rule

type Bundle struct {
	ID       shared.ID
	TenantID shared.ID
	ToolID   shared.ID

	// Version info
	Version     string // e.g., "20240115-a1b2c3d4"
	ContentHash string // SHA256 of bundle content (for change detection)

	// Statistics
	RuleCount   int
	SourceCount int
	SizeBytes   int64

	// Sources included
	SourceIDs    []shared.ID
	SourceHashes map[string]string // source_id -> content_hash

	// Storage location
	StoragePath string // S3 key or local path

	// Build status
	Status           BundleStatus
	BuildError       string
	BuildStartedAt   *time.Time
	BuildCompletedAt *time.Time

	CreatedAt time.Time
	ExpiresAt *time.Time
}

type BundleFilter struct {
	TenantID *shared.ID
	ToolID   *shared.ID
	Status   *BundleStatus
}

type BundleManifest struct {
	Version     string            `json:"version"`
	ToolName    string            `json:"tool_name"`
	ContentHash string            `json:"content_hash"`
	CreatedAt   time.Time         `json:"created_at"`
	RuleCount   int               `json:"rule_count"`
	Sources     []BundleSourceRef `json:"sources"`
}

type BundleRepository interface {
	// Create creates a new bundle.
	Create(ctx context.Context, bundle *Bundle) error

	// GetByID retrieves a bundle by ID.
	GetByID(ctx context.Context, id shared.ID) (*Bundle, error)

	// GetLatest retrieves the latest ready bundle for a tenant and tool.
	GetLatest(ctx context.Context, tenantID, toolID shared.ID) (*Bundle, error)

	// GetByContentHash retrieves a bundle by content hash.
	GetByContentHash(ctx context.Context, hash string) (*Bundle, error)

	// List lists bundles with filters.
	List(ctx context.Context, filter BundleFilter) ([]*Bundle, error)

	// Update updates a bundle.
	Update(ctx context.Context, bundle *Bundle) error

	// Delete deletes a bundle.
	Delete(ctx context.Context, id shared.ID) error

	// DeleteExpired deletes all expired bundles.
	DeleteExpired(ctx context.Context) (int64, error)
}

type BundleSourceRef struct {
	ID          string `json:"id"`
	Name        string `json:"name"`
	ContentHash string `json:"content_hash"`
	RuleCount   int    `json:"rule_count"`
	Priority    int    `json:"priority"`
	IsDefault   bool   `json:"is_default"`
}

type BundleStatus string

type GitConfig struct {
	URL           string `json:"url"`
	Branch        string `json:"branch"`
	Path          string `json:"path"`           // Subdirectory containing rules
	AuthType      string `json:"auth_type"`      // none, ssh, token
	CredentialsID string `json:"credentials_id"` // Reference to stored credentials
}

type HTTPConfig struct {
	URL           string `json:"url"`
	AuthType      string `json:"auth_type"`      // none, basic, bearer
	CredentialsID string `json:"credentials_id"` // Reference to stored credentials
}

type LocalConfig struct {
	Path string `json:"path"`
}

type Override struct {
	ID       shared.ID
	TenantID shared.ID
	ToolID   *shared.ID

	// What to override
	RulePattern string // Glob pattern (e.g., "java.lang.*") or exact rule_id
	IsPattern   bool   // true = glob pattern, false = exact match

	// Override settings
	Enabled          bool     // Force enable or disable
	SeverityOverride Severity // Override severity (empty = no override)

	// Optional scope
	AssetGroupID  *shared.ID
	ScanProfileID *shared.ID

	// Audit
	Reason    string
	CreatedBy *shared.ID

	CreatedAt time.Time
	UpdatedAt time.Time
	ExpiresAt *time.Time // Optional expiration
}

type OverrideFilter struct {
	TenantID      *shared.ID
	ToolID        *shared.ID
	AssetGroupID  *shared.ID
	ScanProfileID *shared.ID
	Enabled       *bool
}

type OverrideRepository interface {
	// Create creates a new override.
	Create(ctx context.Context, override *Override) error

	// GetByID retrieves an override by ID.
	GetByID(ctx context.Context, id shared.ID) (*Override, error)

	// GetByTenantAndID retrieves an override by tenant and ID.
	GetByTenantAndID(ctx context.Context, tenantID, id shared.ID) (*Override, error)

	// List lists overrides with filters and pagination.
	List(ctx context.Context, filter OverrideFilter, page pagination.Pagination) (pagination.Result[*Override], error)

	// ListByTenantAndTool lists all overrides for a tenant and tool.
	ListByTenantAndTool(ctx context.Context, tenantID shared.ID, toolID *shared.ID) ([]*Override, error)

	// Update updates an override.
	Update(ctx context.Context, override *Override) error

	// Delete deletes an override.
	Delete(ctx context.Context, id shared.ID) error

	// DeleteExpired deletes all expired overrides.
	DeleteExpired(ctx context.Context) (int64, error)
}

type Rule struct {
	ID       shared.ID
	SourceID shared.ID
	TenantID shared.ID
	ToolID   *shared.ID

	// Rule identification (tool-specific)
	RuleID string // e.g., "java.lang.security.audit.sqli"
	Name   string

	// Classification
	Severity    Severity
	Category    string
	Subcategory string
	Tags        []string

	// Metadata
	Description    string
	Recommendation string
	References     []string
	CWEIDs         []string
	OWASPIDs       []string

	// File info within source
	FilePath    string
	ContentHash string

	// Additional metadata
	Metadata map[string]any

	CreatedAt time.Time
	UpdatedAt time.Time
}

type RuleFilter struct {
	TenantID *shared.ID
	ToolID   *shared.ID
	SourceID *shared.ID
	Severity *Severity
	Category string
	Tags     []string
	RuleIDs  []string // Filter by specific rule IDs
	Search   string
}

type RuleRepository interface {
	// Create creates a new rule.
	Create(ctx context.Context, rule *Rule) error

	// CreateBatch creates multiple rules in batch.
	CreateBatch(ctx context.Context, rules []*Rule) error

	// GetByID retrieves a rule by ID.
	GetByID(ctx context.Context, id shared.ID) (*Rule, error)

	// GetBySourceAndRuleID retrieves a rule by source and rule ID.
	GetBySourceAndRuleID(ctx context.Context, sourceID shared.ID, ruleID string) (*Rule, error)

	// List lists rules with filters and pagination.
	List(ctx context.Context, filter RuleFilter, page pagination.Pagination) (pagination.Result[*Rule], error)

	// ListBySource lists all rules for a source.
	ListBySource(ctx context.Context, sourceID shared.ID) ([]*Rule, error)

	// Update updates a rule.
	Update(ctx context.Context, rule *Rule) error

	// UpsertBatch upserts multiple rules (insert or update).
	UpsertBatch(ctx context.Context, rules []*Rule) error

	// Delete deletes a rule.
	Delete(ctx context.Context, id shared.ID) error

	// DeleteBySource deletes all rules for a source.
	DeleteBySource(ctx context.Context, sourceID shared.ID) error

	// CountBySource counts rules for a source.
	CountBySource(ctx context.Context, sourceID shared.ID) (int, error)

	// CountByTenantAndTool counts rules for a tenant and tool.
	CountByTenantAndTool(ctx context.Context, tenantID shared.ID, toolID *shared.ID) (int, error)
}

type Severity string

type Source struct {
	ID          shared.ID
	TenantID    shared.ID
	ToolID      *shared.ID // Optional: if nil, applies to all tools
	Name        string
	Description string

	// Source configuration
	SourceType SourceType
	Config     json.RawMessage // GitConfig, HTTPConfig, or LocalConfig

	// Credentials reference (not stored directly)
	CredentialsID *shared.ID

	// Sync configuration
	SyncEnabled         bool
	SyncIntervalMinutes int

	// Sync status
	LastSyncAt       *time.Time
	LastSyncStatus   SyncStatus
	LastSyncError    string
	LastSyncDuration time.Duration
	ContentHash      string // SHA256 of synced content

	// Statistics
	RuleCount int

	// Priority for merge order (higher = applied later)
	Priority int

	// Platform default (managed by system)
	IsPlatformDefault bool

	Enabled   bool
	CreatedAt time.Time
	UpdatedAt time.Time
}

type SourceFilter struct {
	TenantID          *shared.ID
	ToolID            *shared.ID
	SourceType        *SourceType
	Enabled           *bool
	IsPlatformDefault *bool
	SyncStatus        *SyncStatus
	Search            string
}

type SourceRepository interface {
	// Create creates a new rule source.
	Create(ctx context.Context, source *Source) error

	// GetByID retrieves a source by ID.
	GetByID(ctx context.Context, id shared.ID) (*Source, error)

	// GetByTenantAndID retrieves a source by tenant and ID.
	GetByTenantAndID(ctx context.Context, tenantID, id shared.ID) (*Source, error)

	// List lists sources with filters and pagination.
	List(ctx context.Context, filter SourceFilter, page pagination.Pagination) (pagination.Result[*Source], error)

	// ListByTenantAndTool lists all sources for a tenant and tool.
	ListByTenantAndTool(ctx context.Context, tenantID shared.ID, toolID *shared.ID) ([]*Source, error)

	// ListNeedingSync lists sources that need synchronization.
	ListNeedingSync(ctx context.Context, limit int) ([]*Source, error)

	// Update updates a source.
	Update(ctx context.Context, source *Source) error

	// Delete deletes a source.
	Delete(ctx context.Context, id shared.ID) error
}

type SourceType string

type SyncHistory struct {
	ID           shared.ID
	SourceID     shared.ID
	Status       SyncStatus
	RulesAdded   int
	RulesUpdated int
	RulesRemoved int
	Duration     time.Duration
	ErrorMessage string
	ErrorDetails map[string]any
	PreviousHash string
	NewHash      string
	CreatedAt    time.Time
}

type SyncHistoryRepository interface {
	// Create creates a new sync history record.
	Create(ctx context.Context, history *SyncHistory) error

	// ListBySource lists sync history for a source.
	ListBySource(ctx context.Context, sourceID shared.ID, limit int) ([]*SyncHistory, error)
}

type SyncStatus string