policy

type AuditPolicy struct {
	Enabled       bool   `yaml:"enabled,omitempty"`        // Enable audit logging
	LogPath       string `yaml:"log_path,omitempty"`       // Path to audit log file
	LogLevel      string `yaml:"log_level,omitempty"`      // Audit log level (info, warn, error)
	IncludeValues bool   `yaml:"include_values,omitempty"` // Include secret values in audit log (NOT RECOMMENDED)
}

type ComplexityPolicy struct {
	MinLength     int  `yaml:"min_length,omitempty"`     // Minimum secret length
	MaxLength     int  `yaml:"max_length,omitempty"`     // Maximum secret length
	RequireUpper  bool `yaml:"require_upper,omitempty"`  // Require uppercase letters
	RequireLower  bool `yaml:"require_lower,omitempty"`  // Require lowercase letters
	RequireDigit  bool `yaml:"require_digit,omitempty"`  // Require digits
	RequireSymbol bool `yaml:"require_symbol,omitempty"` // Require symbols
}

type EnvironmentPolicy struct {
	AllowedProviders []string `yaml:"allowed_providers,omitempty"` // Environment-specific provider whitelist
	BlockedProviders []string `yaml:"blocked_providers,omitempty"` // Environment-specific provider blacklist
	RequireApproval  bool     `yaml:"require_approval,omitempty"`  // Require manual approval for this env
	MaxSecrets       int      `yaml:"max_secrets,omitempty"`       // Maximum number of secrets allowed
}

type OutputPolicy struct {
	AllowedPaths     []string `yaml:"allowed_paths,omitempty"`     // Whitelist of allowed output paths
	BlockedPaths     []string `yaml:"blocked_paths,omitempty"`     // Blacklist of blocked output paths
	RequireGitignore bool     `yaml:"require_gitignore,omitempty"` // Require output files to be in .gitignore
	MaxTTL           int      `yaml:"max_ttl,omitempty"`           // Maximum TTL for output files (seconds)
}

type PolicyConfig struct {
	// Global policies
	AllowedProviders  []string `yaml:"allowed_providers,omitempty"`  // Whitelist of allowed provider types
	BlockedProviders  []string `yaml:"blocked_providers,omitempty"`  // Blacklist of blocked provider types
	RequireEncryption bool     `yaml:"require_encryption,omitempty"` // Require encrypted provider configs

	// Secret policies
	SecretComplexity  *ComplexityPolicy `yaml:"secret_complexity,omitempty"`  // Secret value complexity requirements
	ForbiddenPatterns []string          `yaml:"forbidden_patterns,omitempty"` // Regex patterns that secrets must not match
	RequiredPatterns  []string          `yaml:"required_patterns,omitempty"`  // Regex patterns that secrets must match

	// Environment policies
	EnvironmentRules map[string]*EnvironmentPolicy `yaml:"environment_rules,omitempty"` // Per-environment restrictions

	// File policies
	OutputRestrictions *OutputPolicy `yaml:"output_restrictions,omitempty"` // File output restrictions

	// Audit policies
	AuditLogging *AuditPolicy `yaml:"audit_logging,omitempty"` // Audit and compliance logging
}

type PolicyEnforcer struct {
	// contains filtered or unexported fields
}