tenant

type AIMode string

type AISettings struct {
	// Mode determines how AI is used: disabled, platform, or byok
	Mode AIMode `json:"mode"`

	// BYOK (Bring Your Own Key) Configuration - only used when Mode = "byok"
	Provider      LLMProvider `json:"provider,omitempty"`       // claude, openai, azure_openai
	APIKey        string      `json:"api_key,omitempty"`        // Encrypted API key (set via special endpoint)
	AzureEndpoint string      `json:"azure_endpoint,omitempty"` // For Azure OpenAI
	ModelOverride string      `json:"model_override,omitempty"` // Optional model preference

	// Auto-Triage Configuration
	AutoTriageEnabled      bool     `json:"auto_triage_enabled"`              // Enable auto-triage on new findings
	AutoTriageSeverities   []string `json:"auto_triage_severities,omitempty"` // Severities to auto-triage: critical, high, etc.
	AutoTriageDelaySeconds int      `json:"auto_triage_delay_seconds"`        // Delay before auto-triage (for dedup)

	// Usage Limits
	MonthlyTokenLimit   int `json:"monthly_token_limit,omitempty"` // Optional cost control (0 = unlimited)
	TokensUsedThisMonth int `json:"tokens_used_this_month"`        // Tracked internally
}

type APISettings struct {
	APIKeyEnabled bool           `json:"api_key_enabled"` // Enable API key access
	WebhookURL    string         `json:"webhook_url"`     // Webhook endpoint URL
	WebhookSecret string         `json:"webhook_secret"`  // Webhook signing secret
	WebhookEvents []WebhookEvent `json:"webhook_events"`  // Events to send to webhook
}

type AssetIdentitySettings struct {
	// StaleAssetDays is the number of days after which an asset is considered stale
	// for IP correlation. If an existing asset hasn't been seen in this many days
	// and the incoming asset has a different name, they won't be auto-merged.
	// This prevents false merges due to IP reuse (DHCP).
	// 0 = use system default (30 days).
	StaleAssetDays int `json:"stale_asset_days,omitempty"`

	// MaxIPsPerAsset limits the number of IPs stored per asset.
	// Assets with more IPs than this skip IP correlation (prevents DoS).
	// 0 = use system default (20).
	MaxIPsPerAsset int `json:"max_ips_per_asset,omitempty"`
}

type AssetLifecycleSettings struct {
	// Enabled toggles the feature. Defaults to false so tenants
	// upgrading from older versions see no change. Enabling for the
	// first time requires a successful dry-run (DryRunCompletedAt)
	// or the force flag on the admin API.
	Enabled bool `json:"enabled"`

	// StaleThresholdDays — days without a MarkSeen() update before
	// the worker flips status from active to stale. Default 14.
	StaleThresholdDays int `json:"stale_threshold_days,omitempty"`

	// GracePeriodDays — newly-discovered assets are immune from the
	// lifecycle worker for this many days after `discovered_at`.
	// Protects assets the scanner has not picked up yet. Default 3.
	GracePeriodDays int `json:"grace_period_days,omitempty"`

	// ManualReactivationGraceDays — when an operator manually
	// reactivates an asset that had been flagged stale/inactive, we
	// auto-set lifecycle_paused_until = NOW + this many days. Avoids
	// the E2.6 flap (worker re-demotes the same asset next day).
	// Default 30. Operators can override per-asset via Snooze.
	ManualReactivationGraceDays int `json:"manual_reactivation_grace_days,omitempty"`

	// ExcludedSourceTypes — source_type values that opt an asset
	// out of the lifecycle worker. Default [manual, import]:
	// user-entered data has intent behind it, the worker should
	// never quietly demote a manually-curated asset.
	ExcludedSourceTypes []string `json:"excluded_source_types,omitempty"`

	// PauseOnIntegrationFailure — when true (default), the worker
	// checks the tenant's agents and integrations before each run.
	// If any are unhealthy, the whole tenant is skipped so a
	// temporarily-offline scanner does not generate a false
	// deactivation storm.
	PauseOnIntegrationFailure bool `json:"pause_on_integration_failure,omitempty"`

	// DryRunCompletedAt records the last time the tenant admin ran
	// a dry-run that showed acceptable counts. Populated by the
	// dry-run endpoint. A non-nil value unlocks the Enabled flag;
	// unset means the API rejects Enable with "run a dry-run first".
	DryRunCompletedAt *int64 `json:"dry_run_completed_at,omitempty"`
}

type AssetSourceSettings struct {
	// SchemaVersion guards forward-incompatible changes to the
	// settings payload. Bumped only when the shape changes in a
	// way that legacy code can't deserialize safely.
	SchemaVersion int `json:"schema_version,omitempty"`

	// Priority is an ordered list of data_sources.id values —
	// highest priority first. Sources not listed are ranked below
	// every listed source; among unlisted sources, the existing
	// last-write-wins behavior applies.
	//
	// Nil/empty = feature effectively off (today's behavior).
	Priority []shared.ID `json:"priority,omitempty"`

	// TrustLevels maps data_sources.id → TrustLevel. Expresses the
	// same precedence as Priority but bucketed, matching the
	// source-creation dropdown in the UI (primary/high/medium/low).
	//
	// When both Priority and TrustLevels are set, Priority wins for
	// ordering and TrustLevels is advisory (used for the UI badge
	// and for populating Priority on first save). Sources present
	// in TrustLevels but missing from Priority are inserted into
	// Priority at the position their bucket implies.
	TrustLevels map[string]TrustLevel `json:"trust_levels,omitempty"`

	// TrackFieldAttribution enables per-field source lineage —
	// populates asset_sources.contributed_data with which source
	// wrote which field and when. Off by default to keep storage
	// cost predictable; on for tenants that want the audit trail.
	TrackFieldAttribution bool `json:"track_field_attribution,omitempty"`
}

type BranchSettings struct {
	// TypeRules defines custom prefix/exact-match rules for branch type detection.
	// Rules are ordered; first match wins. If no rule matches, falls through
	// to system defaults (feature/, release/, hotfix/, main, master, etc.).
	TypeRules branch.BranchTypeRules `json:"type_rules,omitempty"`
}

type BrandingSettings struct {
	PrimaryColor string `json:"primary_color"` // Hex color code, e.g., "#3B82F6"
	LogoDarkURL  string `json:"logo_dark_url"` // Logo for dark theme (URL)
	LogoData     string `json:"logo_data"`     // Logo as base64 data URL (max 150KB)
}

type CTEMPointsConfig struct {
	Enabled            bool `json:"enabled"`
	InternetAccessible int  `json:"internet_accessible"`
	PIIExposed         int  `json:"pii_exposed"`
	PHIExposed         int  `json:"phi_exposed"`
	HighRiskCompliance int  `json:"high_risk_compliance"`
	RestrictedData     int  `json:"restricted_data"`
}

type ComponentWeights struct {
	Exposure    int `json:"exposure"`
	Criticality int `json:"criticality"`
	Findings    int `json:"findings"`
	CTEM        int `json:"ctem"`
}

type ConfigOption struct {
	Value string `json:"value"`
	Label string `json:"label"`
}

type CriticalityScoreConfig struct {
	Critical int `json:"critical"`
	High     int `json:"high"`
	Medium   int `json:"medium"`
	Low      int `json:"low"`
	None     int `json:"none"`
}

type EmailVerificationMode string

type ExposureMultiplierConfig struct {
	Public     float64 `json:"public"`
	Restricted float64 `json:"restricted"`
	Private    float64 `json:"private"`
	Isolated   float64 `json:"isolated"`
	Unknown    float64 `json:"unknown"`
}

type ExposureScoreConfig struct {
	Public     int `json:"public"`
	Restricted int `json:"restricted"`
	Private    int `json:"private"`
	Isolated   int `json:"isolated"`
	Unknown    int `json:"unknown"`
}

type FindingImpactConfig struct {
	Mode             string               `json:"mode"`
	PerFindingPoints int                  `json:"per_finding_points"`
	FindingCap       int                  `json:"finding_cap"`
	SeverityWeights  SeverityWeightConfig `json:"severity_weights"`
}

type GeneralSettings struct {
	Timezone string `json:"timezone"` // e.g., "Asia/Ho_Chi_Minh", "UTC"
	Language string `json:"language"` // e.g., "en", "vi"
	Industry string `json:"industry"` // e.g., "technology", "finance", "healthcare"
	Website  string `json:"website"`  // Company website URL
}

type Invitation struct {
	// contains filtered or unexported fields
}

type LLMProvider string

type MemberInfo struct {
	Membership *Membership
	UserID     shared.ID // Local user ID
	Email      string    // From local users table
	Name       string    // From local users table
	AvatarURL  string    // From local users table
}

type MemberSearchFilters struct {
	Search string // Search by name or email (case-insensitive)
	Limit  int    // Maximum number of results (0 = no limit)
	Offset int    // Offset for pagination
}

type MemberSearchResult struct {
	Members []*MemberWithUser
	Total   int // Total matching members (before limit)
}

type MemberStats struct {
	TotalMembers   int            `json:"total_members"`
	ActiveMembers  int            `json:"active_members"`
	PendingInvites int            `json:"pending_invites"`
	RoleCounts     map[string]int `json:"role_counts"`
}

type MemberStatus string

type MemberWithUser struct {
	// Membership fields
	ID        shared.ID
	UserID    shared.ID
	Role      Role
	InvitedBy *shared.ID
	JoinedAt  time.Time
	// User fields
	Email       string
	Name        string
	AvatarURL   string
	Status      string // active, pending, inactive
	LastLoginAt *time.Time
}

type Membership struct {
	// contains filtered or unexported fields
}

type PentestSettings struct {
	CampaignTypes []ConfigOption `json:"campaign_types,omitempty"`
	Methodologies []ConfigOption `json:"methodologies,omitempty"`
}

type Plan string

type PlanLimits struct {
	MaxMembers    int
	MaxAssets     int
	MaxScansMonth int
	SSO           bool
	AuditLog      bool
	APIAccess     bool
}

type Repository interface {
	// Tenant CRUD
	Create(ctx context.Context, t *Tenant) error
	GetByID(ctx context.Context, id shared.ID) (*Tenant, error)
	GetBySlug(ctx context.Context, slug string) (*Tenant, error)
	Update(ctx context.Context, t *Tenant) error
	Delete(ctx context.Context, id shared.ID) error
	ExistsBySlug(ctx context.Context, slug string) (bool, error)

	// ListActiveTenantIDs returns all active tenant IDs.
	// Used by background jobs that need to process data across all tenants.
	ListActiveTenantIDs(ctx context.Context) ([]shared.ID, error)

	// Membership operations
	CreateMembership(ctx context.Context, membership *Membership) error
	GetMembership(ctx context.Context, userID shared.ID, tenantID shared.ID) (*Membership, error)
	GetMembershipByID(ctx context.Context, id shared.ID) (*Membership, error)
	UpdateMembership(ctx context.Context, membership *Membership) error
	// UpdateMembershipStatus persists the lifecycle status change
	// (active ↔ suspended). Used by Suspend/Reactivate service methods.
	UpdateMembershipStatus(ctx context.Context, membership *Membership) error
	DeleteMembership(ctx context.Context, id shared.ID) error
	ListMembersByTenant(ctx context.Context, tenantID shared.ID) ([]*Membership, error)
	ListMembersWithUserInfo(ctx context.Context, tenantID shared.ID) ([]*MemberWithUser, error)
	SearchMembersWithUserInfo(ctx context.Context, tenantID shared.ID, filters MemberSearchFilters) (*MemberSearchResult, error)
	ListTenantsByUser(ctx context.Context, userID shared.ID) ([]*TenantWithRole, error)
	CountMembersByTenant(ctx context.Context, tenantID shared.ID) (int64, error)
	GetMemberStats(ctx context.Context, tenantID shared.ID) (*MemberStats, error)
	// GetUserMemberships returns lightweight membership data for JWT tokens.
	// Suspended memberships are filtered out — they cannot mint tokens.
	GetUserMemberships(ctx context.Context, userID shared.ID) ([]UserMembership, error)
	// GetUserSuspendedMemberships returns the SUSPENDED memberships for a
	// user. Used by the login flow so the UI can tell a suspended user
	// "your access to {tenant} is suspended" instead of bouncing them to
	// the create-team onboarding screen with no explanation.
	GetUserSuspendedMemberships(ctx context.Context, userID shared.ID) ([]UserMembership, error)
	// GetUserMembershipsWithStatus returns BOTH active and suspended
	// memberships in a single query. The login flow uses this to avoid
	// the two sequential round trips that GetUserMemberships +
	// GetUserSuspendedMemberships would cost.
	GetUserMembershipsWithStatus(ctx context.Context, userID shared.ID) (*UserMembershipsByStatus, error)
	// GetMemberByEmail retrieves a member by email address within a tenant
	GetMemberByEmail(ctx context.Context, tenantID shared.ID, email string) (*MemberWithUser, error)

	// Invitation operations
	CreateInvitation(ctx context.Context, invitation *Invitation) error
	GetInvitationByToken(ctx context.Context, token string) (*Invitation, error)
	GetInvitationByID(ctx context.Context, id shared.ID) (*Invitation, error)
	UpdateInvitation(ctx context.Context, invitation *Invitation) error
	DeleteInvitation(ctx context.Context, id shared.ID) error
	ListPendingInvitationsByTenant(ctx context.Context, tenantID shared.ID) ([]*Invitation, error)
	GetPendingInvitationByEmail(ctx context.Context, tenantID shared.ID, email string) (*Invitation, error)
	DeleteExpiredInvitations(ctx context.Context) (int64, error)

	// DeletePendingInvitationsByUserID removes every UNACCEPTED
	// invitation matching the user's email in the given tenant.
	// Used when removing a member to ensure they can't rejoin via
	// a stale token still sitting in their inbox. Looks up the
	// user's email via JOIN so the caller doesn't need to fetch it
	// first. Email matching is case-insensitive. Returns the number
	// of rows deleted (0 is not an error).
	DeletePendingInvitationsByUserID(ctx context.Context, tenantID, userID shared.ID) (int64, error)

	// AcceptInvitationTx atomically updates the invitation and creates the membership in a single transaction.
	// This ensures data consistency - either both operations succeed or neither does.
	AcceptInvitationTx(ctx context.Context, invitation *Invitation, membership *Membership) error
}

type RiskLevelConfig struct {
	CriticalMin int `json:"critical_min"`
	HighMin     int `json:"high_min"`
	MediumMin   int `json:"medium_min"`
	LowMin      int `json:"low_min"`
}

type RiskScoringSettings struct {
	Preset              string                   `json:"preset,omitempty"`
	Weights             ComponentWeights         `json:"weights"`
	ExposureScores      ExposureScoreConfig      `json:"exposure_scores"`
	ExposureMultipliers ExposureMultiplierConfig `json:"exposure_multipliers"`
	CriticalityScores   CriticalityScoreConfig   `json:"criticality_scores"`
	FindingImpact       FindingImpactConfig      `json:"finding_impact"`
	CTEMPoints          CTEMPointsConfig         `json:"ctem_points"`
	RiskLevels          RiskLevelConfig          `json:"risk_levels"`
}

type Role string

type SecuritySettings struct {
	SSOEnabled        bool     `json:"sso_enabled"`         // Enable SSO (SAML 2.0, OIDC)
	SSOProvider       string   `json:"sso_provider"`        // e.g., "saml", "oidc"
	SSOConfigURL      string   `json:"sso_config_url"`      // SSO metadata/config URL
	MFARequired       bool     `json:"mfa_required"`        // Require MFA for all users
	SessionTimeoutMin int      `json:"session_timeout_min"` // Session timeout in minutes (15-480)
	IPWhitelist       []string `json:"ip_whitelist"`        // Allowed IP addresses/CIDR ranges
	AllowedDomains    []string `json:"allowed_domains"`     // Allowed email domains for signup

	// EmailVerificationMode controls whether new users must verify their email.
	//   "auto"   = (default) require verification IFF SMTP is configured (smart)
	//   "always" = always require verification (operator must configure SMTP)
	//   "never"  = never require verification (open registration; security risk)
	EmailVerificationMode EmailVerificationMode `json:"email_verification_mode,omitempty"`
}

type Settings struct {
	General        GeneralSettings        `json:"general"`
	Security       SecuritySettings       `json:"security"`
	API            APISettings            `json:"api"`
	Branding       BrandingSettings       `json:"branding"`
	Branch         BranchSettings         `json:"branch"`
	AI             AISettings             `json:"ai"`
	RiskScoring    RiskScoringSettings    `json:"risk_scoring"`
	Pentest        PentestSettings        `json:"pentest"`
	AssetIdentity  AssetIdentitySettings  `json:"asset_identity"`
	AssetSource    AssetSourceSettings    `json:"asset_source"`
	AssetLifecycle AssetLifecycleSettings `json:"asset_lifecycle"`
}

type SeverityWeightConfig struct {
	Critical int `json:"critical"`
	High     int `json:"high"`
	Medium   int `json:"medium"`
	Low      int `json:"low"`
	Info     int `json:"info"`
}

type Tenant struct {
	// contains filtered or unexported fields
}

type TenantWithRole struct {
	Tenant   *Tenant
	Role     Role
	JoinedAt time.Time
}

type TrustLevel string

type UserMembership struct {
	TenantID   string // Tenant UUID
	TenantSlug string // Tenant slug for URL-friendly access
	TenantName string // Tenant display name
	Role       string // Role in tenant (owner, admin, member, viewer)
}

type UserMembershipsByStatus struct {
	Active    []UserMembership
	Suspended []UserMembership
}

type WebhookEvent string