# Code generated by highflame-policy-codegen. DO NOT EDIT.
# Source: schemas/overwatch/templates/templates.json
#
# Overwatch default policies and templates.
# Cedar text is loaded from package data at import time.
#
# Usage:
#   from highflame_policy.overwatch_defaults import (
#       OVERWATCH_DEFAULTS,
#       OVERWATCH_TEMPLATES,
#       OVERWATCH_CATEGORIES,
#       get_overwatch_defaults_by_category,
#       get_overwatch_templates_by_category,
#       get_overwatch_template_by_id,
#   )

import json
from dataclasses import dataclass, field
from importlib.resources import files
from typing import Optional


# =============================================================================
# TYPES
# =============================================================================

# Valid Overwatch policy categories
OverwatchCategory = str  # One of: 'secrets', 'pii', 'semantic', 'tools', 'organization', 'trust_safety', 'agent_security'

VALID_CATEGORIES = frozenset(['secrets', 'pii', 'semantic', 'tools', 'organization', 'trust_safety', 'agent_security'])


@dataclass(frozen=True)
class OverwatchCategoryInfo:
    """Category metadata for UI display."""
    id: str
    name: str
    description: str


@dataclass(frozen=True)
class OverwatchDefaultPolicy:
    """A default policy that is auto-created for new projects."""
    id: str
    name: str
    description: str
    category: str
    cedar_text: str
    severity: str
    tags: tuple[str, ...]
    is_active: bool


@dataclass(frozen=True)
class OverwatchTemplate:
    """A policy template available for users to create from."""
    id: str
    name: str
    description: str
    category: str
    cedar_text: str
    severity: str
    tags: tuple[str, ...]


# =============================================================================
# LOAD CEDAR FILES FROM PACKAGE DATA
# =============================================================================

def _load_cedar(path: str) -> str:
    """Load a Cedar policy file from package data."""
    return (
        files('highflame_policy._schemas.overwatch.templates')
        .joinpath(path)
        .read_text(encoding='utf-8')
    )


# Default policies (one per category)
_baseline_default_cedar = _load_cedar('defaults/baseline.cedar')
_secrets_default_cedar = _load_cedar('defaults/secrets.cedar')
_pii_default_cedar = _load_cedar('defaults/pii.cedar')
_semantic_default_cedar = _load_cedar('defaults/semantic.cedar')
_tools_default_cedar = _load_cedar('defaults/tools.cedar')
_trust_safety_default_cedar = _load_cedar('defaults/trust_safety.cedar')
_agent_security_default_cedar = _load_cedar('defaults/agent_security.cedar')

# Additional templates
_tools_mcp_allowlist_cedar = _load_cedar('mcp_server_allowlist.cedar')
_tools_mcp_tool_permissions_cedar = _load_cedar('mcp_tool_permissions.cedar')
_org_default_deny_cedar = _load_cedar('default_deny_all.cedar')
_org_audit_all_cedar = _load_cedar('audit_all_actions.cedar')
_org_team_permissions_cedar = _load_cedar('team_permissions.cedar')
_org_agent_guardrails_cedar = _load_cedar('agent_guardrails.cedar')


# =============================================================================
# CATEGORIES
# =============================================================================

OVERWATCH_CATEGORIES: tuple[OverwatchCategoryInfo, ...] = (
    OverwatchCategoryInfo(
        id='secrets',
        name='Secrets Detection',
        description='Detect and block credentials, tokens, API keys, and sensitive key patterns in prompts, tool calls, and AI responses',
    ),
    OverwatchCategoryInfo(
        id='pii',
        name='PII Detection',
        description='Detect and block personally identifiable information (PII) such as credit card numbers, SSNs, and other sensitive data',
    ),
    OverwatchCategoryInfo(
        id='semantic',
        name='Semantic Threat Detection',
        description='Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats',
    ),
    OverwatchCategoryInfo(
        id='tools',
        name='Tool Permissioning',
        description='Control access to shell execution, file operations, MCP servers, and sensitive system paths',
    ),
    OverwatchCategoryInfo(
        id='organization',
        name='Organization Rules',
        description='Apply organization-wide policy baselines, team permissions, and agent-specific guardrails',
    ),
    OverwatchCategoryInfo(
        id='trust_safety',
        name='Content Safety',
        description='Detect and control violent, harmful, hateful, sexual, and profane content using trust/safety classification scores',
    ),
    OverwatchCategoryInfo(
        id='agent_security',
        name='Agent Security',
        description='Detect tool poisoning, rug pull attacks, and indirect prompt injection targeting AI agents',
    ),
)


# =============================================================================
# DEFAULT POLICIES
# =============================================================================

OVERWATCH_DEFAULTS: tuple[OverwatchDefaultPolicy, ...] = (
    OverwatchDefaultPolicy(
        id='baseline-default',
        name='Baseline Permit',
        description='Permits all actions by default — threat-specific forbid policies override this when threats are detected',
        category='organization',
        cedar_text=_baseline_default_cedar,
        severity='low',
        tags=('baseline', 'permit-default', 'organization'),
        is_active=True,
    ),
    OverwatchDefaultPolicy(
        id='secrets-default',
        name='Secrets Detection',
        description='Detect and block credential leakage across prompts, tool calls, file operations, and AI response content',
        category='secrets',
        cedar_text=_secrets_default_cedar,
        severity='critical',
        tags=('api-keys', 'tokens', 'credentials', 'aws', 'github', 'ssh', 'baseline'),
        is_active=True,
    ),
    OverwatchDefaultPolicy(
        id='pii-default',
        name='PII Detection',
        description='Detect and block credit card numbers, SSN, and other sensitive personal information in prompts and tool calls',
        category='pii',
        cedar_text=_pii_default_cedar,
        severity='critical',
        tags=('pii', 'privacy', 'compliance', 'pci-dss', 'gdpr', 'baseline'),
        is_active=True,
    ),
    OverwatchDefaultPolicy(
        id='semantic-default',
        name='Semantic Threat Detection',
        description='Detect and block prompt injection, jailbreak attempts, and high-severity AI security threats',
        category='semantic',
        cedar_text=_semantic_default_cedar,
        severity='critical',
        tags=('prompt-injection', 'jailbreak', 'owasp-llm01', 'security', 'baseline'),
        is_active=True,
    ),
    OverwatchDefaultPolicy(
        id='tools-default',
        name='Tool Permissioning',
        description='Block dangerous shell execution, restrict sensitive file paths, and enforce threat-based tool access controls',
        category='tools',
        cedar_text=_tools_default_cedar,
        severity='critical',
        tags=('shell', 'command-injection', 'file-access', 'mitre-t1059', 'baseline'),
        is_active=False,
    ),
    OverwatchDefaultPolicy(
        id='trust-safety-default',
        name='Content Safety',
        description='Detect and block violent, harmful, hateful, sexual, and profane content using classification scores',
        category='trust_safety',
        cedar_text=_trust_safety_default_cedar,
        severity='critical',
        tags=('violence', 'weapons', 'hate-speech', 'crime', 'sexual', 'profanity', 'content-safety', 'baseline'),
        is_active=True,
    ),
    OverwatchDefaultPolicy(
        id='agent-security-default',
        name='Agent Security',
        description='Detect and block tool poisoning, rug pull attacks, and indirect prompt injection targeting AI agents',
        category='agent_security',
        cedar_text=_agent_security_default_cedar,
        severity='critical',
        tags=('tool-poisoning', 'rug-pull', 'indirect-injection', 'mcp-security', 'agent-security', 'baseline'),
        is_active=True,
    ),
)


# =============================================================================
# ALL TEMPLATES
# =============================================================================

OVERWATCH_TEMPLATES: tuple[OverwatchTemplate, ...] = (
    OverwatchTemplate(
        id='tools-mcp-allowlist',
        name='MCP Server Allowlist',
        description='Only allow specific MCP servers to be used',
        category='tools',
        cedar_text=_tools_mcp_allowlist_cedar,
        severity='medium',
        tags=('mcp', 'allowlist', 'whitelist'),
    ),
    OverwatchTemplate(
        id='tools-mcp-tool-permissions',
        name='MCP Tool Permissions',
        description='Per-tool access control for MCP servers — allow specific tools while denying others, exclude servers org-wide, block unverified sources',
        category='tools',
        cedar_text=_tools_mcp_tool_permissions_cedar,
        severity='high',
        tags=('mcp', 'tools', 'least-privilege', 'per-server', 'exclusion'),
    ),
    OverwatchTemplate(
        id='org-default-deny',
        name='Default Deny All',
        description='Organization-wide baseline: deny all unless explicitly permitted',
        category='organization',
        cedar_text=_org_default_deny_cedar,
        severity='high',
        tags=('baseline', 'security', 'deny-by-default'),
    ),
    OverwatchTemplate(
        id='org-audit-all',
        name='Audit All Actions',
        description='Log all agent actions for compliance and monitoring',
        category='organization',
        cedar_text=_org_audit_all_cedar,
        severity='low',
        tags=('audit', 'compliance', 'logging'),
    ),
    OverwatchTemplate(
        id='org-team-permissions',
        name='Team-Based Permissions (ReBAC)',
        description='Grant IDE access based on team membership using entity hierarchy - supports dev team full access and support team read-only',
        category='organization',
        cedar_text=_org_team_permissions_cedar,
        severity='medium',
        tags=('rebac', 'team', 'permissions', 'hierarchy'),
    ),
    OverwatchTemplate(
        id='org-agent-guardrails',
        name='Agent-Specific Guardrails',
        description='Apply per-agent security guardrails - injection blocking for Claude, PII blocking for Cursor',
        category='organization',
        cedar_text=_org_agent_guardrails_cedar,
        severity='critical',
        tags=('rebac', 'agent', 'guardrails', 'per-agent'),
    ),
)


# =============================================================================
# HELPER FUNCTIONS
# =============================================================================

def get_overwatch_defaults_by_category(category: str) -> list[OverwatchDefaultPolicy]:
    return [d for d in OVERWATCH_DEFAULTS if d.category == category]


def get_overwatch_templates_by_category(category: str) -> list[OverwatchTemplate]:
    return [t for t in OVERWATCH_TEMPLATES if t.category == category]


def get_overwatch_template_by_id(template_id: str) -> Optional[OverwatchTemplate]:
    return next((t for t in OVERWATCH_TEMPLATES if t.id == template_id), None)


def get_overwatch_templates_metadata_json() -> str:
    """Return the raw templates.json metadata."""
    return (
        files('highflame_policy._schemas.overwatch.templates')
        .joinpath('templates.json')
        .read_text(encoding='utf-8')
    )


__all__ = [
    # Types
    'OverwatchCategoryInfo',
    'OverwatchDefaultPolicy',
    'OverwatchTemplate',
    # Data
    'OVERWATCH_CATEGORIES',
    'OVERWATCH_DEFAULTS',
    'OVERWATCH_TEMPLATES',
    # Functions
    'get_overwatch_defaults_by_category',
    'get_overwatch_templates_by_category',
    'get_overwatch_template_by_id',
    'get_overwatch_templates_metadata_json',
]
