security

type APIKeyAuthenticator struct {
	// contains filtered or unexported fields
}

type APIKeyConfig struct {
	Source    string `yaml:"source"` // environment, file
	FilePath  string `yaml:"file_path,omitempty"`
	EnvPrefix string `yaml:"env_prefix,omitempty"`
}

type AllowAllAuthorizer struct{}

type ArgValidator interface {
	Validate(value any) error
}

type AuditBackend interface {
	Write(event *StructuredAuditEvent) error
	Close() error
}

type AuditConfig struct {
	Enabled          bool        `yaml:"enabled"`
	Backend          string      `yaml:"backend"` // memory, json, syslog
	LogAuthDecisions bool        `yaml:"log_auth_decisions"`
	SIEM             *SIEMConfig `yaml:"siem,omitempty"`
}

type AuditEvent struct {
	Timestamp time.Time              `json:"timestamp"`
	EventType string                 `json:"event_type"`
	UserID    string                 `json:"user_id,omitempty"`
	SessionID string                 `json:"session_id,omitempty"`
	IPAddress string                 `json:"ip_address,omitempty"`
	UserAgent string                 `json:"user_agent,omitempty"`
	Resource  string                 `json:"resource"`
	Action    string                 `json:"action"`
	Result    string                 `json:"result"`
	Error     string                 `json:"error,omitempty"`
	Metadata  map[string]interface{} `json:"metadata,omitempty"`
}

type AuditEventType string

type AuditLogger interface {
	Log(event *AuditEvent)
	LogToolExecution(ctx context.Context, toolName string, args map[string]interface{}, result interface{}, err error)
	LogAuthAttempt(ctx context.Context, success bool, err error)
	LogAuthorizationCheck(ctx context.Context, resource string, permission Permission, allowed bool)
	Close() error
}

type AuditMiddleware struct {
	// contains filtered or unexported fields
}

type AuthContext struct {
	Principal   *Principal
	SessionID   string
	IPAddress   string
	UserAgent   string
	RequestTime time.Time
}

type AuthExtractor interface {
	// ExtractAuth extracts authentication information and returns a Principal
	ExtractAuth(ctx context.Context, r *http.Request) (*Principal, error)
}

type AuthMode string

type Authenticator interface {
	Authenticate(ctx context.Context, token string) (*Principal, error)
}

type AuthorizationConfig struct {
	Enabled     bool   `yaml:"enabled"`
	DefaultDeny bool   `yaml:"default_deny"`
	PolicyFile  string `yaml:"policy_file,omitempty"`
}

type Authorizer interface {
	Authorize(ctx context.Context, principal *Principal, resource string, permission Permission) error
}

type BuiltinAuthConfig struct {
	Method string `yaml:"method"` // api_key, jwt, oauth2

	// API Key configuration
	APIKeys *APIKeyConfig `yaml:"api_keys,omitempty"`
}

type BuiltinAuthExtractor struct {
	// contains filtered or unexported fields
}

type CircuitBreaker struct {
	// contains filtered or unexported fields
}

type CircuitState int

type ClientInfo struct {
	IPAddress string `json:"ip_address,omitempty"`
	UserAgent string `json:"user_agent,omitempty"`
}

type DelegatedAuthConfig struct {
	// Header containing identity
	IdentityHeader string `yaml:"identity_header"`

	// IAP configuration
	IAP *IAPConfig `yaml:"iap,omitempty"`

	// Header mapping for extracting identity fields
	HeaderMapping map[string]string `yaml:"header_mapping,omitempty"`
}

type DelegatedAuthExtractor struct {
	// contains filtered or unexported fields
}

type DetectionCategory string

type DetectionResult struct {
	Detected        bool              `json:"detected"`
	Confidence      float64           `json:"confidence"`
	Category        DetectionCategory `json:"category,omitempty"`
	MatchedPatterns []string          `json:"matched_patterns,omitempty"`
	Details         string            `json:"details,omitempty"`
}

type DisabledAuthExtractor struct{}

type ElasticsearchBackend struct {
	// contains filtered or unexported fields
}

type ElasticsearchConfig struct {
	URLs      []string `yaml:"urls"`
	Index     string   `yaml:"index"`
	Username  string   `yaml:"username,omitempty"`
	Password  string   `yaml:"password,omitempty"`
	TLSVerify bool     `yaml:"tls_verify"`
}

type ErrorCode string

type FileAuditBackend struct {
	// contains filtered or unexported fields
}

type FloatValidator struct {
	Min *float64
	Max *float64
}

type HybridAuthExtractor struct {
	// contains filtered or unexported fields
}

type IAPConfig struct {
	Enabled   bool   `yaml:"enabled"`
	VerifyJWT bool   `yaml:"verify_jwt"`
	Audience  string `yaml:"audience,omitempty"`
}

type IAPJWTClaims struct {
	Email         string `json:"email"`
	Sub           string `json:"sub"`
	Aud           string `json:"aud"`
	Iss           string `json:"iss"`
	Iat           int64  `json:"iat"`
	Exp           int64  `json:"exp"`
	Hd            string `json:"hd"`
	EmailVerified bool   `json:"email_verified"`
}

type IAPKeyCache struct {
	// contains filtered or unexported fields
}

type IAPPublicKey struct {
	Kid string
	N   *big.Int
	E   int
	Key *rsa.PublicKey
}

type InMemoryAuditLogger struct {
	// contains filtered or unexported fields
}

type IntValidator struct {
	Min *int
	Max *int
}

type IntegratedAuditLogger struct {
	// contains filtered or unexported fields
}

type JSONAuditLogger struct {
	// contains filtered or unexported fields
}

type JWTClaims struct {
	Email    string `json:"email"`
	Issuer   string `json:"iss"`
	Audience string `json:"aud"`
	Subject  string `json:"sub"`
	IssuedAt int64  `json:"iat"`
	Expires  int64  `json:"exp"`
}

type MemoryAuditBackend struct {
	// contains filtered or unexported fields
}

type NoAuthAuthenticator struct {
	// contains filtered or unexported fields
}

type NoOpAuditLogger struct{}

type Pattern struct {
	Regex       *regexp.Regexp
	Category    DetectionCategory
	Weight      float64
	Description string
	MinLevel    Sensitivity
}

type Permission string

type Principal struct {
	ID          string
	Name        string
	Roles       []string
	Permissions []Permission
	Metadata    map[string]string
}

type PrincipalInfo struct {
	ID    string   `json:"id"`
	Type  string   `json:"type"`
	Roles []string `json:"roles,omitempty"`
}

type PromptInjectionDetector struct {
	// contains filtered or unexported fields
}

type RBACAuthorizer struct {
	// contains filtered or unexported fields
}

type RateLimiter struct {
	// contains filtered or unexported fields
}

type SIEMConfig struct {
	// Elasticsearch configuration
	Elasticsearch *ElasticsearchConfig `yaml:"elasticsearch,omitempty"`

	// Splunk configuration
	Splunk *SplunkConfig `yaml:"splunk,omitempty"`

	// Generic webhook configuration
	Webhook *WebhookConfig `yaml:"webhook,omitempty"`

	// Batch configuration
	BatchSize     int           `yaml:"batch_size"`
	FlushInterval time.Duration `yaml:"flush_interval"`
}

type SSRFConfig struct {
	// AllowedHosts is the list of allowed hostnames
	AllowedHosts []string
	// AllowedSchemes is the list of allowed URL schemes (default: http, https)
	AllowedSchemes []string
	// AllowLocalhost allows localhost connections (default: true)
	AllowLocalhost bool
	// BlockPrivateIPs blocks RFC1918 private IP ranges (default: true)
	BlockPrivateIPs bool
	// BlockMetadata blocks cloud metadata endpoints (169.254.x.x) (default: true)
	BlockMetadata bool
	// BlockLinkLocal blocks link-local addresses (default: true)
	BlockLinkLocal bool
}

type SSRFValidator struct {
	// contains filtered or unexported fields
}

type SafeYAMLParser struct {
	// contains filtered or unexported fields
}

type SecureError struct {
	Code    ErrorCode              `json:"code"`
	Message string                 `json:"message"`
	Details map[string]interface{} `json:"details,omitempty"`
}

type SecurityConfig struct {
	// Environment: development, staging, production
	Environment string `yaml:"environment" env:"ENVIRONMENT"`

	// Auth mode selection
	AuthMode AuthMode `yaml:"auth_mode" env:"AUTH_MODE"`

	// Delegated auth configuration
	DelegatedAuth *DelegatedAuthConfig `yaml:"delegated_auth,omitempty"`

	// Builtin auth configuration
	BuiltinAuth *BuiltinAuthConfig `yaml:"builtin_auth,omitempty"`

	// Authorization configuration
	Authorization *AuthorizationConfig `yaml:"authorization"`

	// Audit configuration
	Audit *AuditConfig `yaml:"audit"`
}

type Sensitivity int

type SplunkBackend struct {
	// contains filtered or unexported fields
}

type SplunkConfig struct {
	URL       string `yaml:"url"`
	Token     string `yaml:"token"`
	Index     string `yaml:"index,omitempty"`
	Source    string `yaml:"source,omitempty"`
	TLSVerify bool   `yaml:"tls_verify"`
}

type SplunkEvent struct {
	Time   int64                 `json:"time"`
	Host   string                `json:"host,omitempty"`
	Source string                `json:"source,omitempty"`
	Index  string                `json:"index,omitempty"`
	Event  *StructuredAuditEvent `json:"event"`
}

type StringValidator struct {
	Pattern              *regexp.Regexp
	MaxLength            int
	MinLength            int
	AllowedVals          []string
	DisallowNullBytes    bool
	DisallowControlChars bool
	CheckSQLInjection    bool
}

type StructuredAuditEvent struct {
	ID         string                 `json:"id"`
	Timestamp  time.Time              `json:"timestamp"`
	Type       AuditEventType         `json:"type"`
	RequestID  string                 `json:"request_id,omitempty"`
	TraceID    string                 `json:"trace_id,omitempty"`
	SpanID     string                 `json:"span_id,omitempty"`
	Principal  *PrincipalInfo         `json:"principal,omitempty"`
	Resource   string                 `json:"resource,omitempty"`
	Action     string                 `json:"action,omitempty"`
	Result     string                 `json:"result"`
	Error      string                 `json:"error,omitempty"`
	Duration   time.Duration          `json:"duration_ns,omitempty"`
	Metadata   map[string]interface{} `json:"metadata,omitempty"`
	ClientInfo *ClientInfo            `json:"client_info,omitempty"`
}

type TimeoutManager struct {
	// contains filtered or unexported fields
}

type ToolRateLimiter struct {
	// contains filtered or unexported fields
}

type WebhookBackend struct {
	// contains filtered or unexported fields
}

type WebhookConfig struct {
	URL       string            `yaml:"url"`
	Method    string            `yaml:"method"`
	Headers   map[string]string `yaml:"headers,omitempty"`
	TLSVerify bool              `yaml:"tls_verify"`
}

type WebhookPayload struct {
	Events    []*StructuredAuditEvent `json:"events"`
	Timestamp time.Time               `json:"timestamp"`
	Count     int                     `json:"count"`
}

type YAMLLimits struct {
	MaxFileSize  int64 // Maximum file size in bytes (default: 10MB)
	MaxDepth     int   // Maximum nesting depth (default: 20)
	MaxNodes     int   // Maximum number of nodes (default: 10000)
	MaxKeyLength int   // Maximum key length in bytes (default: 1024)
	MaxValueSize int64 // Maximum value size in bytes (default: 1MB)
}