security

type AuditFinding struct {
	CheckID     string `json:"check_id"`
	Severity    string `json:"severity"`
	Title       string `json:"title"`
	Detail      string `json:"detail"`
	Remediation string `json:"remediation"`
}

type AuditOptions struct {
	ConfigPath        string            // Path to config.yaml
	SessionsDir       string            // Path to sessions directory
	VaultPath         string            // Path to .devclaw.vault
	VaultConfigured   bool              // Whether vault is initialized
	APIKey            string            // Current API key value (for plaintext check)
	Provider          string            // Current LLM provider
	GatewayEnabled    bool              // Whether HTTP gateway is enabled
	GatewayBind       string            // Gateway bind address
	GatewayAuth       bool              // Whether gateway auth is configured
	CORSOrigins       []string          // CORS allowed origins
	SSRFEnabled       bool              // Whether SSRF guard is enabled
	SudoAllowed       bool              // Whether sudo is allowed in exec tools
	EmbeddingProvider string            // Embedding provider name
	EmbeddingAPIKey   string            // Embedding API key
	ExtraChecks       map[string]string // Additional key-value pairs for custom checks
}

type AuditReport struct {
	Timestamp     time.Time      `json:"timestamp"`
	TotalChecks   int            `json:"total_checks"`
	CriticalCount int            `json:"critical_count"`
	WarningCount  int            `json:"warning_count"`
	InfoCount     int            `json:"info_count"`
	Findings      []AuditFinding `json:"findings"`
}

type InputGuardrail struct {
	// contains filtered or unexported fields
}

type OutputGuardrail struct {

	// CredentialChecker is an optional function that detects credential patterns
	// in text. When set, ValidateWithContext uses it to detect credential leaks
	// in the final output. Injected by the copilot package to avoid circular imports.
	CredentialChecker func(string) bool
	// contains filtered or unexported fields
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type SSRFConfig struct {
	// AllowPrivate allows requests to private IPs (default: false).
	AllowPrivate bool `yaml:"allow_private"`

	// AllowedHosts is a whitelist. If set, only these hosts are allowed.
	AllowedHosts []string `yaml:"allowed_hosts"`

	// BlockedHosts is a blacklist (checked even if AllowPrivate is true).
	BlockedHosts []string `yaml:"blocked_hosts"`
}

type SSRFGuard struct {
	// contains filtered or unexported fields
}

type SafeMergeError struct {
	Key string
}

type ToolResultContext struct {
	ToolName string
	Output   string
}

type ToolSecurityPolicy struct {
	// AllowedTools lista as tools permitidas por skill (chave = skill name, valor = tool names).
	AllowedTools map[string][]string

	// RequiresConfirmation lista tools que precisam de confirmação do usuário.
	RequiresConfirmation []string

	// ToolRateLimits define rate limits específicos por tool.
	ToolRateLimits map[string]int
}