vulnerabilityfinding

type CVEEventCandidate struct {
	OrgID       uuid.UUID `gorm:"column:org_id"`
	DeviceName  string    `gorm:"column:device_name"`
	CveID       string    `gorm:"column:cve_id"`
	ImageDigest string    `gorm:"column:image_digest"`
	ImageRef    string    `gorm:"column:image_ref"`
	CvssScore   float64   `gorm:"column:cvss_score"`
	Severity    string    `gorm:"column:severity"`
}

type CVEEventResolutionCandidate struct {
	OrgID       uuid.UUID `gorm:"column:org_id"`
	DeviceName  string    `gorm:"column:device_name"`
	CveID       string    `gorm:"column:cve_id"`
	ImageDigest string    `gorm:"column:image_digest"`
	ImageRef    string    `gorm:"column:image_ref"`
	PriorReason string    `gorm:"column:prior_reason"`
	CvssScore   float64   `gorm:"column:cvss_score"`
	Severity    string    `gorm:"column:severity"`
}

type DeviceImageDigest struct {
	ImageDigest string
	DeviceCount int64
	ImageRefs   []string
}

type FleetSeverityCounts struct {
	SeverityCounts
	UniqueDigests int64
}

type GroupedVulnPageRow struct {
	CveID          string
	SeverityRank   int
	MaxCvssScore   *float64
	MaxPublishedAt *time.Time
}

type ImpactDigestDetail struct {
	Owner         *string    `gorm:"column:owner"`
	ImageDigest   string     `gorm:"column:image_digest"`
	ImageRefsJSON []byte     `gorm:"column:image_refs_json"`
	DeviceCount   int64      `gorm:"column:device_count"`
	Severity      string     `gorm:"column:severity"`
	CvssScore     *float64   `gorm:"column:cvss_score"`
	AdvisoryID    *string    `gorm:"column:advisory_id"`
	IssuerName    *string    `gorm:"column:issuer_name"`
	Description   *string    `gorm:"column:description"`
	PublishedAt   *time.Time `gorm:"column:published_at"`
	FirstSeenAt   *time.Time `gorm:"column:first_seen_at"`
}

type ImpactPageResult struct {
	Rows           []ImpactPageRow
	TotalFleets    int64
	WorstSeverity  string
	MaxCvssScore   *float64
	MaxPublishedAt *time.Time
	Continue       *string
}

type ImpactPageRow struct {
	Owner          *string `gorm:"column:owner"`
	DeviceAffected int64   `gorm:"column:device_affected"`
}

type OrgVulnerabilitySummary struct {
	CvesBySeverity SeverityCounts
}

type SeverityCounts struct {
	Total    int64
	Critical int64
	High     int64
	Medium   int64
	Low      int64
	None     int64
	Unknown  int64
}

type Store interface {
	InitialMigration(ctx context.Context) error
	ListDeployedImageDigests(ctx context.Context) ([]string, error)
	// UpsertFindings inserts or updates vulnerability findings and returns the findings
	// that were actually inserted or had their severity/status changed.
	UpsertFindings(ctx context.Context, findings []model.VulnerabilityFinding) ([]model.ChangedFinding, error)

	// GetVulnerabilities returns paginated findings for a single image digest.
	// Supports cursor-based pagination via store.ListParams.Continue and sorting via store.ListParams.SortColumns
	// (store.SortBySeverity, store.SortByCvssScore, store.SortByPublishedAt, store.SortByCveId).
	GetVulnerabilities(ctx context.Context, digest string, listParams store.ListParams) (*VulnerabilityListResult, error)
	// GetVulnerabilitySummary returns the severity counts for a single image digest.
	GetVulnerabilitySummary(ctx context.Context, digest string, fieldSelector *selector.FieldSelector) (SeverityCounts, error)
	// ListFleetDeviceImageDigests returns the (image, imageDigest, deviceCount) rows for all
	// non-deleted devices that belong to the given fleet within the given org.
	ListFleetDeviceImageDigests(ctx context.Context, orgId uuid.UUID, fleetName string) ([]DeviceImageDigest, error)
	// ListOrgDeviceImageDigests returns per-digest device totals and image refs for all
	// non-deleted devices in the organization (any fleet or fleetless).
	ListOrgDeviceImageDigests(ctx context.Context, orgId uuid.UUID) ([]DeviceImageDigest, error)
	// GetVulnerabilityGroups returns findings grouped by CVE across multiple image digests.
	// Supports cursor-based pagination via store.ListParams.Continue and sorting via store.ListParams.SortColumns
	// (store.SortBySeverity, store.SortByCvssScore, store.SortByPublishedAt, store.SortByCveId).
	GetVulnerabilityGroups(ctx context.Context, digests []DeviceImageDigest, listParams store.ListParams) (*VulnerabilityGroupResult, error)
	// GetFleetVulnerabilitySummary returns the severity summary across multiple image digests using SQL aggregation.
	GetFleetVulnerabilitySummary(ctx context.Context, digests []DeviceImageDigest, fieldSelector *selector.FieldSelector) (FleetSeverityCounts, error)

	// GetOrgVulnerabilitySummary returns per-severity CVE and affected-device counts for an organization.
	GetOrgVulnerabilitySummary(ctx context.Context, orgID uuid.UUID) (OrgVulnerabilitySummary, error)
	// FindAnyFindingForCVE returns any finding row for the CVE, or nil if none exist.
	FindAnyFindingForCVE(ctx context.Context, cveID string) (*model.VulnerabilityFinding, error)
	// FindingsForCVEAndImageDigests returns findings for the CVE limited to the given digests (empty digests => empty slice).
	FindingsForCVEAndImageDigests(ctx context.Context, cveID string, imageDigests []string) ([]model.VulnerabilityFinding, error)
	// GetVulnerabilityImpactPage returns one page of fleets with fleet totals, digest lists, and top-level CVE aggregates.
	// Supports cursor-based pagination via store.ListParams.Continue and sorting via store.ListParams.SortColumns (store.SortByOwner or store.SortByDeviceAffected).
	GetVulnerabilityImpactPage(ctx context.Context, orgID uuid.UUID, cveID string, listParams store.ListParams) (*ImpactPageResult, error)
	// GetImpactDigestDetails returns per-(owner, digest) device counts and vulnerability metadata for the given owners.
	GetImpactDigestDetails(ctx context.Context, orgID uuid.UUID, cveID string, owners []string, includeNull bool) ([]ImpactDigestDetail, error)

	// ListCVEEventResolutionCandidates returns open Warning/Critical CVE events that merit a Resolved event (PostgreSQL only).
	ListCVEEventResolutionCandidates(ctx context.Context) ([]CVEEventResolutionCandidate, error)
	// ListOpenWarningSupersedeCVEEventCandidates returns device/CVE rows crossing critical severity with an open Warning (PostgreSQL only).
	ListOpenWarningSupersedeCVEEventCandidates(ctx context.Context) ([]CVEEventCandidate, error)
	// ListCriticalCVEEventCandidates returns device/CVE rows with Critical severity eligible for a Critical event (PostgreSQL only).
	ListCriticalCVEEventCandidates(ctx context.Context) ([]CVEEventCandidate, error)
	// ListWarningCVEEventCandidates returns device/CVE rows with High severity eligible for a Warning event (PostgreSQL only).
	ListWarningCVEEventCandidates(ctx context.Context) ([]CVEEventCandidate, error)

	// ComputeAllCVEActions computes all CVE event actions from changed findings and device image changes.
	// Returns a list of actions (new, supersede, resolved) to apply to device_open_cve_events.
	ComputeAllCVEActions(ctx context.Context, changedFindings []model.ChangedFinding, lastSnapshot time.Time) ([]model.CVEEventAction, error)
	// BatchUpdateOpenEvents applies CVE event actions to device_open_cve_events using batch INSERT/UPDATE/DELETE.
	// Returns the actions that were actually applied (for event emission).
	BatchUpdateOpenEvents(ctx context.Context, actions []model.CVEEventAction) ([]model.CVEEventAction, error)
}

type VulnerabilityFindingStore struct {
	// contains filtered or unexported fields
}

type VulnerabilityGroup struct {
	CveID          string
	SeverityRank   int
	MaxCvssScore   *float64
	MaxPublishedAt *time.Time
	Findings       []model.VulnerabilityFinding
}

type VulnerabilityGroupResult struct {
	Groups   []VulnerabilityGroup
	Continue *string
}

type VulnerabilityListResult struct {
	Items    []model.VulnerabilityFinding
	Continue *string
}