sast

type BuildOptions struct {
	MaxDepth int
	Excludes []string

	// IgnoreGit, when true, skips the .git directory entirely. The default
	// is false: the secrets subcommand walks .git to surface credentials
	// that exist only in past commits.
	IgnoreGit bool

	// IgnoreGlobs is an additional set of glob patterns to exclude. The
	// patterns are matched against the relative path and the base name
	// (mirroring --exclude). The CLI's --ignore flag is wired into this
	// slice so that a single --ignore "fixtures/**" is enough.
	IgnoreGlobs []string

	// IgnoreBinaries, when true, skips binary files entirely. When false
	// (the default for the secrets subcommand), binary files are inspected
	// with strings + EXIF and the result is added to FileContents.
	IgnoreBinaries bool

	// GitHistory, when true, walks the git history at rootPath and adds
	// each file version to FileContents under the __git_history__/ prefix.
	// Requires that IgnoreGit be false; if both are set, IgnoreGit wins.
	GitHistory bool

	// GitHistoryMaxCommits caps the number of commits walked.
	GitHistoryMaxCommits int
	// GitHistoryMaxFiles caps the number of file versions emitted.
	GitHistoryMaxFiles int
}

type Engine struct {
	// contains filtered or unexported fields
}

type EvalOptions struct {
	MaxDepth int
	Excludes []string

	// IgnoreGit, IgnoreGlobs, IgnoreBinaries, GitHistory, etc. are
	// forwarded to BuildScanInputWithOptions / LoadFileContentsWithOptions
	// so the secrets subcommand can enable binary and history scanning
	// without affecting the generic scan command's behaviour.
	IgnoreGit            bool
	IgnoreGlobs          []string
	IgnoreBinaries       bool
	GitHistory           bool
	GitHistoryMaxCommits int
	GitHistoryMaxFiles   int
	MinStringLength      int
}

type Finding struct {
	RuleID      string        `json:"rule_id"`
	Message     string        `json:"message"`
	ArtifactURI string        `json:"artifact_uri"`
	Severity    string        `json:"severity"`
	Level       string        `json:"level"`
	StartLine   int           `json:"start_line"`
	EndLine     int           `json:"end_line,omitempty"`
	Snippet     string        `json:"snippet"`
	Fingerprint string        `json:"-"`
	Metadata    *RuleMetadata `json:"-"`
}

type LoadOptions struct {
	// MaxFileSize is the upper bound for any single file's text content
	// (raw or extracted). Files larger than this are skipped entirely.
	MaxFileSize int64
	// IgnoreBinaries, when true, skips binary files. When false (the
	// default for the secrets subcommand), binary files are inspected:
	// printable strings are extracted with the secretscan package and any
	// EXIF/IPTC/XMP metadata is added under __exif__/.
	IgnoreBinaries bool
	// MinStringLength is the minimum run length to surface when extracting
	// strings from binaries. Defaults to secretscan.StringMin (4).
	MinStringLength int
}

type RuleMetadata struct {
	ID          string   `json:"id"`
	Name        string   `json:"name"`
	Description string   `json:"description"`
	HelpURI     string   `json:"help_uri"`
	Languages   []string `json:"languages"`
	Severity    string   `json:"severity"`
	Level       string   `json:"level"`
	Kind        string   `json:"kind"`
	CWE         []int    `json:"cwe"`
	CAPEC       []string `json:"capec"`
	ATTACKTech  []string `json:"attack_technique"`
	CVSSv4      string   `json:"cvssv4"`
	CWSS        string   `json:"cwss"`
	Tags        []string `json:"tags"`
}

type RuleRef struct {
	Org  string
	Repo string
}

type SARIFArtifact struct {
	Location *SARIFArtifactLocation `json:"location,omitempty"`
}

type SARIFArtifactLocation struct {
	URI string `json:"uri"`
}

type SARIFLocation struct {
	PhysicalLocation *SARIFPhysicalLocation `json:"physicalLocation,omitempty"`
}

type SARIFLog struct {
	Schema  string     `json:"$schema"`
	Version string     `json:"version"`
	Runs    []SARIFRun `json:"runs"`
}

type SARIFMessage struct {
	Text string `json:"text"`
}

type SARIFPhysicalLocation struct {
	ArtifactLocation *SARIFArtifactLocation `json:"artifactLocation,omitempty"`
	Region           *SARIFRegion           `json:"region,omitempty"`
}

type SARIFPropertyBag map[string]any

type SARIFRegion struct {
	StartLine int           `json:"startLine,omitempty"`
	EndLine   int           `json:"endLine,omitempty"`
	Snippet   *SARIFSnippet `json:"snippet,omitempty"`
}

type SARIFReportingDescriptor struct {
	ID               string           `json:"id"`
	Name             string           `json:"name,omitempty"`
	ShortDescription *SARIFMessage    `json:"shortDescription,omitempty"`
	HelpURI          string           `json:"helpUri,omitempty"`
	Properties       SARIFPropertyBag `json:"properties,omitempty"`
}

type SARIFResult struct {
	RuleID       string            `json:"ruleId"`
	Level        string            `json:"level,omitempty"`
	Kind         string            `json:"kind,omitempty"`
	Message      SARIFMessage      `json:"message"`
	Locations    []SARIFLocation   `json:"locations,omitempty"`
	Fingerprints map[string]string `json:"fingerprints,omitempty"`
	Properties   SARIFPropertyBag  `json:"properties,omitempty"`
}

type SARIFRun struct {
	Tool      SARIFTool       `json:"tool"`
	Results   []SARIFResult   `json:"results"`
	Artifacts []SARIFArtifact `json:"artifacts,omitempty"`
}

type SARIFSnippet struct {
	Text string `json:"text"`
}

type SARIFTool struct {
	Driver SARIFToolDriver `json:"driver"`
}

type SARIFToolDriver struct {
	Name           string                     `json:"name"`
	Version        string                     `json:"version,omitempty"`
	InformationURI string                     `json:"informationUri,omitempty"`
	Rules          []SARIFReportingDescriptor `json:"rules,omitempty"`
}

type SASTReport struct {
	Findings    []Finding
	Rules       []RuleMetadata
	RulesLoaded int // rules after filtering (kind/id) that were evaluated
	RulesTotal  int // rules loaded pre-filter (builtin + --rule repos)
}

type ScanInput struct {
	// FileSet maps each relative file path to true for O(1) existence checks in Rego.
	FileSet map[string]bool `json:"file_set"`
	// DirsByLanguage maps language name to directories containing that language's indicator files.
	DirsByLanguage map[string][]string `json:"dirs_by_language"`
	// FileContents maps relative path to file text. Populated lazily for small files
	// when content-level rules are present. Files over MaxFileSize and binary files are
	// skipped unless binary inspection is enabled (see FileScanOptions).
	FileContents map[string]string `json:"file_contents,omitempty"`
	// ScanRoot is the absolute path being scanned (for display; rules use relative paths).
	ScanRoot string `json:"scan_root"`
}