models

type Base struct {
	ID        string `gorm:"primarykey"`
	CreatedAt time.Time
	UpdatedAt time.Time      `gorm:"index"`
	DeletedAt gorm.DeletedAt `gorm:"index"`
}

type DeploymentMechanism string

type GithubAppInstallation struct {
	Base

	GithubAppOAuthID string
	GithubAppOAuth   GithubAppOAuth `gorm:"foreignKey:GithubAppOAuthID"`

	AccountName             string
	AccountAvatarURL        string
	AccountID               int64
	InstallationID          int64
	InstallationSettingsURL string
}

type GithubAppOAuth struct {
	Base
	*SharedOAuthFields

	GithubUserID int64
}

type GithubPullRequest struct {
	Base

	TeamID string

	GithubRepositoryOwner       string
	GithubRepositoryName        string
	GithubPullRequestID         int64
	GithubPullRequestTitle      string
	GithubPullRequestNumber     int64
	GithubPullRequestHeadBranch string
	GithubPullRequestBaseBranch string
	GithubPullRequestState      string

	GithubPullRequestComments []GithubPullRequestComment
}

type GithubPullRequestComment struct {
	Base

	GithubPullRequestID string
	ModuleID            string

	GithubCommentID int64
}

type GithubWebhook struct {
	Base
	HasEncryptedFields

	TeamID string

	GithubRepositoryOwner string
	GithubRepositoryName  string

	// Encrypted data that contains the webhook signing secret
	SigningSecret []byte

	GithubAppInstallations []GithubAppInstallation `gorm:"many2many:github_webhooks_to_app_installations;"`
}

type HasEncryptedFields struct {
	FieldsAreEncrypted bool `gorm:"-"`
}

type LockPriority uint

type Module struct {
	Base

	TeamID string
	Team   Team `gorm:"foreignKey:TeamID"`

	Name string

	DeploymentMechanism DeploymentMechanism

	DeploymentConfig ModuleDeploymentConfig

	CurrentModuleValuesVersionID string
	CurrentModuleValuesVersion   ModuleValuesVersion `gorm:"foreignKey:CurrentModuleValuesVersionID"`

	CurrentModuleEnvVarsVersionID string
	CurrentModuleEnvVarsVersion   ModuleEnvVarsVersion `gorm:"foreignKey:CurrentModuleEnvVarsVersionID"`

	ModuleRunQueueID string
	ModuleRunQueue   ModuleRunQueue `gorm:"foreignKey:ModuleRunQueueID"`

	// LockID represents a unique lock ID for the module. This operates at a higher level than the
	// Terraform state lock. For a LockKind of type "github," this corresponds to a commit SHA.
	LockID string

	// LockKind describes the type of lock.
	LockKind ModuleLockKind

	Runs []ModuleRun
}

type ModuleDeploymentConfig struct {
	Base

	ModuleID string

	ModulePath string

	// Local-related deployment config
	UserID string

	// Git-related deployment config
	GitRepoName   string
	GitRepoOwner  string
	GitRepoBranch string

	// Github-related deployment config
	GithubAppInstallationID string
	GithubAppInstallation   GithubAppInstallation `gorm:"foreignKey:GithubAppInstallationID"`
}

type ModuleEnvVarsVersion struct {
	Base
	HasEncryptedFields

	ModuleID string
	Version  uint

	// JSON-based representation of module values, encrypted before storage
	EnvVars []byte
}

type ModuleLockKind string

type ModuleMonitor struct {
	Base

	TeamID string

	DisplayName  string
	Description  string
	Kind         ModuleMonitorKind
	CronSchedule string

	PresetPolicyName ModuleMonitorPresetPolicyName

	CurrentMonitorPolicyBytesVersionID string
	CurrentMonitorPolicyBytesVersion   MonitorPolicyBytesVersion `gorm:"foreignKey:CurrentMonitorPolicyBytesVersionID"`

	// A list of modules to target. If left empty, targets all modules.
	Modules []Module `gorm:"many2many:monitors_to_modules;"`

	// IsDefault controls whether this is a default monitor for all modules. If this is a default,
	// it cannot be configured from the dashboard.
	IsDefault bool

	// Whether the monitor is disabled
	Disabled bool

	MatchChildModules []byte
	MatchProviders    []byte
	MatchResources    []byte
}

type ModuleMonitorKind string

type ModuleMonitorPresetPolicyName string

type ModuleMonitorResult struct {
	Base

	TeamID string

	ModuleID string
	Module   Module `gorm:"foreignKey:ModuleID"`

	// (optional) The module run id, if this result is attached to a specific module run id (for
	// before_plan, after_plan, etc)
	ModuleRunID string

	ModuleMonitorID string

	Status MonitorResultStatus

	Title    string
	Message  string
	Severity MonitorResultSeverity
}

type ModuleQueuePriority uint

type ModuleRun struct {
	Base

	// TeamID is only used by some queries where the team id is not implicit. This is not
	// written to the module run table.
	TeamID string `gorm:"-"`

	ModuleID string

	Status            ModuleRunStatus
	StatusDescription string

	Kind ModuleRunKind

	LockID        string
	LockOperation string
	LockInfo      string
	LockWho       string
	LockVersion   string
	LockCreated   string
	LockPath      string

	Tokens []ModuleRunToken

	ModuleRunConfig ModuleRunConfig

	LogLocation string

	Monitors             []ModuleMonitor `gorm:"many2many:module_runs_to_monitors;"`
	ModuleMonitorResults []ModuleMonitorResult
}

type ModuleRunConfig struct {
	Base

	ModuleRunID string

	TriggerKind ModuleRunTriggerKind

	// For VCS-triggered runs, this is the corresponding commit SHA that triggered the run
	GitCommitSHA string

	// For locally-triggered runs, this is the hostname of the machine that performed this run
	LocalHostname string

	// Github-specific fields
	GithubCheckID       int64
	GithubCommentID     int64
	GithubPullRequestID int64

	ModuleValuesVersionID string
	ModuleValuesVersion   ModuleValuesVersion `gorm:"foreignKey:ModuleValuesVersionID"`

	ModuleEnvVarsVersionID string
	ModuleEnvVarsVersion   ModuleEnvVarsVersion `gorm:"foreignKey:ModuleEnvVarsVersionID"`
}

type ModuleRunKind string

type ModuleRunQueue struct {
	Base

	ModuleID string

	Items []ModuleRunQueueItem
}

type ModuleRunQueueItem struct {
	Base

	ModuleRunQueueID string
	ModuleRunID      string

	ModuleRunKind ModuleRunKind

	LockPriority LockPriority
	LockID       string
	LockKind     ModuleLockKind

	Priority ModuleQueuePriority
}

type ModuleRunStatus string

type ModuleRunToken struct {
	Base
	HasEncryptedFields

	// The subject of the token (service account user)
	UserID string

	// The run id that this token was created for
	ModuleRunID string

	// When this PAT expires. This should match what's in the JWT data
	Expires *time.Time

	// Whether the personal access token has been revoked
	Revoked bool

	// Encrypted data that contains the token signing secret for that specific token
	SigningSecret []byte
}

type ModuleRunTriggerKind string

type ModuleValues struct {
	Base
	HasEncryptedFields

	ModuleValuesVersionID string

	// JSON-based representation of module values, encrypted before storage
	Values []byte
}

type ModuleValuesVersion struct {
	Base

	ModuleID string
	Version  uint

	Kind ModuleValuesVersionKind

	// Git-specific params
	GitValuesPath string
	GitRepoName   string
	GitRepoOwner  string
	GitRepoBranch string

	// Github-specific params
	GithubAppInstallationID string
	GithubAppInstallation   GithubAppInstallation `gorm:"foreignKey:GithubAppInstallationID"`
}

type ModuleValuesVersionKind string

type MonitorPolicyBytesVersion struct {
	Base

	ModuleMonitorID string
	Version         uint

	PolicyBytes []byte
}

type MonitorResultSeverity string

type MonitorResultStatus string

type Notification struct {
	Base

	TeamID              string
	NotificationInboxID string
	NotificationID      string
	Title               string
	Message             string

	LastNotified *time.Time

	// Whether this has been resolved - can be manually resolved
	Resolved bool

	// Whether this has been auto-resolved - for example, if a monitor eventually succeeds
	AutoResolved bool

	// A list of runs for failed module operations
	Runs []ModuleRun `gorm:"many2many:notification_to_runs;"`

	// A list of monitor results for monitor failures
	MonitorResults []ModuleMonitorResult `gorm:"many2many:notification_to_monitor_results;"`

	ModuleID string
	Module   Module `gorm:"foreignKey:ModuleID"`
}

type NotificationInbox struct {
	Base

	TeamID string `gorm:"unique"`

	Notifications []Notification
}

type Organization struct {
	Base

	DisplayName string
	Icon        string

	// an organization has a single owner, which is a user model
	OwnerID string
	Owner   User `gorm:"foreignKey:OwnerID"`

	// The list of members of this organization. This is not typically returned
	// in queries unless you're explicitly calling list methods for org members.
	OrgMembers []OrganizationMember

	// The list of policies for this organization
	OrgPolicies []OrganizationPolicy

	// The list of teams for this organization
	Teams []Team
}

type OrganizationInviteLink struct {
	Base
	HasEncryptedFields

	OrganizationID       string
	OrganizationMemberID string

	InviterEmail string
	InviteeEmail string

	Expires *time.Time

	// Whether the invite link has been used
	Used bool

	// Encrypted before write
	Token []byte

	// Encrypted before write
	InviteLinkURL []byte
}

type OrganizationMember struct {
	Base

	// The parent organization ID, for the hasMany relationship
	OrganizationID string

	InviteLink     OrganizationInviteLink
	InviteAccepted bool

	// The referenced user
	UserID string
	User   User `gorm:"foreignKey:UserID"`

	// The attached roles for this user.
	OrgPolicies []OrganizationPolicy `gorm:"many2many:organization_member_policies;"`

	// Whether this org member corresponds to a service account runner. This
	// is to make queries easier.
	IsServiceAccountRunner bool
}

type OrganizationPolicy struct {
	Base

	// The parent organization ID, for the hasMany relationship
	OrganizationID string

	IsCustom   bool
	PolicyName string

	// Policy bytes MAY be empty if this is a preset policy, in which case they are preloaded
	// into the server binary.
	Policy []byte
}

type PasswordResetToken struct {
	Base
	HasEncryptedFields

	// Email is the target email of the user that initiated the password reset request
	Email string

	// Revoked represents whether the token has been revoked (used) or not
	Revoked bool

	// Expiry time
	Expires *time.Time

	// Token is hashed before storage
	Token []byte
}

type PersonalAccessToken struct {
	Base
	HasEncryptedFields

	// How this token gets displayed to the user
	DisplayName string

	// When this PAT expires. This should match what's in the JWT data
	Expires *time.Time

	// Whether the personal access token has been revoked
	Revoked bool

	// Encrypted data that contains the token signing secret for that specific token
	SigningSecret []byte

	// The user id that this PAT has been written for.
	UserID string
}

type PresetPolicyName string

type PresetTeamPolicyName string

type SharedOAuthFields struct {
	HasEncryptedFields

	// The ID issued to the client
	ClientID []byte `json:"client-id"`

	// The end-users's access token
	AccessToken []byte `json:"access-token"`

	// The end-user's refresh token
	RefreshToken []byte `json:"refresh-token"`

	// Time token expires and needs to be refreshed.
	// If 0, token will never refresh
	Expiry time.Time

	// The id of the user that linked oauth
	UserID string
	User   User `gorm:"foreignKey:UserID"`
}

type Team struct {
	Base

	DisplayName string

	// The parent organization id
	OrganizationID string

	// The list of members of this team
	TeamMembers []TeamMember

	// The list of policies for this team
	TeamPolicies []TeamPolicy

	// The service account runner user belonging to this team
	ServiceAccountRunnerID string
	ServiceAccountRunner   User `gorm:"foreignKey:ServiceAccountRunnerID"`

	// The github webhooks registered for this team
	GithubWebhooks []GithubWebhook
}

type TeamMember struct {
	Base

	// The parent team ID, for the hasMany relationship
	TeamID string

	// The referenced org member
	OrgMemberID string
	OrgMember   OrganizationMember `gorm:"foreignKey:OrgMemberID"`

	// The attached roles for this user.
	TeamPolicies []TeamPolicy `gorm:"many2many:team_member_policies;"`

	// Whether this team member corresponds to a service account runner. This
	// is to make queries easier.
	IsServiceAccountRunner bool
}

type TeamPolicy struct {
	Base

	// The team organization ID, for the hasMany relationship
	TeamID string

	IsCustom   bool
	PolicyName string

	// Policy bytes MAY be empty if this is a preset policy, in which case they are preloaded
	// into the server binary.
	Policy []byte
}

type User struct {
	Base

	DisplayName   string
	Email         string `gorm:"unique"`
	EmailVerified bool
	Password      string
	Icon          string

	UserAccountKind UserAccountKind
}

type UserAccountKind string

type UserSession struct {
	Base

	// Key contains the session id
	Key string `gorm:"unique"`

	// Contains the encrypted cookie data
	Data []byte

	// Time the session will expire
	ExpiresAt time.Time
}

type VerifyEmailToken struct {
	Base

	// Email is the target email of the user that initiated the password reset request
	Email string

	// Revoked represents whether the token has been revoked (used) or not
	Revoked bool

	// Expiry time
	Expires *time.Time

	// Token is hashed before storage
	Token []byte
}

type WorkerToken struct {
	Base
	HasEncryptedFields

	// The subject of the token (team ID)
	TeamID string

	// When this worker token expires. This should match what's in the JWT data
	Expires *time.Time

	// Whether the worker token has been revoked
	Revoked bool

	// Encrypted data that contains the token signing secret for that specific token
	SigningSecret []byte
}