app

type AddMemberInput struct {
	TenantID string   `json:"tenant_id" validate:"required,uuid"`
	UserID   string   `json:"user_id" validate:"required,uuid"`
	RoleIDs  []string `json:"role_ids" validate:"dive,uuid"`
}

type AssetService interface {
	// Create creates a new asset.
	Create(ctx context.Context, input CreateAssetInput) (*asset.Asset, error)

	// Get retrieves an asset by ID within a tenant.
	// Returns ErrNotFound if asset doesn't exist or belongs to different tenant.
	Get(ctx context.Context, tenantID, assetID shared.ID) (*asset.Asset, error)

	// GetByName retrieves an asset by name within a tenant.
	GetByName(ctx context.Context, tenantID shared.ID, name string) (*asset.Asset, error)

	// List returns paginated assets matching the filter.
	List(ctx context.Context, filter ListAssetsFilter) (*ListResult[*asset.Asset], error)

	// Update updates an existing asset.
	Update(ctx context.Context, input UpdateAssetInput) (*asset.Asset, error)

	// Delete soft-deletes an asset.
	Delete(ctx context.Context, tenantID, assetID shared.ID) error

	// BulkDelete soft-deletes multiple assets.
	BulkDelete(ctx context.Context, tenantID shared.ID, assetIDs []shared.ID) error

	// UpdateRiskScores recalculates risk scores for assets.
	UpdateRiskScores(ctx context.Context, tenantID shared.ID, assetIDs []shared.ID) error
}

type AuditRetentionPolicy struct {
	RetentionDays     int    `json:"retention_days"`
	CompressAfterDays int    `json:"compress_after_days"`
	ArchiveEnabled    bool   `json:"archive_enabled"`
	ArchiveLocation   string `json:"archive_location"`
}

type AuditService interface {
	// Log creates an audit log entry.
	Log(ctx context.Context, log *audit.AuditLog) error

	// LogAsync creates an audit log entry asynchronously.
	LogAsync(ctx context.Context, log *audit.AuditLog)

	// List returns paginated audit logs matching the filter.
	List(ctx context.Context, filter ListAuditLogsFilter) (*ListResult[*audit.AuditLog], error)

	// Get retrieves a specific audit log entry.
	Get(ctx context.Context, tenantID, logID shared.ID) (*audit.AuditLog, error)

	// GetByResourceID returns audit logs for a specific resource.
	GetByResourceID(ctx context.Context, tenantID shared.ID, resourceType, resourceID string) ([]*audit.AuditLog, error)
}

type AuditServiceEnterprise interface {
	AuditService

	// Export exports audit logs to external storage.
	Export(ctx context.Context, filter ListAuditLogsFilter, format string) ([]byte, error)

	// GetRetentionPolicy returns the audit log retention policy.
	GetRetentionPolicy(ctx context.Context, tenantID shared.ID) (*AuditRetentionPolicy, error)

	// SetRetentionPolicy sets the audit log retention policy.
	SetRetentionPolicy(ctx context.Context, tenantID shared.ID, policy *AuditRetentionPolicy) error

	// PurgeOldLogs purges logs older than retention period.
	PurgeOldLogs(ctx context.Context, tenantID shared.ID) (int64, error)
}

type AuthResult struct {
	User         *user.User `json:"user"`
	AccessToken  string     `json:"access_token"`
	RefreshToken string     `json:"refresh_token"`
	ExpiresAt    int64      `json:"expires_at"`
}

type AuthService interface {
	// Login authenticates a user with email and password.
	Login(ctx context.Context, input LoginInput) (*AuthResult, error)

	// Register creates a new user account.
	Register(ctx context.Context, input RegisterInput) (*AuthResult, error)

	// RefreshToken refreshes an access token using a refresh token.
	RefreshToken(ctx context.Context, input RefreshTokenInput) (*AuthResult, error)

	// Logout invalidates a user's session.
	Logout(ctx context.Context, sessionID shared.ID) error

	// LogoutAll invalidates all sessions for a user.
	LogoutAll(ctx context.Context, userID shared.ID) error

	// VerifyToken verifies an access token and returns the user.
	VerifyToken(ctx context.Context, token string) (*user.User, error)
}

type BroadcastNotificationInput struct {
	TenantID  string `json:"tenant_id" validate:"required,uuid"`
	EventType string `json:"event_type" validate:"required"`
	Title     string `json:"title" validate:"required,max=500"`
	Body      string `json:"body" validate:"max=10000"`
	Severity  string `json:"severity" validate:"omitempty,severity"`
	URL       string `json:"url" validate:"omitempty,url"`
}

type CreateAssetInput struct {
	TenantID    string   `json:"tenant_id" validate:"omitempty,uuid"`
	Name        string   `json:"name" validate:"required,min=1,max=255"`
	Type        string   `json:"type" validate:"required,asset_type"`
	Criticality string   `json:"criticality" validate:"required,criticality"`
	Scope       string   `json:"scope" validate:"omitempty,scope"`
	Exposure    string   `json:"exposure" validate:"omitempty,exposure"`
	Description string   `json:"description" validate:"max=1000"`
	Tags        []string `json:"tags" validate:"max=20,dive,max=50"`
}

type CreateRoleInput struct {
	TenantID    *string  `json:"tenant_id,omitempty" validate:"omitempty,uuid"`
	Name        string   `json:"name" validate:"required,min=1,max=100"`
	Slug        string   `json:"slug" validate:"required,slug,min=2,max=50"`
	Description string   `json:"description" validate:"max=500"`
	Permissions []string `json:"permissions" validate:"required,min=1,dive,permission"`
}

type CreateScanInput struct {
	TenantID     string         `json:"tenant_id" validate:"required,uuid"`
	Name         string         `json:"name" validate:"required,min=1,max=255"`
	Description  string         `json:"description" validate:"max=1000"`
	ToolID       string         `json:"tool_id" validate:"required,uuid"`
	AssetGroupID string         `json:"asset_group_id" validate:"omitempty,uuid"`
	AssetIDs     []string       `json:"asset_ids" validate:"omitempty,dive,uuid"`
	Schedule     string         `json:"schedule" validate:"omitempty,cron"`
	Parameters   map[string]any `json:"parameters"`
}

type CreateTenantInput struct {
	Name        string `json:"name" validate:"required,min=1,max=255"`
	Slug        string `json:"slug" validate:"required,slug,min=3,max=63"`
	Description string `json:"description" validate:"max=1000"`
	OwnerID     string `json:"owner_id" validate:"required,uuid"`
}

type CreateUserInput struct {
	Email    string `json:"email" validate:"required,email,max=255"`
	Password string `json:"password" validate:"required,min=8,max=72"`
	Name     string `json:"name" validate:"required,min=1,max=255"`
}

type CreateVulnerabilityInput struct {
	TenantID    string            `json:"tenant_id" validate:"required,uuid"`
	AssetID     string            `json:"asset_id" validate:"required,uuid"`
	Title       string            `json:"title" validate:"required,min=1,max=500"`
	Description string            `json:"description" validate:"max=10000"`
	Severity    string            `json:"severity" validate:"required,severity"`
	Source      string            `json:"source" validate:"required,max=255"`
	SourceRef   string            `json:"source_ref" validate:"max=255"`
	CVEID       string            `json:"cve_id" validate:"omitempty,cve"`
	CWEID       string            `json:"cwe_id" validate:"omitempty,cwe"`
	CVSSScore   *float64          `json:"cvss_score" validate:"omitempty,min=0,max=10"`
	Metadata    map[string]string `json:"metadata"`
}

type ListAssetsFilter struct {
	TenantID    string   `json:"tenant_id"`
	Search      string   `json:"search"`
	Types       []string `json:"types"`
	Criticality []string `json:"criticality"`
	Status      []string `json:"status"`
	Scope       []string `json:"scope"`
	Exposure    []string `json:"exposure"`
	GroupIDs    []string `json:"group_ids"`
	Tags        []string `json:"tags"`
	Page        int      `json:"page"`
	PerPage     int      `json:"per_page"`
	SortBy      string   `json:"sort_by"`
	SortOrder   string   `json:"sort_order"`
}

type ListAuditLogsFilter struct {
	TenantID     string     `json:"tenant_id"`
	UserIDs      []string   `json:"user_ids"`
	Actions      []string   `json:"actions"`
	ResourceType []string   `json:"resource_type"`
	ResourceID   string     `json:"resource_id"`
	Status       []string   `json:"status"`
	DateFrom     *time.Time `json:"date_from"`
	DateTo       *time.Time `json:"date_to"`
	Page         int        `json:"page"`
	PerPage      int        `json:"per_page"`
	SortBy       string     `json:"sort_by"`
	SortOrder    string     `json:"sort_order"`
}

type ListNotificationEventsFilter struct {
	TenantID      string   `json:"tenant_id"`
	IntegrationID string   `json:"integration_id"`
	EventTypes    []string `json:"event_types"`
	Status        []string `json:"status"`
	DateFrom      string   `json:"date_from"`
	DateTo        string   `json:"date_to"`
	Page          int      `json:"page"`
	PerPage       int      `json:"per_page"`
}

type ListResult[T any] struct {
	Items      []T   `json:"items"`
	Total      int64 `json:"total"`
	Page       int   `json:"page"`
	PerPage    int   `json:"per_page"`
	TotalPages int   `json:"total_pages"`
}

type ListRolesFilter struct {
	TenantID       *string `json:"tenant_id"`
	Search         string  `json:"search"`
	IncludeSystem  bool    `json:"include_system"`
	IncludeDefault bool    `json:"include_default"`
	Page           int     `json:"page"`
	PerPage        int     `json:"per_page"`
	SortBy         string  `json:"sort_by"`
	SortOrder      string  `json:"sort_order"`
}

type ListScansFilter struct {
	TenantID  string   `json:"tenant_id"`
	ToolIDs   []string `json:"tool_ids"`
	Status    []string `json:"status"`
	Search    string   `json:"search"`
	Page      int      `json:"page"`
	PerPage   int      `json:"per_page"`
	SortBy    string   `json:"sort_by"`
	SortOrder string   `json:"sort_order"`
}

type ListTenantsFilter struct {
	Search    string   `json:"search"`
	Status    []string `json:"status"`
	Page      int      `json:"page"`
	PerPage   int      `json:"per_page"`
	SortBy    string   `json:"sort_by"`
	SortOrder string   `json:"sort_order"`
}

type ListUsersFilter struct {
	Search    string   `json:"search"`
	Status    []string `json:"status"`
	Page      int      `json:"page"`
	PerPage   int      `json:"per_page"`
	SortBy    string   `json:"sort_by"`
	SortOrder string   `json:"sort_order"`
}

type ListVulnerabilitiesFilter struct {
	TenantID   string   `json:"tenant_id"`
	AssetIDs   []string `json:"asset_ids"`
	Severity   []string `json:"severity"`
	Status     []string `json:"status"`
	Source     []string `json:"source"`
	CVEID      string   `json:"cve_id"`
	Search     string   `json:"search"`
	Page       int      `json:"page"`
	PerPage    int      `json:"per_page"`
	SortBy     string   `json:"sort_by"`
	SortOrder  string   `json:"sort_order"`
	DateFrom   string   `json:"date_from"`
	DateTo     string   `json:"date_to"`
	HasFixable *bool    `json:"has_fixable"`
}

type LoginInput struct {
	Email    string `json:"email" validate:"required,email"`
	Password string `json:"password" validate:"required"`
}

type NotificationResult struct {
	IntegrationID string `json:"integration_id"`
	Success       bool   `json:"success"`
	Error         string `json:"error,omitempty"`
}

type NotificationService interface {
	// Send sends a notification to a specific integration.
	Send(ctx context.Context, input SendNotificationInput) (*NotificationResult, error)

	// Broadcast sends a notification to all matching integrations.
	Broadcast(ctx context.Context, input BroadcastNotificationInput) ([]NotificationResult, error)

	// Test sends a test notification to an integration.
	Test(ctx context.Context, tenantID, integrationID shared.ID) (*NotificationResult, error)

	// ListEvents returns notification events.
	ListEvents(ctx context.Context, filter ListNotificationEventsFilter) (*ListResult[*notification.Event], error)

	// GetEvent retrieves a specific notification event.
	GetEvent(ctx context.Context, tenantID, eventID shared.ID) (*notification.Event, error)

	// RetryEvent retries a failed notification event.
	RetryEvent(ctx context.Context, tenantID, eventID shared.ID) error
}

type RefreshTokenInput struct {
	RefreshToken string `json:"refresh_token" validate:"required"`
}

type RegisterInput struct {
	Email    string `json:"email" validate:"required,email,max=255"`
	Password string `json:"password" validate:"required,min=8,max=72"`
	Name     string `json:"name" validate:"required,min=1,max=255"`
}

type RoleService interface {
	// Create creates a new role (Enterprise only).
	// OSS edition returns ErrNotSupported.
	Create(ctx context.Context, input CreateRoleInput) (*role.Role, error)

	// Get retrieves a role by ID.
	Get(ctx context.Context, tenantID *shared.ID, roleID shared.ID) (*role.Role, error)

	// GetBySlug retrieves a role by slug.
	GetBySlug(ctx context.Context, tenantID *shared.ID, slug string) (*role.Role, error)

	// List returns roles matching the filter.
	List(ctx context.Context, filter ListRolesFilter) (*ListResult[*role.Role], error)

	// Update updates an existing role (Enterprise only for custom roles).
	// System roles cannot be modified.
	Update(ctx context.Context, input UpdateRoleInput) (*role.Role, error)

	// Delete deletes a role (Enterprise only for custom roles).
	// System roles cannot be deleted.
	Delete(ctx context.Context, tenantID *shared.ID, roleID shared.ID) error

	// GetPredefinedRoles returns the predefined system roles.
	GetPredefinedRoles(ctx context.Context) ([]*role.Role, error)

	// AssignToUser assigns a role to a user.
	AssignToUser(ctx context.Context, tenantID, userID, roleID shared.ID) error

	// RemoveFromUser removes a role from a user.
	RemoveFromUser(ctx context.Context, tenantID, userID, roleID shared.ID) error

	// GetUserRoles returns all roles assigned to a user.
	GetUserRoles(ctx context.Context, tenantID, userID shared.ID) ([]*role.Role, error)

	// GetUserPermissions returns all permissions for a user (aggregated from roles).
	GetUserPermissions(ctx context.Context, tenantID, userID shared.ID) ([]string, error)

	// HasPermission checks if a user has a specific permission.
	HasPermission(ctx context.Context, tenantID, userID shared.ID, permission string) (bool, error)
}

type ScanService interface {
	// Create creates a new scan configuration.
	Create(ctx context.Context, input CreateScanInput) (*scan.Scan, error)

	// Get retrieves a scan by ID within a tenant.
	Get(ctx context.Context, tenantID, scanID shared.ID) (*scan.Scan, error)

	// List returns paginated scans matching the filter.
	List(ctx context.Context, filter ListScansFilter) (*ListResult[*scan.Scan], error)

	// Update updates an existing scan.
	Update(ctx context.Context, input UpdateScanInput) (*scan.Scan, error)

	// Delete soft-deletes a scan.
	Delete(ctx context.Context, tenantID, scanID shared.ID) error

	// Trigger triggers a scan to run.
	Trigger(ctx context.Context, tenantID, scanID shared.ID) error

	// Cancel cancels a running scan.
	Cancel(ctx context.Context, tenantID, scanID shared.ID) error

	// Enable enables a scheduled scan.
	Enable(ctx context.Context, tenantID, scanID shared.ID) error

	// Disable disables a scheduled scan.
	Disable(ctx context.Context, tenantID, scanID shared.ID) error
}

type ScanSessionService interface {
	// GetSession retrieves a specific scan session.
	GetSession(ctx context.Context, tenantID, sessionID shared.ID) (*scansession.ScanSession, error)

	// ListSessions returns scan sessions for a scan.
	ListSessions(ctx context.Context, tenantID, scanID shared.ID, page, perPage int) (*ListResult[*scansession.ScanSession], error)

	// GetLatestSession returns the latest session for a scan.
	GetLatestSession(ctx context.Context, tenantID, scanID shared.ID) (*scansession.ScanSession, error)
}

type SendNotificationInput struct {
	TenantID      string `json:"tenant_id" validate:"required,uuid"`
	IntegrationID string `json:"integration_id" validate:"required,uuid"`
	Title         string `json:"title" validate:"required,max=500"`
	Body          string `json:"body" validate:"max=10000"`
	Severity      string `json:"severity" validate:"omitempty,severity"`
	URL           string `json:"url" validate:"omitempty,url"`
	EventType     string `json:"event_type" validate:"omitempty"`
}

type ServiceContext struct {
	TenantID shared.ID
	UserID   shared.ID
	IsAdmin  bool
}

type SessionService interface {
	// Create creates a new session.
	Create(ctx context.Context, userID, tenantID shared.ID, metadata map[string]string) (*session.Session, error)

	// Get retrieves a session by ID.
	Get(ctx context.Context, sessionID shared.ID) (*session.Session, error)

	// GetByUserID returns all sessions for a user.
	GetByUserID(ctx context.Context, userID shared.ID) ([]*session.Session, error)

	// Revoke revokes a session.
	Revoke(ctx context.Context, sessionID shared.ID) error

	// RevokeAll revokes all sessions for a user.
	RevokeAll(ctx context.Context, userID shared.ID) error

	// Touch updates the last activity timestamp.
	Touch(ctx context.Context, sessionID shared.ID) error

	// CleanupExpired removes expired sessions.
	CleanupExpired(ctx context.Context) (int64, error)
}

type TenantMemberService interface {
	// AddMember adds a user to a tenant.
	AddMember(ctx context.Context, input AddMemberInput) error

	// RemoveMember removes a user from a tenant.
	RemoveMember(ctx context.Context, tenantID, userID shared.ID) error

	// GetMembers returns all members of a tenant.
	GetMembers(ctx context.Context, tenantID shared.ID) ([]*tenant.Membership, error)

	// GetMember returns a specific member of a tenant.
	GetMember(ctx context.Context, tenantID, userID shared.ID) (*tenant.Membership, error)

	// UpdateMemberRoles updates a member's roles.
	UpdateMemberRoles(ctx context.Context, tenantID, userID shared.ID, roleIDs []shared.ID) error

	// IsMember checks if a user is a member of a tenant.
	IsMember(ctx context.Context, tenantID, userID shared.ID) (bool, error)
}

type TenantService interface {
	// Create creates a new tenant.
	Create(ctx context.Context, input CreateTenantInput) (*tenant.Tenant, error)

	// Get retrieves a tenant by ID.
	Get(ctx context.Context, tenantID shared.ID) (*tenant.Tenant, error)

	// GetBySlug retrieves a tenant by slug.
	GetBySlug(ctx context.Context, slug string) (*tenant.Tenant, error)

	// List returns paginated tenants matching the filter.
	List(ctx context.Context, filter ListTenantsFilter) (*ListResult[*tenant.Tenant], error)

	// Update updates an existing tenant.
	Update(ctx context.Context, input UpdateTenantInput) (*tenant.Tenant, error)

	// Delete soft-deletes a tenant.
	Delete(ctx context.Context, tenantID shared.ID) error

	// GetUserTenants returns all tenants a user belongs to.
	GetUserTenants(ctx context.Context, userID shared.ID) ([]*tenant.Tenant, error)
}

type UpdateAssetInput struct {
	TenantID    string    `json:"tenant_id" validate:"required,uuid"`
	ID          string    `json:"id" validate:"required,uuid"`
	Name        *string   `json:"name,omitempty" validate:"omitempty,min=1,max=255"`
	Criticality *string   `json:"criticality,omitempty" validate:"omitempty,criticality"`
	Scope       *string   `json:"scope,omitempty" validate:"omitempty,scope"`
	Exposure    *string   `json:"exposure,omitempty" validate:"omitempty,exposure"`
	Description *string   `json:"description,omitempty" validate:"omitempty,max=1000"`
	Tags        *[]string `json:"tags,omitempty" validate:"omitempty,max=20,dive,max=50"`
	Status      *string   `json:"status,omitempty" validate:"omitempty,asset_status"`
}

type UpdateRoleInput struct {
	TenantID    *string   `json:"tenant_id,omitempty" validate:"omitempty,uuid"`
	ID          string    `json:"id" validate:"required,uuid"`
	Name        *string   `json:"name,omitempty" validate:"omitempty,min=1,max=100"`
	Description *string   `json:"description,omitempty" validate:"omitempty,max=500"`
	Permissions *[]string `json:"permissions,omitempty" validate:"omitempty,min=1,dive,permission"`
}

type UpdateScanInput struct {
	TenantID    string          `json:"tenant_id" validate:"required,uuid"`
	ID          string          `json:"id" validate:"required,uuid"`
	Name        *string         `json:"name,omitempty" validate:"omitempty,min=1,max=255"`
	Description *string         `json:"description,omitempty" validate:"omitempty,max=1000"`
	Schedule    *string         `json:"schedule,omitempty" validate:"omitempty,cron"`
	Parameters  *map[string]any `json:"parameters,omitempty"`
	Enabled     *bool           `json:"enabled,omitempty"`
}

type UpdateTenantInput struct {
	ID          string  `json:"id" validate:"required,uuid"`
	Name        *string `json:"name,omitempty" validate:"omitempty,min=1,max=255"`
	Description *string `json:"description,omitempty" validate:"omitempty,max=1000"`
}

type UpdateUserInput struct {
	ID       string  `json:"id" validate:"required,uuid"`
	Name     *string `json:"name,omitempty" validate:"omitempty,min=1,max=255"`
	Email    *string `json:"email,omitempty" validate:"omitempty,email,max=255"`
	Password *string `json:"password,omitempty" validate:"omitempty,min=8,max=72"`
	Status   *string `json:"status,omitempty" validate:"omitempty,user_status"`
}

type UpdateVulnerabilityInput struct {
	TenantID string  `json:"tenant_id" validate:"required,uuid"`
	ID       string  `json:"id" validate:"required,uuid"`
	Status   *string `json:"status,omitempty" validate:"omitempty,finding_status"`
	Severity *string `json:"severity,omitempty" validate:"omitempty,severity"`
	Assignee *string `json:"assignee,omitempty" validate:"omitempty,uuid"`
	Notes    *string `json:"notes,omitempty" validate:"omitempty,max=5000"`
}

type UserService interface {
	// Create creates a new user.
	Create(ctx context.Context, input CreateUserInput) (*user.User, error)

	// Get retrieves a user by ID.
	Get(ctx context.Context, userID shared.ID) (*user.User, error)

	// GetByEmail retrieves a user by email.
	GetByEmail(ctx context.Context, email string) (*user.User, error)

	// List returns paginated users matching the filter.
	List(ctx context.Context, filter ListUsersFilter) (*ListResult[*user.User], error)

	// Update updates an existing user.
	Update(ctx context.Context, input UpdateUserInput) (*user.User, error)

	// Delete soft-deletes a user.
	Delete(ctx context.Context, userID shared.ID) error

	// Suspend suspends a user account.
	Suspend(ctx context.Context, userID shared.ID) error

	// Activate activates a suspended user account.
	Activate(ctx context.Context, userID shared.ID) error

	// ChangePassword changes user password.
	ChangePassword(ctx context.Context, userID shared.ID, oldPassword, newPassword string) error
}

type VulnerabilityService interface {
	// Create creates a new vulnerability.
	Create(ctx context.Context, input CreateVulnerabilityInput) (*vulnerability.Vulnerability, error)

	// Get retrieves a vulnerability by ID within a tenant.
	Get(ctx context.Context, tenantID, vulnID shared.ID) (*vulnerability.Vulnerability, error)

	// List returns paginated vulnerabilities matching the filter.
	List(ctx context.Context, filter ListVulnerabilitiesFilter) (*ListResult[*vulnerability.Vulnerability], error)

	// Update updates an existing vulnerability.
	Update(ctx context.Context, input UpdateVulnerabilityInput) (*vulnerability.Vulnerability, error)

	// Delete soft-deletes a vulnerability.
	Delete(ctx context.Context, tenantID, vulnID shared.ID) error

	// BulkUpdateStatus updates status for multiple vulnerabilities.
	BulkUpdateStatus(ctx context.Context, tenantID shared.ID, vulnIDs []shared.ID, status string) error

	// GetStatsByTenant returns vulnerability statistics for a tenant.
	GetStatsByTenant(ctx context.Context, tenantID shared.ID) (*VulnerabilityStats, error)

	// GetStatsByAsset returns vulnerability statistics for an asset.
	GetStatsByAsset(ctx context.Context, tenantID, assetID shared.ID) (*VulnerabilityStats, error)
}

type VulnerabilityStats struct {
	Total      int64            `json:"total"`
	BySeverity map[string]int64 `json:"by_severity"`
	ByStatus   map[string]int64 `json:"by_status"`
	BySource   map[string]int64 `json:"by_source"`
}