detect

type Configurable interface {
	Configure(env func(string) string)
}

type Correlator interface {
	// Observe returns the identifiers under which content names credentials
	// of this provider (the recipients an encrypted file lists), or nil when
	// the object is of no interest. It runs on every scanned object and has
	// to be cheap; it must not keep a reference to content.
	Observe(content []byte) []string
	// Identifiers returns what the credential is known as in such content:
	// the public key of an identity. The scan matches them against what
	// Observe reported.
	Identifiers(tok Token) []string
}

type DryRunRevoker interface {
	DryRunRevoke(ctx context.Context, tok Token) error
}

type Kind string

type KindInfo struct {
	Kind Kind
	// Description is the human name: "personal access token (classic)".
	Description string
	// Revocable reports whether the provider's revocation endpoint accepts this kind.
	Revocable bool
	// RevokePage is where the owner revokes a credential of this kind by hand.
	RevokePage string
	// RevokeNote is added to the manual revocation advice when the API cannot
	// revoke the kind: what to check instead, or why it does not matter.
	RevokeNote string
	// RevokeEffect names a side effect of revoking through the API that is
	// easy to miss. The placeholder {app} stands for the issuing application.
	RevokeEffect string
	// AuditNote says how to find out whether a leaked credential of this kind
	// was used while it was exposed, and what the provider does on its own
	// when it spots the leak. Shown for every finding, revoked or not.
	AuditNote string
	// UnlocksLabel labels the advice line that lists what a credential of
	// this kind opens in the scanned repositories ("decrypts"). Set only for
	// the kinds of a Correlator.
	UnlocksLabel string
	// UnlocksNone is that line when nothing scanned names the credential.
	UnlocksNone string
}

type LocalSources struct {
	// Env lists environment variables tools read the credential from.
	Env []string
	// EnvFiles lists environment variables whose value is the path of a
	// file holding the credential.
	EnvFiles []string
	// ConfigFiles are relative to the XDG config directory (~/.config).
	ConfigFiles []string
	// HomeFiles are relative to the home directory.
	HomeFiles []string
	// Commands print a credential to stdout, such as `gh auth token`.
	Commands [][]string
}

type Provider interface {
	// Name is how the provider is called in reports: "GitHub", "Slack".
	Name() string
	// Kinds describes every credential family the provider detects.
	Kinds() []KindInfo
	// Find returns every credential of this provider in content. Offsets
	// are set; line numbers are filled in by the Registry.
	Find(content []byte) []Token
	// Verify asks the provider whether the credential is still accepted.
	// Only the provider's explicit invalid-credentials answer is reported as
	// revoked; anything else that is not a clean acceptance is unknown.
	Verify(ctx context.Context, tok Token) Verification
	// Revoke asks the provider to revoke the given credentials. A nil error
	// means every request was accepted; the caller confirms the outcome with
	// Verify.
	Revoke(ctx context.Context, tokens []Token) error
	// LocalSources lists where tools keep this provider's credentials on a
	// developer machine.
	LocalSources() LocalSources
}

type Registry struct {
	// contains filtered or unexported fields
}

type Token struct {
	Kind  Kind
	Value string
	// Offset is the byte offset of the token in the scanned content.
	Offset int
	// Line is the 1-based line the token starts on.
	Line int
	// ChecksumVerified reports whether the token carries a checksum that
	// was verified offline. Classic GitHub tokens do; every other format is
	// matched on shape alone.
	ChecksumVerified bool
	// Attribution is what the token's own shape says about its owner, without
	// contacting the provider: a team id in a Slack token, for example. Empty
	// when the format carries nothing of the sort.
	Attribution string
	// Secret is the material a credential needs besides Value when it is made
	// of several strings: the secret access key found next to an AWS key id,
	// and the session token of a temporary one. Its layout is the provider's
	// business. Value alone identifies the credential; Secret is never
	// printed, logged or fingerprinted.
	Secret string
}

type Verification struct {
	Status VerifyStatus `json:"status"`
	// Detail describes what the credential gives access to: user and scopes,
	// the workspace of a Slack token, the number of repositories an
	// installation token reaches.
	Detail string `json:"detail,omitempty"`
	// ClientID is the id of the application the credential was issued to,
	// when the provider reports one.
	ClientID string `json:"client_id,omitempty"`
	// App is the name of that application when patty knows the client id.
	App string `json:"app,omitempty"`
	// Expires is when the credential stops working, for credentials that expire.
	Expires string `json:"expires,omitempty"`
}

type VerifyStatus string