authentication

type Assessment struct {
	Verdict Verdict  `json:"verdict"`
	Reason  string   `json:"reason"`
	Signals []Signal `json:"signals,omitempty"`
	// Similarity is the auth/anon body similarity in [0,1], or -1 when it was
	// not computed.
	Similarity float64 `json:"similarity"`
}

type CheckMatcher struct {
	// contains filtered or unexported fields
}

type Credentials struct {
	// Headers are the headers a request sends for the session: the session's
	// own, minus any the operator pinned with an explicit -H.
	Headers map[string]string
	// Gen numbers the generation, from 1. Each successful re-login adds one.
	Gen uint64
	// At is when this generation was minted.
	At time.Time
	// ExpiresAt is when this generation expires, when the login said so (an
	// OAuth2 token's expires_in); zero when unknown. The session refreshes
	// shortly before it (see expiryLead).
	ExpiresAt time.Time
	// contains filtered or unexported fields
}

type DiscoverResult struct {
	Session      *Session
	StatusCode   int
	TokenSources []string // human-readable descriptions of where tokens were found
	RawResponse  string   // raw response for storage in login_response
}

type Duration time.Duration

type ExpectResponse struct {
	Status       []int  `yaml:"status,omitempty" json:"status,omitempty"`               // Acceptable status codes (e.g. [200, 201])
	BodyContains string `yaml:"body_contains,omitempty" json:"body_contains,omitempty"` // Response body must contain this string
}

type ExtractRule struct {
	Source  ExtractSource `yaml:"source" json:"source"`
	Name    string        `yaml:"name,omitempty" json:"name,omitempty"`         // Cookie name or header name
	Path    string        `yaml:"path,omitempty" json:"path,omitempty"`         // JSONPath for json source
	ApplyAs string        `yaml:"apply_as,omitempty" json:"apply_as,omitempty"` // Header template, e.g. "Authorization: Bearer {value}"
	// Regex extraction fields (source: "regex")
	Pattern string `yaml:"pattern,omitempty" json:"pattern,omitempty"` // Regex pattern with capture group
	Group   int    `yaml:"group,omitempty" json:"group,omitempty"`     // Capture group index (default: 1)
}

type ExtractSource string

type LintIssue struct {
	Field    string `json:"field"`    // dot-notation path, e.g. "sessions[0].login.url"
	Severity string `json:"severity"` // "error" or "warning"
	Message  string `json:"message"`
	// Line and Column locate the field in the source file (1-based); 0 when
	// the issue has no position (a missing field with no present parent, or a
	// document parsed without one).
	Line   int `json:"line,omitempty"`
	Column int `json:"column,omitempty"`
}

type LiveEvent struct {
	Kind    LiveEventKind
	Session string
	// Gen is the generation the event is about: the suspected one for suspect
	// and a failed relogin, the NEW one for a successful relogin.
	Gen uint64
	OK  bool
	// Reason says what triggered a suspect: "status", "redirect", "body"
	// (a logged_out match), "interval" (the proactive probe), "expiry" (the
	// credentials are about to expire) or "invalidate".
	Reason string
	// Attempts is how many logins a relogin cycle ran.
	Attempts  int
	Err       error
	OnFailure ReauthOnFailure
}

type LiveEventKind string

type LiveOptions struct {
	// Manager re-runs the login (rehydrate) and supplies the probe transport.
	// Nil disables re-login: a confirmed logout goes straight to failed.
	Manager *Manager
	// ProbeClient sends the check.url probe. Nil uses the manager's login
	// transport with redirects not followed (Go's default transport when
	// there is no manager).
	ProbeClient *http.Client
	// ProbeBase resolves a relative check.url (a scan target). Empty falls back
	// to the login URL.
	ProbeBase string
	// Pinned are header names the operator set explicitly (-H): the session
	// never overrides them.
	Pinned []string
	// OnEvent receives suspect / relogin / lost events. Optional.
	OnEvent func(LiveEvent)
	// Context bounds the probes and re-logins; Close cancels it too.
	Context context.Context
	// WaitBudget bounds how long Wait parks a request during a re-login.
	// Zero uses the manager's login budget (DefaultLoginBudget).
	WaitBudget time.Duration

	// Test seams. Nil means the real clock.
	Now   func() time.Time
	Sleep func(ctx context.Context, d time.Duration) error
}

type LiveSession struct {
	// contains filtered or unexported fields
}

type LiveState int32

type LoggedInRule struct {
	Status       []int  `yaml:"status,omitempty" json:"status,omitempty"`
	BodyContains string `yaml:"body_contains,omitempty" json:"body_contains,omitempty"`
	BodyRegex    string `yaml:"body_regex,omitempty" json:"body_regex,omitempty"`
	// HeaderRegex is matched against each response header rendered as
	// "Name: value" (e.g. 'Content-Type: application/json').
	HeaderRegex string `yaml:"header_regex,omitempty" json:"header_regex,omitempty"`
}

type LoggedOutRule struct {
	Status []int `yaml:"status,omitempty" json:"status,omitempty"`
	// RedirectRegex is matched against the Location header of a 3xx.
	RedirectRegex string `yaml:"redirect_regex,omitempty" json:"redirect_regex,omitempty"`
	BodyRegex     string `yaml:"body_regex,omitempty" json:"body_regex,omitempty"`
}

type LoginFlow struct {
	URL         string        `yaml:"url" json:"url"`
	Method      string        `yaml:"method" json:"method"`
	ContentType string        `yaml:"content_type,omitempty" json:"content_type,omitempty"`
	Body        string        `yaml:"body,omitempty" json:"body,omitempty"`
	Extract     []ExtractRule `yaml:"extract,omitempty" json:"extract,omitempty"`
	// Shorthand: type + token_path expand into extract rules automatically.
	Type      LoginType `yaml:"type,omitempty" json:"type,omitempty"`
	TokenPath string    `yaml:"token_path,omitempty" json:"token_path,omitempty"`
	// Response validation.
	Expect *ExpectResponse `yaml:"expect,omitempty" json:"expect,omitempty"`
	// Multi-step login flows. When set, URL/Method/Body/Extract on the parent are ignored.
	Steps []LoginStep `yaml:"steps,omitempty" json:"steps,omitempty"`
	// Headers are extra request headers sent with every login request: the
	// single request, each step (a step's own headers win), or the OAuth2
	// token request. Values support the {{env:…}} / {{totp:…}} templates.
	Headers map[string]string `yaml:"headers,omitempty" json:"headers,omitempty"`

	// OAuth2 token endpoint (type oauth2_client_credentials or
	// oauth2_refresh_token; see oauth.go). Every value supports the
	// {{env:…}} templates; ${ENV} is expanded when the file loads.
	TokenURL     string `yaml:"token_url,omitempty" json:"token_url,omitempty"`
	ClientID     string `yaml:"client_id,omitempty" json:"client_id,omitempty"`
	ClientSecret string `yaml:"client_secret,omitempty" json:"client_secret,omitempty"`
	// Scope is space- (or comma-) separated. Sent with client_credentials.
	Scope string `yaml:"scope,omitempty" json:"scope,omitempty"`
	// Audience is sent as the `audience` parameter with client_credentials.
	Audience     string `yaml:"audience,omitempty" json:"audience,omitempty"`
	RefreshToken string `yaml:"refresh_token,omitempty" json:"refresh_token,omitempty"`
	// AuthStyle is how the client authenticates: "header" (HTTP Basic) or
	// "body" (form fields). Empty tries header, then body.
	AuthStyle string `yaml:"auth_style,omitempty" json:"auth_style,omitempty"`
	// contains filtered or unexported fields
}

type LoginRequest struct {
	Method  string
	URL     string
	Headers map[string]string
	Body    string
	Raw     string // original raw request text
}

type LoginResult struct {
	Session string `json:"session"`
	// OK is false when the login failed: exit 1 for `auth load`. An OK result
	// with a Reason (unverified) is a warning.
	OK bool `json:"ok"`
	// Verified: an expect block passed, or the response showed the login
	// worked (a credential extracted, or a redirect away from the login URL)
	// with no login form left in it.
	Verified bool `json:"verified"`
	// Status is the status of the last response the flow received.
	Status int `json:"status,omitempty"`
	// URL is the request URL of the last request sent (the failing step's, for
	// a multi-step flow that stopped early).
	URL string `json:"url,omitempty"`
	// FinalURL is where that request ended up after redirects.
	FinalURL  string   `json:"final_url,omitempty"`
	Redirects []string `json:"redirects,omitempty"`
	// Step is the index of the last step attempted in a multi-step flow; absent
	// for a single-request flow.
	Step *int `json:"step,omitempty"`
	// ExtractedHeaders names (never values) the headers the login produced.
	ExtractedHeaders []string `json:"extracted_headers,omitempty"`
	// ExpiresAt is when the credentials expire, when the login said so (an
	// OAuth2 token's expires_in).
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
	Reason    string     `json:"reason,omitempty"`
	// Message explains a failure or a warning in prose.
	Message string `json:"message,omitempty"`
	// Err is the failure, for Go callers.
	Err error `json:"-"`
}

type LoginStep struct {
	URL         string `yaml:"url" json:"url"`
	Method      string `yaml:"method" json:"method"`
	ContentType string `yaml:"content_type,omitempty" json:"content_type,omitempty"`
	// Headers are extra request headers for this step, applied after the
	// flow's own login.headers (a step header wins). Values support {var}
	// and the {{env:…}} / {{totp:…}} templates, like url and body.
	Headers map[string]string `yaml:"headers,omitempty" json:"headers,omitempty"`
	Body    string            `yaml:"body,omitempty" json:"body,omitempty"`
	Extract []ExtractRule     `yaml:"extract,omitempty" json:"extract,omitempty"`
	Expect  *ExpectResponse   `yaml:"expect,omitempty" json:"expect,omitempty"`
}

type LoginType string

type Manager struct {
	// contains filtered or unexported fields
}

type ManagerOption func(*Manager)

type ParseError struct {
	File   string
	Line   int
	Column int
	Err    error
}

type ParseOptions struct {
	// Strict reports unknown fields as errors (auth lint). Otherwise they are
	// warnings, so an existing file with an extra key keeps loading.
	Strict bool
	// Agent forces the lenient agent session-config.json decoder (auth load
	// --agent-format, or a path that names an agent session file).
	Agent bool
	// KeepEnvRefs leaves ${ENV} references unexpanded, for a caller that
	// writes the sessions back to a file another loader expands (expanding
	// twice would mangle a value containing '$').
	KeepEnvRefs bool
}

type ProbeResponse struct {
	Status int
	Header http.Header
	Body   []byte
	// URL is the request URL, used to resolve a relative Location.
	URL string
	Err error
}

type ReauthOnFailure string

type Role string

type Session struct {
	Name    string            `yaml:"name" json:"name"`
	Role    Role              `yaml:"role" json:"role"`
	Headers map[string]string `yaml:"headers,omitempty" json:"headers,omitempty"`
	Login   *LoginFlow        `yaml:"login,omitempty" json:"login,omitempty"`
	// LoginRequest is a raw HTTP request string for the login flow.
	LoginRequest string `yaml:"login_request,omitempty" json:"login_request,omitempty"`
	// Check says how to tell whether the session is still logged in
	// (loggedin.go). Optional; scanning_strategy.session supplies defaults.
	Check *SessionCheck `yaml:"check,omitempty" json:"check,omitempty"`
	// Reauth says what a scan does once Check finds the session logged out.
	Reauth *SessionReauth `yaml:"reauth,omitempty" json:"reauth,omitempty"`
	// contains filtered or unexported fields
}

type SessionCheck struct {
	// URL is the active probe. A path ("/api/me") resolves against the target
	// origin. Optional when logged_out has a status or redirect indicator.
	URL    string `yaml:"url,omitempty" json:"url,omitempty"`
	Method string `yaml:"method,omitempty" json:"method,omitempty"`
	// LoggedIn must hold on the probe's response.
	LoggedIn *LoggedInRule `yaml:"logged_in,omitempty" json:"logged_in,omitempty"`
	// LoggedOut flags scan traffic (and the probe) as logged out.
	LoggedOut *LoggedOutRule `yaml:"logged_out,omitempty" json:"logged_out,omitempty"`
	// SampleEvery evaluates the logged_out body regex on 1 in N scan
	// responses (status and Location are checked on every response). 0 means
	// DefaultCheckSampleEvery.
	SampleEvery int `yaml:"sample_every,omitempty" json:"sample_every,omitempty"`
	// Interval runs the active probe proactively at most this often; 0 probes
	// only when traffic looks logged out.
	Interval Duration `yaml:"interval,omitempty" json:"interval,omitempty"`
}

type SessionConfig struct {
	Sessions []Session `yaml:"sessions" json:"sessions"`
}

type SessionDefaults struct {
	// ValidateURL fills check.url.
	ValidateURL string
	// ReauthOnStatus fills check.logged_out.status.
	ReauthOnStatus []int
	// ReauthInterval fills check.interval.
	ReauthInterval time.Duration
}

type SessionDocument struct {
	Form     SessionForm
	Sessions []*Session
	// Issues are what parsing itself found: unknown fields, with line/column.
	// Semantic problems come from Lint.
	Issues []LintIssue
	// contains filtered or unexported fields
}

type SessionForm string

type SessionReauth struct {
	// Enabled defaults to true when the session has a check block.
	Enabled *bool `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	// MaxAttempts is the number of consecutive failed re-logins before giving
	// up. 0 means DefaultReauthMaxAttempts.
	MaxAttempts int `yaml:"max_attempts,omitempty" json:"max_attempts,omitempty"`
	// Backoff is the wait after the first failure; it doubles per failure.
	// 0 means DefaultReauthBackoff.
	Backoff   Duration        `yaml:"backoff,omitempty" json:"backoff,omitempty"`
	OnFailure ReauthOnFailure `yaml:"on_failure,omitempty" json:"on_failure,omitempty"`
	// PauseTraffic holds this session's requests while it re-logs in. Default
	// true.
	PauseTraffic *bool `yaml:"pause_traffic,omitempty" json:"pause_traffic,omitempty"`
}

type Signal struct {
	Name   string `json:"name"`
	Side   string `json:"side,omitempty"`
	Detail string `json:"detail,omitempty"`
}

type Verdict string