security

type AcknowledgmentStore interface {
	InsertAcknowledgment(ctx context.Context, ack *RiskAcknowledgment) (int64, error)
	DeleteAcknowledgment(ctx context.Context, id int64) error
	ListAcknowledgments(ctx context.Context, containerExternalID string) ([]*RiskAcknowledgment, error)
	GetAcknowledgment(ctx context.Context, id int64) (*RiskAcknowledgment, error)
	IsAcknowledged(ctx context.Context, containerExternalID, findingType, findingKey string) (bool, error)
}

type AlertCallback func(containerID int64, containerName string, insights []Insight, isRecover bool)

type CVEInfo struct {
	CVEID    string
	Severity string // "critical", "high", "medium", "low"
}

type CVEReader interface {
	ListCVEsForContainer(ctx context.Context, containerExternalID string) ([]CVEInfo, error)
}

type CategoryScore struct {
	Name       string `json:"name"`
	Weight     int    `json:"weight"`
	SubScore   int    `json:"sub_score"`
	Applicable bool   `json:"applicable"`
	IssueCount int    `json:"issue_count"`
	Summary    string `json:"summary"`
}

type CategorySummary struct {
	Name        string `json:"name"`
	TotalIssues int    `json:"total_issues"`
	Summary     string `json:"summary"`
}

type CertificateInfo struct {
	Status        string // "valid", "expiring", "expired", "error"
	DaysRemaining int
}

type CertificateReader interface {
	ListCertificatesForContainer(ctx context.Context, containerExternalID string) ([]CertificateInfo, error)
}

type ContainerInfo struct {
	ID         int64
	ExternalID string
	Name       string
}

type ContainerInsights struct {
	ContainerID     int64     `json:"container_id"`
	ContainerName   string    `json:"container_name"`
	HighestSeverity *string   `json:"highest_severity"`
	Count           int       `json:"count"`
	Insights        []Insight `json:"insights"`
}

type ContainerRisk struct {
	ContainerID   int64  `json:"container_id"`
	ContainerName string `json:"container_name"`
	Score         int    `json:"score"`
	ColorLevel    string `json:"color"`
	TopIssue      string `json:"top_issue"`
}

type Deps struct {
	Logger        *slog.Logger  // required
	AlertCallback AlertCallback // optional — nil-safe
	EventCallback EventCallback // optional — nil-safe
}

type DockerSecurityConfig struct {
	Privileged  bool
	NetworkMode string
	Bindings    []PortBinding
}

type EventCallback func(eventType string, data any)

type InfrastructurePosture struct {
	Score          int               `json:"score"`
	ColorLevel     string            `json:"color"`
	ContainerCount int               `json:"container_count"`
	ScoredCount    int               `json:"scored_count"`
	IsPartial      bool              `json:"is_partial"`
	Categories     []CategorySummary `json:"categories"`
	TopRisks       []ContainerRisk   `json:"top_risks"`
	ComputedAt     time.Time         `json:"computed_at"`
}

type Insight struct {
	Type          InsightType    `json:"type"`
	Severity      string         `json:"severity"`
	ContainerID   int64          `json:"container_id"`
	ContainerName string         `json:"container_name"`
	Title         string         `json:"title"`
	Description   string         `json:"description"`
	Details       map[string]any `json:"details"`
	DetectedAt    time.Time      `json:"detected_at"`
}

type InsightType string

type PortBinding struct {
	HostIP   string
	HostPort string
	Port     int
	Protocol string
}

type PostureAlertCallback func(score int, previousScore int, color string, isBreach bool)

type PostureEventCallback func(eventType string, data any)

type RiskAcknowledgment struct {
	ID                  int64     `json:"id"`
	ContainerExternalID string    `json:"container_external_id"`
	FindingType         string    `json:"finding_type"`
	FindingKey          string    `json:"finding_key"`
	AcknowledgedBy      string    `json:"acknowledged_by"`
	Reason              string    `json:"reason"`
	AcknowledgedAt      time.Time `json:"acknowledged_at"`
}

type Scorer struct {
	// contains filtered or unexported fields
}

type ScorerDeps struct {
	Certs                CertificateReader    // optional — nil skips TLS scoring
	CVEs                 CVEReader            // optional — nil skips CVE scoring
	Updates              UpdateReader         // optional — nil skips update scoring
	Security             *Service             // optional — nil skips network exposure scoring
	Acks                 AcknowledgmentStore  // required
	Threshold            int                  // optional — 0 disables alerts
	PostureAlertCallback PostureAlertCallback // optional — nil-safe
	PostureEventCallback PostureEventCallback // optional — nil-safe
}

type SecurityScore struct {
	ContainerID     int64           `json:"container_id"`
	ContainerName   string          `json:"container_name"`
	TotalScore      int             `json:"score"`
	ColorLevel      string          `json:"color"`
	Categories      []CategoryScore `json:"categories"`
	ApplicableCount int             `json:"applicable_count"`
	ComputedAt      time.Time       `json:"computed_at"`
	IsPartial       bool            `json:"is_partial"`
}

type Service struct {
	// contains filtered or unexported fields
}

type Summary struct {
	TotalContainersMonitored int            `json:"total_containers_monitored"`
	TotalContainersAffected  int            `json:"total_containers_affected"`
	TotalInsights            int            `json:"total_insights"`
	BySeverity               map[string]int `json:"by_severity"`
	ByType                   map[string]int `json:"by_type"`
}

type UpdateInfo struct {
	UpdateType  string // "major", "minor", "patch", "digest_only"
	PublishedAt *time.Time
}

type UpdateReader interface {
	ListUpdatesForContainer(ctx context.Context, containerExternalID string) ([]UpdateInfo, error)
}