formats

type Applicability struct {
	Status             string     `json:"status"`
	ScannerDescription string     `json:"scannerDescription,omitempty"`
	UndeterminedReason string     `json:"undeterminedReason,omitempty"`
	Evidence           []Evidence `json:"evidence,omitempty"`
}

type BlockedPackages struct {
	Policy    string         `json:"policy,omitempty"`
	Condition string         `json:"condition,omitempty"`
	Packages  map[string]int `json:"packages"`
}

type Bom struct {
	Vulnerabilities struct {
		Vulnerability []struct {
			BomRef string `xml:"bom-ref,attr"`
			Id     string `xml:"id"`
		} `xml:"vulnerability"`
	} `xml:"vulnerabilities"`
}

type ComponentRow struct {
	Id      string `json:"id,omitempty"`
	Name    string `json:"name"`
	Version string `json:"version"`
	// Shown the preferred location of the component from the evidences.
	PreferredLocation *Location `json:"location,omitempty"`
	// Evidences is a list of locations that the component was found in.
	Evidences []Location `json:"evidences,omitempty"`
}

type CuratedAction struct {
	Action string `json:"action"`           // "owner/repo", plus " (subpath[, subpath...])" when invoked via subpaths
	Ref    string `json:"ref"`              // verbatim from the cache directory name, uninterpreted
	Parent string `json:"parent,omitempty"` // "" when directly referenced, or when attribution could not place it
	Status string `json:"status"`
	Notes  string `json:"notes,omitempty"`
}

type CuratedActions struct {
	Actions []CuratedAction `json:"actions,omitempty"`
	// Attributed reports whether a workflow file is present to do parent attribution.
	// else Parent column is dropped in the report.
	Attributed bool `json:"attributed"`
	// LocalCompositeActions holds the `uses: ./...` steps which are evaluated lazily
	LocalCompositeActions []LocalCompositeAction `json:"local_composite_actions,omitempty"`
}

type CuratedPackages struct {
	Blocked      []BlockedPackages `json:"blocked,omitempty"`
	PackageCount int               `json:"num_packages,omitempty"`
	// IsPartial is true when the dependency tree could not be fully resolved (e.g. CVS pip fallback).
	// PackageCount reflects only recovered blocked packages, not the full tree size.
	IsPartial bool `json:"partial,omitempty"`
	// PartialReason explains why IsPartial is true, e.g. "cvs_fallback" or "hf_unresolved".
	PartialReason string `json:"partial_reason,omitempty"`
}

type CveRow struct {
	Id            string         `json:"id"`
	CvssV2        string         `json:"cvssV2,omitempty"`
	CvssV2Vector  string         `json:"cvssV2Vector,omitempty"`
	CvssV3        string         `json:"cvssV3,omitempty"`
	CvssV3Vector  string         `json:"cvssV3Vector,omitempty"`
	Cwe           []string       `json:"cwe,omitempty"`
	Applicability *Applicability `json:"applicability,omitempty"`
}

type EnrichJson struct {
	Vulnerability []struct {
		BomRef string `json:"bom-ref"`
		Id     string `json:"id"`
	} `json:"vulnerabilities"`
}

type Evidence struct {
	Location
	Reason string `json:"reason,omitempty"`
}

type ImpactedDependencyDetails struct {
	SeverityDetails
	ImpactedDependencyName    string         `json:"impactedPackageName"`
	ImpactedDependencyVersion string         `json:"impactedPackageVersion"`
	ImpactedDependencyType    string         `json:"impactedPackageType"`
	Components                []ComponentRow `json:"components"`
}

type JfrogResearchInformation struct {
	SeverityDetails
	Summary         string                        `json:"summary,omitempty"`
	Details         string                        `json:"details,omitempty"`
	SeverityReasons []JfrogResearchSeverityReason `json:"severityReasons,omitempty"`
	Remediation     string                        `json:"remediation,omitempty"`
}

type JfrogResearchSeverityReason struct {
	Name        string `json:"name,omitempty"`
	Description string `json:"description,omitempty"`
	IsPositive  bool   `json:"isPositive,omitempty"`
}

type LicenseRow struct {
	ImpactedDependencyDetails
	LicenseKey  string           `json:"licenseKey"`
	LicenseName string           `json:"licenseName,omitempty"`
	ImpactPaths [][]ComponentRow `json:"impactPaths"`
}

type LicenseViolationRow struct {
	LicenseRow
	ViolationContext
}

type LocalCompositeAction struct {
	Path string `json:"path"`
	// DeclaredBy is the composite action declaring this step, as "<owner>/<repo>@<ref>", or ""
	// when the job's own workflow declares it.
	DeclaredBy string `json:"declared_by,omitempty"`
}

type Location struct {
	File               string   `json:"file"`
	StartLine          int      `json:"startLine,omitempty"`
	StartColumn        int      `json:"startColumn,omitempty"`
	EndLine            int      `json:"endLine,omitempty"`
	EndColumn          int      `json:"endColumn,omitempty"`
	Snippet            string   `json:"snippet,omitempty"`
	ExternalReferences []string `json:"externalReferences,omitempty"`
}

type OperationalRiskViolationRow struct {
	ImpactedDependencyDetails
	ViolationContext
	RiskReason    string `json:"riskReason"`
	IsEol         string `json:"isEndOfLife"`
	EolMessage    string `json:"endOfLifeMessage"`
	Cadence       string `json:"cadence"`
	Commits       string `json:"commits"`
	Committers    string `json:"committers"`
	NewerVersions string `json:"newerVersions"`
	LatestVersion string `json:"latestVersion"`
}

type ResultSummary map[string]map[string]int

type ResultsSummary struct {
	Scans []ScanSummary `json:"scans"`
}

type ResultsTables struct {
	// Licenses
	LicensesTable []licenseTableRow
	// SBOM (Software Bill of Materials)
	SbomTable []SbomTableRow
	// Sca tables
	SecurityVulnerabilitiesTable   []scaVulnerabilityOrViolationTableRow
	SecurityViolationsTable        []scaVulnerabilityOrViolationTableRow
	LicenseViolationsTable         []licenseViolationTableRow
	OperationalRiskViolationsTable []operationalRiskViolationTableRow
	// Iac tables
	IacVulnerabilitiesTable []basicJasTableRow
	IacViolationsTable      []basicJasTableRow
	// Sast tables
	SastVulnerabilitiesTable []basicJasTableRow
	SastViolationsTable      []basicJasTableRow
	// Services
	ServicesVulnerabilitiesTable []basicJasTableRow
	ServicesViolationsTable      []basicJasTableRow
	// Secrets
	SecretsVulnerabilitiesTable []secretsTableRow
	SecretsViolationsTable      []secretsTableRow
	// Malicious Code
	MaliciousVulnerabilitiesTable []maliciousTableRow
}

type SbomTableRow struct {
	Component   string `col-name:"Component"`
	Version     string `col-name:"Version"`
	PackageType string `col-name:"Type"`
	Relation    string `col-name:"Relation"`
	// For sorting
	RelationPriority int
}

type ScaScanResultSummary struct {
	ScanIds         []string      `json:"scan_ids,omitempty"`
	MoreInfoUrls    []string      `json:"more_info_urls,omitempty"`
	Security        ResultSummary `json:"security,omitempty"`
	License         ResultSummary `json:"license,omitempty"`
	OperationalRisk ResultSummary `json:"operational_risk,omitempty"`
}

type ScanResultSummary struct {
	ScaResults       *ScaScanResultSummary `json:"sca,omitempty"`
	IacResults       *ResultSummary        `json:"iac,omitempty"`
	ServicesResults  *ResultSummary        `json:"services,omitempty"`
	SecretsResults   *ResultSummary        `json:"secrets,omitempty"`
	SastResults      *ResultSummary        `json:"sast,omitempty"`
	MaliciousResults *ResultSummary        `json:"maliciousCode,omitempty"`
}

type ScanStatus struct {
	// If not nil, the scan was performed. The value is the status code of the scans. if not 0, the scan failed.
	ScaStatusCode           *int `json:"scaScanStatusCode,omitempty"`
	SastStatusCode          *int `json:"sastScanStatusCode,omitempty"`
	IacStatusCode           *int `json:"iacScanStatusCode,omitempty"`
	ServicesStatusCode      *int `json:"servicesScanStatusCode,omitempty"`
	SecretsStatusCode       *int `json:"secretsScanStatusCode,omitempty"`
	ApplicabilityStatusCode *int `json:"ContextualAnalysisScanStatusCode,omitempty"`
	MaliciousStatusCode     *int `json:"MaliciousStatusCode,omitempty"`
}

type ScanSummary struct {
	Target          string                 `json:"target"`
	Name            string                 `json:"name,omitempty"`
	Vulnerabilities *ScanResultSummary     `json:"vulnerabilities,omitempty"`
	Violations      *ScanViolationsSummary `json:"violations,omitempty"`
	CuratedPackages *CuratedPackages       `json:"curated,omitempty"`
	CuratedActions  *CuratedActions        `json:"curated_actions,omitempty"`
}

type ScanViolationsSummary struct {
	Watches   []string `json:"watches,omitempty"`
	FailBuild bool     `json:"fail_build,omitempty"`
	ScanResultSummary
}

type ScannerInfo struct {
	RuleId                  string   `json:"ruleId"`
	Origin                  string   `json:"origin,omitempty"`
	Cwe                     []string `json:"cwe,omitempty"`
	ScannerShortDescription string   `json:"scannerShortDescription,omitempty"`
	ScannerDescription      string   `json:"scannerDescription,omitempty"`
}

type SeverityDetails struct {
	Severity         string `json:"severity"`
	SeverityNumValue int    `json:"-"` // For sorting
}

type SimpleJsonError struct {
	FilePath     string `json:"filePath"`
	ErrorMessage string `json:"errorMessage"`
}

type SimpleJsonResults struct {
	Vulnerabilities           []VulnerabilityOrViolationRow `json:"vulnerabilities"`
	SecurityViolations        []VulnerabilityOrViolationRow `json:"securityViolations"`
	LicensesViolations        []LicenseViolationRow         `json:"licensesViolations"`
	Licenses                  []LicenseRow                  `json:"licenses"`
	OperationalRiskViolations []OperationalRiskViolationRow `json:"operationalRiskViolations"`
	SecretsVulnerabilities    []SourceCodeRow               `json:"secrets"`
	ServicesVulnerabilities   []SourceCodeRow               `json:"services"`
	IacsVulnerabilities       []SourceCodeRow               `json:"iac"`
	SastVulnerabilities       []SourceCodeRow               `json:"sast"`
	SecretsViolations         []SourceCodeRow               `json:"secretsViolations"`
	ServicesViolations        []SourceCodeRow               `json:"servicesViolations"`
	IacsViolations            []SourceCodeRow               `json:"iacViolations"`
	SastViolations            []SourceCodeRow               `json:"sastViolations"`
	MaliciousVulnerabilities  []SourceCodeRow               `json:"maliciousCode"`
	Errors                    []SimpleJsonError             `json:"errors"`
	Statuses                  ScanStatus                    `json:"scansStatus"`
	MultiScanId               string                        `json:"multiScanId,omitempty"`
}

type SourceCodeRow struct {
	SeverityDetails
	ViolationContext
	ScannerInfo
	Location
	Finding       string         `json:"finding,omitempty"`
	Fingerprint   string         `json:"fingerprint,omitempty"`
	Applicability *Applicability `json:"applicability,omitempty"`
	CodeFlow      [][]Location   `json:"codeFlow,omitempty"`
}

type SummaryResultType string

type ViolationContext struct {
	// The watch name that generated the violation
	Watch string `json:"watch,omitempty"`
	// Unique id of the violation if exists
	IssueId string `json:"issueId,omitempty"`
	// The related policy names
	Policies []string `json:"policies,omitempty"`
	// Value of fail_pr rule that can be applied to a policy. Indicates if the violation should fail the PR
	FailPr bool `json:"fail_pull_request,omitempty"`
	// Value of fail_build rule that can be applied to a policy. Indicates if the violation should fail the build
	FailBuild bool `json:"fail_build,omitempty"`
}

type Vulnerabilities struct {
	Vulnerabilities XMLVulnerability `xml:"vulnerabilities"`
}

type Vulnerability struct {
	BomRef string `json:"bom-ref" xml:"bom-ref,attr"`
	ID     string `json:"id" xml:"id"`
}

type VulnerabilityOrViolationRow struct {
	ImpactedDependencyDetails
	ViolationContext
	Summary                  string                    `json:"summary"`
	Applicable               string                    `json:"applicable"`
	FixedVersions            []string                  `json:"fixedVersions"`
	Cves                     []CveRow                  `json:"cves"`
	IssueId                  string                    `json:"issueId"`
	References               []string                  `json:"references"`
	ImpactPaths              [][]ComponentRow          `json:"impactPaths"`
	JfrogResearchInformation *JfrogResearchInformation `json:"jfrogResearchInformation"`
	Technology               techutils.Technology      `json:"-"`
}

type XMLVulnerability struct {
	Vulnerability []Vulnerability `xml:"vulnerability"`
}