/**
 * Settings -> Security scan.
 *
 * The shape the controller sends: the last stored run (or null when nothing has
 * been scanned yet), what a run started from the screen would read, and what is
 * currently held in quarantine.
 */

export type ScanSeverity = 'critical' | 'high' | 'medium';

export type ScanFinding = {
    path: string;
    relative: string;
    rule: string;
    severity: ScanSeverity;
    reason: string;
    /** The line the match sits on, when the rule is about what a file contains. */
    line: number | null;
    /** That line, shortened and with anything credential-shaped masked. */
    evidence: string | null;
    /** In a file git tracks and has not modified — reported for review. */
    versioned: boolean;
};

export type StoredScan = {
    ran_at: string | null;
    source: 'screen' | 'command' | string;
    ran_by: string;
    roots: string[];
    files: number;
    skipped: number;
    seconds: number;
    counts: {
        critical: number;
        high: number;
        medium: number;
    };
    /** Places the scan could not read, which is not the same as clean. */
    errors: string[];
    findings: ScanFinding[];
    total: number;
    shown: number;
    /** Files at or above the quarantine threshold that would be moved. */
    actionable: number;
};

export type HeldFile = {
    id: string;
    original_path: string;
    rule: string;
    severity: string;
    held_at: string;
};

export type SecurityScanProps = {
    scan: StoredScan | null;
    targets: {
        roots: string[];
        max_bytes: number;
        threshold: string;
        threshold_label: string;
    };
    quarantine: {
        path: string;
        outside_public_root: boolean;
        held: number;
        entries: HeldFile[];
        restore_command: string;
    };
    can: {
        run: boolean;
        hold: boolean;
    };
};