security

type AuditAction string

type AuditEvent struct {
	ID        string         `json:"id"`
	Timestamp time.Time      `json:"timestamp"`
	Input     string         `json:"input"` // Truncated input
	Operation string         `json:"operation"`
	Reason    string         `json:"reason"`
	Level     DangerLevel    `json:"level"`
	Category  string         `json:"category"`
	Action    AuditAction    `json:"action"`
	UserID    string         `json:"user_id,omitempty"`
	SessionID string         `json:"session_id,omitempty"`
	Source    string         `json:"source"`
	Metadata  map[string]any `json:"metadata,omitempty"`
}

type AuditFilter struct {
	StartTime  time.Time
	EndTime    time.Time
	Levels     []DangerLevel
	Categories []string
	Actions    []AuditAction
	UserID     string
	SessionID  string
	Limit      int
}

type AuditStats struct {
	TotalBlocked  int64            `json:"total_blocked"`
	TotalApproved int64            `json:"total_approved"`
	ByLevel       map[string]int64 `json:"by_level"`
	ByCategory    map[string]int64 `json:"by_category"`
	BySource      map[string]int64 `json:"by_source"`
	TopPatterns   []PatternStat    `json:"top_patterns"`
	TimeSeries    []TimeBucket     `json:"time_series"`
}

type AuditStore interface {
	Save(ctx context.Context, event *AuditEvent) error
	Query(ctx context.Context, filter AuditFilter) ([]AuditEvent, error)
	Stats(ctx context.Context) (AuditStats, error)
	Close() error
}

type DangerBlockEvent struct {
	Operation      string      `json:"operation"`             // The specific command line that triggered the block
	Reason         string      `json:"reason"`                // Description of the threat
	PatternMatched string      `json:"pattern_matched"`       // The specific signature that matched the input
	Level          DangerLevel `json:"level"`                 // Severity level
	Category       string      `json:"category"`              // Category classification
	BypassAllowed  bool        `json:"bypass_allowed"`        // Whether the user has administrative privileges to bypass this block
	Suggestions    []string    `json:"suggestions,omitempty"` // Safe alternatives to the blocked command
}

type DangerLevel int

type Detector struct {
	// contains filtered or unexported fields
}

type PatternStat struct {
	Pattern string `json:"pattern"`
	Count   int64  `json:"count"`
}

type RegexRule struct {
	Pattern     *regexp.Regexp // The compiled regex identifying the dangerous sequence
	Description string         // Human-readable explanation of why this pattern is blocked
	Level       DangerLevel    // Severity used for logging and alerting
	Category    string         // Functional category
}

type RuleSource interface {
	LoadRules(ctx context.Context) ([]SecurityRule, error)
	Name() string
}

type RuleUpdate struct {
	Type      RuleUpdateType
	Rule      SecurityRule
	Timestamp time.Time
}

type RuleUpdateType string

type SafePatternRule struct {
	Pattern     *regexp.Regexp
	Description string
	Category    string
}

type SecurityRule interface {
	// Evaluate analyzes the input command. Return non-nil DangerBlockEvent if blocked.
	Evaluate(input string) *DangerBlockEvent
}

type TimeBucket struct {
	Timestamp time.Time `json:"timestamp"`
	Count     int64     `json:"count"`
}