// Package models defines the data types used throughout the application.
package models

// SecurityLogEntry represents a security-relevant log entry for live streaming.
// This struct is used by the LogWatcher service to broadcast parsed Caddy access logs
// with security event annotations to WebSocket clients.
type SecurityLogEntry struct {
	Timestamp   string                 `json:"timestamp"`
	Level       string                 `json:"level"`
	Logger      string                 `json:"logger"`
	ClientIP    string                 `json:"client_ip"`
	Method      string                 `json:"method"`
	URI         string                 `json:"uri"`
	Status      int                    `json:"status"`
	Duration    float64                `json:"duration"`
	Size        int64                  `json:"size"`
	UserAgent   string                 `json:"user_agent"`
	Host        string                 `json:"host"`
	Source      string                 `json:"source"`                 // "waf", "crowdsec", "ratelimit", "acl", "normal"
	Blocked     bool                   `json:"blocked"`                // True if request was blocked
	BlockReason string                 `json:"block_reason,omitempty"` // Reason for blocking
	Details     map[string]interface{} `json:"details,omitempty"`      // Additional metadata
}
