auditfwd

type AuditReporter interface {
	ReportAudit(ctx context.Context, nodeID string, batch api.AuditBatch) error
}

type AuditSource interface {
	Collect(ctx context.Context) ([]api.AuditEntry, error)
}

type AuditdEntry struct {
	Timestamp time.Time
	Type      string
	UID       int
	GID       int
	PID       int
	Syscall   string
	Object    string
	Path      string
	Success   bool
	Raw       string
}

type AuditdReader interface {
	ReadEvents(ctx context.Context) ([]AuditdEntry, error)
}

type AuditdSource struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Enabled controls whether audit forwarding is active.
	// Default: true (set by ApplyDefaults).
	Enabled bool `yaml:"enabled"`

	// CollectInterval is the interval between collection cycles.
	// Must be at least 1s.
	CollectInterval time.Duration `yaml:"collect_interval"`

	// ReportInterval is the interval between reporting to the control plane.
	// Must be >= CollectInterval.
	ReportInterval time.Duration `yaml:"report_interval"`

	// BatchSize is the maximum number of audit entries per report batch.
	// Must be at least 1. Default: 500.
	BatchSize int `yaml:"batch_size"`

	// LocalEndpoint configures an optional local data-plane endpoint.
	LocalEndpoint api.LocalEndpointConfig `yaml:"local_endpoint"`
}

type Forwarder struct {
	// contains filtered or unexported fields
}

type IngestClient interface {
	ReportAudit(ctx context.Context, nodeID string, events []api.AuditEvent) (*api.IngestReceipt, error)
}

type K8sAuditEntry struct {
	Timestamp      time.Time
	Verb           string
	User           K8sUser
	ObjectRef      K8sObjectRef
	RequestURI     string
	ResponseStatus int
	Raw            string
}

type K8sAuditReader interface {
	ReadEvents(ctx context.Context) ([]K8sAuditEntry, error)
}

type K8sAuditSource struct {
	// contains filtered or unexported fields
}

type K8sObjectRef struct {
	Resource  string `json:"resource"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name,omitempty"`
}

type K8sUser struct {
	Username string   `json:"username"`
	Groups   []string `json:"groups,omitempty"`
}

type LocalReporter struct {
	// contains filtered or unexported fields
}

type MultiReporter struct {
	// contains filtered or unexported fields
}

type PlatformReporter struct {
	// contains filtered or unexported fields
}

type ProcessSource struct {
	// contains filtered or unexported fields
}

type SecretFetcher interface {
	FetchSecret(ctx context.Context, nodeID, name string, version int) (*api.SecretEnvelope, error)
}