security

type AuditConfig struct {
	// Enable audit logging
	Enabled bool `yaml:"enabled" json:"enabled"`

	// Log file path (if empty, logs to stdout)
	LogFile string `yaml:"logFile" json:"logFile"`

	// Log level: "info", "warn", "error"
	LogLevel string `yaml:"logLevel" json:"logLevel"`

	// Maximum log file size in MB before rotation
	MaxFileSizeMB int `yaml:"maxFileSizeMB" json:"maxFileSizeMB"`

	// Maximum number of log files to keep
	MaxFiles int `yaml:"maxFiles" json:"maxFiles"`

	// Include request/response bodies in logs (security risk)
	IncludeBodies bool `yaml:"includeBodies" json:"includeBodies"`

	// Log sensitive operations only (vs all operations)
	SensitiveOnly bool `yaml:"sensitiveOnly" json:"sensitiveOnly"`

	// Additional fields to log from request headers
	LogHeaders []string `yaml:"logHeaders" json:"logHeaders"`
}

type AuditEvent struct {
	Timestamp    time.Time              `json:"timestamp"`
	EventType    string                 `json:"event_type"`
	UserID       string                 `json:"user_id,omitempty"`
	ClientIP     string                 `json:"client_ip"`
	Method       string                 `json:"method"`
	Path         string                 `json:"path"`
	Query        string                 `json:"query,omitempty"`
	StatusCode   int                    `json:"status_code"`
	Duration     time.Duration          `json:"duration"`
	Error        string                 `json:"error,omitempty"`
	Headers      map[string]string      `json:"headers,omitempty"`
	RequestBody  string                 `json:"request_body,omitempty"`
	ResponseBody string                 `json:"response_body,omitempty"`
	Sensitive    bool                   `json:"sensitive"`
	Metadata     map[string]interface{} `json:"metadata,omitempty"`
}

type AuditLogger struct {
	// contains filtered or unexported fields
}

type ClientLimiter struct {
	// contains filtered or unexported fields
}

type RateLimitConfig struct {
	// Requests per minute allowed per client
	RequestsPerMinute int

	// Enable global rate limiting (across all clients)
	EnableGlobalLimit bool

	// Global requests per minute limit
	GlobalRequestsPerMinute int

	// Burst size (how many requests can be made immediately)
	BurstSize int

	// Cleanup interval for removing inactive clients
	CleanupInterval time.Duration

	// Client identification method: "ip", "token", "user-agent"
	ClientIDMethod string

	// Custom headers to use for client identification
	ClientIDHeader string
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type RequestValidator struct {
	// contains filtered or unexported fields
}

type Secret struct {
	Name      string            `json:"name"`
	Type      SecretType        `json:"type"`
	Value     string            `json:"-"` // Never serialize the actual value
	Source    SecretSource      `json:"source"`
	CreatedAt time.Time         `json:"created_at"`
	UpdatedAt time.Time         `json:"updated_at"`
	ExpiresAt *time.Time        `json:"expires_at,omitempty"`
	Metadata  map[string]string `json:"metadata,omitempty"`
	Encrypted bool              `json:"encrypted"`
	Rotatable bool              `json:"rotatable"`
}

type SecretAccess struct {
	SecretName string    `json:"secret_name"`
	Operation  string    `json:"operation"`
	Success    bool      `json:"success"`
	Timestamp  time.Time `json:"timestamp"`
	Source     string    `json:"source,omitempty"`
	Error      string    `json:"error,omitempty"`
}

type SecretConfig struct {
	// Storage configuration
	StorageDir    string `json:"storage_dir" yaml:"storageDir"`
	EncryptAtRest bool   `json:"encrypt_at_rest" yaml:"encryptAtRest"`

	// Master key configuration
	MasterKeySource SecretSource `json:"master_key_source" yaml:"masterKeySource"`
	MasterKeyPath   string       `json:"master_key_path,omitempty" yaml:"masterKeyPath,omitempty"`
	MasterKeyEnv    string       `json:"master_key_env,omitempty" yaml:"masterKeyEnv,omitempty"`

	// Rotation configuration
	EnableRotation   bool          `json:"enable_rotation" yaml:"enableRotation"`
	RotationInterval time.Duration `json:"rotation_interval" yaml:"rotationInterval"`

	// Security settings
	RequireEncryption  bool `json:"require_encryption" yaml:"requireEncryption"`
	AllowInlineSecrets bool `json:"allow_inline_secrets" yaml:"allowInlineSecrets"`
}

type SecretReference struct {
	Name   string       `json:"name"`
	Type   SecretType   `json:"type"`
	Source SecretSource `json:"source"`
}

type SecretSource string

type SecretType string

type SecretsManager struct {
	// contains filtered or unexported fields
}

type StorageSecret struct {
	Name      string            `json:"name"`
	Type      SecretType        `json:"type"`
	Value     string            `json:"value"` // Include value for storage
	Source    SecretSource      `json:"source"`
	CreatedAt time.Time         `json:"created_at"`
	UpdatedAt time.Time         `json:"updated_at"`
	ExpiresAt *time.Time        `json:"expires_at,omitempty"`
	Metadata  map[string]string `json:"metadata,omitempty"`
	Encrypted bool              `json:"encrypted"`
	Rotatable bool              `json:"rotatable"`
}

type ValidationConfig struct {
	// Enable request validation
	Enabled bool `yaml:"enabled" json:"enabled"`

	// Maximum query length
	MaxQueryLength int `yaml:"maxQueryLength" json:"maxQueryLength"`

	// Maximum time range for queries
	MaxTimeRange time.Duration `yaml:"maxTimeRange" json:"maxTimeRange"`

	// Allowed metric patterns (regex)
	AllowedMetricPatterns []string `yaml:"allowedMetricPatterns" json:"allowedMetricPatterns"`

	// Blocked metric patterns (regex)
	BlockedMetricPatterns []string `yaml:"blockedMetricPatterns" json:"blockedMetricPatterns"`

	// Maximum number of time series that can be returned
	MaxTimeSeries int `yaml:"maxTimeSeries" json:"maxTimeSeries"`

	// Enable query complexity validation
	EnableComplexityValidation bool `yaml:"enableComplexityValidation" json:"enableComplexityValidation"`

	// Maximum query complexity score
	MaxComplexityScore int `yaml:"maxComplexityScore" json:"maxComplexityScore"`
}