processor

type ActivityBuilder struct {
	// Resource information from the policy
	APIGroup string
	Kind     string
}

type AuditPolicyLookup interface {
	// MatchAudit looks up matching audit rules for the given resource and
	// evaluates them against the provided audit map.
	// Returns the first matching result, or nil if no policy matched.
	MatchAudit(apiGroup, resource string, auditMap map[string]any) (*MatchedPolicy, error)
}

type DLQConfig struct {
	// Enabled controls whether failed events are published to the DLQ.
	Enabled bool

	// StreamName is the NATS JetStream stream name for the DLQ.
	StreamName string

	// SubjectPrefix is the subject prefix for DLQ messages.
	// Messages are published to: <prefix>.<event_type>.<api_group>.<kind>
	SubjectPrefix string
}

type DLQPublisher interface {
	// PublishAuditFailure publishes a failed audit event to the DLQ.
	// policyVersion should be the policy.Generation when available, or 0 if no policy.
	// Returns nil if the DLQ is disabled.
	PublishAuditFailure(ctx context.Context, payload json.RawMessage, policyName string, policyVersion int64, ruleIndex int, errorType ErrorType, err error, resource *DeadLetterResource, tenant *DeadLetterTenant) error

	// PublishEventFailure publishes a failed Kubernetes event to the DLQ.
	// policyVersion should be the policy.Generation when available, or 0 if no policy.
	// Returns nil if the DLQ is disabled.
	PublishEventFailure(ctx context.Context, payload json.RawMessage, policyName string, policyVersion int64, ruleIndex int, errorType ErrorType, err error, resource *DeadLetterResource, tenant *DeadLetterTenant) error
}

type DeadLetterEvent struct {
	// Type identifies whether this is an audit log or Kubernetes event.
	Type EventType `json:"type"`

	// OriginalPayload contains the raw event JSON that failed processing.
	OriginalPayload json.RawMessage `json:"originalPayload"`

	// Error contains the error message from the failed processing attempt.
	Error string `json:"error"`

	// ErrorType classifies the type of error (cel_match, cel_summary, unmarshal).
	ErrorType ErrorType `json:"errorType"`

	// PolicyName is the name of the ActivityPolicy that failed evaluation.
	PolicyName string `json:"policyName"`

	// PolicyVersion is the policy.Generation when the failure occurred.
	// Used to trigger immediate retry when the policy is updated.
	PolicyVersion int64 `json:"policyVersion"`

	// RuleIndex is the index of the rule within the policy that failed.
	// -1 indicates the error occurred before rule evaluation.
	RuleIndex int `json:"ruleIndex"`

	// Timestamp is when the failure occurred.
	Timestamp metav1.Time `json:"timestamp"`

	// Tenant contains multi-tenancy information if available.
	Tenant *DeadLetterTenant `json:"tenant,omitempty"`

	// Resource contains information about the target resource.
	Resource *DeadLetterResource `json:"resource,omitempty"`

	// RetryCount tracks how many times this event has been retried.
	RetryCount int `json:"retryCount"`

	// LastRetryAt is when the last retry attempt occurred.
	LastRetryAt *metav1.Time `json:"lastRetryAt,omitempty"`

	// NextRetryAfter is when the event becomes eligible for the next retry.
	// Nil means the event has not been retried yet.
	NextRetryAfter *metav1.Time `json:"nextRetryAfter,omitempty"`
}

type DeadLetterResource struct {
	// APIGroup is the API group of the resource (empty for core resources).
	APIGroup string `json:"apiGroup,omitempty"`
	// Kind is the kind of the resource.
	Kind string `json:"kind,omitempty"`
	// Name is the name of the resource.
	Name string `json:"name,omitempty"`
	// Namespace is the namespace of the resource (empty for cluster-scoped).
	Namespace string `json:"namespace,omitempty"`
}

type DeadLetterTenant struct {
	// Type is the tenant type (platform, organization, project).
	Type string `json:"type,omitempty"`
	// Name is the tenant name.
	Name string `json:"name,omitempty"`
}

type ErrorType string

type EvaluationResult struct {
	// Activity is the generated activity, or nil if no rule matched
	Activity *v1alpha1.Activity

	// MatchedRuleIndex is the index of the rule that matched, or -1 if none matched
	MatchedRuleIndex int

	// MatchedRuleType is "audit" or "event" depending on which rule matched
	MatchedRuleType string

	// MatchedRuleName is the name of the matched rule from the policy spec
	MatchedRuleName string
}

type EventPolicyLookup interface {
	// MatchEvent looks up matching event rules for the given resource and
	// evaluates them against the provided event map.
	// Returns the first matching result, or nil if no policy matched.
	MatchEvent(apiGroup, kind string, eventMap map[string]any) (*MatchedPolicy, error)
}

type EventProcessor struct {
	// contains filtered or unexported fields
}

type EventType string

type KindResolver func(apiGroup, resource string) (string, error)

type MatchedPolicy struct {
	// PolicyName is the name of the matching policy.
	PolicyName string
	// Generation is the policy generation (version) that produced this match.
	Generation int64
	// APIGroup is the API group of the target resource.
	APIGroup string
	// Kind is the kind of the target resource.
	Kind string
	// Summary is the generated activity summary.
	Summary string
	// Links contains clickable references extracted from link() calls in the summary template.
	Links []cel.Link
}

type NATSDLQPublisher struct {
	// contains filtered or unexported fields
}

type PolicyEvaluationError struct {
	PolicyName string
	RuleIndex  int
	Err        error
}

type PolicyRule interface {
	// IsValid returns true if the rule compiled successfully.
	IsValid() bool
	// EvaluateEventMatch evaluates the match expression against an event map.
	EvaluateEventMatch(eventMap map[string]any) (bool, error)
	// EvaluateAuditMatch evaluates the match expression against an audit map.
	EvaluateAuditMatch(auditMap map[string]any) (bool, error)
	// EvaluateSummary evaluates the summary template with the given variables.
	// Returns the rendered summary, any links collected via link() calls, and any error.
	EvaluateSummary(vars map[string]any) (string, []cel.Link, error)
}

type PolicySpec struct {
	// Name is the policy name.
	Name string
	// APIGroup is the target resource's API group.
	APIGroup string
	// Kind is the target resource's kind.
	Kind string
	// Resource is the plural resource name.
	Resource string
	// ResourceVersion is used for cache invalidation.
	ResourceVersion string
	// AuditRules are the CEL match/summary rule pairs for audit events.
	AuditRules []RuleSpec
	// EventRules are the CEL match/summary rule pairs for Kubernetes events.
	EventRules []RuleSpec
}

type PolicyUpdater interface {
	// AddPolicy adds a policy to the cache.
	AddPolicy(policy *PolicySpec) error
	// UpdatePolicy updates a policy in the cache.
	UpdatePolicy(oldPolicy, newPolicy *PolicySpec) error
	// RemovePolicy removes a policy from the cache.
	RemovePolicy(policy *PolicySpec)
}

type ResourceResolver func(apiGroup, kind string) (string, error)

type RuleSpec struct {
	Match   string
	Summary string
}