idor

type Analyzer interface {
	// AnalyzeTraffic orchestrates the IDOR detection process. It takes a context
	// for cancellation, a slice of captured HTTP request-response pairs, and a
	// configuration object. It returns a slice of any discovered findings and an
	// error if the analysis could not be completed.
	AnalyzeTraffic(ctx context.Context, traffic []RequestResponsePair, config Config) ([]Finding, error)
}

type AuthArtifacts struct {
	// Map keys are the names of the headers (e.g., "Authorization")
	HeaderNames map[string]struct{}
	// Map keys are the names of the cookies (e.g., "session_id")
	CookieNames map[string]struct{}
}

type Config struct {
	Session       Session // The primary authenticated session (User A).
	SecondSession Session // The secondary authenticated session for horizontal checks (User B).

	// Strategy configuration
	SkipHorizontal      bool // Option to skip standard horizontal checks.
	SkipManipulation    bool // Option to skip manipulation checks.
	SkipUnauthenticated bool // Option to skip unauthenticated checks.
	// (Strategic 5.1: Horizontal Manipulation)
	SkipHorizontalManipulation bool // Option to skip horizontal manipulation checks (Pita test).

	// (Fix 3.2: Safety Configuration)
	AllowUnsafeMethods bool // If true, allows testing of POST, PUT, DELETE, PATCH. Default is false.

	ComparisonOptions jsoncompare.Options // Defines how JSON responses are normalized and compared.
	ConcurrencyLevel  int                 // The number of concurrent workers for replaying requests.
	HttpClient        *http.Client        // The HTTP client to use for replaying requests.
}

type ErrUnauthenticated struct {
	Message string
}

type EvaluationResult struct {
	Vulnerable       bool
	ComparisonResult *jsoncompare.ComparisonResult
	SeverityOverride Severity
	TestTypeOverride string
	EvidenceOverride string
}

type Finding struct {
	URL               string
	Method            string
	Evidence          string
	Severity          Severity
	TestType          string // e.g., "Horizontal", "Manipulation", "Unauthenticated", "HorizontalManipulation", "ResourceEnumeration"
	StatusCode        int
	Identifier        *ObservedIdentifier           // Details about the identifier that was manipulated.
	TestedValue       string                        // The value used to replace the original identifier.
	ComparisonDetails *jsoncompare.ComparisonResult // The detailed result from the JSON comparison.
}

type IDORAnalyzer struct {
	// contains filtered or unexported fields
}

type IdentifierLocation string

type IdentifierPool struct {
	// contains filtered or unexported fields
}

type IdentifierType string

type NilSession struct{}

type ObservedIdentifier struct {
	Value     string
	Type      IdentifierType
	Location  IdentifierLocation
	Key       string // The parameter name, JSON path, XPath, or encoded payload locator.
	PathIndex int    // The index in the URL path.

	// (Strategic 5.3) Fields for encoded payloads
	IsEncoded      bool               // Flag indicating if this ID was found within an encoded structure.
	EncodingType   string             // e.g., "Base64JSON", "JWT"
	ParentLocation IdentifierLocation // Where the encoded payload itself was located (e.g., Header)
	ParentKey      string             // The key of the encoded payload
}

type RequestResponsePair struct {
	Request      *http.Request
	RequestBody  []byte
	Response     *http.Response
	ResponseBody []byte
}

type Session interface {
	IsAuthenticated() bool
	ApplyToRequest(req *http.Request)
	// GetAuthArtifacts returns the names of headers and cookies that this session manages.
	GetAuthArtifacts() AuthArtifacts
}

type Severity string