flareguard 0.1.0

package/src/zone/models/audit.rs

@@ -0,0 +1,194 @@
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use std::fmt;
+
+/// Security risk severity level
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
+pub enum RiskLevel {
+    Info,
+    Low,
+    Medium,
+    High,
+    Critical,
+}
+
+impl fmt::Display for RiskLevel {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            RiskLevel::Critical => write!(f, "CRITICAL"),
+            RiskLevel::High => write!(f, "HIGH"),
+            RiskLevel::Medium => write!(f, "MEDIUM"),
+            RiskLevel::Low => write!(f, "LOW"),
+            RiskLevel::Info => write!(f, "INFO"),
+        }
+    }
+}
+
+impl RiskLevel {
+    pub fn badge_str(&self) -> &'static str {
+        match self {
+            RiskLevel::Critical => "CRITICAL",
+            RiskLevel::High => "HIGH",
+            RiskLevel::Medium => "MEDIUM",
+            RiskLevel::Low => "LOW",
+            RiskLevel::Info => "INFO",
+        }
+    }
+}
+
+/// Category of security check
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum RuleCategory {
+    SslTls,
+    HttpsEnforcement,
+    Hsts,
+    WafSecurity,
+    BotManagement,
+    Dnssec,
+    AccessControl,
+    SecurityLevel,
+}
+
+impl fmt::Display for RuleCategory {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            RuleCategory::SslTls => write!(f, "SSL/TLS Configuration"),
+            RuleCategory::HttpsEnforcement => write!(f, "HTTPS Enforcement"),
+            RuleCategory::Hsts => write!(f, "HSTS Security Headers"),
+            RuleCategory::WafSecurity => write!(f, "WAF & Managed Rules"),
+            RuleCategory::BotManagement => write!(f, "Bot Management"),
+            RuleCategory::Dnssec => write!(f, "DNSSEC"),
+            RuleCategory::AccessControl => write!(f, "Access Rules & Lockdown"),
+            RuleCategory::SecurityLevel => write!(f, "Zone Security Level"),
+        }
+    }
+}
+
+/// A specific security finding detected during the zone audit
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AuditFinding {
+    pub rule_id: String,
+    pub rule_name: String,
+    pub category: RuleCategory,
+    pub risk_level: RiskLevel,
+    pub title: String,
+    pub description: String,
+    pub actual_value: String,
+    pub expected_value: String,
+    pub remediation: String,
+    pub score_penalty: u32,
+    pub doc_url: Option<String>,
+}
+
+/// Summary of key settings for clean display in tables and reports
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct ZoneSettingsSummary {
+    pub ssl_mode: String,
+    pub min_tls: String,
+    pub always_https: String,
+    pub hsts_status: String,
+    pub dnssec_status: String,
+    pub waf_status: String,
+    pub bot_fight_mode: String,
+    pub security_level: String,
+}
+
+/// Complete audit report for a single Cloudflare Zone
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct ZoneAuditReport {
+    pub zone_id: String,
+    pub zone_name: String,
+    pub plan_name: String,
+    pub status: String,
+    pub score: u32,
+    pub grade: String,
+    pub passed_checks_count: usize,
+    pub total_checks_count: usize,
+    pub settings_summary: ZoneSettingsSummary,
+    pub findings: Vec<AuditFinding>,
+}
+
+impl ZoneAuditReport {
+    pub fn count_by_severity(&self, severity: RiskLevel) -> usize {
+        self.findings
+            .iter()
+            .filter(|f| f.risk_level == severity)
+            .count()
+    }
+
+    pub fn has_critical(&self) -> bool {
+        self.findings
+            .iter()
+            .any(|f| f.risk_level == RiskLevel::Critical)
+    }
+
+    pub fn has_high_or_critical(&self) -> bool {
+        self.findings
+            .iter()
+            .any(|f| f.risk_level == RiskLevel::Critical || f.risk_level == RiskLevel::High)
+    }
+}
+
+/// Breakdown of findings count by severity
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct SeverityCounts {
+    pub critical: usize,
+    pub high: usize,
+    pub medium: usize,
+    pub low: usize,
+    pub info: usize,
+    pub total: usize,
+}
+
+/// Aggregated multi-zone compliance and security audit report
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct AggregateAuditReport {
+    pub timestamp: DateTime<Utc>,
+    pub account_id: Option<String>,
+    pub total_zones: usize,
+    pub average_score: f64,
+    pub overall_grade: String,
+    pub total_findings: SeverityCounts,
+    pub zone_reports: Vec<ZoneAuditReport>,
+}
+
+impl AggregateAuditReport {
+    pub fn new(zone_reports: Vec<ZoneAuditReport>, account_id: Option<String>) -> Self {
+        let total_zones = zone_reports.len();
+        let average_score = if total_zones == 0 {
+            100.0
+        } else {
+            let sum: u32 = zone_reports.iter().map(|z| z.score).sum();
+            (sum as f64) / (total_zones as f64)
+        };
+
+        let overall_grade =
+            crate::zone::scoring::calculate_grade(average_score.round() as u32).to_string();
+
+        let mut total_findings = SeverityCounts::default();
+        for z in &zone_reports {
+            for f in &z.findings {
+                total_findings.total += 1;
+                match f.risk_level {
+                    RiskLevel::Critical => total_findings.critical += 1,
+                    RiskLevel::High => total_findings.high += 1,
+                    RiskLevel::Medium => total_findings.medium += 1,
+                    RiskLevel::Low => total_findings.low += 1,
+                    RiskLevel::Info => total_findings.info += 1,
+                }
+            }
+        }
+
+        Self {
+            timestamp: Utc::now(),
+            account_id,
+            total_zones,
+            average_score: (average_score * 10.0).round() / 10.0,
+            overall_grade,
+            total_findings,
+            zone_reports,
+        }
+    }
+}

package/src/zone/models/cloudflare.rs

@@ -0,0 +1,252 @@
+use serde::{Deserialize, Serialize};
+
+/// Account summary information associated with a zone
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct AccountInfo {
+    pub id: String,
+    pub name: String,
+}
+
+/// Cloudflare Plan information (e.g. Free, Pro, Business, Enterprise)
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct PlanInfo {
+    pub id: Option<String>,
+    pub name: Option<String>,
+    pub price: Option<i64>,
+    pub currency: Option<String>,
+    pub is_subscribed: Option<bool>,
+}
+
+/// Cloudflare Zone object
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
+pub struct Zone {
+    pub id: String,
+    pub name: String,
+    pub status: String,
+    #[serde(default)]
+    pub paused: bool,
+    #[serde(rename = "type")]
+    pub zone_type: Option<String>,
+    pub development_mode: Option<i64>,
+    pub name_servers: Option<Vec<String>>,
+    pub account: Option<AccountInfo>,
+    pub plan: Option<PlanInfo>,
+}
+
+/// Strict Transport Security (HSTS) configuration within security_header
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct HstsSetting {
+    #[serde(default)]
+    pub enabled: bool,
+    pub max_age: Option<u64>,
+    #[serde(default)]
+    pub include_subdomains: Option<bool>,
+    #[serde(default)]
+    pub preload: Option<bool>,
+    #[serde(default)]
+    pub nosniff: Option<bool>,
+}
+
+/// Security header setting wrapper
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct SecurityHeaderSetting {
+    pub strict_transport_security: Option<HstsSetting>,
+}
+
+/// Zone DNSSEC details
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct DnssecSetting {
+    #[serde(default = "default_dnssec_status")]
+    pub status: String,
+    pub flags: Option<u32>,
+    pub algorithm: Option<String>,
+    pub key_type: Option<String>,
+    pub digest_type: Option<String>,
+    pub digest_algorithm: Option<String>,
+    pub digest: Option<String>,
+    pub ds: Option<String>,
+    pub key_tag: Option<u32>,
+    pub public_key: Option<String>,
+}
+
+fn default_dnssec_status() -> String {
+    "disabled".to_string()
+}
+
+/// WAF Package representation
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct WafPackage {
+    pub id: String,
+    pub name: String,
+    pub description: Option<String>,
+    pub detection_mode: Option<String>,
+    pub zone_id: Option<String>,
+    pub status: Option<String>,
+}
+
+/// Ruleset representation for Modern WAF
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct RulesetInfo {
+    pub id: String,
+    pub name: String,
+    pub phase: Option<String>,
+    pub kind: Option<String>,
+    pub description: Option<String>,
+    pub rules_count: Option<usize>,
+}
+
+/// Aggregated WAF Settings
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct WafSetting {
+    #[serde(default)]
+    pub waf_enabled: bool,
+    #[serde(default)]
+    pub managed_rules_active: bool,
+    #[serde(default)]
+    pub packages: Vec<WafPackage>,
+    #[serde(default)]
+    pub rulesets: Vec<RulesetInfo>,
+}
+
+/// Bot Management / Bot Fight Mode configuration
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct BotManagementSetting {
+    #[serde(default)]
+    pub fight_mode: bool,
+    #[serde(default)]
+    pub using_latest_model: Option<bool>,
+    #[serde(default)]
+    pub optimize_wordpress: Option<bool>,
+    pub sbfm_definitely_automated: Option<String>,
+    pub sbfm_likely_automated: Option<String>,
+    pub sbfm_verified_bots: Option<String>,
+    pub sbfm_static_resource_protection: Option<bool>,
+}
+
+/// Rate limiting rule definition
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct RateLimitRule {
+    pub id: String,
+    pub disabled: Option<bool>,
+    pub description: Option<String>,
+    pub threshold: Option<u32>,
+    pub period: Option<u32>,
+    pub action: Option<String>,
+}
+
+/// Rate limiting settings
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct RateLimitSetting {
+    #[serde(default)]
+    pub rules: Vec<RateLimitRule>,
+}
+
+/// Zone lockdown configuration
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct ZoneLockdownRule {
+    pub id: String,
+    pub paused: Option<bool>,
+    pub description: Option<String>,
+    pub urls: Vec<String>,
+    pub configurations: Vec<LockdownConfig>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct LockdownConfig {
+    pub target: String,
+    pub value: String,
+}
+
+/// Zone Lockdown summary
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct ZoneLockdownSetting {
+    #[serde(default)]
+    pub rules: Vec<ZoneLockdownRule>,
+}
+
+/// IP Access / Firewall Rule
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct IpAccessRule {
+    pub id: String,
+    pub mode: String, // "block", "challenge", "whitelist", "js_challenge", "managed_challenge"
+    pub configuration: IpAccessConfig,
+    pub notes: Option<String>,
+    pub paused: Option<bool>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct IpAccessConfig {
+    pub target: String, // "ip", "ip_range", "asn", "country"
+    pub value: String,
+}
+
+/// IP Access Rules list
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct IpAccessRulesSetting {
+    #[serde(default)]
+    pub rules: Vec<IpAccessRule>,
+}
+
+/// Core Zone Settings (SSL, Min TLS, Always HTTPS, etc.)
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
+pub struct ZoneSettings {
+    pub ssl: Option<String>,              // "off", "flexible", "full", "strict"
+    pub min_tls_version: Option<String>,  // "1.0", "1.1", "1.2", "1.3"
+    pub tls_1_3: Option<String>,          // "on", "off", "zrt"
+    pub always_use_https: Option<String>, // "on", "off"
+    pub automatic_https_rewrites: Option<String>, // "on", "off"
+    pub opportunistic_encryption: Option<String>, // "on", "off"
+    pub security_header: Option<SecurityHeaderSetting>,
+    pub security_level: Option<String>, // "essentially_off", "low", "medium", "high", "under_attack"
+    pub browser_check: Option<String>,  // "on", "off"
+    pub challenge_ttl: Option<i64>,
+    pub brotli: Option<String>,
+    pub early_hints: Option<String>,
+}
+
+/// Complete dataset gathered for a single Cloudflare Zone
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Default)]
+pub struct ZoneAuditData {
+    pub zone: Zone,
+    pub settings: ZoneSettings,
+    pub dnssec: DnssecSetting,
+    pub waf: WafSetting,
+    pub bot_management: BotManagementSetting,
+    pub rate_limits: RateLimitSetting,
+    pub lockdowns: ZoneLockdownSetting,
+    pub ip_access_rules: IpAccessRulesSetting,
+}
+
+/// Standard Cloudflare API Response Envelope
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ApiResponse<T> {
+    pub success: bool,
+    pub errors: Option<Vec<ApiMessage>>,
+    pub messages: Option<Vec<ApiMessage>>,
+    pub result: Option<T>,
+    pub result_info: Option<ResultInfo>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ApiMessage {
+    pub code: Option<i64>,
+    pub message: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ResultInfo {
+    pub page: Option<u32>,
+    pub per_page: Option<u32>,
+    pub count: Option<u32>,
+    pub total_count: Option<u32>,
+    pub total_pages: Option<u32>,
+}
+
+/// Single setting item returned from /zones/{id}/settings
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SettingItem {
+    pub id: String,
+    pub value: serde_json::Value,
+    pub editable: Option<bool>,
+    pub modified_on: Option<String>,
+}

package/src/zone/models/mod.rs

@@ -0,0 +1,7 @@
+pub mod audit;
+pub mod cloudflare;
+pub mod sarif;
+
+pub use audit::*;
+pub use cloudflare::*;
+pub use sarif::*;

package/src/zone/models/sarif.rs

@@ -0,0 +1,89 @@
+use serde::{Deserialize, Serialize};
+
+/// SARIF v2.1.0 root structure
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifReport {
+    #[serde(rename = "$schema")]
+    pub schema: String,
+    pub version: String,
+    pub runs: Vec<SarifRun>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifRun {
+    pub tool: SarifTool,
+    pub results: Vec<SarifResult>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifTool {
+    pub driver: SarifDriver,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifDriver {
+    pub name: String,
+    pub version: String,
+    #[serde(rename = "informationUri")]
+    pub information_uri: String,
+    pub rules: Vec<SarifRuleDescriptor>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifRuleDescriptor {
+    pub id: String,
+    pub name: String,
+    #[serde(rename = "shortDescription")]
+    pub short_description: SarifMessage,
+    #[serde(rename = "fullDescription")]
+    pub full_description: SarifMessage,
+    #[serde(rename = "defaultConfiguration")]
+    pub default_configuration: SarifRuleConfiguration,
+    #[serde(rename = "helpUri", skip_serializing_if = "Option::is_none")]
+    pub help_uri: Option<String>,
+    pub properties: Option<SarifProperties>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifProperties {
+    pub tags: Vec<String>,
+    pub precision: String,
+    #[serde(rename = "security-severity")]
+    pub security_severity: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifRuleConfiguration {
+    pub level: String, // "error", "warning", "note", "none"
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifResult {
+    #[serde(rename = "ruleId")]
+    pub rule_id: String,
+    pub level: String,
+    pub message: SarifMessage,
+    pub locations: Vec<SarifLocation>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifMessage {
+    pub text: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifLocation {
+    #[serde(rename = "physicalLocation")]
+    pub physical_location: SarifPhysicalLocation,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifPhysicalLocation {
+    #[serde(rename = "artifactLocation")]
+    pub artifact_location: SarifArtifactLocation,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SarifArtifactLocation {
+    pub uri: String,
+}