models

Documentation

Overview

Package models provides data models for the application.

Index

• type AIAnalysis
• type DataFlowStep
• type Finding
• type Fix
• type FixKind
• type References
  • func (r *References) Scan(value interface{}) error
  • func (r References) Value() (driver.Value, error)
• type RepoSettings
  • func (s *RepoSettings) Scan(value interface{}) error
  • func (s RepoSettings) Value() (driver.Value, error)
• type Repository
  • func NewRepository(repoURL string) (*Repository, error)
  • func (r *Repository) Owner() string
  • func (r *Repository) RepoName() string
  • func (r *Repository) UpdateLastScan(scanID uuid.UUID)
• type RepositoryCreateRequest
• type RepositoryFilter
• type RepositoryProvider
• type RepositoryStats
• type RepositoryUpdateRequest
• type Scan
  • func NewScan(repoID uuid.UUID, scanType ScanType, trigger ScanTrigger) *Scan
  • func (s *Scan) Cancel()
  • func (s *Scan) Complete(filesScanned, linesScanned int)
  • func (s *Scan) Fail(errMsg string)
  • func (s *Scan) IsFinished() bool
  • func (s *Scan) Start()
• type ScanDelta
• type ScanListFilter
• type ScanMetadata
  • func (m *ScanMetadata) Scan(value interface{}) error
  • func (m ScanMetadata) Value() (driver.Value, error)
• type ScanProgress
• type ScanRequest
• type ScanResponse
• type ScanStatus
• type ScanSummary
• type ScanTrigger
• type ScanType
• type Severity
  • func (s Severity) Weight() int
• type TriggerInfo
• type VulnMetadata
  • func (m *VulnMetadata) Scan(value interface{}) error
  • func (m VulnMetadata) Value() (driver.Value, error)
• type Vulnerability
  • func NewVulnerability(scanID uuid.UUID, ruleID, title string, severity Severity) *Vulnerability
  • func (v *Vulnerability) ToFinding() Finding
• type VulnerabilityCategory
• type VulnerabilityFilter
• type VulnerabilityStats
• type VulnerabilityUpdate
• type WebhookConfig

Types

type AIAnalysis

type AIAnalysis struct {
	Explanation     string   `json:"explanation"`
	RiskAssessment  string   `json:"risk_assessment"`
	ExploitScenario string   `json:"exploit_scenario,omitempty"`
	Recommendations []string `json:"recommendations"`
	ConfidenceScore float64  `json:"confidence_score"`
}

AIAnalysis holds AI-generated analysis for a vulnerability.

type DataFlowStep

type DataFlowStep struct {
	File     string `json:"file"`
	Line     int    `json:"line"`
	Column   int    `json:"column"`
	Snippet  string `json:"snippet"`
	StepType string `json:"step_type"` // source, propagation, sink
}

DataFlowStep represents a step in a data flow analysis.

type Finding

type Finding struct {
	RuleID      string   `json:"rule_id"`
	Title       string   `json:"title"`
	Severity    Severity `json:"severity"`
	Category    string   `json:"category"`
	FilePath    string   `json:"file_path"`
	Line        int      `json:"line"`
	CodeSnippet string   `json:"code_snippet"`
	Remediation string   `json:"remediation"`
	Confidence  float64  `json:"confidence"`
}

Finding represents a simplified vulnerability for reports.

type Fix

type Fix struct {
	Summary string  `json:"summary"`          // one line: what to change
	Kind    FixKind `json:"kind"`             // safe_replace | guidance
	Before  string  `json:"before,omitempty"` // the real matched code
	After   string  `json:"after,omitempty"`  // transformed code (safe) or a secure exemplar (guidance)
	// Replacement is set only for FixSafeReplace: the exact text that replaces
	// the matched span [ColumnStart, ColumnEnd) on the finding's line.
	Replacement string `json:"replacement,omitempty"`
}

Fix is a suggested remediation for a single finding.

type FixKind

type FixKind string

FixKind distinguishes a fix Bastion can apply itself from one that needs a human or an agent to carry out.

const (
	// FixSafeReplace is a deterministic, value-restoring replacement of the
	// matched span; `bastion fix --write` applies it.
	FixSafeReplace FixKind = "safe_replace"
	// FixGuidance describes the change but is not safe to apply mechanically.
	FixGuidance FixKind = "guidance"
)

type References

type References struct {
	CWE   []string `json:"cwe,omitempty"`
	CVE   []string `json:"cve,omitempty"`
	OWASP []string `json:"owasp,omitempty"`
	URLs  []string `json:"urls,omitempty"`
}

References holds external references for a vulnerability.

func (*References) Scan

func (r *References) Scan(value interface{}) error

Scan implements the sql.Scanner interface.

func (References) Value

func (r References) Value() (driver.Value, error)

Value implements the driver.Valuer interface.

type RepoSettings

type RepoSettings struct {
	AutoScanEnabled   bool     `json:"auto_scan_enabled"`
	ScanOnPush        bool     `json:"scan_on_push"`
	ScanOnPR          bool     `json:"scan_on_pr"`
	ProtectedBranches []string `json:"protected_branches"`
	ExcludedPaths     []string `json:"excluded_paths"`
	EnabledRules      []string `json:"enabled_rules"`
	DisabledRules     []string `json:"disabled_rules"`
	NotifyOnCritical  bool     `json:"notify_on_critical"`
	NotifyOnHigh      bool     `json:"notify_on_high"`
	FailPROnCritical  bool     `json:"fail_pr_on_critical"`
	FailPROnHigh      bool     `json:"fail_pr_on_high"`
}

RepoSettings holds repository-specific settings.

func (*RepoSettings) Scan

func (s *RepoSettings) Scan(value interface{}) error

Scan implements the sql.Scanner interface.

func (RepoSettings) Value

func (s RepoSettings) Value() (driver.Value, error)

Value implements the driver.Valuer interface.

type Repository

type Repository struct {
	ID            uuid.UUID          `db:"id" json:"id"`
	Name          string             `db:"name" json:"name"`
	FullName      string             `db:"full_name" json:"full_name"` // owner/repo
	URL           string             `db:"url" json:"url"`
	CloneURL      string             `db:"clone_url" json:"clone_url"`
	Provider      RepositoryProvider `db:"provider" json:"provider"`
	DefaultBranch string             `db:"default_branch" json:"default_branch"`
	Private       bool               `db:"private" json:"private"`
	Description   string             `db:"description" json:"description"`
	Language      string             `db:"language" json:"language"`
	WebhookID     *string            `db:"webhook_id" json:"webhook_id,omitempty"`
	WebhookSecret *string            `db:"webhook_secret" json:"-"`
	Settings      RepoSettings       `db:"settings" json:"settings"`
	LastScanID    *uuid.UUID         `db:"last_scan_id" json:"last_scan_id,omitempty"`
	LastScanAt    *time.Time         `db:"last_scan_at" json:"last_scan_at,omitempty"`
	TotalScans    int                `db:"total_scans" json:"total_scans"`
	CreatedAt     time.Time          `db:"created_at" json:"created_at"`
	UpdatedAt     time.Time          `db:"updated_at" json:"updated_at"`
}

Repository represents a code repository.

func NewRepository

func NewRepository(repoURL string) (*Repository, error)

NewRepository creates a new Repository with defaults.

func (*Repository) Owner

func (r *Repository) Owner() string

Owner returns the repository owner from the full name.

func (*Repository) RepoName

func (r *Repository) RepoName() string

RepoName returns just the repository name.

func (*Repository) UpdateLastScan

func (r *Repository) UpdateLastScan(scanID uuid.UUID)

UpdateLastScan updates the last scan information.

type RepositoryCreateRequest

type RepositoryCreateRequest struct {
	URL           string `json:"url" binding:"required"`
	DefaultBranch string `json:"default_branch"`
	Private       bool   `json:"private"`
	AccessToken   string `json:"access_token,omitempty"`
}

RepositoryCreateRequest represents a request to add a repository.

type RepositoryFilter

type RepositoryFilter struct {
	Provider RepositoryProvider `form:"provider"`
	Name     string             `form:"name"`
	Private  *bool              `form:"private"`
	Limit    int                `form:"limit"`
	Offset   int                `form:"offset"`
}

RepositoryFilter represents filters for querying repositories.

type RepositoryProvider

type RepositoryProvider string

RepositoryProvider represents the Git provider.

const (
	ProviderGitHub    RepositoryProvider = "github"
	ProviderGitLab    RepositoryProvider = "gitlab"
	ProviderBitbucket RepositoryProvider = "bitbucket"
	ProviderGeneric   RepositoryProvider = "generic"
)

type RepositoryStats

type RepositoryStats struct {
	RepositoryID   uuid.UUID  `json:"repository_id"`
	TotalScans     int        `json:"total_scans"`
	LastScanAt     *time.Time `json:"last_scan_at"`
	TotalVulns     int        `json:"total_vulnerabilities"`
	CriticalCount  int        `json:"critical_count"`
	HighCount      int        `json:"high_count"`
	MediumCount    int        `json:"medium_count"`
	LowCount       int        `json:"low_count"`
	ResolvedCount  int        `json:"resolved_count"`
	TrendDirection string     `json:"trend_direction"` // improving, worsening, stable
}

RepositoryStats holds statistics about a repository.

type RepositoryUpdateRequest

type RepositoryUpdateRequest struct {
	DefaultBranch *string       `json:"default_branch,omitempty"`
	Description   *string       `json:"description,omitempty"`
	Settings      *RepoSettings `json:"settings,omitempty"`
}

RepositoryUpdateRequest represents a request to update repository settings.

type Scan

type Scan struct {
	ID           uuid.UUID    `db:"id" json:"id"`
	RepositoryID uuid.UUID    `db:"repository_id" json:"repository_id"`
	Status       ScanStatus   `db:"status" json:"status"`
	Type         ScanType     `db:"type" json:"type"`
	Trigger      ScanTrigger  `db:"trigger" json:"trigger"`
	Branch       string       `db:"branch" json:"branch"`
	CommitSHA    string       `db:"commit_sha" json:"commit_sha"`
	PRNumber     *int         `db:"pr_number" json:"pr_number,omitempty"`
	StartedAt    *time.Time   `db:"started_at" json:"started_at,omitempty"`
	CompletedAt  *time.Time   `db:"completed_at" json:"completed_at,omitempty"`
	Duration     *int64       `db:"duration_ms" json:"duration_ms,omitempty"` // in milliseconds
	FilesScanned int          `db:"files_scanned" json:"files_scanned"`
	LinesScanned int          `db:"lines_scanned" json:"lines_scanned"`
	ErrorMessage *string      `db:"error_message" json:"error_message,omitempty"`
	Metadata     ScanMetadata `db:"metadata" json:"metadata"`
	CreatedAt    time.Time    `db:"created_at" json:"created_at"`
	UpdatedAt    time.Time    `db:"updated_at" json:"updated_at"`
}

Scan represents a security scan of a repository.

func NewScan

func NewScan(repoID uuid.UUID, scanType ScanType, trigger ScanTrigger) *Scan

NewScan creates a new Scan with defaults.

func (*Scan) Cancel

func (s *Scan) Cancel()

Cancel marks the scan as cancelled.

func (*Scan) Complete

func (s *Scan) Complete(filesScanned, linesScanned int)

Complete marks the scan as completed.

func (*Scan) Fail

func (s *Scan) Fail(errMsg string)

Fail marks the scan as failed.

func (*Scan) IsFinished

func (s *Scan) IsFinished() bool

IsFinished returns true if the scan is in a terminal state.

func (*Scan) Start

func (s *Scan) Start()

Start marks the scan as started.

type ScanDelta

type ScanDelta struct {
	ScanID         uuid.UUID       `json:"scan_id"`
	BaselineScanID *uuid.UUID      `json:"baseline_scan_id,omitempty"`
	New            []Vulnerability `json:"new"`
	Resolved       []Vulnerability `json:"resolved"`
	Unchanged      int             `json:"unchanged"`
}

ScanDelta compares findings between two completed scans.

type ScanListFilter

type ScanListFilter struct {
	RepositoryID *uuid.UUID  `form:"repository_id"`
	Status       *ScanStatus `form:"status"`
	Type         *ScanType   `form:"type"`
	Branch       string      `form:"branch"`
	FromDate     *time.Time  `form:"from_date"`
	ToDate       *time.Time  `form:"to_date"`
	Limit        int         `form:"limit"`
	Offset       int         `form:"offset"`
}

ScanListFilter represents filters for listing scans.

type ScanMetadata

type ScanMetadata struct {
	Languages     []string          `json:"languages,omitempty"`
	EnabledRules  []string          `json:"enabled_rules,omitempty"`
	ExcludedPaths []string          `json:"excluded_paths,omitempty"`
	ScanOptions   map[string]string `json:"scan_options,omitempty"`
	TriggerInfo   TriggerInfo       `json:"trigger_info,omitempty"`
}

ScanMetadata holds additional scan metadata.

func (*ScanMetadata) Scan

func (m *ScanMetadata) Scan(value interface{}) error

Scan implements the sql.Scanner interface for ScanMetadata.

func (ScanMetadata) Value

func (m ScanMetadata) Value() (driver.Value, error)

Value implements the driver.Valuer interface for ScanMetadata.

type ScanProgress

type ScanProgress struct {
	ScanID         uuid.UUID  `json:"scan_id"`
	Status         ScanStatus `json:"status"`
	Phase          string     `json:"phase"`    // cloning, parsing, analyzing, reporting
	Progress       float64    `json:"progress"` // 0-100
	FilesProcessed int        `json:"files_processed"`
	TotalFiles     int        `json:"total_files"`
	CurrentFile    string     `json:"current_file,omitempty"`
	Message        string     `json:"message,omitempty"`
}

ScanProgress represents the progress of an ongoing scan.

type ScanRequest

type ScanRequest struct {
	RepositoryURL string            `json:"repository_url" binding:"required"`
	Branch        string            `json:"branch"`
	CommitSHA     string            `json:"commit_sha"`
	ScanType      ScanType          `json:"scan_type"`
	Options       map[string]string `json:"options"`
}

ScanRequest represents a request to start a new scan.

type ScanResponse

type ScanResponse struct {
	ScanID  uuid.UUID  `json:"scan_id"`
	Status  ScanStatus `json:"status"`
	Message string     `json:"message"`
}

ScanResponse represents the response for a scan request.

type ScanStatus

type ScanStatus string

ScanStatus represents the status of a scan.

const (
	ScanStatusPending   ScanStatus = "pending"
	ScanStatusRunning   ScanStatus = "running"
	ScanStatusCompleted ScanStatus = "completed"
	ScanStatusFailed    ScanStatus = "failed"
	ScanStatusCancelled ScanStatus = "cancelled"
)

type ScanSummary

type ScanSummary struct {
	ScanID               uuid.UUID `json:"scan_id"`
	TotalVulnerabilities int       `json:"total_vulnerabilities"`
	Critical             int       `json:"critical"`
	High                 int       `json:"high"`
	Medium               int       `json:"medium"`
	Low                  int       `json:"low"`
	Info                 int       `json:"info"`
	FilesScanned         int       `json:"files_scanned"`
	LinesScanned         int       `json:"lines_scanned"`
	Duration             int64     `json:"duration_ms"`
}

ScanSummary represents a summary of scan results.

type ScanTrigger

type ScanTrigger string

ScanTrigger represents what triggered the scan.

const (
	ScanTriggerWebhook  ScanTrigger = "webhook"
	ScanTriggerManual   ScanTrigger = "manual"
	ScanTriggerSchedule ScanTrigger = "schedule"
	ScanTriggerCLI      ScanTrigger = "cli"
)

type ScanType

type ScanType string

ScanType represents the type of scan.

const (
	ScanTypeFull        ScanType = "full"
	ScanTypeIncremental ScanType = "incremental"
	ScanTypePR          ScanType = "pull_request"
	ScanTypeManual      ScanType = "manual"
)

type Severity

type Severity string

Severity represents the severity level of a vulnerability.

const (
	SeverityCritical Severity = "critical"
	SeverityHigh     Severity = "high"
	SeverityMedium   Severity = "medium"
	SeverityLow      Severity = "low"
	SeverityInfo     Severity = "info"
)

func (Severity) Weight

func (s Severity) Weight() int

SeverityWeight returns a numeric weight for sorting.

type TriggerInfo

type TriggerInfo struct {
	UserID     string `json:"user_id,omitempty"`
	Username   string `json:"username,omitempty"`
	WebhookID  string `json:"webhook_id,omitempty"`
	ScheduleID string `json:"schedule_id,omitempty"`
}

TriggerInfo holds information about what triggered the scan.

type VulnMetadata

type VulnMetadata struct {
	Language     string            `json:"language,omitempty"`
	Framework    string            `json:"framework,omitempty"`
	Function     string            `json:"function,omitempty"`
	DataFlow     []DataFlowStep    `json:"data_flow,omitempty"`
	AIAnalysis   *AIAnalysis       `json:"ai_analysis,omitempty"`
	Tags         []string          `json:"tags,omitempty"`
	CustomFields map[string]string `json:"custom_fields,omitempty"`
}

VulnMetadata holds additional vulnerability metadata.

func (*VulnMetadata) Scan

func (m *VulnMetadata) Scan(value interface{}) error

Scan implements the sql.Scanner interface.

func (VulnMetadata) Value

func (m VulnMetadata) Value() (driver.Value, error)

Value implements the driver.Valuer interface.

type Vulnerability

type Vulnerability struct {
	ID          uuid.UUID             `db:"id" json:"id"`
	Fingerprint string                `db:"fingerprint" json:"fingerprint"`
	ScanID      uuid.UUID             `db:"scan_id" json:"scan_id"`
	RuleID      string                `db:"rule_id" json:"rule_id"`
	Title       string                `db:"title" json:"title"`
	Description string                `db:"description" json:"description"`
	Severity    Severity              `db:"severity" json:"severity"`
	Category    VulnerabilityCategory `db:"category" json:"category"`
	FilePath    string                `db:"file_path" json:"file_path"`
	LineStart   int                   `db:"line_start" json:"line_start"`
	LineEnd     int                   `db:"line_end" json:"line_end"`
	ColumnStart *int                  `db:"column_start" json:"column_start,omitempty"`
	ColumnEnd   *int                  `db:"column_end" json:"column_end,omitempty"`
	CodeSnippet string                `db:"code_snippet" json:"code_snippet"`
	Remediation string                `db:"remediation" json:"remediation"`
	References  References            `db:"reference_data" json:"references"`
	Metadata    VulnMetadata          `db:"metadata" json:"metadata"`
	Confidence  float64               `db:"confidence" json:"confidence"` // 0-1
	// CVSS v3.1 base score + vector. db:"-" because persistence is deferred
	// (the report path is CLI-only); the cvss_score column stays unwritten.
	CVSSScore     float64 `db:"-" json:"cvss_score,omitempty"`
	CVSSVector    string  `db:"-" json:"cvss_vector,omitempty"`
	FalsePositive bool    `db:"false_positive" json:"false_positive"`
	Suppressed    bool    `db:"suppressed" json:"suppressed"`
	// Fix is a machine-readable suggested remediation built from the matched
	// code, distinct from the human-prose Remediation. db:"-": report/CLI only.
	Fix       *Fix      `db:"-" json:"fix,omitempty"`
	CreatedAt time.Time `db:"created_at" json:"created_at"`
}

Vulnerability represents a detected security vulnerability.

func NewVulnerability

func NewVulnerability(scanID uuid.UUID, ruleID, title string, severity Severity) *Vulnerability

NewVulnerability creates a new Vulnerability with defaults.

func (*Vulnerability) ToFinding

func (v *Vulnerability) ToFinding() Finding

ToFinding converts a Vulnerability to a Finding.

type VulnerabilityCategory

type VulnerabilityCategory string

VulnerabilityCategory represents the category of vulnerability.

const (
	CategoryInjection      VulnerabilityCategory = "injection"
	CategoryXSS            VulnerabilityCategory = "xss"
	CategoryAuthentication VulnerabilityCategory = "authentication"
	CategoryAuthorization  VulnerabilityCategory = "authorization"
	CategoryCryptography   VulnerabilityCategory = "cryptography"
	CategorySecrets        VulnerabilityCategory = "secrets"
	CategoryConfiguration  VulnerabilityCategory = "configuration"
	CategoryDependency     VulnerabilityCategory = "dependency"
	CategoryCodeQuality    VulnerabilityCategory = "code_quality"
	CategoryOther          VulnerabilityCategory = "other"
)

type VulnerabilityFilter

type VulnerabilityFilter struct {
	ScanID        *uuid.UUID             `form:"scan_id"`
	RuleID        string                 `form:"rule_id"`
	Severity      *Severity              `form:"severity"`
	Category      *VulnerabilityCategory `form:"category"`
	FilePath      string                 `form:"file_path"`
	FalsePositive *bool                  `form:"false_positive"`
	Suppressed    *bool                  `form:"suppressed"`
	MinConfidence *float64               `form:"min_confidence"`
	Limit         int                    `form:"limit"`
	Offset        int                    `form:"offset"`
}

VulnerabilityFilter represents filters for querying vulnerabilities.

type VulnerabilityStats

type VulnerabilityStats struct {
	TotalCount        int                           `json:"total_count"`
	BySeverity        map[Severity]int              `json:"by_severity"`
	ByCategory        map[VulnerabilityCategory]int `json:"by_category"`
	ByRule            map[string]int                `json:"by_rule"`
	FalsePositives    int                           `json:"false_positives"`
	Suppressed        int                           `json:"suppressed"`
	AverageConfidence float64                       `json:"average_confidence"`
}

VulnerabilityStats holds statistics about vulnerabilities.

type VulnerabilityUpdate

type VulnerabilityUpdate struct {
	FalsePositive *bool   `json:"false_positive,omitempty"`
	Suppressed    *bool   `json:"suppressed,omitempty"`
	Notes         *string `json:"notes,omitempty"`
}

VulnerabilityUpdate represents an update to a vulnerability.

type WebhookConfig

type WebhookConfig struct {
	RepositoryID uuid.UUID `json:"repository_id"`
	WebhookURL   string    `json:"webhook_url"`
	Secret       string    `json:"secret"`
	Events       []string  `json:"events"`
	Active       bool      `json:"active"`
}

WebhookConfig represents webhook configuration for a repository.