squeeze

type ActionInfo struct {
	Name     string // action name, e.g. "CreateTransfer"
	File     string // path to the action file
	GateFile string // expected gate file path
	HasGate  bool   // whether the gate file exists
}

type AnalysisContext struct {
	Routes         []AnalyzedRoute
	Methods        map[string]*ControllerMethod
	Requests       []generator.RequestDef
	Tables         []*schema.Table
	Config         SqueezeConfig
	FuncRegistry   FuncRegistry
	HasGraphQL     bool // true if the project has a graphql/ directory
	RBACRoles      *RBACRoleSet
	RBACDefaults   []RBACDefault
	Actions        []ActionInfo
	GraphQLExposed map[string]bool // table/model names exposed via GraphQL policies (nil = no policies)
	ProjectDir     string
}

type AnalyzedRoute struct {
	Method         string   // GET, POST, PUT, PATCH, DELETE
	Path           string   // full path including group prefixes
	ControllerType string   // e.g. "PostController"
	MethodName     string   // e.g. "Destroy"
	Middleware     []string // accumulated middleware names from groups + per-route
	File           string
	Line           int
}

type AppConfig struct {
	Path       string   `yaml:"path"`                 // directory containing go.mod, relative to pickle.yaml
	Migrations []string `yaml:"migrations,omitempty"` // migration dirs relative to app path; default: ["database/migrations"]
	Config     string   `yaml:"config,omitempty"`     // config dir relative to app path; default: "config"
}

type CallChain struct {
	Segments []ChainSegment
	Line     int
	AuthVars map[string]bool // auth-tainted variable names in scope for this chain
}

type ChainSegment struct {
	Name string
	Args []ast.Expr
}

type CompositeLitInfo struct {
	PackageName string   // e.g. "models"
	TypeName    string   // e.g. "Post"
	FieldNames  []string // fields set in the literal
	Line        int
}

type Config struct {
	Squeeze  SqueezeConfig            `yaml:"squeeze"`
	Apps     map[string]AppConfig     `yaml:"apps,omitempty"`
	Services map[string]ServiceConfig `yaml:"services,omitempty"`
}

type ControllerMethod struct {
	ControllerType string
	MethodName     string
	File           string
	Line           int
	Body           *ast.BlockStmt
	Fset           *token.FileSet
}

type CtxJSONCall struct {
	Line        int
	PayloadExpr ast.Expr
}

type Finding struct {
	Rule     string
	Severity Severity
	File     string
	Line     int
	Message  string
}

type FuncRegistry map[string]*ParsedFunc

type MiddlewareConfig struct {
	Auth      []string `yaml:"auth"`       // middleware that provides authentication
	Admin     []string `yaml:"admin"`      // middleware that provides admin access (implies auth)
	RateLimit []string `yaml:"rate_limit"` // middleware that provides rate limiting
	CSRF      []string `yaml:"csrf"`       // middleware that provides CSRF protection
}

type MustParseCall struct {
	Line        int
	HasCtxParam bool // argument contains ctx.Param(...)
	HasCtxAuth  bool // argument contains ctx.Auth()
}

type ParamCall struct {
	Name string
	Line int
}

type ParsedFunc struct {
	Body   *ast.BlockStmt
	Fset   *token.FileSet
	Params []*ast.Field
}

type RBACDefault struct {
	Role string
	File string
	Line int
}

type RBACRoleSet struct {
	Defined map[string]bool // all roles that have been defined
	Removed map[string]bool // roles that were defined then removed
}

type RoleHit struct {
	Role string
	Line int
}

type Rule func(ctx *AnalysisContext) []Finding

type ServiceConfig struct {
	Dir string `yaml:"dir"` // relative to project root, e.g. "services/api"
}

type Severity int

type SqueezeConfig struct {
	Middleware MiddlewareConfig `yaml:"middleware"`
	Rules      map[string]bool  `yaml:"rules"`
}