component

type AssetDependency struct {
	// contains filtered or unexported fields
}

type Component struct {
	// contains filtered or unexported fields
}

type ComponentStats struct {
	TotalComponents        int `json:"total_components"`
	DirectDependencies     int `json:"direct_dependencies"`
	TransitiveDependencies int `json:"transitive_dependencies"`
	VulnerableComponents   int `json:"vulnerable_components"`

	// Extended stats from findings analysis
	TotalVulnerabilities int            `json:"total_vulnerabilities"`
	OutdatedComponents   int            `json:"outdated_components"`
	CisaKevComponents    int            `json:"cisa_kev_components"`
	VulnBySeverity       map[string]int `json:"vuln_by_severity"` // critical, high, medium, low
	LicenseRisks         map[string]int `json:"license_risks"`    // critical, high, medium, low
}

type DependencyType string

type Ecosystem string

type EcosystemStats struct {
	Ecosystem    string `json:"ecosystem"`
	Total        int    `json:"total"`
	Vulnerable   int    `json:"vulnerable"`
	Outdated     int    `json:"outdated"`
	ManifestFile string `json:"manifest_file"`
}

type Filter struct {
	TenantID           *shared.ID // Filter components used by tenant
	AssetID            *shared.ID // Filter components used by asset
	Name               *string
	PURL               *string
	Ecosystems         []Ecosystem
	DependencyTypes    []DependencyType
	Statuses           []Status
	Licenses           []string
	HasVulnerabilities *bool
}

type LicenseStats struct {
	LicenseID string  `json:"license_id"`    // SPDX identifier
	Name      string  `json:"name"`          // Human-readable name
	Category  string  `json:"category"`      // permissive, copyleft, weak-copyleft, proprietary, public-domain, unknown
	Risk      string  `json:"risk"`          // critical, high, medium, low, none, unknown
	URL       *string `json:"url,omitempty"` // Link to license text (SPDX URL)
	Count     int     `json:"count"`         // Number of components using this license
}

type Repository interface {
	// Global Component Operations
	Upsert(ctx context.Context, comp *Component) (shared.ID, error)
	GetByPURL(ctx context.Context, purl string) (*Component, error)
	GetByID(ctx context.Context, id shared.ID) (*Component, error)

	// License Operations
	// LinkLicenses links licenses to a component and returns the count of newly linked licenses.
	LinkLicenses(ctx context.Context, componentID shared.ID, licenses []string) (linked int, err error)

	// Asset Dependency Operations (Links)
	LinkAsset(ctx context.Context, dep *AssetDependency) error
	GetDependency(ctx context.Context, id shared.ID) (*AssetDependency, error)
	UpdateDependency(ctx context.Context, dep *AssetDependency) error
	DeleteDependency(ctx context.Context, id shared.ID) error
	DeleteByAssetID(ctx context.Context, assetID shared.ID) error

	// GetExistingDependencyByPURL retrieves an existing asset_component by asset and component PURL.
	// Used for parent lookup during rescan when parent component exists from previous scan.
	// Returns nil, nil if not found.
	GetExistingDependencyByPURL(ctx context.Context, assetID shared.ID, purl string) (*AssetDependency, error)

	// GetExistingDependencyByComponentID retrieves an existing asset_component by asset, component, and path.
	// Used for duplicate detection during ingestion.
	// Returns nil, nil if not found.
	GetExistingDependencyByComponentID(ctx context.Context, assetID shared.ID, componentID shared.ID, path string) (*AssetDependency, error)

	// UpdateAssetDependencyParent updates the parent_component_id and depth of an asset_component.
	// Used in three-pass ingestion to set parent references after all components are inserted.
	UpdateAssetDependencyParent(ctx context.Context, id shared.ID, parentID shared.ID, depth int) error

	// ListComponents retrieves global components (optionally filtered by usage).
	ListComponents(ctx context.Context, filter Filter, page pagination.Pagination) (pagination.Result[*Component], error)

	// ListDependencies retrieves dependencies for an asset (joined with component details).
	ListDependencies(ctx context.Context, assetID shared.ID, page pagination.Pagination) (pagination.Result[*AssetDependency], error)

	// GetStats retrieves aggregated component statistics.
	GetStats(ctx context.Context, tenantID shared.ID) (*ComponentStats, error)

	// GetEcosystemStats retrieves per-ecosystem statistics.
	GetEcosystemStats(ctx context.Context, tenantID shared.ID) ([]EcosystemStats, error)

	// GetVulnerableComponents retrieves components with vulnerability details.
	GetVulnerableComponents(ctx context.Context, tenantID shared.ID, limit int) ([]VulnerableComponent, error)

	// GetLicenseStats retrieves license statistics for a tenant.
	GetLicenseStats(ctx context.Context, tenantID shared.ID) ([]LicenseStats, error)
}

type Status string

type VulnerableComponent struct {
	ID        string `json:"id"`
	Name      string `json:"name"`
	Version   string `json:"version"`
	Ecosystem string `json:"ecosystem"`
	PURL      string `json:"purl"`
	License   string `json:"license,omitempty"`

	// Vulnerability breakdown
	CriticalCount int  `json:"critical_count"`
	HighCount     int  `json:"high_count"`
	MediumCount   int  `json:"medium_count"`
	LowCount      int  `json:"low_count"`
	TotalCount    int  `json:"total_count"`
	InCisaKev     bool `json:"in_cisa_kev"`
}