model

type ACMEChallenge struct {
	ID               uuid.UUID `json:"id"`
	DeviceID         uuid.UUID `json:"device_id"`
	FQDN             string    `json:"fqdn"`
	KeyAuthorization string    `json:"key_authorization"`
	CreatedAt        time.Time `json:"created_at"`
	ExpiresAt        time.Time `json:"expires_at"`
}

type Account struct {
	ID                    uuid.UUID     `json:"id"`
	Status                AccountStatus `json:"status"`
	MembershipEpoch       int           `json:"membership_epoch"`
	FoundingEKFingerprint string        `json:"founding_ek_fingerprint,omitempty"`
	RecoveryDeadline      *time.Time    `json:"recovery_deadline,omitempty"`
	DissolvedAt           *time.Time    `json:"dissolved_at,omitempty"`
	CreatedAt             time.Time     `json:"created_at"`
}

type AccountDomain struct {
	ID                 uuid.UUID    `json:"id"`
	AccountID          uuid.UUID    `json:"account_id"`
	Domain             string       `json:"domain"`
	CNAMETarget        string       `json:"cname_target"`
	Status             DomainStatus `json:"status"`
	CreatedAt          time.Time    `json:"created_at"`
	ExpiresAt          *time.Time   `json:"expires_at,omitempty"`
	VerifiedAt         *time.Time   `json:"verified_at,omitempty"`
	VerifiedByDeviceID *uuid.UUID   `json:"verified_by_device_id,omitempty"`

	// Populated by list queries
	AssignedDeviceIDs []uuid.UUID `json:"assigned_devices,omitempty"`
}

type AccountInvite struct {
	ID                 uuid.UUID  `json:"id"`
	AccountID          uuid.UUID  `json:"account_id"`
	InviteCodeHash     string     `json:"-"`
	CreatedByDeviceID  uuid.UUID  `json:"created_by_device_id"`
	ExpiresAt          time.Time  `json:"expires_at"`
	ConsumedAt         *time.Time `json:"consumed_at,omitempty"`
	ConsumedByDeviceID *uuid.UUID `json:"consumed_by_device_id,omitempty"`
	CreatedAt          time.Time  `json:"created_at"`
}

type AccountStatus string

type ActorType string

type AuditEntry struct {
	ID           int64           `json:"id"`
	Timestamp    time.Time       `json:"timestamp"`
	ActorType    ActorType       `json:"actor_type"`
	ActorID      string          `json:"actor_id"`
	Action       string          `json:"action"`
	ResourceType string          `json:"resource_type"`
	ResourceID   *string         `json:"resource_id,omitempty"`
	Details      json.RawMessage `json:"details,omitempty"`
	IPAddress    net.IP          `json:"ip_address,omitempty"`
}

type Device struct {
	ID                 uuid.UUID         `json:"id"`
	AccountID          uuid.UUID         `json:"account_id"`
	Slug               string            `json:"slug"`
	Hostname           string            `json:"hostname"`
	CustomHostname     *string           `json:"custom_hostname"`
	IdentityClass      string            `json:"identity_class"`
	EKFingerprint      string            `json:"ek_fingerprint"`
	EKCertDER          []byte            `json:"-"`
	AKPublicKey        []byte            `json:"-"`
	IssuerFingerprint  *string           `json:"issuer_fingerprint,omitempty"`
	OSVersion          *string           `json:"os_version,omitempty"`
	PCRValues          map[string]string `json:"pcr_values,omitempty"`
	TrustLevel         TrustLevel        `json:"trust_level"`
	TrustLevelOverride *TrustLevel       `json:"trust_level_override,omitempty"`
	IPAddress          net.IP            `json:"ip_address,omitempty"`
	Timezone           *string           `json:"timezone,omitempty"`
	Status             DeviceStatus      `json:"status"`

	HostnameChangesThisYear int        `json:"-"`
	HostnameYear            int        `json:"-"`
	LastHostnameChangeAt    *time.Time `json:"-"`
	VoucherPendingSince     *time.Time `json:"-"`

	CreatedAt  time.Time  `json:"created_at"`
	LastSeenAt *time.Time `json:"last_seen_at,omitempty"`
}

type DeviceStatus string

type DomainAssignment struct {
	DeviceID  uuid.UUID `json:"device_id"`
	Domain    string    `json:"domain"`
	CreatedAt time.Time `json:"created_at"`
}

type DomainStatus string

type EKIssuerCensus struct {
	ID                        uuid.UUID  `json:"id"`
	IssuerFingerprint         string     `json:"issuer_fingerprint"`
	IssuerSubject             string     `json:"issuer_subject"`
	IssuerPublicKeyDER        []byte     `json:"-"`
	IssuerIsCA                *bool      `json:"issuer_is_ca"`
	IssuerHasCertSign         *bool      `json:"issuer_has_certsign"`
	DeviceCount               int        `json:"device_count"`
	DistinctSubnetCount       int        `json:"distinct_subnet_count"`
	StructuralComplianceScore *float32   `json:"structural_compliance_score"`
	Tier                      IssuerTier `json:"tier"`
	FirstSeenAt               time.Time  `json:"first_seen_at"`
	LastSeenAt                time.Time  `json:"last_seen_at"`
	Flagged                   bool       `json:"flagged"`
	FlaggedReason             *string    `json:"flagged_reason,omitempty"`
	CreatedAt                 time.Time  `json:"created_at"`
}

type EKIssuerObservation struct {
	ID                int64     `json:"id"`
	IssuerFingerprint string    `json:"issuer_fingerprint"`
	DeviceID          uuid.UUID `json:"device_id"`
	ClientIPSubnet    string    `json:"client_ip_subnet"`
	ObservedAt        time.Time `json:"observed_at"`
}

type IssuerTier string

type NexusInstance struct {
	ID                       uuid.UUID   `json:"id"`
	Hostname                 string      `json:"hostname"`
	ResolvedAddresses        []net.IP    `json:"resolved_addresses"`
	Region                   *string     `json:"region,omitempty"`
	BackendPort              int         `json:"backend_port"`
	HeartbeatIntervalSeconds int         `json:"heartbeat_interval_seconds"`
	Status                   NexusStatus `json:"status"`
	RegisteredAt             time.Time   `json:"registered_at"`
	LastSeenAt               time.Time   `json:"last_seen_at"`
}

type NexusStatus string

type PCRCensus struct {
	ID               uuid.UUID         `json:"id"`
	GroupingKey      string            `json:"grouping_key"`
	PCRGroup         PCRGroup          `json:"pcr_group"`
	PCRCompositeHash string            `json:"pcr_composite_hash"`
	PCRValues        map[string]string `json:"pcr_values"`
	DeviceCount      int               `json:"device_count"`
	IsMajority       bool              `json:"is_majority"`
	FirstSeenAt      time.Time         `json:"first_seen_at"`
	LastSeenAt       time.Time         `json:"last_seen_at"`
}

type PCRConsensusStatus string

type PCRGroup string

type RecoveryClaim struct {
	ID                  uuid.UUID  `json:"id"`
	DeviceID            uuid.UUID  `json:"device_id"`
	ClaimedAccountID    uuid.UUID  `json:"claimed_account_id"`
	VoucherData         string     `json:"voucher_data"`
	VoucherQuote        string     `json:"voucher_quote"`
	VoucherEpoch        int        `json:"voucher_epoch"`
	IssuerAKPublicKey   []byte     `json:"-"`
	IssuerEKFingerprint string     `json:"issuer_ek_fingerprint"`
	IssuerEKCert        []byte     `json:"-"`
	Attributed          bool       `json:"attributed"`
	Rejected            bool       `json:"rejected"`
	RejectionReason     *string    `json:"rejection_reason,omitempty"`
	AttributedAt        *time.Time `json:"attributed_at,omitempty"`
	CreatedAt           time.Time  `json:"created_at"`
}

type TrustLevel string

type VoucherRequest struct {
	ID              uuid.UUID            `json:"id"`
	AccountID       uuid.UUID            `json:"account_id"`
	IssuerDeviceID  uuid.UUID            `json:"issuer_device_id"`
	SubjectDeviceID uuid.UUID            `json:"subject_device_id"`
	VoucherData     string               `json:"voucher_data"`
	Epoch           int                  `json:"epoch"`
	Status          VoucherRequestStatus `json:"status"`
	Quote           *string              `json:"quote,omitempty"`
	CreatedAt       time.Time            `json:"created_at"`
	SignedAt        *time.Time           `json:"signed_at,omitempty"`
}

type VoucherRequestStatus string