scanprofile

type Filter struct {
	TenantID  *shared.ID
	IsDefault *bool
	IsSystem  *bool
	Tags      []string
	Search    string
}

type FindingCounts struct {
	Critical int `json:"critical"`
	High     int `json:"high"`
	Medium   int `json:"medium"`
	Low      int `json:"low"`
	Info     int `json:"info"`
	Total    int `json:"total"`
}

type GateBreach struct {
	Metric string `json:"metric"` // "critical", "high", "medium", "total"
	Limit  int    `json:"limit"`
	Actual int    `json:"actual"`
}

type Intensity string

type QualityGate struct {
	Enabled         bool   `json:"enabled"`
	FailOnCritical  bool   `json:"fail_on_critical"`            // Fail immediately if any critical finding
	FailOnHigh      bool   `json:"fail_on_high"`                // Fail immediately if any high finding
	MaxCritical     int    `json:"max_critical"`                // Maximum allowed critical findings (-1 = unlimited)
	MaxHigh         int    `json:"max_high"`                    // Maximum allowed high findings (-1 = unlimited)
	MaxMedium       int    `json:"max_medium"`                  // Maximum allowed medium findings (-1 = unlimited)
	MaxTotal        int    `json:"max_total"`                   // Maximum allowed total findings (-1 = unlimited)
	NewFindingsOnly bool   `json:"new_findings_only,omitempty"` // Only count new findings (not in baseline)
	BaselineBranch  string `json:"baseline_branch,omitempty"`   // Branch to compare against for new findings
}

type QualityGateResult struct {
	Passed   bool          `json:"passed"`
	Reason   string        `json:"reason,omitempty"`
	Breaches []GateBreach  `json:"breaches,omitempty"`
	Counts   FindingCounts `json:"counts"`
}

type Repository interface {
	// Create creates a new scan profile.
	Create(ctx context.Context, profile *ScanProfile) error

	// GetByID retrieves a scan profile by ID.
	GetByID(ctx context.Context, id shared.ID) (*ScanProfile, error)

	// GetByTenantAndID retrieves a scan profile by tenant and ID.
	GetByTenantAndID(ctx context.Context, tenantID, id shared.ID) (*ScanProfile, error)

	// GetAccessibleByID retrieves a scan profile by ID if accessible to the tenant.
	// Accessible profiles are: own tenant profiles OR system profiles (tenant_id IS NULL).
	// Enforces tenant isolation at the SQL layer (defense-in-depth).
	GetAccessibleByID(ctx context.Context, tenantID, id shared.ID) (*ScanProfile, error)

	// GetByTenantAndName retrieves a scan profile by tenant and name.
	GetByTenantAndName(ctx context.Context, tenantID shared.ID, name string) (*ScanProfile, error)

	// GetDefaultByTenant retrieves the default scan profile for a tenant.
	GetDefaultByTenant(ctx context.Context, tenantID shared.ID) (*ScanProfile, error)

	// List lists scan profiles with filters and pagination.
	List(ctx context.Context, filter Filter, page pagination.Pagination) (pagination.Result[*ScanProfile], error)

	// ListWithSystemProfiles lists tenant profiles AND system profiles.
	// Returns both tenant-specific profiles and system profiles (marked with is_system=true).
	ListWithSystemProfiles(ctx context.Context, tenantID shared.ID, filter Filter, page pagination.Pagination) (pagination.Result[*ScanProfile], error)

	// GetByIDWithSystemFallback retrieves a profile by ID, checking both tenant and system profiles.
	// This allows tenants to reference system profiles for use in scans.
	GetByIDWithSystemFallback(ctx context.Context, tenantID, id shared.ID) (*ScanProfile, error)

	// Update updates a scan profile.
	Update(ctx context.Context, profile *ScanProfile) error

	// Delete deletes a scan profile.
	Delete(ctx context.Context, id shared.ID) error

	// ClearDefaultForTenant clears the default flag for all profiles in a tenant.
	ClearDefaultForTenant(ctx context.Context, tenantID shared.ID) error

	// CountByTenant counts the number of profiles for a tenant.
	CountByTenant(ctx context.Context, tenantID shared.ID) (int64, error)
}

type ScanProfile struct {
	ID                 shared.ID
	TenantID           shared.ID
	Name               string
	Description        string
	IsDefault          bool
	IsSystem           bool
	ToolsConfig        map[string]ToolConfig
	Intensity          Intensity
	MaxConcurrentScans int
	TimeoutSeconds     int
	Tags               []string
	Metadata           map[string]any
	QualityGate        QualityGate // Quality gate thresholds for CI/CD pass/fail
	CreatedBy          *shared.ID
	CreatedAt          time.Time
	UpdatedAt          time.Time
}

type Severity string

type TemplateMode string

type ToolConfig struct {
	Enabled           bool           `json:"enabled"`
	Severity          string         `json:"severity,omitempty"`            // Minimum severity to report
	Timeout           int            `json:"timeout,omitempty"`             // Timeout in seconds
	Options           map[string]any `json:"options,omitempty"`             // Tool-specific options
	TemplateMode      TemplateMode   `json:"template_mode,omitempty"`       // "default", "custom", "both"
	CustomTemplateIDs []string       `json:"custom_template_ids,omitempty"` // IDs of custom templates to use
}