pangea-aws 0.1.0

data/lib/pangea/resources/aws_ssm_parameter/types/validation.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Validation logic for SSM Parameter attributes
+        module SsmParameterValidation
+          KMS_KEY_PATTERN = /\A(alias\/[a-zA-Z0-9\/_-]+|arn:aws:kms:[a-z0-9-]+:\d{12}:key\/[a-f0-9-]{36}|[a-f0-9-]{36})\z/
+          PARAMETER_NAME_PATTERN = /\A[a-zA-Z0-9\/_.-]+\z/
+          MAX_NAME_LENGTH = 2048
+          MAX_DESCRIPTION_LENGTH = 1024
+          STANDARD_TIER_MAX_VALUE_SIZE = 4096
+          ADVANCED_TIER_MAX_VALUE_SIZE = 8192
+
+          def self.validate(attrs)
+            validate_secure_string_requirements(attrs)
+            validate_parameter_name(attrs)
+            validate_parameter_value_size(attrs)
+            validate_description_length(attrs)
+            validate_allowed_pattern(attrs)
+          end
+
+          def self.validate_secure_string_requirements(attrs)
+            if attrs.type == "SecureString"
+              if attrs.key_id && !attrs.key_id.match?(KMS_KEY_PATTERN)
+                raise Dry::Struct::Error, "key_id must be a valid KMS key ID, ARN, or alias"
+              end
+            elsif attrs.key_id
+              raise Dry::Struct::Error, "key_id can only be specified for SecureString parameters"
+            end
+          end
+
+          def self.validate_parameter_name(attrs)
+            unless attrs.name.match?(PARAMETER_NAME_PATTERN)
+              raise Dry::Struct::Error, "Parameter name can only contain letters, numbers, and the following symbols: /_.-"
+            end
+
+            if attrs.name.length > MAX_NAME_LENGTH
+              raise Dry::Struct::Error, "Parameter name cannot exceed #{MAX_NAME_LENGTH} characters"
+            end
+          end
+
+          def self.validate_parameter_value_size(attrs)
+            max_value_size = attrs.tier == "Advanced" ? ADVANCED_TIER_MAX_VALUE_SIZE : STANDARD_TIER_MAX_VALUE_SIZE
+            if attrs.value.bytesize > max_value_size
+              raise Dry::Struct::Error, "Parameter value cannot exceed #{max_value_size} bytes for #{attrs.tier} tier"
+            end
+          end
+
+          def self.validate_description_length(attrs)
+            if attrs.description && attrs.description.length > MAX_DESCRIPTION_LENGTH
+              raise Dry::Struct::Error, "Parameter description cannot exceed #{MAX_DESCRIPTION_LENGTH} characters"
+            end
+          end
+
+          def self.validate_allowed_pattern(attrs)
+            return unless attrs.allowed_pattern
+
+            begin
+              Regexp.new(attrs.allowed_pattern)
+            rescue RegexpError => e
+              raise Dry::Struct::Error, "Invalid allowed_pattern regular expression: #{e.message}"
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_parameter/types.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'pangea/resources/types'
+require_relative 'types/helpers'
+require_relative 'types/validation'
+require_relative 'types/configs'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Type-safe attributes for AWS Systems Manager Parameter resources
+        class SsmParameterAttributes < Pangea::Resources::BaseAttributes
+          include SsmParameterHelpers
+
+          # Parameter name (required)
+          attribute? :name, Resources::Types::String.optional
+
+          # Parameter type
+          attribute? :type, Resources::Types::String.constrained(included_in: ["String", "StringList", "SecureString"]).optional
+
+          # Parameter value (required)
+          attribute? :value, Resources::Types::String.optional
+
+          # Parameter description
+          attribute? :description, Resources::Types::String.optional
+
+          # KMS Key ID for SecureString parameters
+          attribute? :key_id, Resources::Types::String.optional
+
+          # Parameter tier (Standard or Advanced)
+          attribute :tier, Resources::Types::String.constrained(included_in: ["Standard", "Advanced"]).default("Standard")
+
+          # Allowed pattern for parameter value
+          attribute? :allowed_pattern, Resources::Types::String.optional
+
+          # Data type for parameter
+          attribute? :data_type, Resources::Types::String.constrained(included_in: ["text", "aws:ec2:image"]).optional
+
+          # Overwrite existing parameter
+          attribute :overwrite, Resources::Types::Bool.default(false)
+
+          # Tags for the parameter
+          attribute :tags, Resources::Types::AwsTags.default({}.freeze)
+
+          # Custom validation
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            SsmParameterValidation.validate(attrs)
+            attrs
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_parameter/types.rbs

@@ -0,0 +1,47 @@
+# RBS type definitions for AWS SSM Parameter types
+
+module Pangea
+  module Resources
+    module AWS
+      class SsmParameterAttributes < Dry::Struct
+        attr_reader name: String
+        attr_reader type: String
+        attr_reader value: String
+        attr_reader description: String?
+        attr_reader key_id: String?
+        attr_reader tier: String
+        attr_reader allowed_pattern: String?
+        attr_reader data_type: String?
+        attr_reader overwrite: bool
+        attr_reader tags: Hash[Symbol, String]
+        
+        def is_secure_string?: () -> bool
+        def is_string_list?: () -> bool
+        def is_string?: () -> bool
+        def uses_kms_key?: () -> bool
+        def is_advanced_tier?: () -> bool
+        def is_standard_tier?: () -> bool
+        def has_description?: () -> bool
+        def has_allowed_pattern?: () -> bool
+        def has_data_type?: () -> bool
+        def allows_overwrite?: () -> bool
+        def is_hierarchical?: () -> bool
+        def parameter_path: () -> String
+        def parameter_name_only: () -> String
+        def string_list_values: () -> Array[String]
+        def estimated_monthly_cost: () -> String
+      end
+
+      module SsmParameterConfigs
+        def self.string_parameter: (String, String, ?description: String?) -> Hash[Symbol, untyped]
+        def self.secure_parameter: (String, String, ?key_id: String?, ?description: String?) -> Hash[Symbol, untyped]
+        def self.string_list_parameter: (String, (Array[String] | String), ?description: String?) -> Hash[Symbol, untyped]
+        def self.config_parameter: (String, String, String, ?description: String?) -> Hash[Symbol, untyped]
+        def self.advanced_parameter: (String, String, ?description: String?) -> Hash[Symbol, untyped]
+        def self.database_config_parameter: (String, String, ?key_id: String?) -> Hash[Symbol, untyped]
+        def self.app_config_parameter: (String, String, ?description: String?) -> Hash[Symbol, untyped]
+        def self.ami_parameter: (String, String, ?description: String?) -> Hash[Symbol, untyped]
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_patch_baseline/resource.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_ssm_patch_baseline/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS Systems Manager Patch Baseline with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] SSM patch baseline attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_ssm_patch_baseline(name, attributes = {})
+        # Validate attributes using dry-struct
+        baseline_attrs = Types::SsmPatchBaselineAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_ssm_patch_baseline, name) do
+          patch_baseline_name baseline_attrs.name
+          operating_system baseline_attrs.operating_system
+
+          # Description
+          if baseline_attrs.description
+            description baseline_attrs.description
+          end
+
+          # Approved patches
+          if baseline_attrs.has_approved_patches?
+            approved_patches baseline_attrs.approved_patches
+          end
+
+          # Rejected patches
+          if baseline_attrs.has_rejected_patches?
+            rejected_patches baseline_attrs.rejected_patches
+          end
+
+          # Compliance level and settings
+          approved_patches_compliance_level baseline_attrs.approved_patches_compliance_level
+          approved_patches_enable_non_security baseline_attrs.approved_patches_enable_non_security
+          rejected_patches_action baseline_attrs.rejected_patches_action
+
+          # Global filters
+          baseline_attrs.global_filter.each do |filter|
+            global_filter do
+              key filter[:key]
+              values filter[:values]
+            end
+          end
+
+          # Approval rules
+          baseline_attrs.approval_rule.each do |rule|
+            approval_rule do
+              approve_after_days rule[:approve_after_days] if rule[:approve_after_days]
+              approve_until_date rule[:approve_until_date] if rule[:approve_until_date]
+              compliance_level rule[:compliance_level] if rule[:compliance_level]
+              enable_non_security rule[:enable_non_security] if rule[:enable_non_security]
+              
+              rule[:patch_filter].each do |filter|
+                patch_filter do
+                  key filter[:key]
+                  values filter[:values]
+                end
+              end
+            end
+          end
+
+          # Source configurations
+          baseline_attrs.source.each do |source_config|
+            source do
+              source_name source_config[:name]
+              products source_config[:products]
+              configuration source_config[:configuration]
+            end
+          end
+
+          # Apply tags if present
+          if baseline_attrs.tags&.any?
+            tags do
+              baseline_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_ssm_patch_baseline',
+          name: name,
+          resource_attributes: baseline_attrs.to_h,
+          outputs: {
+            id: "${aws_ssm_patch_baseline.#{name}.id}",
+            name: "${aws_ssm_patch_baseline.#{name}.name}",
+            arn: "${aws_ssm_patch_baseline.#{name}.arn}",
+            created_date: "${aws_ssm_patch_baseline.#{name}.created_date}",
+            modified_date: "${aws_ssm_patch_baseline.#{name}.modified_date}",
+            description: "${aws_ssm_patch_baseline.#{name}.description}",
+            operating_system: "${aws_ssm_patch_baseline.#{name}.operating_system}",
+            approved_patches: "${aws_ssm_patch_baseline.#{name}.approved_patches}",
+            rejected_patches: "${aws_ssm_patch_baseline.#{name}.rejected_patches}",
+            approved_patches_compliance_level: "${aws_ssm_patch_baseline.#{name}.approved_patches_compliance_level}",
+            tags_all: "${aws_ssm_patch_baseline.#{name}.tags_all}"
+          },
+          computed_properties: {
+            is_windows: baseline_attrs.is_windows?,
+            is_amazon_linux: baseline_attrs.is_amazon_linux?,
+            is_redhat_family: baseline_attrs.is_redhat_family?,
+            is_debian_family: baseline_attrs.is_debian_family?,
+            is_suse: baseline_attrs.is_suse?,
+            is_macos: baseline_attrs.is_macos?,
+            has_description: baseline_attrs.has_description?,
+            has_approved_patches: baseline_attrs.has_approved_patches?,
+            has_rejected_patches: baseline_attrs.has_rejected_patches?,
+            has_global_filters: baseline_attrs.has_global_filters?,
+            has_approval_rules: baseline_attrs.has_approval_rules?,
+            has_custom_sources: baseline_attrs.has_custom_sources?,
+            enables_non_security_patches: baseline_attrs.enables_non_security_patches?,
+            blocks_rejected_patches: baseline_attrs.blocks_rejected_patches?,
+            allows_rejected_as_dependency: baseline_attrs.allows_rejected_as_dependency?,
+            compliance_level_priority: baseline_attrs.compliance_level_priority,
+            total_patch_count: baseline_attrs.total_patch_count,
+            filter_summary: baseline_attrs.filter_summary,
+            approval_rule_summary: baseline_attrs.approval_rule_summary
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_patch_baseline/types/attributes.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require_relative 'validation'
+require_relative 'instance_methods'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class SsmPatchBaselineAttributes < Pangea::Resources::BaseAttributes
+          extend SsmPatchBaselineValidation
+          include SsmPatchBaselineInstanceMethods
+
+          attribute? :name, Resources::Types::String.optional
+          attribute? :operating_system, Resources::Types::String.constrained(included_in: ['WINDOWS', 'AMAZON_LINUX', 'AMAZON_LINUX_2', 'UBUNTU', 'REDHAT_ENTERPRISE_LINUX', 'SUSE', 'CENTOS',
+            'ORACLE_LINUX', 'DEBIAN', 'MACOS', 'RASPBIAN', 'ROCKY_LINUX', 'ALMA_LINUX'])
+          attribute? :description, Resources::Types::String.optional
+          attribute :approved_patches, Resources::Types::Array.of(Resources::Types::String).default([].freeze)
+          attribute :rejected_patches, Resources::Types::Array.of(Resources::Types::String).default([].freeze)
+          attribute :approved_patches_compliance_level, Resources::Types::String.constrained(included_in: ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFORMATIONAL', 'UNSPECIFIED']).default('UNSPECIFIED')
+          attribute :approved_patches_enable_non_security, Resources::Types::Bool.default(false)
+          attribute :rejected_patches_action, Resources::Types::String.constrained(included_in: ['ALLOW_AS_DEPENDENCY', 'BLOCK']).default('ALLOW_AS_DEPENDENCY')
+
+          attribute? :global_filter, Resources::Types::Array.of(
+            Resources::Types::Hash.schema(
+              key: Resources::Types::String.constrained(included_in: ['PATCH_SET', 'PRODUCT', 'PRODUCT_FAMILY', 'CLASSIFICATION', 'MSRC_SEVERITY', 'PATCH_ID',
+                                      'SECTION', 'PRIORITY', 'REPOSITORY', 'SEVERITY', 'ARCH', 'EPOCH', 'RELEASE', 'VERSION',
+                                      'NAME', 'BUGZILLA_ID', 'CVE_ID', 'ADVISORY_ID']),
+              values: Resources::Types::Array.of(Resources::Types::String).constrained(min_size: 1)
+            ).lax
+          ).default([].freeze)
+
+          attribute? :approval_rule, Resources::Types::Array.of(
+            Resources::Types::Hash.schema(
+              approve_after_days?: Resources::Types::Integer.optional.constrained(gteq: 0, lteq: 360),
+              approve_until_date?: Resources::Types::String.optional,
+              compliance_level?: Resources::Types::String.constrained(included_in: ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFORMATIONAL', 'UNSPECIFIED']).optional,
+              enable_non_security?: Resources::Types::Bool.optional,
+              patch_filter: Resources::Types::Array.of(
+                Resources::Types::Hash.schema(
+                  key: Resources::Types::String.constrained(included_in: ['PATCH_SET', 'PRODUCT', 'PRODUCT_FAMILY', 'CLASSIFICATION', 'MSRC_SEVERITY', 'PATCH_ID',
+                                          'SECTION', 'PRIORITY', 'REPOSITORY', 'SEVERITY', 'ARCH', 'EPOCH', 'RELEASE', 'VERSION',
+                                          'NAME', 'BUGZILLA_ID', 'CVE_ID', 'ADVISORY_ID']),
+                  values: Resources::Types::Array.of(Resources::Types::String).constrained(min_size: 1)
+                ).lax
+              ).constrained(min_size: 1)
+            )
+          ).default([].freeze)
+
+          attribute? :source, Resources::Types::Array.of(
+            Resources::Types::Hash.schema(name: Resources::Types::String, products: Resources::Types::Array.of(Resources::Types::String).lax.constrained(min_size: 1), configuration: Resources::Types::String)
+          ).default([].freeze)
+
+          attribute :tags, Resources::Types::AwsTags.default({}.freeze)
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            validate_os_filters(attrs)
+            validate_approval_rules(attrs)
+            validate_sources(attrs)
+            validate_patches(attrs)
+            validate_description(attrs)
+            attrs
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_patch_baseline/types/configs.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        module SsmPatchBaselineConfigs
+          def self.critical_patches_baseline(name, operating_system)
+            {
+              name: name, operating_system: operating_system, description: 'Critical patches only baseline',
+              approved_patches_compliance_level: 'CRITICAL',
+              approval_rule: [{
+                approve_after_days: 0, compliance_level: 'CRITICAL',
+                patch_filter: [{ key: operating_system == 'WINDOWS' ? 'CLASSIFICATION' : 'SEVERITY',
+                                 values: operating_system == 'WINDOWS' ? %w[CriticalUpdates SecurityUpdates] : ['Critical'] }]
+              }]
+            }
+          end
+
+          def self.security_patches_baseline(name, operating_system, approve_after_days: 7)
+            filters = security_filters_for_os(operating_system)
+            {
+              name: name, operating_system: operating_system, description: 'Security patches baseline',
+              approved_patches_compliance_level: 'HIGH',
+              approval_rule: [{ approve_after_days: approve_after_days, compliance_level: 'HIGH', patch_filter: filters }]
+            }
+          end
+
+          def self.all_patches_baseline(name, operating_system, approve_after_days: 30)
+            {
+              name: name, operating_system: operating_system,
+              description: "All patches baseline with #{approve_after_days} day approval delay",
+              approved_patches_compliance_level: 'MEDIUM', approved_patches_enable_non_security: true,
+              approval_rule: [{
+                approve_after_days: approve_after_days, compliance_level: 'MEDIUM', enable_non_security: true,
+                patch_filter: [{ key: 'PATCH_SET', values: ['OS'] }]
+              }]
+            }
+          end
+
+          def self.custom_patches_baseline(name, operating_system, approved_patches: [], rejected_patches: [])
+            {
+              name: name, operating_system: operating_system, description: 'Custom patch list baseline',
+              approved_patches: approved_patches, rejected_patches: rejected_patches, approved_patches_compliance_level: 'MEDIUM'
+            }
+          end
+
+          def self.development_baseline(name, operating_system)
+            {
+              name: name, operating_system: operating_system,
+              description: 'Development environment baseline - all patches approved immediately',
+              approved_patches_compliance_level: 'LOW', approved_patches_enable_non_security: true,
+              approval_rule: [{
+                approve_after_days: 0, compliance_level: 'LOW', enable_non_security: true,
+                patch_filter: [{ key: 'PATCH_SET', values: ['OS'] }]
+              }]
+            }
+          end
+
+          def self.production_baseline(name, operating_system, approve_after_days: 14)
+            filters = production_filters_for_os(operating_system)
+            {
+              name: name, operating_system: operating_system,
+              description: "Production environment baseline - security patches with #{approve_after_days} day delay",
+              approved_patches_compliance_level: 'HIGH', approved_patches_enable_non_security: false,
+              rejected_patches_action: 'BLOCK',
+              approval_rule: [{
+                approve_after_days: approve_after_days, compliance_level: 'HIGH', enable_non_security: false, patch_filter: filters
+              }]
+            }
+          end
+
+          def self.security_filters_for_os(operating_system)
+            case operating_system
+            when 'WINDOWS' then [{ key: 'CLASSIFICATION', values: ['SecurityUpdates'] }]
+            when 'UBUNTU', 'DEBIAN' then [{ key: 'PRIORITY', values: %w[Important Standard] }]
+            else [{ key: 'CLASSIFICATION', values: ['Security'] }]
+            end
+          end
+
+          def self.production_filters_for_os(operating_system)
+            case operating_system
+            when 'WINDOWS' then [{ key: 'CLASSIFICATION', values: %w[CriticalUpdates SecurityUpdates] }]
+            when 'UBUNTU', 'DEBIAN' then [{ key: 'PRIORITY', values: ['Important'] }]
+            else [{ key: 'CLASSIFICATION', values: ['Security'] }, { key: 'SEVERITY', values: %w[Critical Important] }]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_patch_baseline/types/instance_methods.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        module SsmPatchBaselineInstanceMethods
+          def is_windows?
+            operating_system == 'WINDOWS'
+          end
+
+          def is_amazon_linux?
+            %w[AMAZON_LINUX AMAZON_LINUX_2].include?(operating_system)
+          end
+
+          def is_redhat_family?
+            %w[REDHAT_ENTERPRISE_LINUX CENTOS ORACLE_LINUX ROCKY_LINUX ALMA_LINUX].include?(operating_system)
+          end
+
+          def is_debian_family?
+            %w[UBUNTU DEBIAN].include?(operating_system)
+          end
+
+          def is_suse?
+            operating_system == 'SUSE'
+          end
+
+          def is_macos?
+            operating_system == 'MACOS'
+          end
+
+          def has_description?
+            !description.nil?
+          end
+
+          def has_approved_patches?
+            approved_patches.any?
+          end
+
+          def has_rejected_patches?
+            rejected_patches.any?
+          end
+
+          def has_global_filters?
+            global_filter.any?
+          end
+
+          def has_approval_rules?
+            approval_rule.any?
+          end
+
+          def has_custom_sources?
+            source.any?
+          end
+
+          def enables_non_security_patches?
+            approved_patches_enable_non_security
+          end
+
+          def blocks_rejected_patches?
+            rejected_patches_action == 'BLOCK'
+          end
+
+          def allows_rejected_as_dependency?
+            rejected_patches_action == 'ALLOW_AS_DEPENDENCY'
+          end
+
+          def compliance_level_priority
+            levels = { 'CRITICAL' => 5, 'HIGH' => 4, 'MEDIUM' => 3, 'LOW' => 2, 'INFORMATIONAL' => 1, 'UNSPECIFIED' => 0 }
+            levels[approved_patches_compliance_level] || 0
+          end
+
+          def total_patch_count
+            approved_patches.count + rejected_patches.count
+          end
+
+          def filter_summary
+            return {} unless has_global_filters?
+            global_filter.each_with_object({}) { |filter, h| h[filter[:key]] = filter[:values] }
+          end
+
+          def approval_rule_summary
+            return [] unless has_approval_rules?
+            approval_rule.map do |rule|
+              summary = { compliance_level: rule[:compliance_level] || 'UNSPECIFIED', enable_non_security: rule[:enable_non_security] || false }
+              summary[:approval_method] = rule[:approve_after_days] ? "after_#{rule[:approve_after_days]}_days" : "until_#{rule[:approve_until_date]}"
+              summary[:filter_count] = rule[:patch_filter].count
+              summary
+            end
+          end
+        end
+      end
+    end
+  end
+end