secrets

type Config struct {
	// Enabled controls whether scrubbing is active (default: true)
	Enabled bool `koanf:"enabled"`

	// Rules defines the detection rules
	Rules []Rule `koanf:"rules"`

	// RedactionString is the replacement for detected secrets (default: "[REDACTED]")
	RedactionString string `koanf:"redaction_string"`

	// AllowList contains patterns to skip during scrubbing
	AllowList []string `koanf:"allow_list"`
	// contains filtered or unexported fields
}

type Finding struct {
	// RuleID identifies which rule matched
	RuleID string `json:"rule_id"`

	// Description explains what was found
	Description string `json:"description"`

	// Severity indicates the importance
	Severity string `json:"severity"`

	// StartIndex is the start position in original content
	StartIndex int `json:"start_index"`

	// EndIndex is the end position in original content
	EndIndex int `json:"end_index"`

	// Line is the line number (1-indexed)
	Line int `json:"line,omitempty"`
}

type NoopScrubber struct{}

type Result struct {
	// Original is the original input content
	Original string `json:"-"`

	// Scrubbed is the content with secrets redacted
	Scrubbed string `json:"scrubbed"`

	// Findings contains the detected secrets (without actual values)
	Findings []Finding `json:"findings,omitempty"`

	// Duration is how long scrubbing took
	Duration time.Duration `json:"duration"`

	// TotalFindings is the count of secrets found
	TotalFindings int `json:"total_findings"`

	// ByRule maps rule IDs to finding counts
	ByRule map[string]int `json:"by_rule,omitempty"`
}

type Rule struct {
	// ID is the unique identifier for this rule
	ID string `koanf:"id"`

	// Description explains what this rule detects
	Description string `koanf:"description"`

	// Pattern is the regex pattern to match secrets
	Pattern string `koanf:"pattern"`

	// Keywords are optional keywords that must be present for the rule to apply
	Keywords []string `koanf:"keywords"`

	// Severity indicates the importance (high, medium, low)
	Severity string `koanf:"severity"`

	// Entropy is the minimum entropy threshold (0 to disable)
	Entropy float64 `koanf:"entropy"`
}

type Scrubber interface {
	// Scrub redacts secrets from the content.
	Scrub(content string) *Result

	// ScrubBytes redacts secrets from byte content.
	ScrubBytes(content []byte) *Result

	// Check detects secrets without redacting.
	Check(content string) *Result

	// IsEnabled returns whether scrubbing is enabled.
	IsEnabled() bool
}