model

type APIResourceOption func(*apiResourceOptions)

type AuthProvider struct {
	Resource

	// The desired state, stored as opaque JSON object.
	Spec *JSONField[domain.AuthProviderSpec] `gorm:"type:jsonb"`
}

type CVEEventAction struct {
	OrgID            uuid.UUID
	DeviceName       string
	CveID            string
	Action           string // "new", "supersede", "resolved"
	Severity         string
	FirstImageDigest *string
	FirstImageRef    *string
}

type Catalog struct {
	Resource

	// The desired state, stored as opaque JSON object.
	Spec *JSONField[domain.CatalogSpec] `gorm:"type:jsonb"`

	// The last reported state, stored as opaque JSON object.
	Status *JSONField[domain.CatalogStatus] `gorm:"type:jsonb"`
}

type CatalogItem struct {
	OrgID       uuid.UUID                          `gorm:"type:uuid;primaryKey"`
	CatalogName string                             `gorm:"primaryKey" selector:"metadata.catalog"`
	AppName     string                             `gorm:"primaryKey" selector:"metadata.name"`
	Owner       *string                            `gorm:"index" selector:"metadata.owner"`
	Spec        *JSONField[domain.CatalogItemSpec] `gorm:"type:jsonb"`
	Labels      JSONMap[string, string]            `gorm:"type:jsonb" selector:"metadata.labels,hidden,private"`
	Annotations JSONMap[string, string]            `gorm:"type:jsonb"`
	CreatedAt   time.Time
	UpdatedAt   time.Time
}

type CertificateSigningRequest struct {
	Resource

	// The desired state of the certificate signing request, stored as opaque JSON object.
	Spec *JSONField[domain.CertificateSigningRequestSpec] `gorm:"type:jsonb"`

	// The last reported state of the certificate signing request, stored as opaque JSON object.
	Status *JSONField[domain.CertificateSigningRequestStatus] `gorm:"type:jsonb"`
}

type ChangedFinding struct {
	ImageDigest     string
	CveID           string
	Severity        string // Current: Critical, High, Medium, Low, None, Unknown
	Status          string // Current: affected, not_affected, fixed, unknown
	SeverityChanged bool   // True if severity changed (or new insert)
	StatusChanged   bool   // True if status changed (or new insert)
}

type Checkpoint struct {
	Consumer  string `gorm:"primaryKey"`
	Key       string `gorm:"primaryKey"`
	Value     []byte
	CreatedAt time.Time `selector:"metadata.creationTimestamp"`
	UpdatedAt time.Time
	DeletedAt gorm.DeletedAt `gorm:"index"`
}

type DependencyRef struct {
	OrgID       uuid.UUID `gorm:"type:uuid;primaryKey"`
	ResourceKey string    `gorm:"primaryKey"` // e.g. "git:repo/ref", "http:repo/path", "secret:ns/name"
	FleetName   *string   `gorm:"primaryKey;default:''"`
	DeviceName  *string   `gorm:"primaryKey;default:''"`

	RefType            string // "git", "http", "secret"
	RepositoryName     *string
	Revision           *string
	HTTPSuffix         *string
	SecretName         *string
	SecretNamespace    *string
	ConfigProviderName string
}

type Device struct {
	Resource

	// The alias for the device.
	Alias *string `selector:"metadata.alias"`

	// The desired state, stored as opaque JSON object.
	Spec *JSONField[domain.DeviceSpec] `gorm:"type:jsonb"`

	// The last reported state, stored as opaque JSON object.
	Status *JSONField[domain.DeviceStatus] `gorm:"type:jsonb"`

	// Conditions set by the service, as opposed to the agent.
	ServiceConditions *JSONField[ServiceConditions] `gorm:"type:jsonb"`

	// The rendered device config
	RenderedConfig *JSONField[*[]domain.ConfigProviderSpec] `gorm:"type:jsonb"`

	// Timestamp when the device was rendered
	RenderTimestamp time.Time

	// The rendered application provided by the service.
	RenderedApplications *JSONField[*[]domain.ApplicationProviderSpec] `gorm:"type:jsonb"`

	// Join table with the relationship of devices to repositories (only maintained for standalone devices)
	Repositories []Repository `gorm:"many2many:device_repos;constraint:OnDelete:CASCADE;"`

	DeviceTimestamp DeviceTimestamp `gorm:"foreignKey:OrgID,Name;references:OrgID,Name;constraint:OnDelete:CASCADE"`
}

type DeviceLabel struct {
	OrgID      uuid.UUID `gorm:"primaryKey;type:uuid;index:,composite:device_label_org_device" selector:"metadata.orgid,hidden,private"`
	DeviceName string    `gorm:"primaryKey;index:,composite:device_label_org_device" selector:"metadata.name"`
	LabelKey   string    `gorm:"primaryKey;index:,composite:device_label_key" selector:"metadata.labels.key"`
	LabelValue string    `gorm:"index" selector:"metadata.labels.value"`

	// Foreign Key Constraint with CASCADE DELETE
	Device Device `gorm:"foreignKey:OrgID,DeviceName;references:OrgID,Name;constraint:OnDelete:CASCADE"`
}

type DeviceOpenCveEvent struct {
	OrgID            uuid.UUID `gorm:"type:uuid;primaryKey"`
	DeviceName       string    `gorm:"type:text;primaryKey"`
	CveID            string    `gorm:"type:text;primaryKey;column:cve_id"`
	Severity         string    `gorm:"type:text;not null"` // Critical or High
	FirstImageDigest *string   `gorm:"type:text"`
	FirstImageRef    *string   `gorm:"type:text"`
	CreatedAt        time.Time `gorm:"type:timestamptz;not null;default:now()"`
}

type DeviceTimestamp struct {
	OrgID uuid.UUID `gorm:"type:uuid;primaryKey;index:,composite:org_name,priority:1"`
	// Uniquely identifies the resource within an organization and schema.
	// Depending on the schema (kind), assigned by the device management system or the crypto identity of the device (public key). Immutable.
	// This may become a URN later, so it's important API users treat this as an opaque handle.
	Name string `gorm:"primaryKey;index:,composite:org_name,priority:2" selector:"metadata.name"`

	// The last time the device was seen (reported status).  Since this is updated frequently,
	// we store it in a separate table to avoid bloating the main device table.  In addition we don't index this field
	// because the effort of maintaining the index outweighs the benefit of querying by last seen.
	LastSeen *time.Time
}

type DeviceType interface {
	Device | DeviceWithTimestamp
}

type DeviceTypePtr interface {
	ToApiResource(opts ...APIResourceOption) (*domain.Device, error)
}

type DeviceWithTimestamp struct {
	Device
	LastSeen *time.Time
}

type EnrollmentRequest struct {
	Resource

	// The desired state of the enrollment request, stored as opaque JSON object.
	Spec *JSONField[domain.EnrollmentRequestSpec] `gorm:"type:jsonb"`

	// The last reported state of the enrollment request, stored as opaque JSON object.
	Status *JSONField[domain.EnrollmentRequestStatus] `gorm:"type:jsonb"`
}

type Event struct {
	Resource
	Reason             string                          `gorm:"type:string;index" selector:"reason"`
	SourceComponent    string                          `gorm:"type:string"`
	Actor              string                          `gorm:"type:string" selector:"actor"`
	Type               string                          `gorm:"type:string;index" selector:"type"`
	Message            string                          `gorm:"type:text"`
	Details            *JSONField[domain.EventDetails] `gorm:"type:jsonb"`
	InvolvedObjectName string                          `gorm:"type:string;index:idx_involved_object" selector:"involvedObject.name"`
	InvolvedObjectKind string                          `gorm:"type:string;index:idx_involved_object" selector:"involvedObject.kind"`
}

type Fleet struct {
	Resource

	// The desired state, stored as opaque JSON object.
	Spec *JSONField[domain.FleetSpec] `gorm:"type:jsonb"`

	// The last reported state, stored as opaque JSON object.
	Status *JSONField[domain.FleetStatus] `gorm:"type:jsonb"`

	// Join table with the relationship of fleets to repositories
	Repositories []Repository `gorm:"many2many:fleet_repos;constraint:OnDelete:CASCADE;"`
}

type GitDependencyProbe struct {
	RepositoryName string
	Revision       string
	Fingerprint    *string
	FleetNames     StringArray
	DeviceNames    StringArray
	RepoSpec       *JSONField[domain.RepositorySpec] `gorm:"type:jsonb"`
}

type HttpDependencyProbe struct {
	RepositoryName string
	HTTPSuffix     string
	Fingerprint    *string
	FleetNames     StringArray
	DeviceNames    StringArray
	RepoSpec       *JSONField[domain.RepositorySpec] `gorm:"type:jsonb"`
}

type JSONField[T any] struct {
	Data T
}

type JSONMap[K comparable, V any] map[K]V

type Organization = orgmodel.Organization

type Repository struct {
	Resource

	// The desired state, stored as opaque JSON object.
	Spec *JSONField[domain.RepositorySpec] `gorm:"type:jsonb"`

	// The last reported state, stored as opaque JSON object.
	Status *JSONField[domain.RepositoryStatus] `gorm:"type:jsonb"`

	// Join table with the relationship of repository to fleets
	Fleets []Fleet `gorm:"many2many:fleet_repos;constraint:OnDelete:CASCADE;"`

	// Join table with the relationship of repository to devices (only maintained for standalone devices)
	Devices []Device `gorm:"many2many:device_repos;constraint:OnDelete:CASCADE;"`
}

type Resource struct {

	// Uniquely identifies the organization the resource belongs to.
	// Assigned by IAM. Immutable.
	OrgID        uuid.UUID    `gorm:"type:uuid;primaryKey;index:,composite:org_name,priority:1"`
	Organization Organization `gorm:"foreignKey:OrgID"`

	// Uniquely identifies the resource within an organization and schema.
	// Depending on the schema (kind), assigned by the device management system or the crypto identity of the device (public key). Immutable.
	// This may become a URN later, so it's important API users treat this as an opaque handle.
	Name string `gorm:"primaryKey;index:,composite:org_name,priority:2" selector:"metadata.name"`

	// The "kind/name" of the resource owner of this resource.
	Owner *string `gorm:"index:owner_idx" selector:"metadata.owner"`

	// Labels associated with the resource, used for selecting and querying objects.
	// Labels are stored as a JSONB object, supporting flexible indexing and querying capabilities.
	Labels JSONMap[string, string] `gorm:"type:jsonb" selector:"metadata.labels,hidden,private"`

	// Annotations associated with the resource, used for storing additional metadata.
	// Similar to labels, annotations are stored as a JSONB object to support flexible indexing and querying.
	Annotations JSONMap[string, string] `gorm:"type:jsonb" selector:"metadata.annotations,hidden,private"`

	Generation      *int64
	ResourceVersion *int64
	CreatedAt       time.Time `selector:"metadata.creationTimestamp"`
	UpdatedAt       time.Time
	DeletedAt       gorm.DeletedAt `gorm:"index"`
}

type ResourceInterface interface {
	GetKind() string
	GetName() string
	GetOrgID() uuid.UUID
	SetOrgID(uuid.UUID)
	GetResourceVersion() *int64
	SetResourceVersion(*int64)
	GetGeneration() *int64
	SetGeneration(*int64)
	GetOwner() *string
	SetOwner(*string)
	GetLabels() JSONMap[string, string]
	SetLabels(JSONMap[string, string])
	GetAnnotations() JSONMap[string, string]
	SetAnnotations(JSONMap[string, string])
	GetNonNilFieldsFromResource() []string
	HasNilSpec() bool
	HasSameSpecAs(any) bool
	GetStatusAsJson() ([]byte, error)
	GetTimestamp() time.Time
}

type ResourceSync struct {
	Resource

	// The desired state, stored as opaque JSON object.
	Spec *JSONField[domain.ResourceSyncSpec] `gorm:"type:jsonb"`

	// The last reported state, stored as opaque JSON object.
	Status *JSONField[domain.ResourceSyncStatus] `gorm:"type:jsonb"`
}

type SchemaMigration struct {
	Key       string    `gorm:"primaryKey"`
	AppliedAt time.Time `gorm:"not null"`
}

type SecretDependencyRef struct {
	OrgID       uuid.UUID
	FleetName   string
	DeviceName  string
	Fingerprint *string
}

type ServiceConditions struct {
	Conditions     *[]domain.Condition          `json:"conditions,omitempty"`
	DependencySync *domain.DependencySyncStatus `json:"dependencySync,omitempty"`
}

type StringArray []string

type SyncState struct {
	OrgID uuid.UUID `gorm:"type:uuid;primaryKey"`
	// Format: "git:<repo-name>/<ref>", "http:<repo-name>/<suffix>", "secret:<namespace>/<name>"
	ResourceKey   string `gorm:"primaryKey"`
	Fingerprint   string
	LastCheckedAt time.Time
	LastChangeAt  *time.Time
	ProbeStatus   string
	ProbeMessage  string
}

type TemplateVersion struct {
	OrgID           uuid.UUID               `gorm:"type:uuid;primary_key;"`
	Organization    Organization            `gorm:"foreignKey:OrgID"`
	Name            string                  `gorm:"primary_key;" selector:"metadata.name"`
	FleetName       string                  `gorm:"primary_key;" selector:"metadata.owner"`
	Fleet           Fleet                   `gorm:"foreignkey:OrgID,FleetName;constraint:OnDelete:CASCADE;"`
	Labels          JSONMap[string, string] `gorm:"type:jsonb" selector:"metadata.labels,hidden,private"`
	Annotations     JSONMap[string, string] `gorm:"type:jsonb" selector:"metadata.annotations,hidden,private"`
	Generation      *int64
	ResourceVersion *int64
	CreatedAt       time.Time `selector:"metadata.creationTimestamp"`
	UpdatedAt       time.Time
	DeletedAt       gorm.DeletedAt `gorm:"index"`

	// The desired state, stored as opaque JSON object.
	Spec *JSONField[domain.TemplateVersionSpec] `gorm:"type:jsonb"`

	// The last reported state, stored as opaque JSON object.
	Status *JSONField[domain.TemplateVersionStatus] `gorm:"type:jsonb"`
}

type VulnerabilityFinding struct {
	ImageDigest string                          `gorm:"type:text;not null;primaryKey"`
	CveID       string                          `gorm:"type:text;not null;primaryKey"`
	Status      VulnerabilityStatus             `gorm:"type:text;not null"`
	Severity    VulnerabilitySeverity           `gorm:"type:text;not null"`
	AdvisoryID  *string                         `gorm:"type:text"`
	Issuer      *JSONField[VulnerabilityIssuer] `gorm:"type:jsonb"`
	CvssScore   *float64                        `gorm:"type:numeric(3,1)"`
	Description *string                         `gorm:"type:text"`
	PublishedAt *time.Time                      `gorm:"type:timestamptz"`
	FirstSeenAt time.Time                       `gorm:"type:timestamptz;not null;default:now()"`
	UpdatedAt   time.Time                       `gorm:"type:timestamptz;not null;autoUpdateTime"`
}

type VulnerabilityIssuer struct {
	// ID is the opaque UUID of the organization.
	ID string `json:"id"`
	// Name is the name of the organization.
	Name string `json:"name"`
	// CpeKey is the CPE key of the organization, if known.
	CpeKey *string `json:"cpe_key,omitempty"`
	// Website is the website of the organization, if known.
	Website *string `json:"website,omitempty"`
}

type VulnerabilitySeverity string

type VulnerabilityStatus string