postgres

func (*AITriageRepository) AcquireTriageSlot ¶

func (r *AITriageRepository) AcquireTriageSlot(ctx context.Context, tenantID, resultID shared.ID) (*aitriage.TriageContext, error)

AcquireTriageSlot atomically checks token limit and reserves a slot for processing. Uses SELECT FOR UPDATE to prevent race conditions when multiple workers process concurrently. This method: 1. Locks the triage result row with FOR UPDATE 2. Checks if status is 'pending' (not already processing) 3. Calculates current token usage with locking 4. Checks against monthly token limit 5. Updates status to 'processing' atomically Returns the triage context if slot acquired, or appropriate error.

func (*AITriageRepository) CountByTenantThisMonth ¶

func (r *AITriageRepository) CountByTenantThisMonth(ctx context.Context, tenantID shared.ID) (int, error)

CountByTenantThisMonth counts triage jobs for token usage tracking. Uses UTC timezone for consistent month boundaries across all regions.

func (*AITriageRepository) Create ¶

func (r *AITriageRepository) Create(ctx context.Context, result *aitriage.TriageResult) error

Create creates a new triage result.

func (*AITriageRepository) FindStuckJobs ¶

func (r *AITriageRepository) FindStuckJobs(ctx context.Context, stuckDuration time.Duration, limit int) ([]*aitriage.TriageResult, error)

FindStuckJobs finds triage jobs that have been in pending/processing state for too long. Used by recovery job to mark them as failed. stuckDuration: how long a job must be stuck before being considered for recovery.

func (*AITriageRepository) GetByFindingID ¶

func (r *AITriageRepository) GetByFindingID(ctx context.Context, tenantID, findingID shared.ID) (*aitriage.TriageResult, error)

GetByFindingID retrieves the latest triage result for a finding.

func (*AITriageRepository) GetByID ¶

func (r *AITriageRepository) GetByID(ctx context.Context, tenantID, id shared.ID) (*aitriage.TriageResult, error)

GetByID retrieves a triage result by ID.

func (*AITriageRepository) GetPendingJobs ¶

func (r *AITriageRepository) GetPendingJobs(ctx context.Context, limit int) ([]*aitriage.TriageResult, error)

GetPendingJobs retrieves pending triage jobs for processing. SECURITY: Orders by tenant_id to group jobs by tenant for proper isolation. Workers should process results grouped by tenant_id to prevent cross-tenant leakage. Consider using GetPendingJobsByTenant for better isolation.

func (*AITriageRepository) GetPendingJobsByTenant ¶

func (r *AITriageRepository) GetPendingJobsByTenant(ctx context.Context, tenantID shared.ID, limit int) ([]*aitriage.TriageResult, error)

GetPendingJobsByTenant retrieves pending triage jobs for a specific tenant. SECURITY: This is the preferred method - ensures proper tenant isolation.

func (*AITriageRepository) GetTenantsWithPendingJobs ¶

func (r *AITriageRepository) GetTenantsWithPendingJobs(ctx context.Context, limit int) ([]shared.ID, error)

GetTenantsWithPendingJobs returns tenant IDs that have pending triage jobs. SECURITY: Use this to iterate tenants, then call GetPendingJobsByTenant for each.

func (*AITriageRepository) GetTriageContext ¶

func (r *AITriageRepository) GetTriageContext(ctx context.Context, tenantID, resultID shared.ID) (*aitriage.TriageContext, error)

GetTriageContext retrieves triage result with tenant settings and token usage in one optimized query. Uses UTC timezone for consistent month boundaries across all regions.

func (*AITriageRepository) HasPendingOrProcessing ¶

func (r *AITriageRepository) HasPendingOrProcessing(ctx context.Context, tenantID, findingID shared.ID) (bool, error)

HasPendingOrProcessing checks if a finding has a pending or processing triage job. Used for deduplication to prevent multiple concurrent triage requests for the same finding.

func (*AITriageRepository) ListByFindingID ¶

func (r *AITriageRepository) ListByFindingID(ctx context.Context, tenantID, findingID shared.ID, limit, offset int) ([]*aitriage.TriageResult, int, error)

ListByFindingID retrieves all triage results for a finding (history).

func (*AITriageRepository) MarkStuckAsFailed ¶

func (r *AITriageRepository) MarkStuckAsFailed(ctx context.Context, id shared.ID, errorMessage string) (bool, error)

MarkStuckAsFailed marks a stuck triage job as failed. Returns true if the job was updated, false if it was already in a terminal state.

func (*AITriageRepository) SumTokensByTenantThisMonth ¶

func (r *AITriageRepository) SumTokensByTenantThisMonth(ctx context.Context, tenantID shared.ID) (int, error)

SumTokensByTenantThisMonth sums tokens used this month. Uses UTC timezone for consistent month boundaries across all regions.

func (*AITriageRepository) Update ¶

func (r *AITriageRepository) Update(ctx context.Context, result *aitriage.TriageResult) error

Update updates an existing triage result.

func (*APIKeyRepository) Create ¶

func (r *APIKeyRepository) Create(ctx context.Context, key *apikey.APIKey) error

Create inserts a new API key.

func (*APIKeyRepository) Delete ¶

func (r *APIKeyRepository) Delete(ctx context.Context, id, tenantID apikey.ID) error

Delete deletes an API key by ID and tenant.

func (*APIKeyRepository) GetByHash ¶

func (r *APIKeyRepository) GetByHash(ctx context.Context, hash string) (*apikey.APIKey, error)

GetByHash retrieves an API key by its hash.

func (*APIKeyRepository) GetByID ¶

func (r *APIKeyRepository) GetByID(ctx context.Context, id, tenantID apikey.ID) (*apikey.APIKey, error)

GetByID retrieves an API key by ID and tenant.

func (*APIKeyRepository) List ¶

func (r *APIKeyRepository) List(ctx context.Context, filter apikey.Filter) (apikey.ListResult, error)

List retrieves a paginated list of API keys.

func (*APIKeyRepository) Update ¶

func (r *APIKeyRepository) Update(ctx context.Context, key *apikey.APIKey) error

Update updates an API key.

func (*AccessControlRepository) BatchListFindingGroupIDs ¶ added in v0.1.3

func (r *AccessControlRepository) BatchListFindingGroupIDs(ctx context.Context, tenantID shared.ID, findingIDs []shared.ID) (map[shared.ID][]shared.ID, error)

BatchListFindingGroupIDs returns group IDs for multiple findings in a single query. Avoids N+1 when checking group membership for bulk operations.

func (*AccessControlRepository) BulkCreateAssetOwners ¶ added in v0.1.2

func (r *AccessControlRepository) BulkCreateAssetOwners(ctx context.Context, owners []*accesscontrol.AssetOwner) (int, error)

BulkCreateAssetOwners inserts multiple asset owners in batches. Returns the number of rows successfully inserted.

func (*AccessControlRepository) BulkCreateAssetOwnersWithSource ¶ added in v0.1.2

func (r *AccessControlRepository) BulkCreateAssetOwnersWithSource(ctx context.Context, owners []*accesscontrol.AssetOwner, source string, ruleID *shared.ID) (int, error)

BulkCreateAssetOwnersWithSource creates multiple asset owner records with source tracking. Automatically chunks large batches to stay within PostgreSQL parameter limits.

func (*AccessControlRepository) BulkCreateFindingGroupAssignments ¶ added in v0.1.2

func (r *AccessControlRepository) BulkCreateFindingGroupAssignments(ctx context.Context, fgas []*accesscontrol.FindingGroupAssignment) (int, error)

BulkCreateFindingGroupAssignments inserts multiple finding-group assignments. Uses ON CONFLICT DO NOTHING for idempotency (same finding+group pair is ignored).

func (*AccessControlRepository) BulkDeleteAutoAssignedForAssets ¶ added in v0.1.2

func (r *AccessControlRepository) BulkDeleteAutoAssignedForAssets(ctx context.Context, assetIDs []shared.ID, groupID shared.ID) (int, error)

BulkDeleteAutoAssignedForAssets removes auto-assigned ownership for multiple assets in a group. Processes in chunks to avoid exceeding PostgreSQL's parameter limit.

func (*AccessControlRepository) CanAccessAsset ¶

func (r *AccessControlRepository) CanAccessAsset(ctx context.Context, userID, assetID shared.ID) (bool, error)

CanAccessAsset checks if a user can access a specific asset.

func (*AccessControlRepository) CountAssetOwners ¶

func (r *AccessControlRepository) CountAssetOwners(ctx context.Context, assetID shared.ID) (int64, error)

CountAssetOwners counts the number of owners for an asset.

func (*AccessControlRepository) CountAssetsByGroups ¶ added in v0.1.2

func (r *AccessControlRepository) CountAssetsByGroups(ctx context.Context, groupIDs []shared.ID) (map[shared.ID]int, error)

CountAssetsByGroups counts assets owned by multiple groups in a single query.

func (*AccessControlRepository) CountAssignmentRules ¶

func (r *AccessControlRepository) CountAssignmentRules(ctx context.Context, tenantID shared.ID, filter accesscontrol.AssignmentRuleFilter) (int64, error)

CountAssignmentRules counts assignment rules with filtering.

func (*AccessControlRepository) CountFindingsByGroupFromRules ¶ added in v0.1.2

func (r *AccessControlRepository) CountFindingsByGroupFromRules(ctx context.Context, tenantID, groupID shared.ID) (int64, error)

CountFindingsByGroupFromRules counts findings assigned to a group via assignment rules.

func (*AccessControlRepository) CountScopeRules ¶ added in v0.1.2

func (r *AccessControlRepository) CountScopeRules(ctx context.Context, tenantID, groupID shared.ID, filter accesscontrol.ScopeRuleFilter) (int64, error)

CountScopeRules counts scope rules for a group with tenant isolation, respecting the same filter as ListScopeRules.

func (*AccessControlRepository) CreateAssetOwner ¶

func (r *AccessControlRepository) CreateAssetOwner(ctx context.Context, ao *accesscontrol.AssetOwner) error

CreateAssetOwner creates a new asset ownership relationship. Supports both group-level and user-level (direct) ownership.

func (*AccessControlRepository) CreateAssetOwnerWithSource ¶ added in v0.1.2

func (r *AccessControlRepository) CreateAssetOwnerWithSource(ctx context.Context, ao *accesscontrol.AssetOwner, source string, ruleID *shared.ID) error

CreateAssetOwnerWithSource creates an asset owner record with source tracking.

func (*AccessControlRepository) CreateAssignmentRule ¶

func (r *AccessControlRepository) CreateAssignmentRule(ctx context.Context, rule *accesscontrol.AssignmentRule) error

CreateAssignmentRule creates a new assignment rule.

func (*AccessControlRepository) CreateGroupPermission ¶

func (r *AccessControlRepository) CreateGroupPermission(ctx context.Context, gp *accesscontrol.GroupPermission) error

CreateGroupPermission creates a new group permission override.

func (*AccessControlRepository) CreateScopeRule ¶ added in v0.1.2

func (r *AccessControlRepository) CreateScopeRule(ctx context.Context, rule *accesscontrol.ScopeRule) error

CreateScopeRule creates a new scope rule.

func (*AccessControlRepository) DeleteAssetOwner ¶

func (r *AccessControlRepository) DeleteAssetOwner(ctx context.Context, assetID, groupID shared.ID) error

DeleteAssetOwner removes an asset ownership by asset and group ID.

func (*AccessControlRepository) DeleteAssetOwnerByID ¶

func (r *AccessControlRepository) DeleteAssetOwnerByID(ctx context.Context, id shared.ID) error

DeleteAssetOwnerByID removes an asset ownership by its ID.

func (*AccessControlRepository) DeleteAssetOwnerByUser ¶

func (r *AccessControlRepository) DeleteAssetOwnerByUser(ctx context.Context, assetID, userID shared.ID) error

DeleteAssetOwnerByUser removes an asset ownership by asset and user ID (direct ownership).

func (*AccessControlRepository) DeleteAssignmentRule ¶

func (r *AccessControlRepository) DeleteAssignmentRule(ctx context.Context, tenantID, id shared.ID) error

DeleteAssignmentRule removes an assignment rule.

func (*AccessControlRepository) DeleteAutoAssignedByRule ¶ added in v0.1.2

func (r *AccessControlRepository) DeleteAutoAssignedByRule(ctx context.Context, tenantID, ruleID shared.ID) (int, error)

DeleteAutoAssignedByRule removes all auto-assigned asset owners created by a specific rule. Uses subquery to enforce tenant isolation via the scope rule's tenant.

func (*AccessControlRepository) DeleteAutoAssignedForAsset ¶ added in v0.1.2

func (r *AccessControlRepository) DeleteAutoAssignedForAsset(ctx context.Context, assetID, groupID shared.ID) error

DeleteAutoAssignedForAsset removes auto-assigned ownership for an asset in a specific group.

func (*AccessControlRepository) DeleteGroupPermission ¶

func (r *AccessControlRepository) DeleteGroupPermission(ctx context.Context, groupID shared.ID, permissionID string) error

DeleteGroupPermission removes a group permission.

func (*AccessControlRepository) DeleteScopeRule ¶ added in v0.1.2

func (r *AccessControlRepository) DeleteScopeRule(ctx context.Context, tenantID, id shared.ID) error

DeleteScopeRule deletes a scope rule by ID with tenant isolation.

func (*AccessControlRepository) DeleteScopeRuleWithCleanup ¶ added in v0.1.2

func (r *AccessControlRepository) DeleteScopeRuleWithCleanup(ctx context.Context, tenantID, ruleID shared.ID) (int, error)

DeleteScopeRuleWithCleanup atomically removes auto-assigned assets and deletes the scope rule within a single transaction. This prevents the inconsistent state where assets are unassigned but the rule still exists (if rule deletion fails).

func (*AccessControlRepository) FindAssetsByAssetGroupMatch ¶ added in v0.1.2

func (r *AccessControlRepository) FindAssetsByAssetGroupMatch(ctx context.Context, tenantID shared.ID, assetGroupIDs []shared.ID) ([]shared.ID, error)

FindAssetsByAssetGroupMatch finds assets that belong to any of the specified asset groups.

func (*AccessControlRepository) FindAssetsByTagMatch ¶ added in v0.1.2

func (r *AccessControlRepository) FindAssetsByTagMatch(ctx context.Context, tenantID shared.ID, tags []string, logic accesscontrol.MatchLogic) ([]shared.ID, error)

FindAssetsByTagMatch finds assets matching tag criteria.

func (*AccessControlRepository) GetAssetOwner ¶

func (r *AccessControlRepository) GetAssetOwner(ctx context.Context, assetID, groupID shared.ID) (*accesscontrol.AssetOwner, error)

GetAssetOwner retrieves an asset ownership by asset and group ID.

func (*AccessControlRepository) GetAssetOwnerByID ¶

func (r *AccessControlRepository) GetAssetOwnerByID(ctx context.Context, id shared.ID) (*accesscontrol.AssetOwner, error)

GetAssetOwnerByID retrieves an asset ownership by its ID.

func (*AccessControlRepository) GetAssetOwnerByUser ¶

func (r *AccessControlRepository) GetAssetOwnerByUser(ctx context.Context, assetID, userID shared.ID) (*accesscontrol.AssetOwner, error)

GetAssetOwnerByUser retrieves an asset ownership by asset and user ID (direct ownership).

func (*AccessControlRepository) GetAssignmentRule ¶

func (r *AccessControlRepository) GetAssignmentRule(ctx context.Context, tenantID, id shared.ID) (*accesscontrol.AssignmentRule, error)

GetAssignmentRule retrieves an assignment rule by ID.

func (*AccessControlRepository) GetGroupPermission ¶

func (r *AccessControlRepository) GetGroupPermission(ctx context.Context, groupID shared.ID, permissionID string) (*accesscontrol.GroupPermission, error)

GetGroupPermission retrieves a group permission by group ID and permission ID.

func (*AccessControlRepository) GetPrimaryOwnerBrief ¶ added in v0.1.2

func (r *AccessControlRepository) GetPrimaryOwnerBrief(ctx context.Context, tenantID, assetID shared.ID) (*accesscontrol.OwnerBrief, error)

GetPrimaryOwnerBrief returns a lightweight representation of the primary owner for an asset.

func (*AccessControlRepository) GetPrimaryOwnersByAssetIDs ¶ added in v0.1.2

func (r *AccessControlRepository) GetPrimaryOwnersByAssetIDs(ctx context.Context, tenantID shared.ID, assetIDs []shared.ID) (map[string]*accesscontrol.OwnerBrief, error)

GetPrimaryOwnersByAssetIDs returns primary owners for multiple assets in a single query. Returns a map of assetID (string) → OwnerBrief.

func (*AccessControlRepository) GetScopeRule ¶ added in v0.1.2

func (r *AccessControlRepository) GetScopeRule(ctx context.Context, tenantID, id shared.ID) (*accesscontrol.ScopeRule, error)

GetScopeRule retrieves a scope rule by ID with tenant isolation.

func (*AccessControlRepository) GetUserAssetAccess ¶

func (r *AccessControlRepository) GetUserAssetAccess(ctx context.Context, userID, assetID shared.ID) (*accesscontrol.UserAssetAccess, error)

GetUserAssetAccess gets the user's access details for an asset.

func (*AccessControlRepository) HasAnyScopeAssignment ¶ added in v0.1.2

func (r *AccessControlRepository) HasAnyScopeAssignment(ctx context.Context, tenantID, userID shared.ID) (bool, error)

HasAnyScopeAssignment checks if a user has any rows in user_accessible_assets. Returns true if the user has at least one group-based asset assignment. Used for backward compat: if false, user sees all data (no groups configured yet).

func (*AccessControlRepository) HasPrimaryOwner ¶

func (r *AccessControlRepository) HasPrimaryOwner(ctx context.Context, assetID shared.ID) (bool, error)

HasPrimaryOwner checks if an asset has at least one primary owner.

func (*AccessControlRepository) ListAccessibleAssets ¶

func (r *AccessControlRepository) ListAccessibleAssets(ctx context.Context, tenantID, userID shared.ID) ([]shared.ID, error)

ListAccessibleAssets returns all asset IDs a user can access within a tenant.

func (*AccessControlRepository) ListActiveRulesByPriority ¶

func (r *AccessControlRepository) ListActiveRulesByPriority(ctx context.Context, tenantID shared.ID) ([]*accesscontrol.AssignmentRule, error)

ListActiveRulesByPriority lists active assignment rules ordered by priority (descending).

func (*AccessControlRepository) ListActiveScopeRulesByGroup ¶ added in v0.1.2

func (r *AccessControlRepository) ListActiveScopeRulesByGroup(ctx context.Context, tenantID, groupID shared.ID) ([]*accesscontrol.ScopeRule, error)

ListActiveScopeRulesByGroup returns all active scope rules for a group with tenant isolation.

func (*AccessControlRepository) ListActiveScopeRulesByTenant ¶ added in v0.1.2

func (r *AccessControlRepository) ListActiveScopeRulesByTenant(ctx context.Context, tenantID shared.ID) ([]*accesscontrol.ScopeRule, error)

ListActiveScopeRulesByTenant returns all active scope rules for a tenant.

func (*AccessControlRepository) ListAssetOwners ¶

func (r *AccessControlRepository) ListAssetOwners(ctx context.Context, assetID shared.ID) ([]*accesscontrol.AssetOwner, error)

ListAssetOwners lists all owners of an asset (both group and user ownership).

func (*AccessControlRepository) ListAssetOwnersByGroupWithDetails ¶ added in v0.1.2

func (r *AccessControlRepository) ListAssetOwnersByGroupWithDetails(ctx context.Context, groupID shared.ID, limit, offset int) ([]*accesscontrol.AssetOwnerWithAsset, int64, error)

ListAssetOwnersByGroupWithDetails lists asset owners for a group with asset name/type/status, with pagination.

func (*AccessControlRepository) ListAssetOwnersWithNames ¶ added in v0.1.2

func (r *AccessControlRepository) ListAssetOwnersWithNames(ctx context.Context, tenantID, assetID shared.ID) ([]*accesscontrol.AssetOwnerWithNames, error)

ListAssetOwnersWithNames returns asset owners with resolved user/group names.

func (*AccessControlRepository) ListAssetsByGroup ¶

func (r *AccessControlRepository) ListAssetsByGroup(ctx context.Context, groupID shared.ID) ([]shared.ID, error)

ListAssetsByGroup lists all asset IDs owned by a group.

func (*AccessControlRepository) ListAssetsByUser ¶

func (r *AccessControlRepository) ListAssetsByUser(ctx context.Context, userID shared.ID) ([]shared.ID, error)

ListAssetsByUser lists all asset IDs directly owned by a user.

func (*AccessControlRepository) ListAssignmentRules ¶

func (r *AccessControlRepository) ListAssignmentRules(ctx context.Context, tenantID shared.ID, filter accesscontrol.AssignmentRuleFilter) ([]*accesscontrol.AssignmentRule, error)

ListAssignmentRules lists assignment rules with filtering.

func (*AccessControlRepository) ListAutoAssignedAssets ¶ added in v0.1.2

func (r *AccessControlRepository) ListAutoAssignedAssets(ctx context.Context, tenantID, groupID shared.ID) ([]shared.ID, error)

ListAutoAssignedAssets lists asset IDs that are auto-assigned to a group via scope rules. Uses JOIN to enforce tenant isolation through the scope rule.

func (*AccessControlRepository) ListAutoAssignedGroupsForAsset ¶ added in v0.1.2

func (r *AccessControlRepository) ListAutoAssignedGroupsForAsset(ctx context.Context, assetID shared.ID) ([]shared.ID, error)

ListAutoAssignedGroupsForAsset lists group IDs that an asset is auto-assigned to via scope rules.

func (*AccessControlRepository) ListFindingGroupAssignments ¶ added in v0.1.2

func (r *AccessControlRepository) ListFindingGroupAssignments(ctx context.Context, tenantID, findingID shared.ID) ([]*accesscontrol.FindingGroupAssignment, error)

ListFindingGroupAssignments lists all group assignments for a finding.

func (*AccessControlRepository) ListGroupPermissions ¶

func (r *AccessControlRepository) ListGroupPermissions(ctx context.Context, groupID shared.ID) ([]*accesscontrol.GroupPermission, error)

ListGroupPermissions lists all custom permissions for a group.

func (*AccessControlRepository) ListGroupPermissionsByEffect ¶

func (r *AccessControlRepository) ListGroupPermissionsByEffect(ctx context.Context, groupID shared.ID, effect accesscontrol.PermissionEffect) ([]*accesscontrol.GroupPermission, error)

ListGroupPermissionsByEffect lists group permissions filtered by effect.

func (*AccessControlRepository) ListGroupsByAsset ¶

func (r *AccessControlRepository) ListGroupsByAsset(ctx context.Context, assetID shared.ID) ([]shared.ID, error)

ListGroupsByAsset lists all group IDs that own an asset (excludes direct user ownership).

func (*AccessControlRepository) ListGroupsWithActiveScopeRules ¶ added in v0.1.2

func (r *AccessControlRepository) ListGroupsWithActiveScopeRules(ctx context.Context, tenantID shared.ID) ([]shared.ID, error)

ListGroupsWithActiveScopeRules returns distinct group IDs that have active scope rules for a tenant.

func (*AccessControlRepository) ListGroupsWithAssetGroupMatchRule ¶ added in v0.1.2

func (r *AccessControlRepository) ListGroupsWithAssetGroupMatchRule(ctx context.Context, assetGroupID shared.ID) ([]shared.ID, error)

ListGroupsWithAssetGroupMatchRule returns distinct access control group IDs that have active scope rules referencing the given asset group ID in match_asset_group_ids.

func (*AccessControlRepository) ListScopeRules ¶ added in v0.1.2

func (r *AccessControlRepository) ListScopeRules(ctx context.Context, tenantID, groupID shared.ID, filter accesscontrol.ScopeRuleFilter) ([]*accesscontrol.ScopeRule, error)

ListScopeRules lists scope rules for a group.

func (*AccessControlRepository) ListTenantsWithActiveScopeRules ¶ added in v0.1.2

func (r *AccessControlRepository) ListTenantsWithActiveScopeRules(ctx context.Context) ([]shared.ID, error)

ListTenantsWithActiveScopeRules returns all tenants that have at least one active scope rule.

func (*AccessControlRepository) ListUsersByAsset ¶

func (r *AccessControlRepository) ListUsersByAsset(ctx context.Context, assetID shared.ID) ([]shared.ID, error)

ListUsersByAsset lists all user IDs that directly own an asset.

func (*AccessControlRepository) RefreshAccessForAssetAssign ¶ added in v0.1.2

func (r *AccessControlRepository) RefreshAccessForAssetAssign(ctx context.Context, groupID, assetID shared.ID, ownershipType string) error

RefreshAccessForAssetAssign incrementally updates access when an asset is assigned to a group.

func (*AccessControlRepository) RefreshAccessForAssetUnassign ¶ added in v0.1.2

func (r *AccessControlRepository) RefreshAccessForAssetUnassign(ctx context.Context, groupID, assetID shared.ID) error

RefreshAccessForAssetUnassign incrementally updates access when an asset is removed from a group.

func (*AccessControlRepository) RefreshAccessForDirectOwnerAdd ¶ added in v0.1.2

func (r *AccessControlRepository) RefreshAccessForDirectOwnerAdd(ctx context.Context, assetID, userID shared.ID, ownershipType string) error

RefreshAccessForDirectOwnerAdd updates the user_accessible_assets materialized view when a user is directly added as an asset owner.

func (*AccessControlRepository) RefreshAccessForDirectOwnerRemove ¶ added in v0.1.2

func (r *AccessControlRepository) RefreshAccessForDirectOwnerRemove(ctx context.Context, assetID, userID shared.ID) error

RefreshAccessForDirectOwnerRemove updates the user_accessible_assets materialized view when a user is removed as a direct asset owner.

func (*AccessControlRepository) RefreshAccessForMemberAdd ¶ added in v0.1.2

func (r *AccessControlRepository) RefreshAccessForMemberAdd(ctx context.Context, groupID, userID shared.ID) error

RefreshAccessForMemberAdd incrementally updates access when a user is added to a group.

func (*AccessControlRepository) RefreshAccessForMemberRemove ¶ added in v0.1.2

func (r *AccessControlRepository) RefreshAccessForMemberRemove(ctx context.Context, groupID, userID shared.ID) error

RefreshAccessForMemberRemove incrementally updates access when a user is removed from a group.

func (*AccessControlRepository) RefreshUserAccessibleAssets ¶

func (r *AccessControlRepository) RefreshUserAccessibleAssets(ctx context.Context) error

RefreshUserAccessibleAssets refreshes the materialized view for user-asset access.

func (*AccessControlRepository) UpdateAssetOwner ¶

func (r *AccessControlRepository) UpdateAssetOwner(ctx context.Context, ao *accesscontrol.AssetOwner) error

UpdateAssetOwner updates an existing asset ownership.

func (*AccessControlRepository) UpdateAssignmentRule ¶

func (r *AccessControlRepository) UpdateAssignmentRule(ctx context.Context, tenantID shared.ID, rule *accesscontrol.AssignmentRule) error

UpdateAssignmentRule updates an existing assignment rule.

func (*AccessControlRepository) UpdateGroupPermission ¶

func (r *AccessControlRepository) UpdateGroupPermission(ctx context.Context, gp *accesscontrol.GroupPermission) error

UpdateGroupPermission updates an existing group permission.

func (*AccessControlRepository) UpdateScopeRule ¶ added in v0.1.2

func (r *AccessControlRepository) UpdateScopeRule(ctx context.Context, tenantID shared.ID, rule *accesscontrol.ScopeRule) error

UpdateScopeRule updates an existing scope rule with tenant isolation.

func (*AccessControlRepository) ValidateAssetGroupsBelongToTenant ¶ added in v0.1.2

func (r *AccessControlRepository) ValidateAssetGroupsBelongToTenant(ctx context.Context, tenantID shared.ID, assetGroupIDs []shared.ID) error

ValidateAssetGroupsBelongToTenant checks that all given asset group IDs belong to the specified tenant. Returns an error if any asset group doesn't exist or belongs to a different tenant.

func (*AdminRepository) AuthenticateByAPIKey ¶

func (r *AdminRepository) AuthenticateByAPIKey(ctx context.Context, rawKey string) (*admin.AdminUser, error)

AuthenticateByAPIKey authenticates an admin user by raw API key. Implements SEC-H01: Rate limiting via account lockout after failed attempts.

func (*AdminRepository) Count ¶

func (r *AdminRepository) Count(ctx context.Context, filter admin.Filter) (int, error)

Count counts admin users with optional filter.

func (*AdminRepository) CountByRole ¶

func (r *AdminRepository) CountByRole(ctx context.Context, role admin.AdminRole) (int, error)

CountByRole counts admin users by role.

func (*AdminRepository) Create ¶

func (r *AdminRepository) Create(ctx context.Context, a *admin.AdminUser) error

Create creates a new admin user.

func (*AdminRepository) Delete ¶

func (r *AdminRepository) Delete(ctx context.Context, id shared.ID) error

Delete deletes an admin user.

func (*AdminRepository) GetByAPIKeyPrefix ¶

func (r *AdminRepository) GetByAPIKeyPrefix(ctx context.Context, prefix string) (*admin.AdminUser, error)

GetByAPIKeyPrefix retrieves an admin user by API key prefix.

func (*AdminRepository) GetByEmail ¶

func (r *AdminRepository) GetByEmail(ctx context.Context, email string) (*admin.AdminUser, error)

GetByEmail retrieves an admin user by email.

func (*AdminRepository) GetByID ¶

func (r *AdminRepository) GetByID(ctx context.Context, id shared.ID) (*admin.AdminUser, error)

GetByID retrieves an admin user by ID.

func (*AdminRepository) List ¶

func (r *AdminRepository) List(ctx context.Context, filter admin.Filter, page pagination.Pagination) (pagination.Result[*admin.AdminUser], error)

List lists admin users with filters and pagination.

func (*AdminRepository) RecordUsage ¶

func (r *AdminRepository) RecordUsage(ctx context.Context, id shared.ID, ip string) error

RecordUsage records API key usage (IP and timestamp).

func (*AdminRepository) Update ¶

func (r *AdminRepository) Update(ctx context.Context, a *admin.AdminUser) error

Update updates an admin user.

func (*AgentRepository) ClaimJob ¶

func (r *AgentRepository) ClaimJob(ctx context.Context, id shared.ID) error

ClaimJob atomically increments the current_jobs counter for an agent. Returns error if the agent is at capacity or not available.

func (*AgentRepository) CountByTenant ¶

func (r *AgentRepository) CountByTenant(ctx context.Context, tenantID shared.ID) (int, error)

CountByTenant counts the number of tenant-owned agents (excluding platform agents). Used for enforcing agent limits per plan.

func (*AgentRepository) Create ¶

func (r *AgentRepository) Create(ctx context.Context, a *agent.Agent) error

Create persists a new agent.

func (*AgentRepository) Delete ¶

func (r *AgentRepository) Delete(ctx context.Context, id shared.ID) error

Delete deletes an agent.

func (*AgentRepository) FindAvailable ¶

func (r *AgentRepository) FindAvailable(ctx context.Context, tenantID shared.ID, capabilities []string, tool string) ([]*agent.Agent, error)

FindAvailable finds available agents for a task.

func (*AgentRepository) FindAvailableWithCapacity ¶

func (r *AgentRepository) FindAvailableWithCapacity(ctx context.Context, tenantID shared.ID, capabilities []string, tool string) ([]*agent.Agent, error)

FindAvailableWithCapacity finds daemon agents with available job capacity. Used for load balancing - returns agents sorted by load factor (least loaded first). Only returns agents that can receive jobs from server (daemon mode or worker/collector type). Only considers agents with health='online' (have sent heartbeat recently). Agents with health='unknown' are excluded as they have never sent a heartbeat.

func (*AgentRepository) FindAvailableWithTool ¶

func (r *AgentRepository) FindAvailableWithTool(ctx context.Context, tenantID shared.ID, tool string) (*agent.Agent, error)

FindAvailableWithTool finds the best available agent for a tool. Returns the least-loaded agent that has the required tool.

func (*AgentRepository) FindByCapabilities ¶

func (r *AgentRepository) FindByCapabilities(ctx context.Context, tenantID shared.ID, capabilities []string, tool string) ([]*agent.Agent, error)

FindByCapabilities finds agents with the given capabilities.

func (*AgentRepository) GetAgentsOfflineSince ¶

func (r *AgentRepository) GetAgentsOfflineSince(ctx context.Context, since time.Time) ([]*agent.Agent, error)

GetAgentsOfflineSince returns agents that went offline after the given timestamp. Used for historical queries like "which agents went offline in the last hour?"

func (*AgentRepository) GetAvailableCapabilitiesForTenant ¶

func (r *AgentRepository) GetAvailableCapabilitiesForTenant(ctx context.Context, tenantID shared.ID) ([]string, error)

GetAvailableCapabilitiesForTenant returns all unique capability names from all agents accessible to the tenant. Only agents with health='online' are considered.

func (*AgentRepository) GetAvailableToolsForTenant ¶

func (r *AgentRepository) GetAvailableToolsForTenant(ctx context.Context, tenantID shared.ID) ([]string, error)

GetAvailableToolsForTenant returns all unique tool names that have at least one ONLINE agent. Only agents with health='online' are considered - meaning daemon is running and recently sent heartbeat.

func (*AgentRepository) GetByAPIKeyHash ¶

func (r *AgentRepository) GetByAPIKeyHash(ctx context.Context, hash string) (*agent.Agent, error)

GetByAPIKeyHash retrieves an agent by API key hash.

func (*AgentRepository) GetByID ¶

func (r *AgentRepository) GetByID(ctx context.Context, id shared.ID) (*agent.Agent, error)

GetByID retrieves an agent by its ID.

func (*AgentRepository) GetByTenantAndID ¶

func (r *AgentRepository) GetByTenantAndID(ctx context.Context, tenantID, id shared.ID) (*agent.Agent, error)

GetByTenantAndID retrieves an agent by tenant and ID.

func (*AgentRepository) GetPlatformAgentStats ¶ added in v0.1.2

func (r *AgentRepository) GetPlatformAgentStats(ctx context.Context, tenantID shared.ID) (*agent.PlatformAgentStatsResult, error)

GetPlatformAgentStats returns aggregate statistics for platform agents. NOTE: Cross-tenant access is intentional — platform agents are shared infrastructure managed by OpenCTEM, not scoped to individual tenants. The queued jobs count is tenant-scoped via the tenantID parameter.

func (*AgentRepository) GetTenantAgentStats ¶ added in v0.1.5

func (r *AgentRepository) GetTenantAgentStats(ctx context.Context, tenantID shared.ID) (*agent.TenantAgentStats, error)

GetTenantAgentStats returns aggregate statistics for a tenant's agents. Computes status / health / type / execution_mode breakdowns plus active job count in a SINGLE query using UNION ALL of grouped subqueries — replaces client-side .filter().length over a paginated list.

func (*AgentRepository) HasAgentForCapability ¶

func (r *AgentRepository) HasAgentForCapability(ctx context.Context, tenantID shared.ID, capability string) (bool, error)

HasAgentForCapability checks if there's at least one ONLINE agent that supports the given capability.

func (*AgentRepository) HasAgentForTool ¶

func (r *AgentRepository) HasAgentForTool(ctx context.Context, tenantID shared.ID, tool string) (bool, error)

HasAgentForTool checks if there's at least one ONLINE agent that supports the given tool. Only agents with health='online' are considered - meaning daemon is running and recently sent heartbeat.

func (*AgentRepository) IncrementStats ¶

func (r *AgentRepository) IncrementStats(ctx context.Context, id shared.ID, findings, scans, errors int64) error

IncrementStats increments agent statistics.

func (*AgentRepository) List ¶

func (r *AgentRepository) List(ctx context.Context, filter agent.Filter, page pagination.Pagination) (pagination.Result[*agent.Agent], error)

List lists agents with filters and pagination.

func (*AgentRepository) MarkStaleAgentsOffline ¶

func (r *AgentRepository) MarkStaleAgentsOffline(ctx context.Context, timeout time.Duration) ([]shared.ID, error)

MarkStaleAgentsOffline finds agents that haven't sent heartbeat within timeout and marks them offline. Returns the list of agent IDs that were marked offline (for audit logging). This is used by the health monitor worker.

func (*AgentRepository) MarkStaleAsOffline ¶

func (r *AgentRepository) MarkStaleAsOffline(ctx context.Context, timeout time.Duration) (int64, error)

MarkStaleAsOffline marks agents as offline (health) if they haven't sent heartbeat within the timeout. Note: This updates Health (automatic), not Status (admin-controlled). Agents can still authenticate if their Status is 'active', regardless of Health. Returns the number of agents marked as offline.

func (*AgentRepository) ReleaseJob ¶

func (r *AgentRepository) ReleaseJob(ctx context.Context, id shared.ID) error

ReleaseJob atomically decrements the current_jobs counter for an agent.

func (*AgentRepository) Update ¶

func (r *AgentRepository) Update(ctx context.Context, a *agent.Agent) error

Update updates an agent.

func (*AgentRepository) UpdateLastSeen ¶

func (r *AgentRepository) UpdateLastSeen(ctx context.Context, id shared.ID) error

UpdateLastSeen updates the last seen timestamp and sets health to online. Note: This updates Health (automatic), not Status (admin-controlled).

func (*AgentRepository) UpdateOfflineTimestamp ¶

func (r *AgentRepository) UpdateOfflineTimestamp(ctx context.Context, id shared.ID) error

UpdateOfflineTimestamp marks an agent as offline with the current timestamp. Called when a health monitor detects heartbeat timeout (agent hasn't sent heartbeat within threshold). Preserves last_seen_at as the time of the last successful heartbeat.

func (*AssetGroupRepository) AddAssets ¶

func (r *AssetGroupRepository) AddAssets(ctx context.Context, groupID shared.ID, assetIDs []shared.ID) error

AddAssets adds assets to a group using multi-row INSERT for performance.

func (*AssetGroupRepository) Count ¶

func (r *AssetGroupRepository) Count(ctx context.Context, filter assetgroup.Filter) (int64, error)

Count counts asset groups.

func (*AssetGroupRepository) CountAssetsByType ¶

func (r *AssetGroupRepository) CountAssetsByType(ctx context.Context, groupID shared.ID) (map[string]int64, error)

CountAssetsByType returns count of assets per type in a group.

func (*AssetGroupRepository) Create ¶

func (r *AssetGroupRepository) Create(ctx context.Context, g *assetgroup.AssetGroup) error

Create creates a new asset group.

func (*AssetGroupRepository) Delete ¶

func (r *AssetGroupRepository) Delete(ctx context.Context, id shared.ID) error

Delete deletes an asset group.

func (*AssetGroupRepository) ExistsByName ¶

func (r *AssetGroupRepository) ExistsByName(ctx context.Context, tenantID shared.ID, name string) (bool, error)

ExistsByName checks if a group with the name exists.

func (*AssetGroupRepository) GetByID ¶

func (r *AssetGroupRepository) GetByID(ctx context.Context, id shared.ID) (*assetgroup.AssetGroup, error)

GetByID retrieves an asset group by ID.

func (*AssetGroupRepository) GetByTenantAndID ¶ added in v0.1.3

func (r *AssetGroupRepository) GetByTenantAndID(ctx context.Context, tenantID, id shared.ID) (*assetgroup.AssetGroup, error)

GetByTenantAndID retrieves an asset group by tenant and ID (tenant-scoped).

func (*AssetGroupRepository) GetDistinctAssetTypes ¶

func (r *AssetGroupRepository) GetDistinctAssetTypes(ctx context.Context, groupID shared.ID) ([]string, error)

GetDistinctAssetTypes returns all unique asset types in a group.

func (*AssetGroupRepository) GetDistinctAssetTypesMultiple ¶

func (r *AssetGroupRepository) GetDistinctAssetTypesMultiple(ctx context.Context, groupIDs []shared.ID) ([]string, error)

GetDistinctAssetTypesMultiple returns all unique asset types across multiple groups.

func (*AssetGroupRepository) GetGroupAssets ¶

func (r *AssetGroupRepository) GetGroupAssets(ctx context.Context, groupID shared.ID, page pagination.Pagination) (pagination.Result[*assetgroup.GroupAsset], error)

GetGroupAssets returns assets belonging to a group.

func (*AssetGroupRepository) GetGroupFindings ¶

func (r *AssetGroupRepository) GetGroupFindings(ctx context.Context, groupID shared.ID, page pagination.Pagination) (pagination.Result[*assetgroup.GroupFinding], error)

GetGroupFindings returns findings for assets belonging to a group.

func (*AssetGroupRepository) GetGroupIDsByAssetID ¶

func (r *AssetGroupRepository) GetGroupIDsByAssetID(ctx context.Context, assetID shared.ID) ([]shared.ID, error)

GetGroupIDsByAssetID returns IDs of groups containing a specific asset.

func (*AssetGroupRepository) GetStats ¶

func (r *AssetGroupRepository) GetStats(ctx context.Context, tenantID shared.ID) (*assetgroup.Stats, error)

GetStats returns aggregated statistics.

func (*AssetGroupRepository) List ¶

func (r *AssetGroupRepository) List(
	ctx context.Context,
	filter assetgroup.Filter,
	opts assetgroup.ListOptions,
	page pagination.Pagination,
) (pagination.Result[*assetgroup.AssetGroup], error)

List lists asset groups with filtering and pagination.

func (*AssetGroupRepository) RecalculateCounts ¶

func (r *AssetGroupRepository) RecalculateCounts(ctx context.Context, groupID shared.ID) error

RecalculateCounts recalculates asset counts for a group. Note: finding_count is computed in real-time during SELECT queries.

func (*AssetGroupRepository) RemoveAssets ¶

func (r *AssetGroupRepository) RemoveAssets(ctx context.Context, groupID shared.ID, assetIDs []shared.ID) error

RemoveAssets removes assets from a group.

func (*AssetGroupRepository) Update ¶

func (r *AssetGroupRepository) Update(ctx context.Context, g *assetgroup.AssetGroup) error

Update updates an asset group.

func (*AssetRelationshipRepository) CountByAsset ¶

func (r *AssetRelationshipRepository) CountByAsset(ctx context.Context, tenantID, assetID shared.ID) (int64, error)

CountByAsset returns the count of relationships for an asset.

func (*AssetRelationshipRepository) CountByType ¶ added in v0.1.5

func (r *AssetRelationshipRepository) CountByType(ctx context.Context, tenantID shared.ID) (map[asset.RelationshipType]int64, error)

CountByType returns relationship counts grouped by type for a tenant. Used by the usage-stats endpoint so admins can see which relationship types are actually being used and prune the registry based on real data instead of guessing.

func (*AssetRelationshipRepository) Create ¶

func (r *AssetRelationshipRepository) Create(ctx context.Context, rel *asset.Relationship) error

Create persists a new relationship.

func (*AssetRelationshipRepository) CreateBatchIgnoreConflicts ¶ added in v0.1.2

func (r *AssetRelationshipRepository) CreateBatchIgnoreConflicts(ctx context.Context, rels []*asset.Relationship) (int, error)

CreateBatchIgnoreConflicts inserts multiple relationships, silently skipping duplicates.

func (*AssetRelationshipRepository) Delete ¶

func (r *AssetRelationshipRepository) Delete(ctx context.Context, tenantID, id shared.ID) error

Delete removes a relationship by ID within a tenant.

func (*AssetRelationshipRepository) Exists ¶

func (r *AssetRelationshipRepository) Exists(
	ctx context.Context,
	tenantID, sourceID, targetID shared.ID,
	relType asset.RelationshipType,
) (bool, error)

Exists checks if a specific relationship already exists.

func (*AssetRelationshipRepository) GetByID ¶

func (r *AssetRelationshipRepository) GetByID(ctx context.Context, tenantID, id shared.ID) (*asset.RelationshipWithAssets, error)

GetByID retrieves a relationship by ID within a tenant.

func (*AssetRelationshipRepository) ListByAsset ¶

func (r *AssetRelationshipRepository) ListByAsset(
	ctx context.Context,
	tenantID, assetID shared.ID,
	filter asset.RelationshipFilter,
) ([]*asset.RelationshipWithAssets, int64, error)

ListByAsset retrieves all relationships for an asset (both directions). Uses UNION ALL of two indexed queries for performance instead of OR.

func (*AssetRelationshipRepository) Update ¶

func (r *AssetRelationshipRepository) Update(ctx context.Context, rel *asset.Relationship) error

Update updates an existing relationship.

func (*AssetRepository) BatchUpdateRiskScores ¶ added in v0.1.2

func (r *AssetRepository) BatchUpdateRiskScores(ctx context.Context, tenantID shared.ID, assets []*asset.Asset) error

BatchUpdateRiskScores updates risk_score for multiple assets in a single query.

func (*AssetRepository) BulkUpdateStatus ¶ added in v0.1.3

func (r *AssetRepository) BulkUpdateStatus(ctx context.Context, tenantID shared.ID, assetIDs []shared.ID, status asset.Status) (int64, error)

BulkUpdateStatus atomically updates the status of multiple assets in a single SQL statement.

func (*AssetRepository) Count ¶

func (r *AssetRepository) Count(ctx context.Context, filter asset.Filter) (int64, error)

Count returns the total number of assets matching the filter.

func (*AssetRepository) Create ¶

func (r *AssetRepository) Create(ctx context.Context, a *asset.Asset) error

Create persists a new asset.

func (*AssetRepository) Delete ¶

func (r *AssetRepository) Delete(ctx context.Context, tenantID, assetID shared.ID) error

Delete removes an asset by its ID within a tenant. Security: Requires tenantID to prevent cross-tenant deletion.

func (*AssetRepository) ExistsByName ¶

func (r *AssetRepository) ExistsByName(ctx context.Context, tenantID shared.ID, name string) (bool, error)

ExistsByName checks if an asset with the given name exists within a tenant. Security: Requires tenantID to prevent cross-tenant enumeration.

func (*AssetRepository) FindRepositoryByFullName ¶

func (r *AssetRepository) FindRepositoryByFullName(ctx context.Context, tenantID shared.ID, fullName string) (*asset.Asset, error)

FindRepositoryByFullName finds a repository asset that matches the given full name (org/repo format). It searches for assets whose name or external_id ends with the full org/repo pattern. This is more precise than FindRepositoryByRepoName as it considers the organization.

func (*AssetRepository) FindRepositoryByRepoName ¶

func (r *AssetRepository) FindRepositoryByRepoName(ctx context.Context, tenantID shared.ID, repoName string) (*asset.Asset, error)

FindRepositoryByRepoName finds a repository asset whose name ends with the given repo name. This handles matching agent-created assets like "github.com-org/suborg/repo" with repo name "repo". NOTE: This only matches by repo name, use FindRepositoryByFullName for more precise matching.

func (*AssetRepository) GetAggregateStats ¶ added in v0.1.3

func (r *AssetRepository) GetAggregateStats(ctx context.Context, tenantID shared.ID, types []string, tags []string) (*asset.AggregateStats, error)

GetAggregateStats computes all asset statistics in a SINGLE round-trip. Filters: types (asset_type ANY), tags (tags && — overlap, matches List semantics).

The previous implementation issued 6 queries (1 totals + 5 GROUP BY breakdowns). This version collapses everything into one query using a CTE + UNION ALL, trading slightly more complex SQL for an 83% reduction in DB round-trips. PostgreSQL plans a single scan of the filtered CTE for all aggregates.

func (*AssetRepository) GetAssetTypeBreakdown ¶ added in v0.1.2

func (r *AssetRepository) GetAssetTypeBreakdown(ctx context.Context, tenantID shared.ID) (map[string]asset.AssetTypeStats, error)

GetAssetTypeBreakdown returns total and exposed counts per asset_type in a single query.

func (*AssetRepository) GetAverageRiskScore ¶ added in v0.1.2

func (r *AssetRepository) GetAverageRiskScore(ctx context.Context, tenantID shared.ID) (float64, error)

GetAverageRiskScore returns the average risk_score for all assets in a tenant.

func (*AssetRepository) GetByExternalID ¶

func (r *AssetRepository) GetByExternalID(ctx context.Context, tenantID shared.ID, provider asset.Provider, externalID string) (*asset.Asset, error)

GetByExternalID retrieves an asset by external ID and provider.

func (*AssetRepository) GetByID ¶

func (r *AssetRepository) GetByID(ctx context.Context, tenantID, assetID shared.ID) (*asset.Asset, error)

GetByID retrieves an asset by its ID within a tenant. Security: Requires tenantID to prevent cross-tenant data access.

func (*AssetRepository) GetByName ¶

func (r *AssetRepository) GetByName(ctx context.Context, tenantID shared.ID, name string) (*asset.Asset, error)

GetByName retrieves an asset by name within a tenant.

func (*AssetRepository) GetByNames ¶

func (r *AssetRepository) GetByNames(ctx context.Context, tenantID shared.ID, names []string) (map[string]*asset.Asset, error)

GetByNames retrieves multiple assets by their names within a tenant. Returns a map of name -> Asset for found assets.

func (*AssetRepository) List ¶

func (r *AssetRepository) List(
	ctx context.Context,
	filter asset.Filter,
	opts asset.ListOptions,
	page pagination.Pagination,
) (pagination.Result[*asset.Asset], error)

List retrieves assets with filtering, sorting, and pagination.

func (*AssetRepository) ListDistinctTags ¶ added in v0.1.2

func (r *AssetRepository) ListDistinctTags(ctx context.Context, tenantID shared.ID, prefix string, limit int) ([]string, error)

ListDistinctTags returns distinct tags across all assets for a tenant. Supports prefix filtering for autocomplete and a limit for result size.

func (*AssetRepository) Update ¶

func (r *AssetRepository) Update(ctx context.Context, a *asset.Asset) error

Update updates an existing asset.

func (*AssetRepository) UpdateFindingCounts ¶

func (r *AssetRepository) UpdateFindingCounts(ctx context.Context, tenantID shared.ID, assetIDs []shared.ID) error

UpdateFindingCounts updates finding counts for multiple assets in batch. This recalculates the finding_count from the findings table.

func (*AssetRepository) UpsertBatch ¶

func (r *AssetRepository) UpsertBatch(ctx context.Context, assets []*asset.Asset) (created int, updated int, err error)

UpsertBatch creates or updates multiple assets in a single operation. Uses PostgreSQL ON CONFLICT for atomic upsert behavior. Conflict is detected on (tenant_id, name) unique constraint.

func (*AssetServiceRepository) CountByAsset ¶

func (r *AssetServiceRepository) CountByAsset(ctx context.Context, tenantID, assetID shared.ID) (int, error)

CountByAsset returns the number of services for an asset.

func (*AssetServiceRepository) CountByTenant ¶

func (r *AssetServiceRepository) CountByTenant(ctx context.Context, tenantID shared.ID) (int64, error)

CountByTenant returns the total number of services for a tenant.

func (*AssetServiceRepository) CountPublic ¶

func (r *AssetServiceRepository) CountPublic(ctx context.Context, tenantID shared.ID) (int64, error)

CountPublic returns the number of public services for a tenant.

func (*AssetServiceRepository) Create ¶

func (r *AssetServiceRepository) Create(ctx context.Context, service *asset.AssetService) error

Create persists a new asset service.

func (*AssetServiceRepository) Delete ¶

func (r *AssetServiceRepository) Delete(ctx context.Context, tenantID, id shared.ID) error

Delete removes an asset service by its ID.

func (*AssetServiceRepository) DeleteByAssetID ¶

func (r *AssetServiceRepository) DeleteByAssetID(ctx context.Context, tenantID, assetID shared.ID) error

DeleteByAssetID removes all services for an asset.

func (*AssetServiceRepository) GetByAssetAndPort ¶

func (r *AssetServiceRepository) GetByAssetAndPort(ctx context.Context, tenantID, assetID shared.ID, port int, protocol asset.Protocol) (*asset.AssetService, error)

GetByAssetAndPort retrieves a service by asset ID and port.

func (*AssetServiceRepository) GetByAssetID ¶

func (r *AssetServiceRepository) GetByAssetID(ctx context.Context, tenantID, assetID shared.ID) ([]*asset.AssetService, error)

GetByAssetID retrieves all services for an asset.

func (*AssetServiceRepository) GetByID ¶

func (r *AssetServiceRepository) GetByID(ctx context.Context, tenantID, id shared.ID) (*asset.AssetService, error)

GetByID retrieves an asset service by its ID.

func (*AssetServiceRepository) GetPortCounts ¶

func (r *AssetServiceRepository) GetPortCounts(ctx context.Context, tenantID shared.ID, topN int) (map[int]int, error)

GetPortCounts returns count of services grouped by port (top N).

func (*AssetServiceRepository) GetServiceTypeCounts ¶

func (r *AssetServiceRepository) GetServiceTypeCounts(ctx context.Context, tenantID shared.ID) (map[asset.ServiceType]int, error)

GetServiceTypeCounts returns count of services grouped by service type.

func (*AssetServiceRepository) List ¶

func (r *AssetServiceRepository) List(ctx context.Context, tenantID shared.ID, opts asset.ListAssetServicesOptions) ([]*asset.AssetService, int, error)

List retrieves services with filtering and pagination.

func (*AssetServiceRepository) ListByServiceType ¶

func (r *AssetServiceRepository) ListByServiceType(ctx context.Context, tenantID shared.ID, serviceType asset.ServiceType, limit, offset int) ([]*asset.AssetService, int, error)

ListByServiceType retrieves services of a specific type.

func (*AssetServiceRepository) ListHighRisk ¶

func (r *AssetServiceRepository) ListHighRisk(ctx context.Context, tenantID shared.ID, minRiskScore int, limit, offset int) ([]*asset.AssetService, int, error)

ListHighRisk retrieves services with risk score above threshold.

func (*AssetServiceRepository) ListPublic ¶

func (r *AssetServiceRepository) ListPublic(ctx context.Context, tenantID shared.ID, limit, offset int) ([]*asset.AssetService, int, error)

ListPublic retrieves all public (internet-exposed) services for a tenant.

func (*AssetServiceRepository) SearchByCPE ¶

func (r *AssetServiceRepository) SearchByCPE(ctx context.Context, tenantID shared.ID, cpe string, limit int) ([]*asset.AssetService, error)

SearchByCPE searches services by CPE (partial match).

func (*AssetServiceRepository) SearchByProduct ¶

func (r *AssetServiceRepository) SearchByProduct(ctx context.Context, tenantID shared.ID, product string, limit int) ([]*asset.AssetService, error)

SearchByProduct searches services by product name (partial match).

func (*AssetServiceRepository) SearchByVersion ¶

func (r *AssetServiceRepository) SearchByVersion(ctx context.Context, tenantID shared.ID, version string, limit int) ([]*asset.AssetService, error)

SearchByVersion searches services by version (partial match).

func (*AssetServiceRepository) Update ¶

func (r *AssetServiceRepository) Update(ctx context.Context, service *asset.AssetService) error

Update updates an existing asset service.

func (*AssetServiceRepository) UpdateFindingCounts ¶

func (r *AssetServiceRepository) UpdateFindingCounts(ctx context.Context, counts map[shared.ID]int) error

UpdateFindingCounts updates finding counts for multiple services.

func (*AssetServiceRepository) UpsertBatch ¶

func (r *AssetServiceRepository) UpsertBatch(ctx context.Context, services []*asset.AssetService) (created int, updated int, err error)

UpsertBatch creates or updates multiple services in a single operation.

func (*AssetSourceRepository) CountBySource ¶

func (r *AssetSourceRepository) CountBySource(ctx context.Context, sourceID shared.ID) (int64, error)

CountBySource returns the number of assets for a data source.

func (*AssetSourceRepository) Create ¶

func (r *AssetSourceRepository) Create(ctx context.Context, as *datasource.AssetSource) error

Create creates a new asset source record.

func (*AssetSourceRepository) Delete ¶

func (r *AssetSourceRepository) Delete(ctx context.Context, id shared.ID) error

Delete deletes an asset source by ID.

func (*AssetSourceRepository) DeleteByAsset ¶

func (r *AssetSourceRepository) DeleteByAsset(ctx context.Context, assetID shared.ID) error

DeleteByAsset deletes all asset sources for an asset.

func (*AssetSourceRepository) DeleteBySource ¶

func (r *AssetSourceRepository) DeleteBySource(ctx context.Context, sourceID shared.ID) error

DeleteBySource deletes all asset sources for a data source.

func (*AssetSourceRepository) GetByAsset ¶

func (r *AssetSourceRepository) GetByAsset(ctx context.Context, assetID shared.ID) ([]*datasource.AssetSource, error)

GetByAsset retrieves all sources for an asset.

func (*AssetSourceRepository) GetByAssetAndSource ¶

func (r *AssetSourceRepository) GetByAssetAndSource(ctx context.Context, assetID shared.ID, sourceType datasource.SourceType, sourceID *shared.ID) (*datasource.AssetSource, error)

GetByAssetAndSource retrieves an asset source by asset ID, source type, and source ID.

func (*AssetSourceRepository) GetByID ¶

func (r *AssetSourceRepository) GetByID(ctx context.Context, id shared.ID) (*datasource.AssetSource, error)

GetByID retrieves an asset source by ID.

func (*AssetSourceRepository) GetPrimaryByAsset ¶

func (r *AssetSourceRepository) GetPrimaryByAsset(ctx context.Context, assetID shared.ID) (*datasource.AssetSource, error)

GetPrimaryByAsset retrieves the primary source for an asset.

func (*AssetSourceRepository) List ¶

func (r *AssetSourceRepository) List(ctx context.Context, filter datasource.AssetSourceFilter, opts datasource.AssetSourceListOptions) (datasource.AssetSourceListResult, error)

List lists asset sources with filtering and pagination. nolint:dupl // Similar pattern to FindingDataSourceRepository.List - intentional for type safety

func (*AssetSourceRepository) SetPrimary ¶

func (r *AssetSourceRepository) SetPrimary(ctx context.Context, assetSourceID shared.ID) error

SetPrimary sets a source as the primary source for an asset.

func (*AssetSourceRepository) Update ¶

func (r *AssetSourceRepository) Update(ctx context.Context, as *datasource.AssetSource) error

Update updates an existing asset source.

func (*AssetSourceRepository) Upsert ¶

func (r *AssetSourceRepository) Upsert(ctx context.Context, as *datasource.AssetSource) error

Upsert creates or updates an asset source.

func (*AssetStateHistoryRepository) CountBySource ¶

func (r *AssetStateHistoryRepository) CountBySource(ctx context.Context, tenantID shared.ID, since time.Time) (map[asset.ChangeSource]int, error)

CountBySource returns count of changes grouped by source.

func (*AssetStateHistoryRepository) CountByType ¶

func (r *AssetStateHistoryRepository) CountByType(ctx context.Context, tenantID shared.ID, since time.Time) (map[asset.StateChangeType]int, error)

CountByType returns count of changes grouped by change type.

func (*AssetStateHistoryRepository) Create ¶

func (r *AssetStateHistoryRepository) Create(ctx context.Context, change *asset.AssetStateChange) error

Create appends a new state change record.

func (*AssetStateHistoryRepository) CreateBatch ¶

func (r *AssetStateHistoryRepository) CreateBatch(ctx context.Context, changes []*asset.AssetStateChange) error

CreateBatch appends multiple state change records in a single operation.

func (*AssetStateHistoryRepository) GetActivityTimeline ¶

func (r *AssetStateHistoryRepository) GetActivityTimeline(ctx context.Context, tenantID shared.ID, from, to time.Time) ([]asset.DailyActivityCount, error)

GetActivityTimeline returns daily counts of changes over a time period.

func (*AssetStateHistoryRepository) GetByAssetID ¶

func (r *AssetStateHistoryRepository) GetByAssetID(ctx context.Context, tenantID, assetID shared.ID, opts asset.ListStateHistoryOptions) ([]*asset.AssetStateChange, int, error)

GetByAssetID retrieves all state changes for an asset.

func (*AssetStateHistoryRepository) GetByID ¶

func (r *AssetStateHistoryRepository) GetByID(ctx context.Context, tenantID, id shared.ID) (*asset.AssetStateChange, error)

GetByID retrieves a state change by its ID.

func (*AssetStateHistoryRepository) GetChangesByUser ¶

func (r *AssetStateHistoryRepository) GetChangesByUser(ctx context.Context, tenantID, userID shared.ID, opts asset.ListStateHistoryOptions) ([]*asset.AssetStateChange, int, error)

GetChangesByUser retrieves all changes made by a specific user.

func (*AssetStateHistoryRepository) GetComplianceChanges ¶

func (r *AssetStateHistoryRepository) GetComplianceChanges(ctx context.Context, tenantID shared.ID, since time.Time, limit int) ([]*asset.AssetStateChange, error)

GetComplianceChanges retrieves compliance-related changes within a time window.

func (*AssetStateHistoryRepository) GetExposureChanges ¶

func (r *AssetStateHistoryRepository) GetExposureChanges(ctx context.Context, tenantID shared.ID, since time.Time, limit int) ([]*asset.AssetStateChange, error)

GetExposureChanges retrieves all exposure-related changes within a time window.

func (*AssetStateHistoryRepository) GetLatestByAsset ¶

func (r *AssetStateHistoryRepository) GetLatestByAsset(ctx context.Context, tenantID shared.ID, changeTypes []asset.StateChangeType) (map[shared.ID]*asset.AssetStateChange, error)

GetLatestByAsset retrieves the most recent state change for each asset.

func (*AssetStateHistoryRepository) GetNewlyExposedAssets ¶

func (r *AssetStateHistoryRepository) GetNewlyExposedAssets(ctx context.Context, tenantID shared.ID, since time.Time, limit int) ([]*asset.AssetStateChange, error)

GetNewlyExposedAssets retrieves assets that became internet-accessible.

func (*AssetStateHistoryRepository) GetRecentAppearances ¶

func (r *AssetStateHistoryRepository) GetRecentAppearances(ctx context.Context, tenantID shared.ID, since time.Time, limit int) ([]*asset.AssetStateChange, error)

GetRecentAppearances retrieves assets that appeared within the time window.

func (*AssetStateHistoryRepository) GetRecentDisappearances ¶

func (r *AssetStateHistoryRepository) GetRecentDisappearances(ctx context.Context, tenantID shared.ID, since time.Time, limit int) ([]*asset.AssetStateChange, error)

GetRecentDisappearances retrieves assets that disappeared within the time window.

func (*AssetStateHistoryRepository) GetShadowITCandidates ¶

func (r *AssetStateHistoryRepository) GetShadowITCandidates(ctx context.Context, tenantID shared.ID, since time.Time, limit int) ([]*asset.AssetStateChange, error)

GetShadowITCandidates retrieves assets that appeared but have unknown/shadow scope.

func (*AssetStateHistoryRepository) List ¶

func (r *AssetStateHistoryRepository) List(ctx context.Context, tenantID shared.ID, opts asset.ListStateHistoryOptions) ([]*asset.AssetStateChange, int, error)

List retrieves state changes with filtering and pagination.

func (*AssetTypeCategoryRepository) Create ¶

func (r *AssetTypeCategoryRepository) Create(ctx context.Context, c *assettype.Category) error

Create creates a new category.

func (*AssetTypeCategoryRepository) Delete ¶

func (r *AssetTypeCategoryRepository) Delete(ctx context.Context, id shared.ID) error

Delete deletes a category.

func (*AssetTypeCategoryRepository) GetByCode ¶

func (r *AssetTypeCategoryRepository) GetByCode(ctx context.Context, code string) (*assettype.Category, error)

GetByCode retrieves a category by code.

func (*AssetTypeCategoryRepository) GetByID ¶

func (r *AssetTypeCategoryRepository) GetByID(ctx context.Context, id shared.ID) (*assettype.Category, error)

GetByID retrieves a category by ID.

func (*AssetTypeCategoryRepository) List ¶

func (r *AssetTypeCategoryRepository) List(
	ctx context.Context,
	filter assettype.CategoryFilter,
	page pagination.Pagination,
) (pagination.Result[*assettype.Category], error)

List lists categories with pagination.

func (*AssetTypeCategoryRepository) ListActive ¶

func (r *AssetTypeCategoryRepository) ListActive(ctx context.Context) ([]*assettype.Category, error)

ListActive lists all active categories.

func (*AssetTypeCategoryRepository) Update ¶

func (r *AssetTypeCategoryRepository) Update(ctx context.Context, c *assettype.Category) error

Update updates an existing category.

func (*AssetTypeRepository) ExistsByCode ¶

func (r *AssetTypeRepository) ExistsByCode(ctx context.Context, code string) (bool, error)

ExistsByCode checks if an asset type with the given code exists.

func (*AssetTypeRepository) GetByCode ¶

func (r *AssetTypeRepository) GetByCode(ctx context.Context, code string) (*assettype.AssetType, error)

GetByCode retrieves an asset type by its code.

func (*AssetTypeRepository) GetByID ¶

func (r *AssetTypeRepository) GetByID(ctx context.Context, id shared.ID) (*assettype.AssetType, error)

GetByID retrieves an asset type by ID.

func (*AssetTypeRepository) List ¶

func (r *AssetTypeRepository) List(
	ctx context.Context,
	filter assettype.Filter,
	opts assettype.ListOptions,
	page pagination.Pagination,
) (pagination.Result[*assettype.AssetType], error)

List lists asset types with filtering and pagination.

func (*AssetTypeRepository) ListActive ¶

func (r *AssetTypeRepository) ListActive(ctx context.Context) ([]*assettype.AssetType, error)

ListActive lists all active asset types.

func (*AssetTypeRepository) ListActiveByCategory ¶

func (r *AssetTypeRepository) ListActiveByCategory(ctx context.Context, categoryID shared.ID) ([]*assettype.AssetType, error)

ListActiveByCategory lists active asset types by category.

func (*AssetTypeRepository) ListWithCategory ¶

func (r *AssetTypeRepository) ListWithCategory(
	ctx context.Context,
	filter assettype.Filter,
	opts assettype.ListOptions,
	page pagination.Pagination,
) (pagination.Result[*assettype.AssetTypeWithCategory], error)

ListWithCategory lists asset types with their categories.

func (*AuditLogRepository) Count ¶

func (r *AuditLogRepository) Count(ctx context.Context, filter admin.AuditLogFilter) (int64, error)

Count counts audit logs with optional filter.

func (*AuditLogRepository) CountOlderThan ¶

func (r *AuditLogRepository) CountOlderThan(ctx context.Context, olderThan time.Time) (int64, error)

CountOlderThan counts audit logs older than the specified time.

func (*AuditLogRepository) Create ¶

func (r *AuditLogRepository) Create(ctx context.Context, log *admin.AuditLog) error

Create creates a new audit log entry.

func (*AuditLogRepository) DeleteOlderThan ¶

func (r *AuditLogRepository) DeleteOlderThan(ctx context.Context, olderThan time.Time) (int64, error)

DeleteOlderThan deletes audit logs older than the specified time.

func (*AuditLogRepository) GetByID ¶

func (r *AuditLogRepository) GetByID(ctx context.Context, id shared.ID) (*admin.AuditLog, error)

GetByID retrieves an audit log by ID.

func (*AuditLogRepository) GetFailedActions ¶

func (r *AuditLogRepository) GetFailedActions(ctx context.Context, since time.Duration, limit int) ([]*admin.AuditLog, error)

GetFailedActions returns recent failed actions (for monitoring).

func (*AuditLogRepository) GetRecentActions ¶

func (r *AuditLogRepository) GetRecentActions(ctx context.Context, limit int) ([]*admin.AuditLog, error)

GetRecentActions returns the most recent actions (for dashboard).

func (*AuditLogRepository) List ¶

func (r *AuditLogRepository) List(ctx context.Context, filter admin.AuditLogFilter, page pagination.Pagination) (pagination.Result[*admin.AuditLog], error)

List lists audit logs with filters and pagination.

func (*AuditLogRepository) ListByAdmin ¶

func (r *AuditLogRepository) ListByAdmin(ctx context.Context, adminID shared.ID, page pagination.Pagination) (pagination.Result[*admin.AuditLog], error)

ListByAdmin lists audit logs for a specific admin.

func (*AuditLogRepository) ListByResource ¶

func (r *AuditLogRepository) ListByResource(ctx context.Context, resourceType string, resourceID shared.ID, page pagination.Pagination) (pagination.Result[*admin.AuditLog], error)

ListByResource lists audit logs for a specific resource.

func (*AuditRepository) Count ¶

func (r *AuditRepository) Count(ctx context.Context, filter audit.Filter) (int64, error)

Count returns the count of audit logs matching the filter.

func (*AuditRepository) CountByAction ¶

func (r *AuditRepository) CountByAction(ctx context.Context, tenantID *shared.ID, action audit.Action, since time.Time) (int64, error)

CountByAction counts occurrences of an action within a time range.

func (*AuditRepository) Create ¶

func (r *AuditRepository) Create(ctx context.Context, log *audit.AuditLog) error

Create persists a new audit log entry.

func (*AuditRepository) CreateBatch ¶

func (r *AuditRepository) CreateBatch(ctx context.Context, logs []*audit.AuditLog) error

CreateBatch persists multiple audit log entries.

func (*AuditRepository) DeleteOlderThan ¶

func (r *AuditRepository) DeleteOlderThan(ctx context.Context, before time.Time) (int64, error)

DeleteOlderThan deletes audit logs older than the specified time.

func (*AuditRepository) GetByID ¶

func (r *AuditRepository) GetByID(ctx context.Context, id shared.ID) (*audit.AuditLog, error)

GetByID retrieves an audit log by ID.

func (*AuditRepository) GetByTenantAndID ¶ added in v0.1.3

func (r *AuditRepository) GetByTenantAndID(ctx context.Context, tenantID, id shared.ID) (*audit.AuditLog, error)

GetByTenantAndID retrieves an audit log by tenant and ID (tenant-scoped).

func (*AuditRepository) GetLatestByResource ¶

func (r *AuditRepository) GetLatestByResource(ctx context.Context, resourceType audit.ResourceType, resourceID string) (*audit.AuditLog, error)

GetLatestByResource retrieves the latest audit log for a resource.

func (*AuditRepository) List ¶

func (r *AuditRepository) List(ctx context.Context, filter audit.Filter, page pagination.Pagination) (pagination.Result[*audit.AuditLog], error)

List retrieves audit logs matching the filter with pagination.

func (*AuditRepository) ListByActor ¶

func (r *AuditRepository) ListByActor(ctx context.Context, actorID shared.ID, page pagination.Pagination) (pagination.Result[*audit.AuditLog], error)

ListByActor retrieves audit logs for a specific actor.

func (*AuditRepository) ListByResource ¶

func (r *AuditRepository) ListByResource(ctx context.Context, resourceType audit.ResourceType, resourceID string, page pagination.Pagination) (pagination.Result[*audit.AuditLog], error)

ListByResource retrieves audit logs for a specific resource.