posture

type ControlResult struct {
	Category    string    `json:"category"`   // posture category the evidence came from
	ControlID   string    `json:"control_id"` // e.g. "A.8.24" or "CC6.6"
	Framework   Framework `json:"framework"`
	Title       string    `json:"title"`
	Description string    `json:"description"`
	Status      string    `json:"status"` // "pass", "warn", "fail"
	Severity    Severity  `json:"severity"`
	Score       int       `json:"score"`  // 0 = pass, otherwise earned risk points
	Detail      string    `json:"detail"` // human-readable explanation
}

type FleetCategorySummary struct {
	Category  string `json:"category"`
	NodeCount int    `json:"node_count"`
	TotalRows int    `json:"total_rows"`
}

type Framework string

type NodePosture struct {
	ID          uint      `gorm:"primarykey" json:"id"`
	CreatedAt   time.Time `json:"created_at"`
	UpdatedAt   time.Time `json:"updated_at"`
	NodeUUID    string    `gorm:"type:varchar(36);uniqueIndex:idx_posture_node_category" json:"node_uuid"`
	Environment string    `gorm:"index:idx_posture_env" json:"environment"`
	Category    string    `gorm:"uniqueIndex:idx_posture_node_category;type:varchar(64)" json:"category"`
	// QueryName is the full osquery scheduled-query name including prefix.
	QueryName string `gorm:"type:varchar(255)" json:"query_name"`
	// RowCount is the number of rows in the result (e.g. 3 packages, 5 users).
	RowCount int `json:"row_count"`
	// Summary is a compact JSON snapshot of the result data. For small
	// results this is the full columns array; for large results it's
	// truncated to the first 100 rows to keep the record manageable.
	Summary string `gorm:"type:text" json:"summary"`
	// Snapshot is the raw columns JSON from the latest result, capped at
	// 256KB. Used for detail views and compatibility with existing posture data.
	Snapshot string `gorm:"type:text" json:"-"`
	// FirstSeen is when this category was first observed for this node.
	FirstSeen time.Time `json:"first_seen"`
	LastSeen  time.Time `gorm:"index" json:"last_seen"`
}

type PostureManager struct {
	DB *gorm.DB
}

type PostureProfile struct {
	ID          string                  `json:"id"`
	Name        string                  `json:"name"`
	Description string                  `json:"description"`
	Platform    string                  `json:"platform"`
	Queries     map[string]ProfileQuery `json:"queries"`
}

type PostureScore struct {
	NodeUUID   string          `json:"node_uuid"`
	Timestamp  time.Time       `json:"timestamp"`
	TotalScore int             `json:"total_score"` // 0-100 normalized, lower is better
	RiskLevel  string          `json:"risk_level"`  // "low", "medium", "high", "critical"
	Controls   []ControlResult `json:"controls"`
	PassCount  int             `json:"pass_count"`
	WarnCount  int             `json:"warn_count"`
	FailCount  int             `json:"fail_count"`
}

type ProfileQuery struct {
	Query    string `json:"query"`
	Interval int    `json:"interval"`
	Platform string `json:"platform,omitempty"`
	Snapshot bool   `json:"snapshot"`
}

type ScoreCalculator struct {
	// contains filtered or unexported fields
}

type ScoringRule struct {
	// Categories lists every posture category that can provide evidence
	// for this control. The rule is evaluated when at least one of them
	// has been collected; mutually exclusive sources (deb vs rpm) belong
	// in the same rule so an empty inapplicable source is not a finding.
	Categories  []string  `json:"categories"`
	ControlID   string    `json:"control_id"`
	Framework   Framework `json:"framework"`
	Title       string    `json:"title"`
	Description string    `json:"description"`
	Severity    Severity  `json:"severity"`
	// Evaluate receives the collected categories (only those present for
	// the node) with their parsed rows and returns (status, detail).
	// status is "pass", "warn", or "fail".
	Evaluate func(data map[string][]map[string]interface{}) (status, detail string)
}

type Severity string