config

type Allowlist struct {
	// Short human readable description of the allowlist.
	Description string

	// MatchCondition determines whether all criteria must match. Defaults to "OR".
	MatchCondition AllowlistMatchCondition

	// Commits is a slice of commit SHAs that are allowed to be ignored.
	Commits []string

	// Paths is a slice of path regular expressions that are allowed to be ignored.
	Paths []*regexp.Regexp

	// Can be `match` or `line`.
	//
	// If `match` the _Regexes_ will be tested against the match of the _Rule.Regex_.
	//
	// If `line` the _Regexes_ will be tested against the entire line.
	//
	// If RegexTarget is empty, it will be tested against the found secret.
	RegexTarget string

	// Regexes is slice of content regular expressions that are allowed to be ignored.
	Regexes []*regexp.Regexp

	// StopWords is a slice of stop words that are allowed to be ignored.
	// This targets the _secret_, not the content of the regex match like the
	// Regexes slice.
	StopWords []string
	// contains filtered or unexported fields
}

type AllowlistMatchCondition int

type Component struct {
	RuleID string
	// Optional components are attached when found but do not gate the primary finding.
	Optional bool
	// Within uses the same directional L/C grammar as --match-context.
	Within string
}

type Config struct {
	Title       string
	Extend      Extend
	Path        string
	Description string
	Rules       map[string]Rule
	Keywords    map[string]struct{}
	// KeywordToRules maps each lowercase keyword to the rule IDs that use it.
	// This allows O(1) lookup from Aho-Corasick keyword matches to the rules
	// that need to be checked, instead of iterating all rules.
	KeywordToRules map[string][]string
	// NoKeywordRules contains rule IDs that have no keywords and must always be checked.
	NoKeywordRules []string
	// used to keep sarif results consistent
	OrderedRules []string

	// Deprecated: use filter/prefilter Expr expressions instead. This is a shim for backwards-compatibility.
	Allowlists []*Allowlist

	MinVersion            string
	BetterleaksMinVersion string

	// Prefilter is a global expression (attributes only) evaluated before any
	// per-match work. Returns true = skip this fragment entirely; false = keep.
	// Translated from global Allowlists path/commit checks.
	Prefilter string
	// Filter is a global expression (attributes + finding) evaluated per match.
	// Returns true = skip (discard) this finding; false = keep.
	// Translated from global Allowlists regex/stopword checks.
	Filter string
	// contains filtered or unexported fields
}

type Extend struct {
	Path          string   `toml:"path"`
	URL           string   `toml:"url"`
	UseDefault    bool     `toml:"useDefault"`
	DisabledRules []string `toml:"disabledRules"`
}

type Rule struct {
	// RuleID is a unique identifier for this rule
	RuleID string

	// Description is the description of the rule.
	Description string

	// Entropy is a float representing the minimum shannon
	// entropy a regex group must have to be considered a secret.
	Entropy float64

	// SecretGroup is an int used to extract secret from regex
	// match and used as the group that will have its entropy
	// checked if `entropy` is set.
	SecretGroup int

	// Regex is a golang regular expression used to detect secrets.
	Regex *regexp.Regexp

	// Path is a golang regular expression used to
	// filter secrets by path
	Path *regexp.Regexp

	// Tags is an array of strings used for metadata
	// and reporting purposes.
	Tags []string

	// Specificity controls precedence when overlapping findings compete.
	// Higher specificity findings suppress lower specificity findings.
	Specificity int

	// Confidence estimates how likely a match is to be a real secret.
	Confidence string

	// Keywords are used for pre-regex check filtering. Rules that contain
	// keywords will perform a quick string compare check to make sure the
	// keyword(s) are in the content being scanned.
	Keywords []string

	// Allowlists allows a rule to be ignored for specific commits, paths, regexes, and/or stopwords.
	Allowlists []*Allowlist

	// Components are other rules whose matches contribute to this rule.
	// Required components gate the rule; optional components are attached when found.
	Components []*Component

	SkipReport bool

	// TokenEfficiency enables the Token Efficiency filter for this rule.
	// When enabled, candidate secrets are evaluated using BPE tokenization
	// to measure how "rare" or non-natural-language a string is. Strings that
	// tokenize efficiently (i.e., common words/phrases) are filtered out.
	TokenEfficiency bool

	// ValidateExpr is the raw expression used for secret validation.
	ValidateExpr string

	// Filter is an expression evaluated against attributes + finding per regex match.
	// Returns true = skip (discard this finding); false = keep.
	// Deprecated legacy Allowlists, Entropy, and TokenEfficiency are translated into this field.
	Filter string
	// contains filtered or unexported fields
}