model

type Alert struct {
	// ID is unique identifier of alert. It would be used for aggregation. If ID is empty, it will be generated automatically.
	ID AlertID `json:"id"`

	// Version is schema version of alert. It should be overwritten with AlertSchemaVersion.
	Version string `json:"version"`

	// JobID is identifier of job that generates alert.
	JobID types.JobID `json:"job_id"`

	// Timestamp is time when alert is generated. If Timestamp is zero, it will be set to current time.
	Timestamp time.Time `json:"timestamp"`

	AlertBody
}

type AlertBody struct {
	// RuleID is identifier of rule that generates alert. It's optional.
	RuleID string `json:"rule_id"`

	// Title is short description of alert. It's required.
	Title string `json:"title"`

	// Description is detailed description of alert.
	Description string `json:"description"`

	// Timestamp is time when alert is generated. If Timestamp is nil, it will be set to current time. It allows not only string time format (RFC3339) but also integer (Unix timestamp) and float (Unix timestamp with nano seconds).
	Timestamp any `json:"timestamp"`

	// Attrs is key-value pairs of additional information of alert.
	Attrs Attrs `json:"attrs"`
}

type AlertID string

type Attrs map[string]any

type PolicyMetadata struct {
	Title       string    `json:"title"`
	Description string    `json:"description"`
	Tags        []string  `json:"tags"`
	Input       []QueryID `json:"input"`
	Package     string    `json:"package"`
	Location    string    `json:"location"`
}

type PolicyMetadataSet []*PolicyMetadata

type PolicySelector func(meta *PolicyMetadata) bool

type Queries []*Query

type Query struct {
	// contains filtered or unexported fields
}

type QueryID string

type QueryInput map[QueryID]any

type QueryOutput struct {
	Alert []AlertBody `json:"alert"`
}