/**
 * Business Logic Vulnerability Types
 *
 * Types for detecting BOLA, IDOR, BFLA, and other
 * authorization/business logic vulnerabilities.
 *
 * @module scanners/logic/types
 */
import type { Severity } from "../../certification/types.js";
import type { DeterministicFinding } from "../types.js";
/**
 * Business logic vulnerability types
 */
export type LogicVulnType = "bola" | "idor" | "bfla" | "mass-assignment" | "race-condition-auth" | "privilege-escalation" | "missing-auth" | "missing-authz" | "direct-db-access" | "horizontal-priv-esc" | "vertical-priv-esc";
/**
 * HTTP methods for API endpoints
 */
export type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
/**
 * Web framework types
 */
export type WebFramework = "nextjs" | "express" | "fastify" | "koa" | "hapi" | "nestjs" | "django" | "flask" | "fastapi" | "rails" | "spring" | "laravel" | "gin" | "echo" | "fiber" | "auto";
/**
 * Detected API endpoint
 */
export interface APIEndpoint {
    /** File where the endpoint is defined */
    file: string;
    /** Line number */
    line: number;
    /** HTTP method */
    method: HttpMethod | HttpMethod[];
    /** Route path (e.g., /api/users/:id) */
    path: string;
    /** Function/handler name */
    handler?: string;
    /** Framework that defines this endpoint */
    framework: WebFramework;
    /** Parameters extracted from path */
    pathParams: string[];
    /** Whether authentication middleware is applied */
    hasAuth: boolean;
    /** Authorization checks detected */
    authzChecks: AuthorizationCheck[];
    /** Resource type being accessed (e.g., "user", "order") */
    resourceType?: string;
    /** Whether endpoint accesses database */
    hasDbAccess: boolean;
    /** Database queries in this endpoint */
    dbQueries: DatabaseQuery[];
}
/**
 * Authorization check detected in code
 */
export interface AuthorizationCheck {
    /** Type of check */
    type: "ownership" | "role" | "permission" | "admin" | "custom";
    /** Where the check is performed */
    location: {
        file: string;
        line: number;
    };
    /** Code snippet of the check */
    snippet: string;
    /** Whether check appears to be bypassable */
    potentiallyBypassable: boolean;
    /** Reason for bypass concern */
    bypassReason?: string;
}
/**
 * Database query detected in endpoint
 */
export interface DatabaseQuery {
    /** Query type */
    type: "select" | "insert" | "update" | "delete" | "raw";
    /** Table/collection being accessed */
    table?: string;
    /** Whether query includes ownership filter */
    hasOwnershipFilter: boolean;
    /** Location in code */
    location: {
        file: string;
        line: number;
    };
    /** Code snippet */
    snippet: string;
}
/**
 * Resource access pattern
 */
export interface ResourceAccess {
    /** Resource type (e.g., "user", "order", "file") */
    resource: string;
    /** Operation being performed */
    operation: "read" | "create" | "update" | "delete";
    /** Whether ownership is verified */
    ownershipCheck: boolean;
    /** How the resource ID is obtained */
    idSource: "path" | "query" | "body" | "header" | "session";
    /**
     * Whether an ID_SOURCE_PATTERN actually matched handler source code.
     * False means idSource is the untouched "path" default (no real id
     * reference was found). Used by isPureInsert to distinguish a genuine
     * no-id create (waitlist signup) from a create that reads an existing
     * object id from body/query/path (real IDOR candidate).
     */
    idMatched: boolean;
    /** File location */
    file: string;
    /** Line number */
    line: number;
}
/**
 * Authorization flow analysis result
 */
export interface AuthorizationAnalysis {
    /** Endpoint being analyzed */
    endpoint: APIEndpoint;
    /** Whether authentication is required */
    requiresAuth: boolean;
    /** Authentication method detected */
    authMethod?: "jwt" | "session" | "api-key" | "oauth" | "basic" | "custom";
    /** Authorization checks found */
    authzChecks: AuthorizationCheck[];
    /** Resources accessed */
    resourceAccesses: ResourceAccess[];
    /** Potential vulnerabilities */
    vulnerabilities: LogicVulnerability[];
    /** Confidence score (0-100) */
    confidence: number;
}
/**
 * A business logic vulnerability finding
 */
export interface LogicVulnerability {
    /** Vulnerability type */
    vulnType: LogicVulnType;
    /** Human-readable name */
    name: string;
    /** Description */
    description: string;
    /** Severity */
    severity: Severity;
    /** Confidence (0-100) */
    confidence: number;
    /** Affected endpoint */
    endpoint: string;
    /** HTTP method */
    method: HttpMethod | HttpMethod[];
    /** File location */
    file: string;
    /** Line number */
    line: number;
    /** Code snippet showing the issue */
    snippet?: string;
    /** Authentication check status */
    authCheck: {
        present: boolean;
        location?: string;
        bypassable: boolean;
        bypassReason?: string;
    };
    /** Resource access details */
    resourceAccess?: ResourceAccess;
    /** CWE IDs */
    cweIds: string[];
    /** OWASP references */
    owaspRefs: string[];
    /** Suggested remediation */
    remediation: string;
}
/**
 * Logic finding extends DeterministicFinding with logic-specific fields
 */
export interface LogicFinding extends DeterministicFinding {
    /** Vulnerability type */
    vulnType: LogicVulnType;
    /** Affected endpoint path */
    affectedEndpoint: string;
    /** HTTP method */
    httpMethod?: HttpMethod | HttpMethod[];
    /** Auth check details */
    authCheck?: {
        present: boolean;
        location?: string;
        bypassable: boolean;
        bypassReason?: string;
    };
    /** Resource access details */
    resourceAccess?: ResourceAccess;
    /** OWASP references */
    owaspRefs?: string[];
    /** Suggested remediation */
    remediation?: string;
}
/**
 * Scan options for logic analysis
 */
export interface LogicScanOptions {
    /** Framework to use (auto-detect if not specified) */
    framework?: WebFramework;
    /** Specific vulnerability types to focus on */
    focusAreas?: LogicVulnType[];
    /** Include LLM-powered semantic analysis */
    includeLLMAnalysis?: boolean;
    /** Maximum files to analyze */
    maxFiles?: number;
    /** File patterns to include */
    include?: string[];
    /** File patterns to exclude */
    exclude?: string[];
}
/**
 * Result from logic vulnerability scan
 */
export interface LogicScanResult {
    /** Project path */
    projectPath: string;
    /** Framework detected */
    framework: WebFramework;
    /** All endpoints found */
    endpoints: APIEndpoint[];
    /** Logic vulnerabilities found */
    vulnerabilities: LogicVulnerability[];
    /** Findings in standard format */
    findings: LogicFinding[];
    /** Scan statistics */
    stats: {
        filesAnalyzed: number;
        endpointsFound: number;
        vulnerabilitiesFound: number;
        bySeverity: Partial<Record<Severity, number>>;
        byVulnType: Partial<Record<LogicVulnType, number>>;
    };
    /** Scan duration */
    duration: number;
    /** Whether scan completed successfully */
    success: boolean;
    /** Error message if failed */
    error?: string;
}
/**
 * CWE mappings for logic vulnerabilities
 */
export declare const LOGIC_VULN_CWE_MAP: Record<LogicVulnType, string[]>;
/**
 * OWASP references for logic vulnerabilities
 */
export declare const LOGIC_VULN_OWASP_MAP: Record<LogicVulnType, string[]>;
/**
 * Default severity for each vulnerability type
 */
export declare const LOGIC_VULN_SEVERITY_MAP: Record<LogicVulnType, Severity>;
/**
 * Patterns for detecting framework types
 */
export declare const FRAMEWORK_DETECTION_PATTERNS: Record<WebFramework, {
    packageNames: string[];
    filePatterns: RegExp[];
    codePatterns: RegExp[];
}>;
//# sourceMappingURL=types.d.ts.map