types

type Account struct {
	// we have to name column to aid as it collides with Network.Id when work with associations
	Id string `gorm:"primaryKey"`

	// User.Id it was created by
	CreatedBy              string
	CreatedAt              time.Time
	Domain                 string `gorm:"index"`
	DomainCategory         string
	IsDomainPrimaryAccount bool
	SetupKeys              map[string]*SetupKey              `gorm:"-"`
	SetupKeysG             []SetupKey                        `json:"-" gorm:"foreignKey:AccountID;references:id"`
	Network                *Network                          `gorm:"embedded;embeddedPrefix:network_"`
	Peers                  map[string]*nbpeer.Peer           `gorm:"-"`
	PeersG                 []nbpeer.Peer                     `json:"-" gorm:"foreignKey:AccountID;references:id"`
	Users                  map[string]*User                  `gorm:"-"`
	UsersG                 []User                            `json:"-" gorm:"foreignKey:AccountID;references:id"`
	Groups                 map[string]*Group                 `gorm:"-"`
	GroupsG                []*Group                          `json:"-" gorm:"foreignKey:AccountID;references:id"`
	Policies               []*Policy                         `gorm:"foreignKey:AccountID;references:id"`
	Routes                 map[route.ID]*route.Route         `gorm:"-"`
	RoutesG                []route.Route                     `json:"-" gorm:"foreignKey:AccountID;references:id"`
	NameServerGroups       map[string]*nbdns.NameServerGroup `gorm:"-"`
	NameServerGroupsG      []nbdns.NameServerGroup           `json:"-" gorm:"foreignKey:AccountID;references:id"`
	DNSSettings            DNSSettings                       `gorm:"embedded;embeddedPrefix:dns_settings_"`
	PostureChecks          []*posture.Checks                 `gorm:"foreignKey:AccountID;references:id"`
	Services               []*service.Service                `gorm:"foreignKey:AccountID;references:id"`
	Domains                []*proxydomain.Domain             `gorm:"foreignKey:AccountID;references:id"`
	// Settings is a dictionary of Account settings
	Settings         *Settings                        `gorm:"embedded;embeddedPrefix:settings_"`
	Networks         []*networkTypes.Network          `gorm:"foreignKey:AccountID;references:id"`
	NetworkRouters   []*routerTypes.NetworkRouter     `gorm:"foreignKey:AccountID;references:id"`
	NetworkResources []*resourceTypes.NetworkResource `gorm:"foreignKey:AccountID;references:id"`
	Onboarding       AccountOnboarding                `gorm:"foreignKey:AccountID;references:id;constraint:OnDelete:CASCADE"`

	ReverseProxyFreeDomainNonce string
}

type AccountDNSSettings struct {
	DNSSettings DNSSettings `gorm:"embedded;embeddedPrefix:dns_settings_"`
}

type AccountMeta struct {
	// AccountId is the unique identifier of the account
	AccountID      string `gorm:"column:id"`
	CreatedAt      time.Time
	CreatedBy      string
	Domain         string
	DomainCategory string
}

type AccountNetwork struct {
	Network *Network `gorm:"embedded;embeddedPrefix:network_"`
}

type AccountOnboarding struct {
	AccountID             string `gorm:"primaryKey"`
	OnboardingFlowPending bool
	SignupFormPending     bool
	CreatedAt             time.Time
	UpdatedAt             time.Time
}

type AccountSettings struct {
	Settings *Settings `gorm:"embedded;embeddedPrefix:settings_"`
}

type AccountSettingsInfo = sharedtypes.AccountSettingsInfo

type ComponentGroup = sharedtypes.ComponentGroup

type ComponentPeer = sharedtypes.ComponentPeer

type ComponentResource = sharedtypes.ComponentResource

type ComponentResourceType = sharedtypes.ComponentResourceType

type ComponentRouter = sharedtypes.ComponentRouter

type DNSSettings = sharedtypes.DNSSettings

type DashboardFeatures struct {
	// AgentNetwork, when set, forces the Agent Network menu shown (true) or
	// hidden (false) regardless of the deployment feature flag.
	AgentNetwork *bool `json:"agent_network,omitempty"`
}

type Engine string

type ExtraSettings struct {
	// PeerApprovalEnabled enables or disables the need for peers bo be approved by an administrator
	PeerApprovalEnabled bool

	// UserApprovalRequired enables or disables the need for users joining via domain matching to be approved by an administrator
	UserApprovalRequired bool

	// IntegratedValidator is the string enum for the integrated validator type
	IntegratedValidator string
	// IntegratedValidatorGroups list of group IDs to be used with integrated approval configurations
	IntegratedValidatorGroups []string `gorm:"serializer:json"`

	FlowEnabled              bool     `gorm:"-"`
	FlowGroups               []string `gorm:"-"`
	FlowPacketCounterEnabled bool     `gorm:"-"`
	FlowENCollectionEnabled  bool     `gorm:"-"`
	FlowDnsCollectionEnabled bool     `gorm:"-"`
}

type FirewallRule = sharedtypes.FirewallRule

type FirewallRuleContext = sharedtypes.FirewallRuleContext

type ForwardingRule = sharedtypes.ForwardingRule

type Group struct {
	// ID of the group
	ID string `gorm:"primaryKey"`

	// AccountID is a reference to Account that this object belongs
	AccountID string `json:"-" gorm:"index"`

	PublicID string `json:"-"`

	// Name visible in the UI
	Name string

	// Issued defines how this group was created (enum of "api", "integration" or "jwt")
	Issued string

	// Peers list of the group
	Peers      []string    `gorm:"-"` // Peers and GroupPeers list will be ignored when writing to the DB. Use AddPeerToGroup and RemovePeerFromGroup methods to modify group membership
	GroupPeers []GroupPeer `gorm:"foreignKey:GroupID;references:id;constraint:OnDelete:CASCADE;"`

	// Resources contains a list of resources in that group
	Resources []Resource `gorm:"serializer:json"`

	IntegrationReference integration_reference.IntegrationReference `gorm:"embedded;embeddedPrefix:integration_ref_"`
}

type GroupCompact = sharedtypes.GroupCompact

type GroupPeer struct {
	AccountID string `gorm:"index"`
	GroupID   string `gorm:"primaryKey"`
	PeerID    string `gorm:"primaryKey"`
}

type HashedProxyToken string

type IdentityProvider struct {
	// ID is the unique identifier of the identity provider
	ID string `gorm:"primaryKey"`
	// AccountID is a reference to Account that this object belongs
	AccountID string `json:"-" gorm:"index"`
	// Type is the type of identity provider
	Type IdentityProviderType
	// Name is a human-readable name for the identity provider
	Name string
	// Issuer is the OIDC issuer URL
	Issuer string
	// ClientID is the OAuth2 client ID
	ClientID string
	// ClientSecret is the OAuth2 client secret
	ClientSecret string
}

type IdentityProviderType string

type Job struct {
	// ID is the primary identifier
	ID string `gorm:"primaryKey"`

	// CreatedAt when job was created (UTC)
	CreatedAt time.Time `gorm:"autoCreateTime"`

	// CompletedAt when job finished, null if still running
	CompletedAt *time.Time

	// TriggeredBy user that triggered this job
	TriggeredBy string `gorm:"index"`

	PeerID string `gorm:"index"`

	AccountID string `gorm:"index"`

	// Status of the job: pending, succeeded, failed
	Status JobStatus `gorm:"index;type:varchar(50)"`

	// FailedReason describes why the job failed (if failed)
	FailedReason string

	Workload Workload `gorm:"embedded;embeddedPrefix:workload_"`
}

type JobStatus string

type JobType string

type LookupMap = sharedtypes.LookupMap

type Network = sharedtypes.Network

type NetworkMap = sharedtypes.NetworkMap

type NetworkMapComponents = sharedtypes.NetworkMapComponents

type NetworkMapComponentsCompact = sharedtypes.NetworkMapComponentsCompact

type PeerLogin struct {
	// WireGuardPubKey is a peers WireGuard public key
	WireGuardPubKey string
	// SSHKey is a peer's ssh key. Can be empty (e.g., old version do not provide it, or this feature is disabled)
	SSHKey string
	// Meta is the system information passed by peer, must be always present.
	Meta nbpeer.PeerSystemMeta
	// UserID indicates that JWT was used to log in, and it was valid. Can be empty when SetupKey is used or auth is not required.
	UserID string
	// SetupKey references to a server.SetupKey to log in. Can be empty when UserID is used or auth is not required.
	SetupKey string
	// ConnectionIP is the real IP of the peer
	ConnectionIP net.IP

	// ExtraDNSLabels is a list of extra DNS labels that the peer wants to use
	ExtraDNSLabels []string
}

type PeerNetworkMapResult struct {
	NetworkMap *NetworkMap
	Components *NetworkMapComponents
}

type PeerSync struct {
	// WireGuardPubKey is a peers WireGuard public key
	WireGuardPubKey string
	// Meta is the system information passed by peer, must be always present
	Meta nbpeer.PeerSystemMeta
	// RealIP is the peer's connection IP, used to refresh its geo location.
	// May be nil when the request has no associated connection IP.
	RealIP net.IP
	// UpdateAccountPeers indicate updating account peers,
	// which occurs when the peer's metadata is updated
	UpdateAccountPeers bool
}

type PersonalAccessToken struct {
	ID string `gorm:"primaryKey"`
	// User is a reference to Account that this object belongs
	UserID         string `gorm:"index"`
	Name           string
	HashedToken    string
	ExpirationDate *time.Time
	// scope could be added in future
	CreatedBy string
	CreatedAt time.Time
	LastUsed  *time.Time
}

type PersonalAccessTokenGenerated struct {
	PlainToken string
	PersonalAccessToken
}

type PlainProxyToken string

type Policy = sharedtypes.Policy

type PolicyRule = sharedtypes.PolicyRule

type PolicyRuleDirection = sharedtypes.PolicyRuleDirection

type PolicyRuleProtocolType = sharedtypes.PolicyRuleProtocolType

type PolicyTrafficActionType = sharedtypes.PolicyTrafficActionType

type PolicyUpdateOperation = sharedtypes.PolicyUpdateOperation

type PolicyUpdateOperationType = sharedtypes.PolicyUpdateOperationType

type PrimaryAccountInfo struct {
	IsDomainPrimaryAccount bool
	Domain                 string
}

type ProxyAccessToken struct {
	ID          string `gorm:"primaryKey"`
	Name        string
	HashedToken HashedProxyToken `gorm:"type:varchar(255);uniqueIndex"`
	// AccountID is nil for management-wide tokens, set for account-scoped tokens
	AccountID *string `gorm:"index"`
	ExpiresAt *time.Time
	CreatedBy string
	CreatedAt time.Time
	LastUsed  *time.Time
	Revoked   bool
}

type ProxyAccessTokenGenerated struct {
	PlainToken PlainProxyToken
	ProxyAccessToken
}

type Resource = sharedtypes.Resource

type ResourceType = sharedtypes.ResourceType

type RouteFirewallRule = sharedtypes.RouteFirewallRule

type RulePortRange = sharedtypes.RulePortRange

type Settings struct {
	// PeerLoginExpirationEnabled globally enables or disables peer login expiration
	PeerLoginExpirationEnabled bool

	// PeerLoginExpiration is a setting that indicates when peer login expires.
	// Applies to all peers that have Peer.LoginExpirationEnabled set to true.
	PeerLoginExpiration time.Duration

	// PeerInactivityExpirationEnabled globally enables or disables peer inactivity expiration
	PeerInactivityExpirationEnabled bool

	// PeerInactivityExpiration is a setting that indicates when peer inactivity expires.
	// Applies to all peers that have Peer.PeerInactivityExpirationEnabled set to true.
	PeerInactivityExpiration time.Duration

	// RegularUsersViewBlocked allows to block regular users from viewing even their own peers and some UI elements
	RegularUsersViewBlocked bool

	// GroupsPropagationEnabled allows to propagate auto groups from the user to the peer
	GroupsPropagationEnabled bool

	// JWTGroupsEnabled allows extract groups from JWT claim, which name defined in the JWTGroupsClaimName
	// and add it to account groups.
	JWTGroupsEnabled bool

	// JWTGroupsClaimName from which we extract groups name to add it to account groups
	JWTGroupsClaimName string

	// JWTAllowGroups list of groups to which users are allowed access
	JWTAllowGroups []string `gorm:"serializer:json"`

	// RoutingPeerDNSResolutionEnabled enabled the DNS resolution on the routing peers
	RoutingPeerDNSResolutionEnabled bool

	// DNSDomain is the custom domain for that account
	DNSDomain string

	// NetworkRange is the custom network range for that account
	NetworkRange netip.Prefix `gorm:"serializer:json"`
	// NetworkRangeV6 is the custom IPv6 network range for that account
	NetworkRangeV6 netip.Prefix `gorm:"serializer:json"`

	// PeerExposeEnabled enables or disables peer-initiated service expose
	PeerExposeEnabled bool
	// PeerExposeGroups list of peer group IDs allowed to expose services
	PeerExposeGroups []string `gorm:"serializer:json"`

	// Extra is a dictionary of Account settings
	Extra *ExtraSettings `gorm:"embedded;embeddedPrefix:extra_"`

	// LazyConnectionEnabled indicates if the experimental feature is enabled or disabled
	LazyConnectionEnabled bool `gorm:"default:false"`

	// AutoUpdateVersion client auto-update version
	AutoUpdateVersion string `gorm:"default:'disabled'"`

	// AutoUpdateAlways when true, updates are installed automatically in the background;
	// when false, updates require user interaction from the UI
	AutoUpdateAlways bool `gorm:"default:false"`

	// IPv6EnabledGroups is the list of group IDs whose peers receive IPv6 overlay addresses.
	// Peers not in any of these groups will not be allocated an IPv6 address.
	// Empty list means IPv6 is disabled for the account.
	// For new accounts this defaults to the All group.
	IPv6EnabledGroups []string `gorm:"serializer:json"`

	// MetricsPushEnabled globally enables or disables client metrics push for the account
	MetricsPushEnabled bool `gorm:"default:false"`

	// AgentNetworkOnly limits the dashboard to the Agent Network surface for this account.
	// Set for accounts created via netbird.ai signups; users can disable it later.
	AgentNetworkOnly bool `gorm:"default:false"`

	// DashboardFeatures holds per-account dashboard section visibility overrides.
	// It serializes to a single JSON column so new sections can be added without
	// a schema change.
	DashboardFeatures *DashboardFeatures `gorm:"serializer:json"`

	// EmbeddedIdpEnabled indicates if the embedded identity provider is enabled.
	// This is a runtime-only field, not stored in the database.
	EmbeddedIdpEnabled bool `gorm:"-"`

	// LocalAuthDisabled indicates if local (email/password) authentication is disabled.
	// This is a runtime-only field, not stored in the database.
	LocalAuthDisabled bool `gorm:"-"`

	// LocalMfaEnabled indicates if TOTP MFA is enabled for local users.
	// Only applicable when the embedded IDP is enabled.
	LocalMfaEnabled bool
}

type SetupKey struct {
	Id string
	// AccountID is a reference to Account that this object belongs
	AccountID string `json:"-" gorm:"index"`
	Key       string
	KeySecret string `gorm:"index"`
	Name      string
	Type      SetupKeyType
	CreatedAt time.Time
	ExpiresAt *time.Time
	UpdatedAt time.Time `gorm:"autoUpdateTime:false"`
	// Revoked indicates whether the key was revoked or not (we don't remove them for tracking purposes)
	Revoked bool
	// UsedTimes indicates how many times the key was used
	UsedTimes int
	// LastUsed last time the key was used for peer registration
	LastUsed *time.Time
	// AutoGroups is a list of Group IDs that are auto assigned to a Peer when it uses this key to register
	AutoGroups []string `gorm:"serializer:json"`
	// UsageLimit indicates the number of times this key can be used to enroll a machine.
	// The value of 0 indicates the unlimited usage.
	UsageLimit int
	// Ephemeral indicate if the peers will be ephemeral or not
	Ephemeral bool
	// AllowExtraDNSLabels indicates if the key allows extra DNS labels
	AllowExtraDNSLabels bool
}

type SetupKeyType string

type UpdateOperation string

type UpdateReason struct {
	Resource  UpdateResource
	Operation UpdateOperation
}

type UpdateResource string

type User struct {
	Id string `gorm:"primaryKey"`
	// AccountID is a reference to Account that this object belongs
	AccountID     string `json:"-" gorm:"index"`
	Role          UserRole
	IsServiceUser bool
	// NonDeletable indicates whether the service user can be deleted
	NonDeletable bool
	// ServiceUserName is only set if IsServiceUser is true
	ServiceUserName string
	// AutoGroups is a list of Group IDs to auto-assign to peers registered by this user
	AutoGroups []string                        `gorm:"serializer:json"`
	PATs       map[string]*PersonalAccessToken `gorm:"-"`
	PATsG      []PersonalAccessToken           `json:"-" gorm:"foreignKey:UserID;references:id;constraint:OnDelete:CASCADE;"`
	// Blocked indicates whether the user is blocked. Blocked users can't use the system.
	Blocked bool
	// PendingApproval indicates whether the user requires approval before being activated
	PendingApproval bool
	// LastLogin is the last time the user logged in to IdP
	LastLogin *time.Time
	// CreatedAt records the time the user was created
	CreatedAt time.Time

	// Issued of the user
	Issued string `gorm:"default:api"`

	IntegrationReference integration_reference.IntegrationReference `gorm:"embedded;embeddedPrefix:integration_ref_"`

	Name  string `gorm:"default:''"`
	Email string `gorm:"default:''"`
}

type UserInfo struct {
	ID                   string                                     `json:"id"`
	Email                string                                     `json:"email"`
	Name                 string                                     `json:"name"`
	Role                 string                                     `json:"role"`
	AutoGroups           []string                                   `json:"auto_groups"`
	Status               string                                     `json:"-"`
	IsServiceUser        bool                                       `json:"is_service_user"`
	IsBlocked            bool                                       `json:"is_blocked"`
	NonDeletable         bool                                       `json:"non_deletable"`
	LastLogin            time.Time                                  `json:"last_login"`
	Issued               string                                     `json:"issued"`
	PendingApproval      bool                                       `json:"pending_approval"`
	Password             string                                     `json:"password"`
	IntegrationReference integration_reference.IntegrationReference `json:"-"`
	// IdPID is the identity provider ID (connector ID) extracted from the Dex-encoded user ID.
	// This field is only populated when the user ID can be decoded from Dex's format.
	IdPID string `json:"idp_id,omitempty"`
}

type UserInvite struct {
	UserInfo        *UserInfo
	InviteToken     string
	InviteExpiresAt time.Time
	InviteCreatedAt time.Time
}

type UserInviteInfo struct {
	Email     string    `json:"email"`
	Name      string    `json:"name"`
	ExpiresAt time.Time `json:"expires_at"`
	Valid     bool      `json:"valid"`
	InvitedBy string    `json:"invited_by"`
}

type UserInviteRecord struct {
	ID          string    `gorm:"primaryKey"`
	AccountID   string    `gorm:"index;not null"`
	Email       string    `gorm:"index;not null"`
	Name        string    `gorm:"not null"`
	Role        string    `gorm:"not null"`
	AutoGroups  []string  `gorm:"serializer:json"`
	HashedToken string    `gorm:"index;not null"` // SHA-256 hash of the token (base64 encoded)
	ExpiresAt   time.Time `gorm:"not null"`
	CreatedAt   time.Time `gorm:"not null"`
	CreatedBy   string    `gorm:"not null"`
}

type UserRole string

type UserStatus string

type Workload struct {
	Type       JobType         `gorm:"column:workload_type;index;type:varchar(50)"`
	Parameters json.RawMessage `gorm:"type:json"`
	Result     json.RawMessage `gorm:"type:json"`
}