models

type Alert struct {
	// ID is the rule/policy that triggered the alert.
	AnalysisID string `json:"analysisId" validate:"required"`

	// Type specifies if an alert is for a policy or a rule
	Type string `json:"type" validate:"oneof=RULE POLICY RULE_ERROR"`

	// CreatedAt is the creation timestamp (seconds since epoch).
	CreatedAt time.Time `json:"createdAt" validate:"required"`

	// Severity is the alert severity at the time of creation.
	Severity string `json:"severity" validate:"oneof=INFO LOW MEDIUM HIGH CRITICAL"`

	// OutputIds is the set of outputs for this alert.
	OutputIds []string `json:"outputIds,omitempty" validate:"dive,uuid4"`

	// LogTypes is the set of logs that could trigger the alert.
	LogTypes []string `json:"logTypes,omitempty"`

	// ResourceTypes is the set of resources that could trigger the alert.
	ResourceTypes []string `json:"resourceTypes,omitempty"`

	// ResourceID is the ID of the failing resource in the policy.
	ResourceID string `json:"resourceId,omitempty"`

	// AnalysisSourceID is the ID of the source integration for the rule/policy that failed.
	AnalysisSourceID string `json:"analysisSourceId,omitempty"`

	// AnalysisDescription is the description of the rule/policy that triggered the alert.
	AnalysisDescription string `json:"analysisDescription,omitempty"`

	// Name is the name of the policy at the time the alert was triggered.
	AnalysisName *string `json:"analysisName,omitempty"`

	// Version is the S3 object version for the policy.
	Version *string `json:"version,omitempty"`

	// Reference is the user-provided triage information
	Reference string `json:"reference,omitempty"`

	// Destinations is the custom user-provided destination override
	Destinations []string `json:"destinations,omitempty" validate:"dive,uuid4"`

	// Runbook is the user-provided triage information.
	Runbook string `json:"runbook,omitempty"`

	// Tags is the set of policy tags.
	Tags []string `json:"tags,omitempty"`

	// AlertID specifies the alertId that this Alert is associated with.
	AlertID *string `json:"alertId,omitempty"`

	// Title is the optional title for the alert generated by Python Rules engine
	Title string `json:"title,omitempty"`

	Context map[string]interface{} `json:"context"`

	// RetryCount is a counter for the nubmer of times we have attempted to send this alert to a destination.
	RetryCount int `json:"retryCount,omitempty"`

	// IsTest is a test flag set only to replace the contents of the alert with dummy values
	IsTest bool `json:"isTest,omitempty"`

	// IsResent is a flag set to indicate the alert is not new
	IsResent bool `json:"isResent,omitempty"`
}

type DeliverAlertInput struct {
	AlertID   string   `json:"alertId" validate:"required,hexadecimal,len=32"` // AlertID is an MD5 hash
	OutputIds []string `json:"outputIds" validate:"gt=0,dive,uuid4"`
}

type DeliverAlertOutput = alertModels.AlertSummary

type DispatchAlertsInput = events.SQSMessage

type LambdaInput struct {
	// `DispatchAlerts` is an alias for `SQSMessage` so that we can invoke directly
	// in AWS UI with a valid `SQSMessage` JSON payload without needing to put data on
	// the queue and wait for the trigger. This matches the raw SQS message format
	// (hence 'Records' being the name of the field), but genericapi will route the
	// request to the DispatchAlerts handler. This way all requests can be routed
	// by genericapi without having to inspect the message ahead of time.
	DispatchAlerts []*DispatchAlertsInput `json:"Records"`
	DeliverAlert   *DeliverAlertInput     `json:"deliverAlert"`
	SendTestAlert  *SendTestAlertInput    `json:"sendTestAlert"`
}

type SendTestAlertInput struct {
	OutputIds []string `json:"outputIds" validate:"gt=0,dive,uuid4"`
}

type SendTestAlertOutput struct {
	OutputID     string    `json:"outputId"`
	Message      string    `json:"message"`
	StatusCode   int       `json:"statusCode"`
	Success      bool      `json:"success"`
	DispatchedAt time.Time `json:"dispatchedAt"`
}