git.stella-ops.org/src/Scanner/StellaOps.Scanner.WebService/Contracts/RuntimePolicyContracts.cs

using System.Collections.Generic;
using System.Text.Json.Serialization;

namespace StellaOps.Scanner.WebService.Contracts;

public sealed record RuntimePolicyRequestDto
{
    [JsonPropertyName("namespace")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? Namespace { get; init; }

    [JsonPropertyName("labels")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public IDictionary<string, string>? Labels { get; init; }

    [JsonPropertyName("images")]
    public IReadOnlyList<string> Images { get; init; } = Array.Empty<string>();
}

public sealed record RuntimePolicyResponseDto
{
    [JsonPropertyName("ttlSeconds")]
    public int TtlSeconds { get; init; }

    [JsonPropertyName("expiresAtUtc")]
    public DateTimeOffset ExpiresAtUtc { get; init; }

    [JsonPropertyName("policyRevision")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? PolicyRevision { get; init; }

    [JsonPropertyName("results")]
    public IReadOnlyDictionary<string, RuntimePolicyImageResponseDto> Results { get; init; } = new Dictionary<string, RuntimePolicyImageResponseDto>(StringComparer.Ordinal);
}

public sealed record RuntimePolicyImageResponseDto
{
    [JsonPropertyName("policyVerdict")]
    public string PolicyVerdict { get; init; } = "unknown";

    [JsonPropertyName("signed")]
    public bool Signed { get; init; }

    [JsonPropertyName("hasSbomReferrers")]
    public bool HasSbomReferrers { get; init; }

    [JsonPropertyName("hasSbom")]
    public bool HasSbomLegacy { get; init; }

    [JsonPropertyName("reasons")]
    public IReadOnlyList<string> Reasons { get; init; } = Array.Empty<string>();

    [JsonPropertyName("rekor")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public RuntimePolicyRekorDto? Rekor { get; init; }

    [JsonPropertyName("confidence")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public double? Confidence { get; init; }

    [JsonPropertyName("quieted")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public bool? Quieted { get; init; }

    [JsonPropertyName("quietedBy")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? QuietedBy { get; init; }

    [JsonPropertyName("metadata")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? Metadata { get; init; }

    [JsonPropertyName("buildIds")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public IReadOnlyList<string>? BuildIds { get; init; }

    [JsonPropertyName("linksets")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public IReadOnlyList<LinksetSummaryDto>? Linksets { get; init; }
}

public sealed record RuntimePolicyRekorDto
{
    [JsonPropertyName("uuid")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? Uuid { get; init; }

    [JsonPropertyName("url")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? Url { get; init; }

    [JsonPropertyName("verified")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public bool? Verified { get; init; }
}

/// <summary>
/// Request for policy overlays on graph nodes (for Cartographer integration).
/// </summary>
public sealed record PolicyOverlayRequestDto
{
    [JsonPropertyName("tenant")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? Tenant { get; init; }

    [JsonPropertyName("nodes")]
    public IReadOnlyList<PolicyOverlayNodeDto> Nodes { get; init; } = Array.Empty<PolicyOverlayNodeDto>();

    [JsonPropertyName("overlayKind")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? OverlayKind { get; init; }

    [JsonPropertyName("includeEvidence")]
    public bool IncludeEvidence { get; init; }
}

/// <summary>
/// A graph node for policy overlay evaluation.
/// </summary>
public sealed record PolicyOverlayNodeDto
{
    [JsonPropertyName("nodeId")]
    public string NodeId { get; init; } = string.Empty;

    [JsonPropertyName("nodeType")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? NodeType { get; init; }

    [JsonPropertyName("purl")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? Purl { get; init; }

    [JsonPropertyName("imageDigest")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? ImageDigest { get; init; }

    [JsonPropertyName("advisoryKey")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? AdvisoryKey { get; init; }
}

/// <summary>
/// Response containing policy overlays for graph nodes.
/// </summary>
public sealed record PolicyOverlayResponseDto
{
    [JsonPropertyName("tenant")]
    public string Tenant { get; init; } = string.Empty;

    [JsonPropertyName("generatedAt")]
    public DateTimeOffset GeneratedAt { get; init; }

    [JsonPropertyName("policyRevision")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public string? PolicyRevision { get; init; }

    [JsonPropertyName("overlays")]
    public IReadOnlyList<PolicyOverlayDto> Overlays { get; init; } = Array.Empty<PolicyOverlayDto>();
}

/// <summary>
/// A single policy overlay for a graph node with deterministic ID.
/// </summary>
public sealed record PolicyOverlayDto
{
    [JsonPropertyName("overlayId")]
    public string OverlayId { get; init; } = string.Empty;

    [JsonPropertyName("nodeId")]
    public string NodeId { get; init; } = string.Empty;

    [JsonPropertyName("overlayKind")]
    public string OverlayKind { get; init; } = "policy.overlay.v1";

    [JsonPropertyName("verdict")]
    public string Verdict { get; init; } = "unknown";

    [JsonPropertyName("reasons")]
    public IReadOnlyList<string> Reasons { get; init; } = Array.Empty<string>();

    [JsonPropertyName("confidence")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public double? Confidence { get; init; }

    [JsonPropertyName("quieted")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public bool? Quieted { get; init; }

    [JsonPropertyName("evidence")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public PolicyOverlayEvidenceDto? Evidence { get; init; }
}

/// <summary>
/// Runtime evidence attached to a policy overlay.
/// </summary>
public sealed record PolicyOverlayEvidenceDto
{
    [JsonPropertyName("signed")]
    public bool Signed { get; init; }

    [JsonPropertyName("hasSbomReferrers")]
    public bool HasSbomReferrers { get; init; }

    [JsonPropertyName("rekor")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public RuntimePolicyRekorDto? Rekor { get; init; }

    [JsonPropertyName("buildIds")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public IReadOnlyList<string>? BuildIds { get; init; }

    [JsonPropertyName("metadata")]
    [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)]
    public IReadOnlyDictionary<string, string>? Metadata { get; init; }
}