security

type Analyzer interface {
	// Name returns the analyzer's unique identifier
	Name() string

	// Description returns a human-readable description
	Description() string

	// Analyze inspects a container and returns any security issues found
	Analyze(ctx context.Context, data *ContainerData) ([]Issue, error)

	// IsEnabled returns whether this analyzer is currently enabled
	IsEnabled() bool

	// SetEnabled enables or disables the analyzer
	SetEnabled(enabled bool)
}

type BaseAnalyzer struct {
	// contains filtered or unexported fields
}

type Calculator struct {
	// contains filtered or unexported fields
}

type CategoryScore struct {
	Issues       int
	TotalPenalty int
	CappedAt     int  // If penalty was capped
	WasCapped    bool // Whether capping was applied
}

type ContainerData struct {
	// Basic identification
	ID    string
	Name  string
	Image string

	// Container configuration
	User        string            // User running in container
	Env         []string          // Environment variables
	Labels      map[string]string // Container labels
	Cmd         []string          // Command
	Entrypoint  []string          // Entrypoint
	WorkingDir  string            // Working directory
	Healthcheck *HealthcheckData  // Healthcheck configuration

	// Host configuration
	Privileged     bool     // Privileged mode
	ReadonlyRootfs bool     // Read-only filesystem
	NetworkMode    string   // Network mode (bridge, host, etc.)
	PidMode        string   // PID namespace mode
	IpcMode        string   // IPC namespace mode
	CapAdd         []string // Added capabilities
	CapDrop        []string // Dropped capabilities
	SecurityOpt    []string // Security options
	RestartPolicy  string   // Restart policy name

	// Resource limits
	MemoryLimit int64 // Memory limit in bytes
	MemorySwap  int64 // Memory+Swap limit
	CPUShares   int64 // CPU shares
	CPUQuota    int64 // CPU quota
	CPUPeriod   int64 // CPU period
	NanoCPUs    int64 // CPU limit in nano CPUs
	PidsLimit   int64 // PIDs limit

	// Networking
	Ports    []PortData    // Port mappings
	Networks []NetworkData // Network attachments

	// Storage
	Mounts []MountData // Volume mounts
	Binds  []string    // Bind mounts

	// State
	Running bool
	Health  string // healthy, unhealthy, starting, none
}

type ContainerReportData struct {
	ContainerID   string               `json:"container_id"`
	ContainerName string               `json:"container_name"`
	Image         string               `json:"image"`
	Score         int                  `json:"score"`
	Grade         models.SecurityGrade `json:"grade"`
	GradeColor    string               `json:"grade_color"`
	IssueCount    int                  `json:"issue_count"`
	CriticalCount int                  `json:"critical_count"`
	HighCount     int                  `json:"high_count"`
	MediumCount   int                  `json:"medium_count"`
	LowCount      int                  `json:"low_count"`
	Issues        []IssueReportData    `json:"issues,omitempty"`
	ScannedAt     time.Time            `json:"scanned_at"`
}

type DataPoint struct {
	Timestamp time.Time `json:"timestamp"`
	Value     float64   `json:"value"`
}

type DockerClient interface {
	ContainerInspect(ctx context.Context, containerID string) (interface{}, error)
	ContainerList(ctx context.Context, all bool) ([]interface{}, error)
}

type HealthcheckData struct {
	Test        []string // Health check command
	Interval    int64    // Interval in nanoseconds
	Timeout     int64    // Timeout in nanoseconds
	Retries     int      // Number of retries
	StartPeriod int64    // Start period in nanoseconds
}

type HighRiskPort struct {
	OpenPort
	ServiceName string `json:"service_name"`
	Risk        string `json:"risk"` // low, medium, high, critical
	Description string `json:"description"`
	Mitigation  string `json:"mitigation"`
}

type HostPortAnalysis struct {
	ScannedAt       time.Time      `json:"scanned_at"`
	Duration        time.Duration  `json:"duration"`
	TotalOpenPorts  int            `json:"total_open_ports"`
	TCPPorts        []OpenPort     `json:"tcp_ports"`
	UDPPorts        []OpenPort     `json:"udp_ports"`
	ExposedPorts    []OpenPort     `json:"exposed_ports"`    // Ports bound to 0.0.0.0 or ::
	PrivilegedPorts []OpenPort     `json:"privileged_ports"` // Ports < 1024
	HighRiskPorts   []HighRiskPort `json:"high_risk_ports"`  // Known risky services
	UnknownServices []OpenPort     `json:"unknown_services"` // Ports without known service
	Recommendations []string       `json:"recommendations,omitempty"`
	SecurityScore   int            `json:"security_score"` // 0-100
}

type HostPortScanner struct {
	// contains filtered or unexported fields
}

type Issue struct {
	CheckID        string // Unique check identifier (e.g., "USER_001")
	Severity       models.IssueSeverity
	Category       models.IssueCategory
	Title          string
	Description    string
	Recommendation string
	FixCommand     string                 // Command to fix the issue
	DocURL         string                 // Documentation URL
	Penalty        int                    // Score penalty
	Details        map[string]interface{} // Additional context
}

type IssueReportData struct {
	ID             string               `json:"id"`
	ContainerName  string               `json:"container_name"`
	Severity       models.IssueSeverity `json:"severity"`
	SeverityColor  string               `json:"severity_color"`
	Category       models.IssueCategory `json:"category"`
	Title          string               `json:"title"`
	Description    string               `json:"description"`
	Recommendation string               `json:"recommendation"`
	FixCommand     string               `json:"fix_command,omitempty"`
	DocURL         string               `json:"doc_url,omitempty"`
	CVEID          string               `json:"cve_id,omitempty"`
	CVSSScore      float64              `json:"cvss_score,omitempty"`
}

type IssueRepository interface {
	CreateBatch(ctx context.Context, issues []models.SecurityIssue) error
	GetByID(ctx context.Context, id int64) (*models.SecurityIssue, error)
	GetByScanID(ctx context.Context, scanID uuid.UUID) ([]*models.SecurityIssue, error)
	GetByContainerID(ctx context.Context, containerID string, status *models.IssueStatus) ([]*models.SecurityIssue, error)
	GetByHostID(ctx context.Context, hostID uuid.UUID, opts ListIssuesOptions) ([]*models.SecurityIssue, int, error)
	UpdateStatus(ctx context.Context, id int64, status models.IssueStatus, userID *uuid.UUID) error
	GetOpenIssueCount(ctx context.Context, containerID string) (int, error)
	DeleteByScanID(ctx context.Context, scanID uuid.UUID) error
}

type ListIssuesOptions struct {
	ContainerID *string
	ScanID      *uuid.UUID
	Severity    *models.IssueSeverity
	Category    *models.IssueCategory
	Status      *models.IssueStatus
	CheckID     *string
	Limit       int
	Offset      int
}

type ListScansOptions struct {
	HostID      *uuid.UUID
	ContainerID *string
	MinScore    *int
	MaxScore    *int
	Grade       *models.SecurityGrade
	Since       *time.Time
	Limit       int
	Offset      int
}

type MountData struct {
	Type        string // bind, volume, tmpfs
	Source      string
	Destination string
	Mode        string // rw, ro
	RW          bool
	Propagation string
}

type NetworkData struct {
	Name      string
	NetworkID string
	IPAddress string
	Gateway   string
}

type OpenPort struct {
	Port      uint16 `json:"port"`
	Protocol  string `json:"protocol"` // tcp, tcp6, udp, udp6
	LocalAddr string `json:"local_addr"`
	State     string `json:"state"`
	PID       int    `json:"pid,omitempty"`
	Process   string `json:"process,omitempty"`
	UID       int    `json:"uid,omitempty"`
	Inode     uint64 `json:"inode,omitempty"`
}

type PortData struct {
	ContainerPort uint16
	HostPort      uint16
	HostIP        string
	Protocol      string // tcp, udp
}

type ReportData struct {
	// Report metadata
	ID          uuid.UUID `json:"id"`
	GeneratedAt time.Time `json:"generated_at"`
	Title       string    `json:"title"`

	// Scope
	HostID   *uuid.UUID `json:"host_id,omitempty"`
	HostName string     `json:"host_name,omitempty"`

	// Summary statistics
	TotalContainers   int     `json:"total_containers"`
	ScannedContainers int     `json:"scanned_containers"`
	AverageScore      float64 `json:"average_score"`
	LowestScore       int     `json:"lowest_score"`
	HighestScore      int     `json:"highest_score"`

	// Grade distribution
	GradeDistribution map[models.SecurityGrade]int `json:"grade_distribution"`

	// Issue summary
	TotalIssues    int                          `json:"total_issues"`
	SeverityCounts map[models.IssueSeverity]int `json:"severity_counts"`

	// Container details
	Containers []ContainerReportData `json:"containers"`

	// Top issues across all containers
	TopIssues []IssueReportData `json:"top_issues"`

	// Trends (if available)
	Trends *TrendsData `json:"trends,omitempty"`
}

type ReportFormat string

type ReportGenerator struct {
	// contains filtered or unexported fields
}

type ReportOptions struct {
	Format          ReportFormat
	IncludeDetails  bool                 // Include full issue details
	IncludeTrends   bool                 // Include historical trends
	GroupByCategory bool                 // Group issues by category
	GroupBySeverity bool                 // Group issues by severity
	MinSeverity     models.IssueSeverity // Minimum severity to include
}

type ScanRepository interface {
	Create(ctx context.Context, scan *models.SecurityScan) error
	GetByID(ctx context.Context, id uuid.UUID) (*models.SecurityScan, error)
	GetByContainerID(ctx context.Context, containerID string, limit int) ([]*models.SecurityScan, error)
	GetByHostID(ctx context.Context, hostID uuid.UUID, limit int) ([]*models.SecurityScan, error)
	GetLatestByContainer(ctx context.Context, containerID string) (*models.SecurityScan, error)
	List(ctx context.Context, opts ListScansOptions) ([]*models.SecurityScan, int, error)
	Delete(ctx context.Context, id uuid.UUID) error
	DeleteOlderThan(ctx context.Context, before time.Time) (int64, error)
	GetScoreHistory(ctx context.Context, containerID string, days int) ([]models.TrendPoint, error)
	GetGlobalScoreHistory(ctx context.Context, days int) ([]models.TrendPoint, error)
	GetAverageScore(ctx context.Context, hostID *uuid.UUID) (float64, error)
}

type ScanResult struct {
	// Scan metadata
	ID            uuid.UUID `json:"id"`
	ContainerID   string    `json:"container_id"`
	ContainerName string    `json:"container_name"`
	Image         string    `json:"image"`
	HostID        uuid.UUID `json:"host_id"`

	// Score and grade
	Score int                  `json:"score"`
	Grade models.SecurityGrade `json:"grade"`

	// Issues found
	Issues        []Issue `json:"issues"`
	IssueCount    int     `json:"issue_count"`
	CriticalCount int     `json:"critical_count"`
	HighCount     int     `json:"high_count"`
	MediumCount   int     `json:"medium_count"`
	LowCount      int     `json:"low_count"`

	// CVE information (if scanned)
	CVECount   int  `json:"cve_count"`
	IncludeCVE bool `json:"include_cve"`

	// Timing
	ScanDuration time.Duration `json:"scan_duration"`
	ScannedAt    time.Time     `json:"scanned_at"`

	// Errors during scan (non-fatal)
	Warnings []string `json:"warnings,omitempty"`
}

type Scanner struct {
	// contains filtered or unexported fields
}

type ScannerConfig struct {
	// Analyzers to use (nil for all defaults)
	Analyzers []Analyzer

	// Scoring configuration
	ScoreConfig *ScoreConfig

	// Timeout for scanning a single container
	ScanTimeout time.Duration

	// Whether to include CVE scanning (requires Trivy)
	IncludeCVE bool

	// Maximum concurrent scans
	MaxConcurrent int
}

type ScoreConfig struct {
	// Base score starts at 100
	BaseScore int

	// Individual check penalties (can be overridden)
	Penalties map[string]int

	// Severity multipliers (applied after individual penalties)
	SeverityMultipliers map[models.IssueSeverity]float64

	// Maximum penalties per category to prevent single category domination
	MaxPenaltyPerCategory map[models.IssueCategory]int

	// Minimum score (floor)
	MinScore int

	// Maximum score (ceiling)
	MaxScore int
}

type ScoreResult struct {
	// Final score (0-100)
	Score int

	// Grade (A-F)
	Grade models.SecurityGrade

	// Breakdown by category
	CategoryBreakdown map[models.IssueCategory]CategoryScore

	// Total penalties applied
	TotalPenalty int

	// Number of issues by severity
	SeverityCounts map[models.IssueSeverity]int

	// Top issues (sorted by penalty)
	TopIssues []Issue
}

type SecuritySummary struct {
	GeneratedAt       time.Time                    `json:"generated_at"`
	TotalContainers   int                          `json:"total_containers"`
	TotalIssues       int                          `json:"total_issues"`
	AverageScore      float64                      `json:"average_score"`
	GradeDistribution map[models.SecurityGrade]int `json:"grade_distribution"`
	SeverityCounts    map[models.IssueSeverity]int `json:"severity_counts"`
}

type Service struct {
	// contains filtered or unexported fields
}

type ServiceConfig struct {
	// Scanner configuration
	ScannerConfig *ScannerConfig

	// Auto-scan interval (0 to disable)
	AutoScanInterval time.Duration

	// Retention period for scan history
	ScanRetentionDays int

	// Maximum scans to keep per container
	MaxScansPerContainer int
}

type TrendsData struct {
	Period        string      `json:"period"`
	AverageScores []DataPoint `json:"average_scores"`
	IssueCounts   []DataPoint `json:"issue_counts"`
	Improvement   float64     `json:"improvement_percent"`
}

type TrivyClient interface {
	ScanImage(ctx context.Context, image string) ([]Issue, error)
	IsAvailable() bool
}