# Push protection's rules (hub spec §15.4, oxygenhub#268), compiled into
# the hub. Each rule:
#
#   id          stable name, part of every fingerprint: never reuse one
#   description what a refusal calls it
#   regex       Rust `regex` syntax, matched on bytes; the capture group
#               named `secret`, when there is one, is the secret, else the
#               whole match
#   keywords    optional prefilter: the regex runs on a text only when one
#               of these occurs in it (case-insensitive)
#   requires    optional: a regex the same file or inserted text must also
#               match somewhere, for secrets that are only one when paired
#
# Rules are tried in order and a match overlapping an earlier rule's is
# dropped, so the specific rules come before the general ones. Bump
# `version` whenever a rule is added, changed or removed.

version = 1

[[rule]]
id = "gcp-service-account"
description = "Google Cloud service account key"
keywords = ["service_account"]
regex = '''"private_key"\s*:\s*"(?P<secret>-----BEGIN[^"]{40,})"'''
requires = '''"type"\s*:\s*"service_account"'''

[[rule]]
id = "aws-access-key-id"
description = "AWS access key ID"
keywords = ["akia", "asia", "abia", "acca"]
regex = '''\b(?P<secret>(?:AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16})\b'''

[[rule]]
id = "aws-secret-access-key"
description = "AWS secret access key"
keywords = ["aws", "secret"]
regex = '''(?im)(?:aws|secret)[a-z0-9_ .\-]{0,30}['"]?\s*[:=]\s*['"]?(?P<secret>[A-Za-z0-9/+]{40})(?:[^A-Za-z0-9/+=]|$)'''
requires = '''\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16}\b'''

[[rule]]
id = "azure-storage-connection-string"
description = "Azure storage account connection string"
keywords = ["accountkey="]
regex = '''(?i)DefaultEndpointsProtocol=https?;AccountName=[A-Za-z0-9]+;AccountKey=(?P<secret>[A-Za-z0-9+/]{40,}={0,2})'''

[[rule]]
id = "github-token"
description = "GitHub token"
keywords = ["ghp_", "gho_", "ghu_", "ghs_", "ghr_"]
regex = '''\b(?P<secret>gh[pousr]_[A-Za-z0-9]{36,255})\b'''

[[rule]]
id = "github-fine-grained-token"
description = "GitHub fine-grained personal access token"
keywords = ["github_pat_"]
regex = '''\b(?P<secret>github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59})\b'''

[[rule]]
id = "gitlab-token"
description = "GitLab personal access token"
keywords = ["glpat-"]
regex = '''\b(?P<secret>glpat-[A-Za-z0-9_\-.]{20,})'''

[[rule]]
id = "oxygenhub-token"
description = "OxygenHub personal access token"
keywords = ["oxyhub_"]
regex = '''\b(?P<secret>oxyhub_[0-9a-f]{64})\b'''

[[rule]]
id = "oxygenhub-agent-grant"
description = "OxygenHub agent grant token"
keywords = ["oxyagent_"]
regex = '''\b(?P<secret>oxyagent_[0-9a-f]{64})\b'''

[[rule]]
id = "oxygenflow-job-token"
description = "OxygenFlow job token"
keywords = ["flowjob_"]
regex = '''\b(?P<secret>flowjob_[0-9a-f]{64})\b'''

[[rule]]
id = "oxygenflow-runner-credential"
description = "OxygenFlow runner credential"
keywords = ["flowrunner_"]
regex = '''\b(?P<secret>flowrunner_[0-9a-f]{64})\b'''

[[rule]]
id = "oxygenflow-registration-token"
description = "OxygenFlow runner registration token"
keywords = ["flowreg_"]
regex = '''\b(?P<secret>flowreg_[0-9a-f]{48})\b'''

[[rule]]
id = "slack-token"
description = "Slack token"
keywords = ["xoxb-", "xoxa-", "xoxp-", "xoxr-", "xoxs-"]
regex = '''\b(?P<secret>xox[baprs]-[A-Za-z0-9-]{10,})'''

[[rule]]
id = "stripe-live-key"
description = "Stripe live secret key"
keywords = ["sk_live_", "rk_live_"]
regex = '''\b(?P<secret>[rs]k_live_[A-Za-z0-9]{24,})\b'''

[[rule]]
id = "openssh-private-key"
description = "OpenSSH private key"
keywords = ["openssh private key"]
regex = '''(?P<secret>-----BEGIN[ ]OPENSSH[ ]PRIVATE[ ]KEY-----[\s\S]{40,}?-----END[ ]OPENSSH[ ]PRIVATE[ ]KEY-----)'''

[[rule]]
id = "private-key"
description = "PEM private key"
keywords = ["private key"]
regex = '''(?P<secret>-----BEGIN[ ](?:[A-Z0-9]+[ ])*PRIVATE[ ]KEY-----[\s\S]{40,}?-----END[ ](?:[A-Z0-9]+[ ])*PRIVATE[ ]KEY-----)'''