version: "1"
definitions:
  is_github: network.hostname == "github.com"

rules:
  - id: "allow-github-api"
    condition: |
      $is_github &&
      http.method in ["GET", "POST"] &&
      http.path.startsWith("/api/v3")
    action: allow

  - id: "block-force-push"
    condition: run.tool == "git" && "-f" in run.flags
    action: block
    log: true

pub const RULES_DIR_DEFAULT: &str = "/etc/outcall/rules.d";
pub const RULE_FILE_EXTENSION: &str = ".yaml";
pub const RULE_VERSION_SUPPORTED: &str = "1";
pub const EVALUATION_TIMEOUT_MS: u64 = 50;
pub const ENRICH_HOOK_TIMEOUT_MS: u64 = 5000;

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RuleFile {
    pub version: String,
    pub definitions: Option<HashMap<String, String>>,
    pub rules: Vec<Rule>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Rule {
    pub id: String,
    pub condition: String,
    pub action: RuleAction,          // from S000
    pub priority: Option<i32>,       // S003-FR-032: default 100, lower = higher priority
    pub log: Option<bool>,
    pub description: Option<String>,
    pub enrich: Option<EnrichConfig>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct EnrichConfig {
    pub script: String,
    pub timeout_ms: Option<u64>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct EvaluateRequest {
    pub context: EvaluationContext,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct EvaluationContext {
    pub network: Option<NetworkContext>,
    pub http: Option<HttpContext>,
    pub dns: Option<DnsContext>,
    pub docker: Option<DockerContext>,
    pub run: Option<RunContext>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct NetworkContext {
    pub hostname: Option<String>,
    pub ip: String,
    pub port: u16,
    pub protocol: String,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct HttpContext {
    pub method: String,
    pub path: String,
    pub host: String,
    pub headers: HashMap<String, String>,
    pub body_size: u64,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DnsContext {
    pub query: String,
    pub record_type: String,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DockerContext {
    pub image: String,
    pub command: Vec<String>,
    pub volumes: Vec<String>,
    pub env_keys: Vec<String>,
    pub capabilities: Vec<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RunContext {
    pub tool: String,
    pub args: Vec<String>,
    pub flags: Vec<String>,
    pub cwd: String,
    pub context: HashMap<String, serde_json::Value>,
}

/// Internal rule engine result. Translated to Verdict (S000) for agent API responses.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct EvaluateResult {
    pub decision: Decision,
    pub matched_rule: Option<String>,
    pub file: Option<String>,
    pub logged: bool,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum Decision {
    Allow,
    Block,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RuleSummary {
    pub id: String,
    pub file: String,
    pub action: RuleAction,
    pub condition_preview: String,
    pub description: Option<String>,
}

/// Agent-submitted rule request (via agent API).
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RuleRequestSubmission {
    pub description: String,
    pub requested_access: String,
    pub suggested_condition: Option<String>,
}

/// Server-side stored rule request (enriched with ID, timestamp, status).
/// Host API returns this via ApiResponse<StoredRuleRequest>.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct StoredRuleRequest {
    pub id: String,
    pub submitted_at: String,
    pub status: RuleRequestStatus,   // from S000
    pub description: String,
    pub requested_access: String,
    pub suggested_condition: Option<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ReloadResult {
    pub files_loaded: usize,
    pub rules_loaded: usize,
    pub warnings: Vec<String>,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TestExpressionRequest {
    pub expression: String,
    pub context: EvaluationContext,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TestExpressionResult {
    pub result: bool,
    pub error: Option<String>,
}