models

type Affected struct {
	Package          pkg      `json:"package"`
	Ranges           []rng    `json:"ranges"`
	Versions         []string `json:"versions"`
	DatabaseSpecific struct {
		Source string `json:"source"`
	} `json:"database_specific"`
}

type AffectedComponent struct {
	ID               string  `json:"id" gorm:"primaryKey;"`
	PURL             string  `json:"purl" gorm:"type:text;column:purl;index"`
	Ecosystem        string  `json:"ecosystem" gorm:"type:text;"`
	Scheme           string  `json:"scheme" gorm:"type:text;"`
	Type             string  `json:"type" gorm:"type:text;"`
	Name             string  `json:"name" gorm:"type:text;"`
	Namespace        *string `json:"namespace" gorm:"type:text;"`
	Qualifiers       *string `json:"qualifiers" gorm:"type:text;"`
	Subpath          *string `json:"subpath" gorm:"type:text;"`
	Version          *string `json:"version" gorm:"index"` // either version or semver is defined
	SemverIntroduced *string `json:"semver_start" gorm:"type:semver;index"`
	SemverFixed      *string `json:"semver_end" gorm:"type:semver;index"`

	CVE []CVE `json:"cves" gorm:"many2many:cve_affected_component;constraint:OnUpdate:CASCADE,OnDelete:CASCADE;"`
}

type Asset struct {
	Model
	Name string `json:"name" gorm:"type:text"`
	Slug string `json:"slug" gorm:"type:text;uniqueIndex:idx_app_project_slug;not null;"`

	ProjectID   uuid.UUID `json:"projectId" gorm:"uniqueIndex:idx_app_project_slug;not null;type:uuid;"`
	Description string    `json:"description" gorm:"type:text"`
	Flaws       []Flaw    `json:"flaws" gorm:"foreignKey:AssetID;constraint:OnDelete:CASCADE;"`

	Type AssetType `json:"type" gorm:"type:text;not null;"`

	Importance            int  `json:"importance" gorm:"default:1;"`
	ReachableFromInternet bool `json:"reachableFromInternet" gorm:"default:false;"`

	ConfidentialityRequirement RequirementLevel `json:"confidentialityRequirement" gorm:"default:'high';not null;type:text;"`
	IntegrityRequirement       RequirementLevel `json:"integrityRequirement" gorm:"default:'high';not null;type:text;"`
	AvailabilityRequirement    RequirementLevel `json:"availabilityRequirement" gorm:"default:'high';not null;type:text;"`

	Components []ComponentDependency `json:"components" gorm:"hasMany;constraint:OnUpdate:CASCADE,OnDelete:CASCADE;"`

	Version             string    `json:"version" gorm:"type:text;"`
	LastComponentUpdate time.Time `json:"lastComponentUpdate"`
}

type AssetType string

type CPEMatch struct {
	MatchCriteriaID string `json:"matchCriteriaId" gorm:"primaryKey;type:text;"`
	Criteria        string `json:"criteria" gorm:"type:text;"`
	Part            string `json:"part" gorm:"type:text;"`
	Vendor          string `json:"vendor" gorm:"type:text;"`
	Product         string `json:"product" gorm:"type:text;"`
	Version         string `json:"version" gorm:"type:text;"`
	Update          string `json:"update" gorm:"type:text;"`
	Edition         string `json:"edition" gorm:"type:text;"`
	Language        string `json:"language" gorm:"type:text;"`
	SwEdition       string `json:"swEdition" gorm:"type:text;"`
	TargetSw        string `json:"targetSw" gorm:"type:text;"`
	TargetHw        string `json:"targetHw" gorm:"type:text;"`
	Other           string `json:"other" gorm:"type:text;"`

	VersionEndExcluding   string `json:"versionEndExcluding" gorm:"type:text;"`
	VersionStartIncluding string `json:"versionStartIncluding" gorm:"type:text;"`

	Vulnerable bool `json:"vulnerable" gorm:"type:boolean;"`

	CVEs []*CVE `json:"cve" gorm:"many2many:cve_cpe_match;constraint:OnUpdate:CASCADE,OnDelete:CASCADE;"`
}

type CVE struct {
	CVE string `json:"cve" gorm:"primaryKey;not null;type:text;"`

	CreatedAt time.Time `json:"createdAt"`
	UpdatedAt time.Time `json:"updatedAt"`

	DatePublished    time.Time `json:"datePublished"`
	DateLastModified time.Time `json:"dateLastModified"`

	Weaknesses  []*Weakness `json:"weaknesses" gorm:"foreignKey:CVEID;constraint:OnDelete:CASCADE;"`
	Description string      `json:"description" gorm:"type:text;"`

	CVSS                float32  `json:"cvss" gorm:"type:decimal(4,2);"`
	Severity            Severity `json:"severity"`
	ExploitabilityScore float32  `json:"exploitabilityScore" gorm:"type:decimal(4,2);"`
	ImpactScore         float32  `json:"impactScore" gorm:"type:decimal(4,2);"`

	AttackVector          string `json:"attackVector"`
	AttackComplexity      string `json:"attackComplexity"`
	PrivilegesRequired    string `json:"privilegesRequired"`
	UserInteraction       string `json:"userInteractionRequired"`
	Scope                 string `json:"scope"`
	ConfidentialityImpact string `json:"confidentialityImpact"`
	IntegrityImpact       string `json:"integrityImpact"`
	AvailabilityImpact    string `json:"availabilityImpact"`

	References string `json:"references" gorm:"type:text;"`

	CISAExploitAdd        *datatypes.Date `json:"cisaExploitAdd" gorm:"type:date;"`
	CISAActionDue         *datatypes.Date `json:"cisaActionDue" gorm:"type:date;"`
	CISARequiredAction    string          `json:"cisaRequiredAction" gorm:"type:text;"`
	CISAVulnerabilityName string          `json:"cisaVulnerabilityName" gorm:"type:text;"`

	Configurations []*CPEMatch `json:"configurations" gorm:"many2many:cve_cpe_match;"`

	EPSS       *float64 `json:"epss" gorm:"type:decimal(6,5);"`
	Percentile *float32 `json:"percentile" gorm:"type:decimal(6,5);"`

	AffectedComponents []AffectedComponent `json:"affectedComponents" gorm:"many2many:cve_affected_component"`

	Vector string `json:"vector" gorm:"type:text;"`

	Risk     obj.RiskMetrics `json:"risk" gorm:"-"`
	Exploits []*Exploit      `json:"exploits" gorm:"foreignKey:CVEID;"`
}

type CVEWithAffectedComponent struct {
	CVE any
	AffectedComponent
}

type CWE struct {
	CreatedAt time.Time    `json:"createdAt"`
	UpdatedAt time.Time    `json:"updatedAt"`
	DeletedAt sql.NullTime `gorm:"index" json:"-"`

	CWE string `json:"cwe" gorm:"primaryKey;not null;"`

	Description string `json:"description" gorm:"type:text;"`
}

type Comment struct {
	Model
	FlawID  uuid.UUID `json:"flawId"`
	UserID  uuid.UUID `json:"userId"`
	Comment string    `json:"comment"`
}

type Component struct {
	// either cpe or purl is set
	PurlOrCpe    string                `json:"purlOrCpe" gorm:"primaryKey;column:purl_or_cpe"`
	Dependencies []ComponentDependency `json:"dependsOn" gorm:"hasMany;"`
}

type ComponentDependency struct {
	ID uuid.UUID `gorm:"primarykey;type:uuid;default:gen_random_uuid()" json:"id"`

	// the provided sbom from cyclondx only contains the transitive dependencies, which do really get used
	// this means, that the dependency graph between people using the same library might differ, since they use it differently
	// we use edges, which provide the information, that a component is used by another component in one asset
	AssetSemverStart    string    `json:"semverStart" gorm:"column:semver_start;type:semver"`
	AssetSemverEnd      *string   `json:"semverEnd" gorm:"column:semver_end;type:semver"`
	Component           Component `json:"component" gorm:"foreignKey:ComponentPurlOrCpe;references:PurlOrCpe"`
	ComponentPurlOrCpe  *string   `json:"componentPurlOrCpe" gorm:"column:component_purl_or_cpe;"` // will be nil, for direct dependencies
	Dependency          Component `json:"dependency" gorm:"foreignKey:DependencyPurlOrCpe;references:PurlOrCpe"`
	DependencyPurlOrCpe string    `json:"dependencyPurlOrCpe" gorm:"column:dependency_purl_or_cpe;"`
	AssetID             uuid.UUID `json:"assetId" gorm:"column:asset_id;type:uuid;"`
	Asset               Asset     `json:"asset" gorm:"foreignKey:AssetID;constraint:OnDelete:CASCADE;"`

	Depth int `json:"depth" gorm:"column:depth"`
}

type Config struct {
	Key string `gorm:"primarykey"`
	Val string `gorm:"type:text"`
}

type Exploit struct {
	ID          string     ` gorm:"primaryKey;"`
	Published   *time.Time `json:"pushed_at" gorm:"type:date;"`
	Updated     *time.Time `json:"updated_at" gorm:"type:date;"`
	Author      string     `json:"author" gorm:"type:text;"`
	Type        string     `json:"type" gorm:"type:text;"`
	Verified    bool       `json:"verified" gorm:"type:boolean;"`
	SourceURL   string     `json:"sourceURL" gorm:"type:text;"`
	Description string     `json:"description" gorm:"type:text;"`
	CVE         CVE        `json:"cve" gorm:"foreignKey:CVEID;constraint:OnDelete:CASCADE;"`
	CVEID       string     `json:"cveID" gorm:"type:text;"`
	Tags        string     `json:"tags" gorm:"type:text;"`
	Forks       int        `json:"forks" gorm:"type:integer;"`
	Watchers    int        `json:"watchers" gorm:"type:integer;"`
	Subscribers int        `json:"subscribers_count" gorm:"type:integer;"`
	Stars       int        `json:"stargazers_count" gorm:"type:integer;"`
}

type Flaw struct {
	ID string `json:"id" gorm:"primaryKey;not null;"`
	// the scanner which was used to detect this flaw
	ScannerID string `json:"scanner" gorm:"not null;"`

	Message  *string     `json:"message"`
	Comments []Comment   `gorm:"foreignKey:FlawID;constraint:OnDelete:CASCADE;" json:"comments"`
	Events   []FlawEvent `gorm:"foreignKey:FlawID;constraint:OnDelete:CASCADE;" json:"events"`
	AssetID  uuid.UUID   `json:"assetId" gorm:"not null;"`
	State    FlawState   `json:"state" gorm:"default:'open';not null;type:text;"`

	CVE                *CVE       `json:"cve"`
	CVEID              string     `json:"cveId" gorm:"null;type:text;default:null;"`
	Component          *Component `json:"component" gorm:"foreignKey:ComponentPurlOrCpe;constraint:OnDelete:CASCADE;"`
	ComponentPurlOrCpe string     `json:"componentPurlOrCpe" gorm:"type:text;default:null;"`

	Effort            *int     `json:"effort" gorm:"default:null;"`
	RiskAssessment    *int     `json:"riskAssessment" gorm:"default:null;"`
	RawRiskAssessment *float64 `json:"rawRiskAssessment" gorm:"default:null;"`

	Priority *int `json:"priority" gorm:"default:null;"`

	ArbitraryJsonData string `json:"arbitraryJsonData" gorm:"type:text;"`

	LastDetected time.Time `json:"lastDetected" gorm:"default:now();not null;"`

	CreatedAt time.Time    `json:"createdAt"`
	UpdatedAt time.Time    `json:"updatedAt"`
	DeletedAt sql.NullTime `gorm:"index" json:"-"`
	// contains filtered or unexported fields
}

type FlawEvent struct {
	Model
	Type   FlawEventType `json:"type" gorm:"type:text"`
	FlawID string        `json:"flawId"`
	UserID string        `json:"userId"`

	Justification *string `json:"justification" gorm:"type:text;"`

	ArbitraryJsonData string `json:"arbitraryJsonData" gorm:"type:text;"`
	// contains filtered or unexported fields
}

type FlawEventType string

type FlawState string

type GithubAppInstallation struct {
	InstallationID int `json:"installationId" gorm:"primaryKey"`

	Org   *Org       `json:"org" gorm:"foreignKey:OrgID;constraint:OnDelete:CASCADE;"`
	OrgID *uuid.UUID `json:"orgId" gorm:"column:org_id"`

	InstallationCreatedWebhookReceivedTime time.Time `json:"installationCreatedWebhookReceivedTime"`
}

type Mitigation struct {
	Model
	Type             Type      `json:"mitigationType"`
	InitiatingUserID string    `json:"initiatingUserId"`
	ResultID         uuid.UUID `json:"resultId"`

	DueDate    *time.Time     `json:"dueDate"`
	Properties datatypes.JSON `gorm:"type:jsonb;default:'{}';not null"`

	MitigationPending bool   `json:"mitigationPending" gorm:"default:false"` // will be true for fix and transfer types - we are waiting for another scan report which verifies, that the related result is fixed. Will be false for avoid and accept types
	Justification     string `json:"justification"`
}

type Model struct {
	ID        uuid.UUID    `gorm:"primarykey;type:uuid;default:gen_random_uuid()" json:"id"`
	CreatedAt time.Time    `json:"createdAt"`
	UpdatedAt time.Time    `json:"updatedAt"`
	DeletedAt sql.NullTime `gorm:"index" json:"-"`
}

type OSV struct {
	ID            string     `json:"id"`
	Summary       string     `json:"summary"`
	Modified      time.Time  `json:"modified"`
	Published     time.Time  `json:"published"`
	Related       []string   `json:"related"`
	Aliases       []string   `json:"aliases"`
	Affected      []Affected `json:"affected"`
	SchemaVersion string     `json:"schema_version"`
}

type Org struct {
	Model
	Name                   string    `json:"name" gorm:"type:text"`
	ContactPhoneNumber     *string   `json:"contactPhoneNumber" gorm:"type:text"`
	NumberOfEmployees      *int      `json:"numberOfEmployees"`
	Country                *string   `json:"country" gorm:"type:text"`
	Industry               *string   `json:"industry" gorm:"type:text"`
	CriticalInfrastructure bool      `json:"criticalInfrastructure"`
	ISO27001               bool      `json:"iso27001"`
	NIST                   bool      `json:"nist"`
	Grundschutz            bool      `json:"grundschutz"`
	Projects               []Project `json:"projects" gorm:"foreignKey:OrganizationID;constraint:OnDelete:CASCADE;"`
	Slug                   string    `json:"slug" gorm:"type:text;unique;not null;index"`
	Description            string    `json:"description" gorm:"type:text"`
}

type PAT struct {
	CreatedAt   time.Time `json:"createdAt"`
	UserID      uuid.UUID `json:"userId"`
	PubKey      string    `json:"pubKey"`
	Description string    `json:"description" gorm:"type:text"`
	ID          uuid.UUID `json:"id" gorm:"type:uuid;default:gen_random_uuid()"`
	Fingerprint string    `json:"fingerprint"`
}

type Project struct {
	Model
	Name           string    `json:"name" gorm:"type:text"`
	Assets         []Asset   `json:"assets" gorm:"foreignKey:ProjectID;constraint:OnDelete:CASCADE;"`
	OrganizationID uuid.UUID `json:"organizationId" gorm:"uniqueIndex:idx_project_org_slug;not null;type:uuid"`
	Slug           string    `json:"slug" gorm:"type:text;uniqueIndex:idx_project_org_slug;not null"`
	Description    string    `json:"description" gorm:"type:text"`
}

type RequirementLevel string

type Severity string

type Type string

type VulnInPackage struct {
	CVEID             string
	CVE               CVE
	FixedVersion      *string
	IntroducedVersion *string
	PackageName       string
	PurlWithVersion   string
}

type Weakness struct {
	Source string `json:"source" gorm:"type:text;"`
	Type   string `json:"type" gorm:"type:text;"`
	CVEID  string `json:"cve" gorm:"primaryKey;not null;type:text;"`
	CVE    CVE
	CWEID  string `json:"cwe" gorm:"primaryKey;not null;type:text;"`
}