raxit-core 0.1.2

//! Agent Assets Schema - Data structures for RAXIT scan results
//!
//! Based on Agent Assets Schema v0.1.0 from SPEC.md

use serde::{Deserialize, Serialize};
use std::collections::HashMap;

/// Complete scan result including all discovered assets
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ScanResult {
    /// Manifest section (SPEC.md v0.1.0)
    pub manifest: Manifest,

    /// Discovered agents
    pub agents: Vec<Agent>,

    /// Discovered tools
    pub tools: Vec<Tool>,

    /// Discovered models
    pub models: Vec<Model>,

    /// Memory configurations
    pub memory: Vec<Memory>,

    /// Trust boundaries
    #[serde(rename = "trustBoundaries")]
    pub trust_boundaries: Vec<TrustBoundary>,

    /// Secret findings
    #[serde(rename = "secretFindings", skip_serializing_if = "Vec::is_empty")]
    pub secret_findings: Vec<SecretFinding>,

    /// Memory findings
    #[serde(rename = "memoryFindings", skip_serializing_if = "Vec::is_empty")]
    pub memory_findings: Vec<MemoryFinding>,

    /// Network findings
    #[serde(rename = "networkFindings", skip_serializing_if = "Vec::is_empty")]
    pub network_findings: Vec<NetworkFinding>,

    /// Provenance findings
    #[serde(rename = "provenanceFindings", skip_serializing_if = "Vec::is_empty")]
    pub provenance_findings: Vec<ProvenanceFinding>,
}

impl ScanResult {
    pub fn new() -> Self {
        Self {
            manifest: Manifest::default(),
            agents: Vec::new(),
            tools: Vec::new(),
            models: Vec::new(),
            memory: Vec::new(),
            trust_boundaries: Vec::new(),
            secret_findings: Vec::new(),
            memory_findings: Vec::new(),
            network_findings: Vec::new(),
            provenance_findings: Vec::new(),
        }
    }

    pub fn to_yaml(&self) -> crate::Result<String> {
        serde_yaml::to_string(self).map_err(Into::into)
    }

    pub fn to_json(&self) -> crate::Result<String> {
        serde_json::to_string_pretty(self).map_err(Into::into)
    }
}

impl Default for ScanResult {
    fn default() -> Self {
        Self::new()
    }
}

/// Alias for backward compatibility
pub type AgentAssets = ScanResult;

/// Manifest section - metadata about the scan and project (SPEC.md v0.1.0)
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Manifest {
    /// Schema version
    pub schema_version: String,

    /// Subject - project being scanned
    pub subject: Subject,

    /// Unique scan ID
    pub scan_id: String,

    /// Timestamp when scan was performed
    pub scanned_at: String,

    /// Tool that performed the scan
    pub scanned_by: String,

    /// Files included in scan
    pub files: Vec<String>,

    /// Scan configuration
    pub scan_config: ScanConfigMetadata,

    /// Signature (optional, when signed via RAXIT API)
    #[serde(skip_serializing_if = "Option::is_none")]
    pub signature: Option<Signature>,
}

impl Default for Manifest {
    fn default() -> Self {
        Self {
            schema_version: "0.1.0".to_string(),
            subject: Subject::default(),
            scan_id: generate_scan_id(),
            scanned_at: chrono::Utc::now().to_rfc3339(),
            scanned_by: format!("raxit-cli/{}", env!("CARGO_PKG_VERSION")),
            files: Vec::new(),
            scan_config: ScanConfigMetadata::default(),
            signature: None,
        }
    }
}

/// Subject - project being scanned
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Subject {
    /// Project name
    pub name: String,

    /// Project version (from pyproject.toml if available)
    #[serde(skip_serializing_if = "Option::is_none")]
    pub version: Option<String>,

    /// Source repository URL
    #[serde(skip_serializing_if = "Option::is_none")]
    pub source: Option<String>,
}

impl Default for Subject {
    fn default() -> Self {
        Self {
            name: "unknown".to_string(),
            version: None,
            source: None,
        }
    }
}

/// Scan configuration metadata for reproducibility
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ScanConfigMetadata {
    /// Exclude patterns used
    pub exclude_patterns: Vec<String>,

    /// Frameworks detected
    pub frameworks_detected: Vec<String>,

    /// Number of parallel workers used
    pub parallel_workers: usize,

    /// Whether incremental scanning was enabled
    pub incremental: bool,

    /// Number of files scanned
    pub files_scanned: usize,

    /// Number of files skipped (incremental mode)
    pub files_skipped: usize,
}

impl Default for ScanConfigMetadata {
    fn default() -> Self {
        Self {
            exclude_patterns: Vec::new(),
            frameworks_detected: Vec::new(),
            parallel_workers: 1,
            incremental: false,
            files_scanned: 0,
            files_skipped: 0,
        }
    }
}

/// Signature from RAXIT API (optional)
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Signature {
    /// Digest of the schema
    pub digest: String,

    /// Signing algorithm
    pub algorithm: String,

    /// Base64-encoded signature value
    pub signature_value: String,

    /// Timestamp when signed
    pub signed_at: String,

    /// Key metadata
    #[serde(skip_serializing_if = "Option::is_none")]
    pub key_metadata: Option<KeyMetadata>,

    /// Attestation information
    #[serde(skip_serializing_if = "Option::is_none")]
    pub attestation: Option<Attestation>,
}

/// Key metadata from RAXIT API
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct KeyMetadata {
    pub key_id: String,
    pub key_version: String,
}

/// Attestation information from RAXIT API
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Attestation {
    pub project_id: String,
    pub project_name: String,
    pub organization: String,
    pub signed_by: String,
}

/// Generate a unique scan ID
fn generate_scan_id() -> String {
    let now = chrono::Utc::now();
    let random_suffix: String = (0..6)
        .map(|_| format!("{:x}", rand::random::<u8>() % 16))
        .collect();
    format!("scan-{}-{}", now.format("%Y%m%d"), random_suffix)
}

/// Metadata about the scan (legacy compatibility)
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ScanMetadata {
    /// Framework name (e.g., "pydantic-ai", "langgraph")
    pub framework: String,

    /// Framework version
    #[serde(rename = "frameworkVersion")]
    pub framework_version: Option<String>,

    /// Scan timestamp
    pub timestamp: String,

    /// RAXIT SDK version
    #[serde(rename = "raxitVersion")]
    pub raxit_version: String,

    /// Source path scanned
    pub source_path: String,
}

impl Default for ScanMetadata {
    fn default() -> Self {
        Self {
            framework: "unknown".to_string(),
            framework_version: None,
            timestamp: chrono::Utc::now().to_rfc3339(),
            raxit_version: env!("CARGO_PKG_VERSION").to_string(),
            source_path: ".".to_string(),
        }
    }
}

/// Agent definition
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Agent {
    /// Unique agent identifier
    pub id: String,

    /// Agent name
    pub name: String,

    /// Source location
    pub location: SourceLocation,

    /// Model used by agent
    #[serde(rename = "modelId")]
    pub model_id: Option<String>,

    /// Tools available to agent
    #[serde(rename = "toolIds")]
    pub tool_ids: Vec<String>,

    /// Memory configuration
    #[serde(rename = "memoryId")]
    pub memory_id: Option<String>,

    /// System prompt
    #[serde(rename = "systemPrompt")]
    pub system_prompt: Option<String>,

    /// Result type schema
    #[serde(rename = "resultType")]
    pub result_type: Option<String>,

    /// Dependencies type
    #[serde(rename = "depsType")]
    pub deps_type: Option<String>,
}

/// Tool definition
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Tool {
    /// Unique tool identifier
    pub id: String,

    /// Tool name
    pub name: String,

    /// Source location
    pub location: SourceLocation,

    /// Tool description
    pub description: Option<String>,

    /// Parameters schema
    pub parameters: Option<HashMap<String, String>>,

    /// Whether tool requires context
    #[serde(rename = "requiresContext")]
    pub requires_context: bool,

    /// Tool type (plain or context-aware)
    #[serde(rename = "toolType")]
    pub tool_type: String,

    /// Data flows (CaMeL-style provenance)
    #[serde(rename = "dataFlows")]
    pub data_flows: Vec<DataFlow>,
}

/// Model configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Model {
    /// Unique model identifier
    pub id: String,

    /// Provider (e.g., "openai", "anthropic")
    pub provider: String,

    /// Model name
    #[serde(rename = "modelName")]
    pub model_name: String,

    /// Source location
    pub location: SourceLocation,

    /// Configuration parameters
    pub config: HashMap<String, String>,
}

/// Memory configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Memory {
    /// Unique memory identifier
    pub id: String,

    /// Memory type
    #[serde(rename = "memoryType")]
    pub memory_type: String,

    /// Source location
    pub location: SourceLocation,

    /// Configuration
    pub config: HashMap<String, String>,
}

/// Trust boundary definition
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TrustBoundary {
    /// Boundary identifier
    pub id: String,

    /// Component ID (agent or tool)
    #[serde(rename = "componentId")]
    pub component_id: String,

    /// Component type
    #[serde(rename = "componentType")]
    pub component_type: String,

    /// Untrusted input (A)
    #[serde(rename = "hasUntrustedInput")]
    pub has_untrusted_input: bool,

    /// Sensitive access (B)
    #[serde(rename = "hasSensitiveAccess")]
    pub has_sensitive_access: bool,

    /// External actions (C)
    #[serde(rename = "hasExternalActions")]
    pub has_external_actions: bool,

    /// Compliance status
    pub compliant: bool,

    /// Violations (if not compliant)
    pub violations: Vec<String>,

    /// Source location
    pub location: SourceLocation,
}

/// Secret finding from secret detection analyzer
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SecretFinding {
    /// Unique finding identifier
    pub id: String,

    /// Type of secret detected
    #[serde(rename = "secretType")]
    pub secret_type: String,

    /// Source location
    pub location: SourceLocation,

    /// Severity level (critical, high, medium, low)
    pub severity: String,

    /// Description of the finding
    pub message: String,

    /// Matched pattern (masked for security)
    #[serde(rename = "matchedPattern", skip_serializing_if = "Option::is_none")]
    pub matched_pattern: Option<String>,
}

/// Memory finding from memory detection analyzer
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct MemoryFinding {
    /// Unique finding identifier
    pub id: String,

    /// Type of memory usage (vector_store, database, file_persistence, etc.)
    #[serde(rename = "memoryType")]
    pub memory_type: String,

    /// Technology used (chroma, pinecone, sqlite, redis, etc.)
    pub technology: String,

    /// Source location
    pub location: SourceLocation,

    /// Configuration details (connection string, file path, etc.)
    #[serde(skip_serializing_if = "Option::is_none")]
    pub configuration: Option<String>,

    /// Description of the finding
    pub message: String,
}

/// Network finding from network detection analyzer
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct NetworkFinding {
    /// Unique finding identifier
    pub id: String,

    /// Type of network usage (http_call, api_client, socket_connection, etc.)
    #[serde(rename = "networkType")]
    pub network_type: String,

    /// Technology used (requests, httpx, openai, etc.)
    pub technology: String,

    /// Source location
    pub location: SourceLocation,

    /// Endpoint URL (if available)
    #[serde(skip_serializing_if = "Option::is_none")]
    pub endpoint: Option<String>,

    /// HTTP method (GET, POST, etc.)
    #[serde(skip_serializing_if = "Option::is_none")]
    pub method: Option<String>,

    /// Description of the finding
    pub message: String,
}

/// Provenance finding from data provenance analyzer
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ProvenanceFinding {
    /// Unique finding identifier
    pub id: String,

    /// Type of finding (tainted_sink, unsafe_flow, etc.)
    #[serde(rename = "findingType")]
    pub finding_type: String,

    /// Source type (untrusted_input, external_data, etc.)
    #[serde(rename = "sourceType")]
    pub source_type: String,

    /// Sink type (print, file_write, database_insert, etc.)
    #[serde(rename = "sinkType")]
    pub sink_type: String,

    /// Tainted variables involved
    #[serde(rename = "taintedVariables")]
    pub tainted_variables: Vec<String>,

    /// Source location
    pub location: SourceLocation,

    /// Severity level (critical, high, medium, low)
    pub severity: String,

    /// Description of the finding
    pub message: String,

    /// Data flow path (optional)
    #[serde(rename = "dataFlow", skip_serializing_if = "Option::is_none")]
    pub data_flow: Option<String>,
}

/// Data flow for CaMeL-style provenance
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct DataFlow {
    /// Variable or data identifier
    pub variable: String,

    /// Data source
    pub source: String,

    /// Readers
    pub readers: Vec<String>,

    /// Writers
    pub writers: Vec<String>,

    /// Taint level
    #[serde(rename = "taintLevel")]
    pub taint_level: String,
}

/// Source code location
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct SourceLocation {
    /// File path
    pub file: String,

    /// Start line
    pub line: u32,

    /// End line
    #[serde(rename = "endLine")]
    pub end_line: Option<u32>,

    /// Function or class name
    pub function: Option<String>,
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_scan_result_serialization() {
        let result = ScanResult::new();
        let yaml = result.to_yaml();
        assert!(yaml.is_ok());

        let json = result.to_json();
        assert!(json.is_ok());
    }

    #[test]
    fn test_default_metadata() {
        let result = ScanResult::default();
        assert_eq!(result.manifest.schema_version, "0.1.0");
        assert!(result
            .manifest
            .scanned_by
            .contains(env!("CARGO_PKG_VERSION")));
    }
}