plugin

type AWSCommonRecon struct {
	AWSReconBase
	Concurrency  int      `param:"concurrency"    desc:"Maximum concurrent API requests" default:"5"`
	Regions      []string `param:"regions"        desc:"AWS regions to scan" default:"all" shortcode:"r"`
	ResourceType []string `param:"resource-type"  desc:"AWS Cloud Control resource type" default:"all" shortcode:"t"`
	ResourceARN  []string `param:"resource-arn"   desc:"AWS target resource ARN" shortcode:"a"`
}

type AWSReconBase struct {
	OutputDir  string `param:"output-dir"   desc:"Base output directory" default:"aurelian-output"`
	Profile    string `param:"profile"      desc:"AWS profile to use" shortcode:"p"`
	ProfileDir string `param:"profile-dir"  desc:"Set to override the default AWS profile directory"`
	OpsecLevel string `param:"opsec_level"  desc:"Operational security level for AWS operations" default:"none"`
}

type AzureCommonRecon struct {
	AzureReconBase
	Concurrency     int                    `param:"concurrency" desc:"Maximum concurrent API requests" default:"5"`
	SubscriptionIDs []string               `` /* 135-byte string literal not displayed */
	AzureCredential azcore.TokenCredential `param:"-"`
}

type AzureEnricherConfig struct {
	Context    context.Context
	Credential azcore.TokenCredential
}

type AzureEnricherFunc func(cfg AzureEnricherConfig, result *templates.ARGQueryResult) error

type AzureEntraRecon struct {
	AzureReconBase
	AzureCredential azcore.TokenCredential `param:"-"`
}

type AzureEvaluatorFunc func(result templates.ARGQueryResult) bool

type AzureReconBase struct {
	OutputDir string `param:"output-dir" desc:"Base output directory" default:"aurelian-output"`
}

type Category string

type Config struct {
	Args    map[string]any  // Runtime arguments (backward compat)
	Params  Parameters      // Typed parameter set
	Context context.Context // Execution context
	Output  io.Writer       // Output destination
	Verbose bool            // Verbose logging
	Log     *Logger         // User-facing terminal logger
}

type ConsoleFormatter struct {
	Writer io.Writer
}

type EnricherConfig struct {
	Context   context.Context
	AWSConfig aws.Config
}

type EnricherFunc func(cfg EnricherConfig, r *output.AWSResource) error

type Finding struct {
	model.BaseAurelianModel
	// RuleID is the machine-readable identifier for the detection rule
	// Examples: "lambda-no-auth-function-url", "s3-public-bucket"
	RuleID string

	// Severity indicates impact level
	// Valid values: "low", "medium", "high", "critical"
	Severity string

	// Name is the human-readable name of the finding
	// Example: "Lambda Function URL Without Authentication"
	Name string

	// Description provides detailed explanation of the vulnerability
	Description string

	// Resource is the cloud resource with the vulnerability
	Resource output.AWSResource

	// References contains external documentation links (optional)
	References []string

	// Recommendation provides remediation guidance (optional)
	Recommendation string
}

type Formatter interface {
	Format(results []model.AurelianModel) error
}

type GCPCommonRecon struct {
	ProjectID          []string              `param:"project-id"           desc:"GCP project IDs" shortcode:"p"`
	OrgID              []string              `param:"org-id"               desc:"GCP organization IDs" shortcode:"o"`
	FolderID           []string              `param:"folder-id"            desc:"GCP folder IDs"`
	ResourceType       []string              `param:"resource-type"        desc:"Resource types to enumerate" default:"all" shortcode:"t"`
	Concurrency        int                   `param:"concurrency"          desc:"Max concurrent API requests" default:"5"`
	CredentialsFile    string                `param:"creds-file"           desc:"Path to GCP credentials JSON" shortcode:"c"`
	IncludeSysProjects bool                  `param:"include-sys-projects" desc:"Include system projects" default:"false"`
	ClientOptions      []option.ClientOption `param:"-"`
	ResolvedProjects   []string              `param:"-"`
}

type GCPEnricherConfig struct {
	Context       context.Context
	ClientOptions []option.ClientOption
}

type GCPEnricherFunc func(cfg GCPEnricherConfig, r *output.GCPResource) error

type GraphFormatter struct {
	// contains filtered or unexported fields
}

type GraphOutputBase struct {
	Neo4jURI      string `param:"neo4j-uri" desc:"Neo4j connection URI (e.g., bolt://localhost:7687)" default:""`
	Neo4jUsername string `param:"neo4j-username" desc:"Neo4j username" default:"neo4j"`
	Neo4jPassword string `param:"neo4j-password" desc:"Neo4j password" default:"neo4j" sensitive:"true"`
}

type JSONFormatter struct {
	Writer io.Writer
	Pretty bool
}

type Logger struct {
	// contains filtered or unexported fields
}

type Module interface {
	// Metadata
	ID() string
	Name() string
	Description() string
	Platform() Platform
	Category() Category
	OpsecLevel() string
	Authors() []string
	References() []string
	SupportedResourceTypes() []string

	// Parameters returns a pointer to the module's config struct for parameter
	// binding, or nil if the module has no parameters. The returned value is
	// used both for deriving CLI flags (via ParametersFrom) and as the bind
	// target for Bind before Run is called.
	Parameters() any

	// Execution — send results into the pipeline via out.Send().
	// The caller owns the pipeline lifecycle (including Close).
	Run(cfg Config, out *pipeline.P[model.AurelianModel]) error
}

type ModuleWrapper struct {
	Module
}

type OrgPoliciesParam struct {
	OrgPoliciesFile string                   `param:"org-policies-file" desc:"Path to Org Policies JSON file"`
	OrgPolicies     *orgpolicies.OrgPolicies `param:"-"`
}

type Parameter struct {
	Name        string
	Description string
	Type        string // "string", "int", "bool", "[]string"
	Required    bool
	Default     any
	Shortcode   string
	Hidden      bool           // Hide from help output
	Pattern     *regexp.Regexp // Regex validation for string values
	Enum        []string       // Allowed values (case-insensitive)
	Sensitive   bool           // Mask in logs and help text
	Value       any            // Runtime value
	IsSet       bool           // Whether explicitly provided
}

type Parameters struct {
	// contains filtered or unexported fields
}

type Platform string

type PostBinder interface {
	PostBind(cfg Config, m Module) error
}

type RegistryEntry struct {
	Module   Module
	Platform Platform
	Category Category
}

type SlogHandler struct {
	// contains filtered or unexported fields
}