#pragma once

#include "KswordArkProcessIoctl.h"

// ============================================================
// KswordArkSafetyIoctl.h
// 作用：
// - 定义 Phase-15 危险操作统一治理协议；
// - R0 通过中央 safety policy 决策危险操作；
// - R3 可查询策略、开启高级模式、逐步切换到显式二次确认模式。
// ============================================================

#define KSWORD_ARK_SAFETY_PROTOCOL_VERSION 1UL

#define KSWORD_ARK_IOCTL_FUNCTION_QUERY_SAFETY_POLICY 0x81AUL
#define KSWORD_ARK_IOCTL_FUNCTION_SET_SAFETY_POLICY   0x81BUL

#define IOCTL_KSWORD_ARK_QUERY_SAFETY_POLICY \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_QUERY_SAFETY_POLICY, \
        METHOD_BUFFERED, \
        FILE_ANY_ACCESS)

#define IOCTL_KSWORD_ARK_SET_SAFETY_POLICY \
    CTL_CODE( \
        KSWORD_ARK_IOCTL_DEVICE_TYPE, \
        KSWORD_ARK_IOCTL_FUNCTION_SET_SAFETY_POLICY, \
        METHOD_BUFFERED, \
        FILE_WRITE_ACCESS)

#define KSWORD_ARK_SAFETY_POLICY_FLAG_ACTIVE                         0x00000001UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ADVANCED_MODE                  0x00000002UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_REQUIRE_CONFIRMATION_HIGH_RISK 0x00000004UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_LEGACY_UNCONFIRMED_R3    0x00000008UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_DENY_CRITICAL_PROCESS          0x00000010UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_PROCESS_TERMINATE        0x00000020UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_PROCESS_SUSPEND          0x00000040UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_PROCESS_PROTECTION       0x00000080UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_FILE_DELETE              0x00000100UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_CALLBACK_CONTROL         0x00000200UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_AUDIT_ONLY                     0x00000400UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_MEMORY_WRITE             0x00000800UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_KERNEL_PATCH             0x00001000UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_DRIVER_UNLOAD            0x00002000UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_PROCESS_INJECT           0x00004000UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_DRIVER_THREAD_CONTROL    0x00008000UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_FIRMWARE_RETURN          0x00010000UL
#define KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_RAW_DISK_WRITE           0x00020000UL

#define KSWORD_ARK_SAFETY_POLICY_FLAG_MUTATING_DEFAULTS \
    (KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_PROCESS_TERMINATE | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_PROCESS_SUSPEND | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_PROCESS_PROTECTION | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_FILE_DELETE | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_CALLBACK_CONTROL | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_MEMORY_WRITE | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_KERNEL_PATCH | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_DRIVER_UNLOAD | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_PROCESS_INJECT | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_DRIVER_THREAD_CONTROL | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_FIRMWARE_RETURN | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_RAW_DISK_WRITE)

#define KSWORD_ARK_SAFETY_POLICY_FLAG_DEFAULT \
    (KSWORD_ARK_SAFETY_POLICY_FLAG_ACTIVE | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ADVANCED_MODE | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_REQUIRE_CONFIRMATION_HIGH_RISK | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_ALLOW_LEGACY_UNCONFIRMED_R3 | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_DENY_CRITICAL_PROCESS | \
     KSWORD_ARK_SAFETY_POLICY_FLAG_MUTATING_DEFAULTS)

#define KSWORD_ARK_SAFETY_OPERATION_NONE                     0UL
#define KSWORD_ARK_SAFETY_OPERATION_PROCESS_TERMINATE        1UL
#define KSWORD_ARK_SAFETY_OPERATION_PROCESS_SUSPEND          2UL
#define KSWORD_ARK_SAFETY_OPERATION_PROCESS_SET_PROTECTION   3UL
#define KSWORD_ARK_SAFETY_OPERATION_FILE_DELETE              4UL
#define KSWORD_ARK_SAFETY_OPERATION_CALLBACK_SET_RULES       5UL
#define KSWORD_ARK_SAFETY_OPERATION_CALLBACK_REMOVE_EXTERNAL 6UL
#define KSWORD_ARK_SAFETY_OPERATION_CALLBACK_CANCEL_PENDING  7UL
#define KSWORD_ARK_SAFETY_OPERATION_DRIVER_UNLOAD            8UL
#define KSWORD_ARK_SAFETY_OPERATION_MEMORY_WRITE             9UL
#define KSWORD_ARK_SAFETY_OPERATION_KERNEL_PATCH             10UL
#define KSWORD_ARK_SAFETY_OPERATION_PROCESS_INJECT           11UL
#define KSWORD_ARK_SAFETY_OPERATION_DRIVER_THREAD_CONTROL     12UL
#define KSWORD_ARK_SAFETY_OPERATION_FIRMWARE_RETURN           13UL
#define KSWORD_ARK_SAFETY_OPERATION_RAW_DISK_WRITE             14UL

#define KSWORD_ARK_SAFETY_RISK_LOW      1UL
#define KSWORD_ARK_SAFETY_RISK_MEDIUM   2UL
#define KSWORD_ARK_SAFETY_RISK_HIGH     3UL
#define KSWORD_ARK_SAFETY_RISK_CRITICAL 4UL

#define KSWORD_ARK_SAFETY_DECISION_ALLOW              1UL
#define KSWORD_ARK_SAFETY_DECISION_DENY               2UL
#define KSWORD_ARK_SAFETY_DECISION_AUDIT_ONLY_ALLOW   3UL

#define KSWORD_ARK_SAFETY_DECISION_FLAG_POLICY_ACTIVE              0x00000001UL
#define KSWORD_ARK_SAFETY_DECISION_FLAG_ADVANCED_MODE              0x00000002UL
#define KSWORD_ARK_SAFETY_DECISION_FLAG_UI_CONFIRMED               0x00000004UL
#define KSWORD_ARK_SAFETY_DECISION_FLAG_LEGACY_CONFIRMATION_ASSUMED 0x00000008UL
#define KSWORD_ARK_SAFETY_DECISION_FLAG_CRITICAL_TARGET            0x00000010UL
#define KSWORD_ARK_SAFETY_DECISION_FLAG_AUDIT_ONLY                 0x00000020UL

#define KSWORD_ARK_SAFETY_REASON_NONE                    0UL
#define KSWORD_ARK_SAFETY_REASON_POLICY_INACTIVE         1UL
#define KSWORD_ARK_SAFETY_REASON_OPERATION_DISABLED      2UL
#define KSWORD_ARK_SAFETY_REASON_ADVANCED_MODE_REQUIRED  3UL
#define KSWORD_ARK_SAFETY_REASON_CONFIRMATION_REQUIRED   4UL
#define KSWORD_ARK_SAFETY_REASON_CRITICAL_PROCESS_DENIED 5UL
#define KSWORD_ARK_SAFETY_REASON_INVALID_TARGET          6UL

#define KSWORD_ARK_SAFETY_CONTEXT_FLAG_UI_CONFIRMED 0x00000001UL

#define KSWORD_ARK_SAFETY_TEXT_MAX_CHARS 160U

typedef struct _KSWORD_ARK_QUERY_SAFETY_POLICY_REQUEST
{
    unsigned long size;
    unsigned long version;
    unsigned long flags;
    unsigned long reserved;
} KSWORD_ARK_QUERY_SAFETY_POLICY_REQUEST;

typedef struct _KSWORD_ARK_QUERY_SAFETY_POLICY_RESPONSE
{
    unsigned long size;
    unsigned long version;
    unsigned long policyFlags;
    unsigned long defaultPolicyFlags;
    unsigned long policyGeneration;
    unsigned long lastOperation;
    unsigned long lastDecision;
    unsigned long lastReason;
    unsigned long lastRiskLevel;
    unsigned long lastTargetProcessId;
    long lastStatus;
    unsigned long reserved;
    unsigned long long allowedCount;
    unsigned long long deniedCount;
    unsigned long long auditOnlyCount;
    wchar_t lastTargetText[KSWORD_ARK_SAFETY_TEXT_MAX_CHARS];
} KSWORD_ARK_QUERY_SAFETY_POLICY_RESPONSE;

typedef struct _KSWORD_ARK_SET_SAFETY_POLICY_REQUEST
{
    unsigned long size;
    unsigned long version;
    unsigned long setFlags;
    unsigned long clearFlags;
    unsigned long expectedGeneration;
    unsigned long reserved;
} KSWORD_ARK_SET_SAFETY_POLICY_REQUEST;

typedef struct _KSWORD_ARK_SET_SAFETY_POLICY_RESPONSE
{
    unsigned long size;
    unsigned long version;
    unsigned long oldPolicyFlags;
    unsigned long newPolicyFlags;
    unsigned long oldGeneration;
    unsigned long newGeneration;
    long status;
    unsigned long reserved;
} KSWORD_ARK_SET_SAFETY_POLICY_RESPONSE;
