posture

type CheckPatch struct {
	ProfileID          *string `json:"profile_id,omitempty"`
	ProfileName        *string `json:"profile_name,omitempty"`
	ProfileDescription *string `json:"profile_description,omitempty"`
	ProfilePlatform    *string `json:"profile_platform,omitempty"`
	Category           *string `json:"category,omitempty"`
	Name               *string `json:"name,omitempty"`
	Description        *string `json:"description,omitempty"`
	QueryName          *string `json:"query_name,omitempty"`
	Query              *string `json:"query,omitempty"`
	Interval           *int    `json:"interval,omitempty"`
	Platform           *string `json:"platform,omitempty"`
	Snapshot           *bool   `json:"snapshot,omitempty"`
	Enabled            *bool   `json:"enabled,omitempty"`
	ScoringRule        *string `json:"scoring_rule,omitempty"`
	ControlID          *string `json:"control_id,omitempty"`
	Framework          *string `json:"framework,omitempty"`
	Severity           *string `json:"severity,omitempty"`
	Weight             *int    `json:"weight,omitempty"`
}

type ControlResult struct {
	Category    string    `json:"category"`   // posture category the evidence came from
	ControlID   string    `json:"control_id"` // e.g. "A.8.24" or "CC6.6"
	Framework   Framework `json:"framework"`
	Title       string    `json:"title"`
	Description string    `json:"description"`
	Status      string    `json:"status"` // "pass", "warn", "fail"
	Severity    Severity  `json:"severity"`
	Score       int       `json:"score"` // 0 = pass, otherwise earned risk points
	// MaxScore is the risk points this control would contribute if it
	// failed outright (its weight). A passing control still reports this so
	// callers can renormalize the total after excluding controls — e.g. the
	// SPA's "what if I ignore this check" recompute — without needing the
	// evaluation rules themselves.
	MaxScore int    `json:"max_score"`
	Detail   string `json:"detail"` // human-readable explanation
}

type EvidenceSource interface {
	ScoringRules() []ScoringRule
	ScoreEvidence(nodeUUIDs []string) (map[string][]NodePosture, error)
}

type FleetCategorySummary struct {
	Category  string `json:"category"`
	NodeCount int    `json:"node_count"`
	TotalRows int    `json:"total_rows"`
}

type Framework string

type NodePosture struct {
	ID          uint      `gorm:"primarykey" json:"id"`
	CreatedAt   time.Time `json:"created_at"`
	UpdatedAt   time.Time `json:"updated_at"`
	NodeUUID    string    `gorm:"type:varchar(36);uniqueIndex:idx_posture_node_category" json:"node_uuid"`
	Environment string    `gorm:"index:idx_posture_env" json:"environment"`
	Category    string    `gorm:"uniqueIndex:idx_posture_node_category;type:varchar(64)" json:"category"`
	// QueryName is the full osquery scheduled-query name including prefix.
	QueryName string `gorm:"type:varchar(255)" json:"query_name"`
	// RowCount is the number of rows in the result (e.g. 3 packages, 5 users).
	RowCount int `json:"row_count"`
	// Summary is a compact JSON snapshot of the result data. For small
	// results this is the full columns array; for large results it's
	// truncated to the first 100 rows to keep the record manageable.
	Summary string `gorm:"type:text" json:"summary"`
	// Snapshot is the raw columns JSON from the latest result, capped at
	// 256KB. Used for detail views and compatibility with existing posture data.
	Snapshot string `gorm:"type:text" json:"-"`
	// FirstSeen is when this category was first observed for this node.
	FirstSeen time.Time `json:"first_seen"`
	LastSeen  time.Time `gorm:"index" json:"last_seen"`
}

type PostureCheck struct {
	ID                 uint      `gorm:"primarykey" json:"id"`
	CreatedAt          time.Time `json:"created_at"`
	UpdatedAt          time.Time `json:"updated_at"`
	ProfileID          string    `gorm:"type:varchar(64);uniqueIndex:idx_posture_check_profile_category" json:"profile_id"`
	ProfileName        string    `gorm:"type:varchar(255)" json:"profile_name"`
	ProfileDescription string    `gorm:"type:text" json:"profile_description"`
	ProfilePlatform    string    `gorm:"type:varchar(64)" json:"profile_platform"`
	Category           string    `gorm:"type:varchar(64);uniqueIndex:idx_posture_check_profile_category;index" json:"category"`
	Name               string    `gorm:"type:varchar(255)" json:"name"`
	Description        string    `gorm:"type:text" json:"description"`
	QueryName          string    `gorm:"type:varchar(255)" json:"query_name"`
	Query              string    `gorm:"type:text" json:"query"`
	Interval           int       `json:"interval"`
	Platform           string    `gorm:"type:varchar(64)" json:"platform"`
	Snapshot           bool      `json:"snapshot"`
	Enabled            bool      `gorm:"index" json:"enabled"`
	ScoringRule        string    `gorm:"type:varchar(64);index" json:"scoring_rule"`
	ControlID          string    `gorm:"type:varchar(64)" json:"control_id"`
	Framework          Framework `gorm:"type:varchar(32)" json:"framework"`
	Severity           Severity  `gorm:"type:varchar(32)" json:"severity"`
	Weight             int       `json:"weight"`
}

type PostureManager struct {
	DB *gorm.DB
	// Evidence, when set, adds scoring evidence posture queries do not
	// collect. osctrl-api wires vulnerability findings here when both
	// --posture-enabled and --vuln-enabled are on.
	Evidence EvidenceSource
}

type PostureProfile struct {
	ID          string                  `json:"id"`
	Name        string                  `json:"name"`
	Description string                  `json:"description"`
	Platform    string                  `json:"platform"`
	Queries     map[string]ProfileQuery `json:"queries"`
}

type PostureScore struct {
	NodeUUID   string          `json:"node_uuid"`
	Timestamp  time.Time       `json:"timestamp"`
	TotalScore int             `json:"total_score"` // 0-100 normalized, lower is better
	RiskLevel  string          `json:"risk_level"`  // "low", "medium", "high", "critical"
	Controls   []ControlResult `json:"controls"`
	PassCount  int             `json:"pass_count"`
	WarnCount  int             `json:"warn_count"`
	FailCount  int             `json:"fail_count"`
}

type ProfileQuery struct {
	QueryName string `json:"query_name,omitempty"`
	Query     string `json:"query"`
	Interval  int    `json:"interval"`
	Platform  string `json:"platform,omitempty"`
	Snapshot  bool   `json:"snapshot"`
}

type ScoreCalculator struct {
	// contains filtered or unexported fields
}

type ScoringRule struct {
	RuleKey string `json:"rule_key"`
	// Categories lists every posture category that can provide evidence
	// for this control. The rule is evaluated when at least one of them
	// has been collected; mutually exclusive sources (deb vs rpm) belong
	// in the same rule so an empty inapplicable source is not a finding.
	Categories  []string  `json:"categories"`
	ControlID   string    `json:"control_id"`
	Framework   Framework `json:"framework"`
	Title       string    `json:"title"`
	Description string    `json:"description"`
	Severity    Severity  `json:"severity"`
	Weight      int       `json:"weight"`
	// Evaluate receives the collected categories (only those present for
	// the node) with their parsed rows and returns (status, detail).
	// status is "pass", "warn", or "fail".
	Evaluate func(data map[string][]map[string]interface{}) (status, detail string)
	// Grade, when set, replaces Evaluate for controls whose weight depends
	// on the evidence: a known-exploited vulnerability fails at critical
	// weight, a high-severity one at high weight. It returns the status,
	// the detail and the severity the result is scored and escalated at.
	Grade func(data map[string][]map[string]interface{}) (status, detail string, severity Severity) `json:"-"`
}

type Severity string