity"`
	// Title is a one-line summary, written for the fixture.
	Title string `yaml:"title"`
	// Symbols maps a Go package path to the functions the vulnerability is in, which is what
	// govulncheck follows to decide whether it is reachable.
	Symbols map[string][]string `yaml:"symbols,omitempty"`
	// CWE is the weakness, which retire.js requires on every entry.
	CWE string `yaml:"cwe,omitempty"`
}

type Annotation struct {
	// File is relative to the repository, with any fixture suffix removed.
	File string
	// Line is the line the annotation is about: the first line after it that is neither blank nor
	// another annotation.
	Line int
	Rule string
	// Want is true for `ruleid:` and false for `ok:`.
	Want bool
}

type ComponentExpectation struct {
	Name string `yaml:"name"`
	// Repositories are the repository urls, relative to the descriptor.
	Repositories []string `yaml:"repositories"`
}

type Container struct {
	// Work is the one writable directory, mounted at the same path inside. The run's HOME is
	// Work/home, so every cache and dataset Draugr reads is the one the test put there.
	Work string
	// HostHome is the invoking user's home directory, mounted read-only for the tools installed
	// under it.
	HostHome string
	// Path is the PATH inside the container.
	Path string
	// Extra are further read-only mounts, such as a GOROOT outside the directories already mounted.
	Extra []string
	// Env is added to the environment inside the container.
	Env map[string]string
	// UID and GID are who the container runs as, so what it writes belongs to the invoking user.
	UID, GID int
}

type ErrorExpectation struct {
	Control string `yaml:"control"`
	// Contains is text the control's error must include.
	Contains string `yaml:"contains"`
}

type Expected struct {
	// Init is what `draugr init` writes for the repository.
	Init InitExpectation `yaml:"init"`
	// Secrets are credentials the harness writes into the repository before it is committed.
	// Each must be reported by the secrets control.
	Secrets []SecretExpectation `yaml:"secrets"`
	// Findings are every other result the scan must report, and together with the secrets and the
	// fixture's inline sast annotations, every result it may report.
	Findings []FindingExpectation `yaml:"findings"`
	// Sealed changes what the container provides, for a scenario about a failure.
	Sealed RunOptions `yaml:"sealed"`
	// Errors are the controls that must fail to run, each with text its error must contain. Every
	// other control must run.
	Errors []ErrorExpectation `yaml:"errors"`
}

type Finding struct {
	Control      string
	Tool         string
	Rule         string
	File         string
	Line         int
	Package      string
	Reachability string
}

type FindingExpectation struct {
	Control string `yaml:"control"`
	// Tool is the scanner that reported it, as the SARIF names it.
	Tool string `yaml:"tool"`
	Rule string `yaml:"rule"`
	// Location is file:line relative to the repository, or the file alone for a result about a
	// whole file.
	Location string `yaml:"location"`
	// Package is "ecosystem name version", for a finding about a dependency.
	Package string `yaml:"package,omitempty"`
	// Reachability is the verdict reachability analysis reached, where it ran.
	Reachability string `yaml:"reachability,omitempty"`
}

type InitExpectation struct {
	// Controls are the controls it enables, in any order.
	Controls []string `yaml:"controls"`
	// Components are the components it declares.
	Components []ComponentExpectation `yaml:"components"`
}

type Normalizer struct {
	// Clear are paths to fields replaced with Cleared. "*" matches every element of an array or
	// every value of an object. Each path must match at least one field.
	Clear [][]string
	// Sort are paths to arrays sorted by their elements' JSON.
	Sort [][]string
	// Replace maps a string to what it becomes, in every string value.
	Replace map[string]string
	// AllowMissing accepts a Clear path that matches nothing. For a run where a control failed to
	// start, which leaves no scanner version and no finding for that control to clear.
	AllowMissing bool
}

type RunOptions struct {
	// WithoutTool is a program removed from PATH inside the container.
	WithoutTool string `yaml:"withoutTool"`
	// FailingTool is a program replaced by one that writes FailingToolMessage and exits 2.
	FailingTool string `yaml:"failingTool"`
	// WithoutTrivyDB leaves Trivy's vulnerability database unwritten.
	WithoutTrivyDB bool `yaml:"withoutTrivyDB"`
	// GoVulnDBAge is how long before the run the local Go vulnerability database is recorded as
	// fetched, as a Go duration. Empty means at the start of the run.
	GoVulnDBAge string `yaml:"goVulnDBAge"`
}

type Scenario struct {
	// Name is the directory name, which is also the component and the repository's directory.
	Name string
	// Dir is the scenario directory.
	Dir string
	// Expected is the parsed expected.yaml.
	Expected Expected
}

type SecretExpectation struct {
	// File is where the harness writes it, relative to the repository. It is written on line 1.
	File string `yaml:"file"`
	// Rules are the rules that must report it.
	Rules []string `yaml:"rules"`
}